Fix ansible-lint failures

ansible/roles/checkout_static_sites/tasks/main.yaml

@@ -1,6 +1,6 @@
 ---
 - name: Create static site directories
-  become: yes
+  become: true
   ansible.builtin.file:
     path: "{{ item.path }}"
     state: directory
@@ -9,7 +9,7 @@
     group: "{{ item.owner }}"
   loop: "{{ checkout_static_sites.checkouts }}"
 - name: Check out static site repositories
-  become: yes
+  become: true
   become_user: "{{ item.owner }}"
   ansible.builtin.git:
     dest: "{{ item.path }}"

ansible/roles/docker/tasks/main.yaml

@@ -1,38 +1,41 @@
 ---
 - name: Install Docker installation prerequisites
-  become: yes
-  apt:
-    update_cache: yes
-    state: latest
+  become: true
+  ansible.builtin.apt:
+    update_cache: true
+    # Don't upgrade, only make sure that the packages are present
+    # state: latest
     name:
       - ca-certificates
       - curl
       - gnupg
       - lsb-release
 
-- name: Add Docker GPG key
-  become: yes
-  shell: "curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg"
+- name: Add Docker GPG key # noqa command-instead-of-module risky-shell-pipe
+  become: true
+  ansible.builtin.shell: "curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg"
   args:
     creates: /usr/share/keyrings/docker-archive-keyring.gpg
 
-- name: Retrieve dpkg architecture
-  shell: dpkg --print-architecture
+- name: Retrieve dpkg architecture # noqa command-instead-of-shell
+  ansible.builtin.shell: dpkg --print-architecture
   register: dpkg_architecture
-  changed_when: False
+  changed_when: false
 
 - name: Add Docker apt repository
-  become: yes
-  template:
+  become: true
+  ansible.builtin.template:
     src: docker.list.j2
     dest: /etc/apt/sources.list.d/docker.list
+    mode: 0644
 
 - name: Install Docker
-  become: yes
-  apt:
-    update_cache: yes
-    state: latest
+  become: true
+  ansible.builtin.apt:
+    update_cache: true
+    # Don't upgrade, only make sure that the packages are present
+    # state: latest
     name:
-    - docker-ce
-    - docker-ce-cli
-    - containerd.io
+      - docker-ce
+      - docker-ce-cli
+      - containerd.io

ansible/roles/install_nix/tasks/main.yaml

@@ -1,7 +1,7 @@
 ---
 # Obvious race condition here that we are just going to ignore
 - name: Copy Nix installation script
-  become: yes
+  become: true
   ansible.builtin.copy:
     src: install-nix
     dest: /etc/pbri/install-nix