`Incorrect sudo password` with new, empty Trellis

[strarsis]

Version

1.28.0

What did you expect to happen?

Provisioning to finish successfully.

Apparently this is caused by {% raw %} in ´ansible_become_pass` in ´Load become pass´ task.
(Disclosure: AI (Gemini) helped me with finding the underlying issue).

Removing the raw part fixes the issue for me:

  - name: Load become password
    set_fact:
      ansible_become_pass: "{% for user in vault_users | default([]) if user.name == ansible_user %}{{ user.password | default('') }}{% endfor %}"
    when: ansible_user != 'root' and not cli_ask_become_pass | default(false) and ansible_become_pass is not defined
    no_log: true

- ansible_become_pass: "{% raw %}{% for user in vault_users | default([]) if user.name == ansible_user %}{{ user.password | default('') }}{% endfor %}{% endraw %}"
+ ansible_become_pass: "{% for user in vault_users | default([]) if user.name == ansible_user %}{{ user.password | default('') }}{% endfor %}"

Discourse discussion: https://discourse.roots.io/t/empty-trellis-provision-task-failed-incorrect-sudo-password/30125

What actually happens?

Error: Task failed: Incorrect sudo password

Steps to reproduce

I was able to reliably reproduce this:

• Create new Hyper-V VM.
• Install Ubuntu 24 LTS onto it.
• Ensure ansible can connect with SSH key/password on initial provision. (Run initial provision once).
• ´trellis provision staging`

System info

• Windows 10 Pro (ESU)
• Hyper-V VM
• Ubuntu 24 LTS
• Latest Trellis CLI

Log output

Task failed: Incorrect sudo password

Please confirm this isn't a support request.

Yes

[retlehs]

Nice find, want to submit a PR?

[strarsis]

PR: #1651