Limits of Ansible Check Mode When Testing Playbooks Without Production Credentials

The goal is to run Ansible playbooks in check mode (--check) inside a CI pipeline to validate changes without applying them, thereby avoiding the need to expose production credentials.

However, check mode does not guarantee that every module behaves as a pure read‑only operation; some modules may still attempt to connect to managed nodes, gather facts, or call external APIs, which can require credentials or produce side‑effects even when --check is supplied.

Additionally, the --diff flag may show limited information when no actual change is simulated, and certain community modules are known to ignore the check mode flag and perform real modifications.

These uncertainties raise questions about the reliability of check mode for credential‑free testing and the extent to which it can be trusted in automated validation.

• Does check mode guarantee zero state change for all core and community modules when no credentials are provided?
• Which specific modules are documented to bypass --check and execute changes despite the flag?
• How can a CI pipeline verify that no credentials are inadvertently accessed during a check mode run?