Ansible check mode is useful but incomplete. It runs without making changes, modules that support it report what they would change, and modules that do not support it report nothing and do nothing. The documentation itself calls it a simulation, so do not treat a clean run as proof.
What check mode does
Run ansible-playbook foo.yml --check and Ansible simulates the play. Diff mode adds before and after comparisons for modules that support it, and the two can be combined for detailed validation.
Known limits
The documentation states two limits that matter for reviewers:
- Modules that do not support check mode report nothing and do nothing, so a task can be silent in the preview and still change a host in a real run.
- Check mode does not produce output for tasks whose conditionals depend on registered variables, meaning results of earlier tasks. Later tasks may therefore be skipped.
Controlling it per task
A task can set check_mode: true to always run in check mode, or check_mode: false to always make changes, even when the playbook is run with --check. That second setting deserves attention in review.
- name: Always runs for real
ansible.builtin.command: /opt/tool/refresh
check_mode: false
A task like this changes the system during what the operator believes is a dry run.
Review table
| Observation | What it suggests |
|---|---|
| Many tasks skipped in check mode | Preview is incomplete, test elsewhere |
| check_mode: false on a task | It changes hosts in a dry run, ask why |
| command or shell tasks | Often cannot predict their effect |
| Output only for supported modules | Silent tasks are unknown, not safe |
A safer workflow
- Use check and diff mode in CI against a staging inventory.
- Flag every
check_mode: falsein code review. - Prefer modules that support check mode over raw command tasks.
- Run a real change on a small canary group first, using
--limit. - Keep idempotent tasks so reruns are safe.
Where it fits
Check mode answers the question "what might change on this host?" for supported modules. It does not answer "is this playbook safe to run?". That needs code review, pinned dependencies and limited credentials.
Quick check
Does check mode change anything on hosts?
No, except tasks marked check_mode: false.
Why do some tasks show nothing?
Their modules may not support check mode, or conditionals depend on earlier results.
Is diff mode separate?
They are separate modes that can be used together.
Safeguard offers SBOM and dependency scanning and policy gates that can block a pull request on findings, and you can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
