---
- name: Check for 3rd-party enabled repositories (Pure Ansible)
  hosts: all
  become: true
  strategy: linear
  vars:
    allowed_repos:
      - baseos
      - appstream
      - extras
      - powertools
      - devel
      - ha
      - resilientstorage
      - sap
      - sap-hana
      - epel
      - epel-modular
      - layershift
      - mariadb

  tasks:
    - name: Get list of enabled repos
      ansible.builtin.command: dnf repolist --enabled --quiet
      register: repolist
      changed_when: false

    - name: Parse enabled repo IDs
      ansible.builtin.set_fact:
        enabled_repos: >-
          {{
            repolist.stdout_lines[1:]
            | map('regex_replace', '^([^ ]+).*', '\1')
            | list
            | map('trim')
            | reject('eq', '')
            | list
          }}

    - name: Identify 3rd-party repos
      ansible.builtin.set_fact:
        thirdparty_repos: "{{ enabled_repos | difference(allowed_repos) }}"

    - name: Register report data
      ansible.builtin.set_fact:
        snowflake_report_item:
          host: "{{ inventory_hostname }}"
          thirdparty_repos: "{{ thirdparty_repos }}"

    - name: Aggregate all reports (run once on first host)
      ansible.builtin.set_fact:
        snowflake_reports: >-
          {{
            (snowflake_reports | default([])) + [hostvars[item].snowflake_report_item]
          }}
      delegate_to: localhost
      run_once: true
      when: inventory_hostname == ansible_play_hosts_all[0]
      loop: "{{ ansible_play_hosts_all }}"

    - name: Display JSON report
      ansible.builtin.debug:
        msg: "{{ snowflake_reports | to_nice_json }}"
      changed_when: >-
        snowflake_reports is defined and
        snowflake_reports | selectattr('thirdparty_repos', '!=', []) | list | length > 0
      delegate_to: localhost
      run_once: true
      when: inventory_hostname == ansible_play_hosts_all[0]