---
- name: Check for 3rd-party enabled repositories (Pure Ansible)
  hosts: all
  become: true
  strategy: linear
  vars:
    allowed_repos:
      - baseos
      - appstream
      - extras
      - powertools
      - devel
      - ha
      - resilientstorage
      - sap
      - sap-hana
      - epel
      - epel-modular
    ignore_patterns:
      - "imunify360*"
      - "cloudlinux-rollout*"

  tasks:
    - name: Get list of enabled repos
      ansible.builtin.command: dnf repolist --enabled --quiet
      register: repolist
      changed_when: false

    - name: Parse enabled repo IDs
      ansible.builtin.set_fact:
        enabled_repos: >-
          {{
            repolist.stdout_lines[1:]
            | map('regex_replace', '^([^ ]+).*', '\1')
            | list
            | map('trim')
            | reject('eq', '')
            | list
          }}

    - name: Convert ignore patterns to regex and filter repos
      ansible.builtin.set_fact:
        filtered_repos: >-
          {% set ignore_regex = ignore_patterns | map('regex_replace', '\\*', '.*') | map('regex_replace', '(.*)', '^\\1$') | join('|') %}
          {% set result = [] %}
          {% for repo in (enabled_repos | difference(allowed_repos)) %}
          {%   if not ignore_regex or not (repo | regex_search(ignore_regex)) %}
          {%     set _ = result.append(repo) %}
          {%   endif %}
          {% endfor %}
          {{ result }}

    - name: Register report data
      ansible.builtin.set_fact:
        snowflake_report_item:
          host: "{{ inventory_hostname }}"
          thirdparty_repos: "{{ filtered_repos }}"

    - name: Aggregate all reports (run once on first host)
      ansible.builtin.set_fact:
        snowflake_reports: >-
          {{
            (snowflake_reports | default([])) + [hostvars[item].snowflake_report_item]
          }}
      delegate_to: localhost
      run_once: true
      when: inventory_hostname == ansible_play_hosts_all[0]
      loop: "{{ ansible_play_hosts_all }}"

    - name: Display clean JSON report
      ansible.builtin.debug:
        msg: "{{ snowflake_reports | to_nice_json(indent=2) }}"
      changed_when: >-
        snowflake_reports is defined and
        snowflake_reports | selectattr('thirdparty_repos', '!=', []) | list | length > 0
      delegate_to: localhost
      run_once: true
      when: inventory_hostname == ansible_play_hosts_all[0]