---
- name: Check for 3rd-party enabled repositories (Pure Ansible)
  hosts: all
  become: true
  strategy: linear
  vars:
    allowed_repos:
      - baseos
      - appstream
      - extras
      - powertools
      - devel
      - ha
      - resilientstorage
      - sap
      - sap-hana
      - epel
      - epel-modular
    ignore_patterns:
      - "imunify360*"
      - "cloudlinux-rollout*"

  tasks:
    - name: Get list of enabled repos
      ansible.builtin.command: dnf repolist --enabled --quiet
      register: repolist
      changed_when: false

    - name: Extract repo IDs
      ansible.builtin.set_fact:
        enabled_repos: >-
          {{
            repolist.stdout_lines[1:]
            | map('split') | map('first')
            | list
          }}

    - name: Find third-party repos
      ansible.builtin.set_fact:
        thirdparty_repos: >-
          {% set ignored = ignore_patterns | map('regex_replace', '\\*', '.*') %}
          {% set result = [] %}
          {% for repo in (enabled_repos | difference(allowed_repos)) %}
          {%   set matched = false %}
          {%   for pattern in ignored %}
          {%     if repo is match(pattern) %}
          {%       set matched = true %}
          {%     endif %}
          {%   endfor %}
          {%   if not matched %}
          {%     set _ = result.append(repo) %}
          {%   endif %}
          {% endfor %}
          {{ result }}

    - name: Show third-party repos
      ansible.builtin.debug:
        msg:
          host: "{{ inventory_hostname }}"
          thirdparty_repos: "{{ thirdparty_repos }}"
      changed_when: "{{ thirdparty_repos | length > 0 }}"