---
- name: Check for Third-Party Yum/DNF Repositories
  hosts: all
  become: true
  gather_facts: false
  vars:
    # These are the standard, expected repository IDs for AlmaLinux 8 and EPEL.
    # The 'crb' repo is the new name for 'powertools' in later 8.x versions.
    # We include both to be safe.
    allowed_repos:
      - appstream
      - baseos
      - extras
      - ha
      - powertools
      - crb
      - epel
      - epel-modular

  tasks:
    - name: Get list of enabled repositories
      ansible.builtin.shell:
        cmd: "dnf repolist --enabled | awk 'NR>1 {print $1}'"
        warn: false
      changed_when: false
      register: enabled_repos_raw
      check_mode: false

    - name: Create a list of enabled repo IDs
      ansible.builtin.set_fact:
        enabled_repos_list: "{{ enabled_repos_raw.stdout_lines }}"

    - name: Identify any non-standard repositories
      ansible.builtin.set_fact:
        third_party_repos: "{{ enabled_repos_list | difference(allowed_repos) }}"

    - name: Report hosts with third-party repositories
      ansible.builtin.debug:
        msg:
          - "WARNING: Found unexpected third-party repositories on {{ inventory_hostname }}:"
          - "{{ third_party_repos }}"
      when: third_party_repos | length > 0

    - name: Report compliant hosts
      ansible.builtin.debug:
        msg: "OK: No third-party repositories found on {{ inventory_hostname }}."
      when: third_party_repos | length == 0