---
- name: Check for Third-Party Yum/DNF Repositories
  hosts: all
  become: true
  gather_facts: false
  vars:
    # These are the standard, expected repository IDs for AlmaLinux 8 and EPEL.
    # The 'crb' repo is the new name for 'powertools' in later 8.x versions.
    # We include both to be safe.
    allowed_repos:
      - appstream
      - baseos
      - extras
      - ha
      - powertools
      - crb
      - epel
      - epel-modular

  tasks:
    - name: Get list of enabled repositories
      ansible.builtin.shell: |
        set -o pipefail
        dnf repolist --enabled | awk 'NR>1 {print $1}'
      args:
        executable: /bin/bash
      changed_when: false
      register: enabled_repos_raw
      check_mode: false

    - name: Create a list of enabled repo IDs
      ansible.builtin.set_fact:
        enabled_repos_list: "{{ enabled_repos_raw.stdout_lines }}"

    - name: Identify any non-standard repositories
      ansible.builtin.set_fact:
        third_party_repos: "{{ enabled_repos_list | difference(allowed_repos) }}"

    - name: Assemble report data
      ansible.builtin.set_fact:
        repo_report:
          hostname: "{{ inventory_hostname }}"
          status: "{% if third_party_repos | length > 0 %}non-compliant{% else %}compliant{% endif %}"
          third_party_repos: "{{ third_party_repos }}"
          all_enabled_repos: "{{ enabled_repos_list }}"
      check_mode: false

    - name: Output report in JSON format
      ansible.builtin.debug:
        msg: "{{ repo_report | to_json }}"