---
- name: Check for Third-Party Yum/DNF Repositories
  hosts: all
  gather_facts: false
  vars:
    allowed_repos:
      - appstream
      - baseos
      - extras
      - ha
      - powertools
      - crb
      - epel
      - epel-modular
      - layershift
      - kernelcare
      - mariadb
    
    allowed_repos_wildcard:
      - 'imunify360*'
      - 'cloudlinux*'
      - 'PLESK_*'
      - 'plesk*'
      - 'alt*'

  tasks:
    - name: Get list of enabled repositories
      ansible.builtin.shell: |
        dnf repolist --enabled --quiet
      changed_when: false
      register: enabled_repos_raw
      check_mode: false

    - name: Create a list of enabled repo IDs
      ansible.builtin.set_fact:
        enabled_repos_list: "{{ enabled_repos_raw.stdout_lines | map('split') | map('first') | list }}"

    - name: Identify non-standard repositories (with wildcard support)
      ansible.builtin.set_fact:
        third_party_repos: >-
          {{
            enabled_repos_list
            | difference(allowed_repos)
            | reject('match', '^(' + (allowed_repos_wildcard | default([]) | map('replace', '*', '.*') | join('|')) + ')$')
            | reject('equalto', 'repo')
            | reject('equalto', '')
            | list
          }}

    - name: Assemble report data
      ansible.builtin.set_fact:
        repo_report:
          hostname: "{{ inventory_hostname }}"
          status: "{% if third_party_repos | length > 0 %}non-compliant{% else %}compliant{% endif %}"
          third_party_repos: "{{ third_party_repos }}"
      check_mode: false

    - name: Output report in JSON format
      ansible.builtin.debug:
        msg: "{{ repo_report | to_nice_json }}"
      changed_when: repo_report.status == "non-compliant"