---
- name: Audit alt-php-config version
  hosts: all
  gather_facts: false
  vars:
    desired_version_pattern: "1-69"
    audit_file: "/home/ssh-gateway/ansible/kuly/RM10272.txt"
  tasks:
    - name: Get server info
      plesk_info:
      register: plsk

    - name: Check alt-php-config version on Imunify/CloudLinux servers
      when: >
        plsk.plesk_found and
        (plsk.imunify_found or plsk.cloudlinux_found)
      block:
        - name: Gather RPM package facts
          ansible.builtin.package_facts:
            manager: auto
          changed_when: false

        - name: Skip if alt-php-config is not installed
          ansible.builtin.debug:
            msg: "alt-php-config not installed – skipping audit"
          when: "'alt-php-config' not in ansible_facts.packages"
          failed_when: false

        - name: Extract alt-php-config package metadata
          ansible.builtin.set_fact:
            alt_php_pkg: "{{ ansible_facts.packages['alt-php-config'][0] }}"
          when: "'alt-php-config' in ansible_facts.packages"

        - name: Check if version matches 1-69 pattern (e.g., 1-69.el8, 1-69.el9)
          ansible.builtin.set_fact:
            version_compliant: "{{ alt_php_pkg.version == '1' and alt_php_pkg.release is regex('^69\\.') }}"
          when: "'alt-php-config' in ansible_facts.packages"

        - name: Record non-compliant version to audit file
          ansible.builtin.lineinfile:
            path: "{{ audit_file }}"
            line: "{{ inventory_hostname }} - alt-php-config-{{ alt_php_pkg.version }}-{{ alt_php_pkg.release }}"
            create: true
            mode: '0644'
          delegate_to: localhost
          when:
            - "'alt-php-config' in ansible_facts.packages"
            - not version_compliant | bool