eget: вынести роль в ansible-roles, декларативные пакеты

roles/eget/tasks/install.yml

@@ -1,30 +0,0 @@
----
-- name: 'Download eget from url "{{ eget_download_url }}"'
-  ansible.builtin.get_url:
-    url: "{{ eget_download_url }}"
-    dest: "{{ eget_download_dest }}"
-    mode: "0600"
-
-- name: "Unarchive eget"
-  ansible.builtin.unarchive:
-    src: "{{ eget_download_dest }}"
-    dest: "/tmp"
-    list_files: true
-    remote_src: true
-
-- name: "Install eget binary"
-  ansible.builtin.copy:
-    src: '{{ (eget_unarchive_dest, "eget") | path_join }}'
-    dest: "{{ eget_install_path }}"
-    mode: "0755"
-    remote_src: true
-
-- name: "Remove temporary files"
-  ansible.builtin.file:
-    path: "{{ eget_download_dest }}"
-    state: absent
-
-- name: "Remove temporary directories"
-  ansible.builtin.file:
-    path: "{{ eget_unarchive_dest }}"
-    state: absent

roles/eget/tasks/install_eget.yml

@@ -0,0 +1,46 @@
+---
+# Bootstrap самого eget: скачать релиз с GitHub, распаковать, поставить бинарник.
+# Идемпотентность — по версии уже установленного eget; чужой eget нельзя обновить
+# им самим (chicken-and-egg), поэтому качаем архив релиза напрямую.
+
+- name: "Check installed eget version"
+  ansible.builtin.command:
+    cmd: "{{ eget_install_path }} --version"
+  register: eget_version_check
+  changed_when: false
+  failed_when: false
+  check_mode: false  # read-only проба: нужна и в --check, чтобы gate ниже был честным
+
+- name: "Install eget from GitHub release"
+  when: >-
+    eget_version_check.rc != 0
+    or eget_version not in eget_version_check.stdout
+  block:
+    - name: "Download eget release archive"
+      ansible.builtin.get_url:
+        url: "{{ eget_download_url }}"
+        dest: "{{ eget_download_dest }}"
+        checksum: "{{ eget_download_checksum or omit }}"
+        mode: "0600"
+
+    - name: "Extract eget release archive"
+      ansible.builtin.unarchive:
+        src: "{{ eget_download_dest }}"
+        dest: "/tmp"
+        remote_src: true
+
+    - name: "Install eget binary"
+      ansible.builtin.copy:
+        src: '{{ (eget_unarchive_dest, "eget") | path_join }}'
+        dest: "{{ eget_install_path }}"
+        mode: "0755"
+        remote_src: true
+
+  always:
+    - name: "Remove eget bootstrap artifacts"
+      ansible.builtin.file:
+        path: "{{ item }}"
+        state: absent
+      loop:
+        - "{{ eget_download_dest }}"
+        - "{{ eget_unarchive_dest }}"

roles/eget/tasks/main.yml

@@ -1,24 +1,40 @@
 ---
 # tasks file for eget
 
-- name: "Check if eget installed"
-  ansible.builtin.command:
-    cmd: "{{ eget_install_path }} --version"
-  register: eget_installed_output
-  ignore_errors: true
-  changed_when: false
-
-- name: "Check eget installed version"
-  ansible.builtin.set_fact:
-    eget_need_install: "{{ not (eget_installed_output.rc == 0 and eget_version in eget_installed_output.stdout) }}"
-
-- name: "Assert that installation flag is defined"
+- name: "Validate eget_packages entries"
   ansible.builtin.assert:
     that:
-      - eget_need_install is defined
-      - eget_need_install is boolean
+      - item.repo is defined and item.repo is string and item.repo | length > 0
+      - item.tag is defined and item.tag is string and item.tag | length > 0
+      - item.to is not defined or item.to is string
+      - item.file is not defined or item.file is string
+      - item.asset is not defined or item.asset is string
+      - item.assets is not defined or (item.assets is sequence and item.assets is not string)
+    fail_msg: >-
+      Некорректный элемент eget_packages (repo/tag — непустые строки;
+      asset/file/to — строки; assets — список строк): {{ item }}
+    quiet: true
+  loop: "{{ eget_packages }}"
+  loop_control:
+    label: "{{ item.repo | default('?') }}"
 
-- name: "Download eget and install eget"
-  ansible.builtin.include_tasks:
-    file: "install.yml"
-  when: eget_need_install
+- name: "Ensure eget is installed"
+  ansible.builtin.import_tasks: install_eget.yml
+
+- name: "Install pinned binaries with eget"
+  ansible.builtin.command:
+    argv: "{{ _eget_argv }}"
+  vars:
+    _eget_to: "{{ item.to | default(eget_packages_to) }}"
+    _eget_assets: >-
+      {{ item.assets | default([item.asset] if item.asset is defined else []) }}
+    _eget_argv: >-
+      {{ [eget_install_path, item.repo, '--upgrade-only',
+          '--to=' ~ _eget_to, '--tag=' ~ item.tag]
+         + (['--file=' ~ item.file] if item.file is defined else [])
+         + (['--asset'] | product(_eget_assets) | map('join', '=') | list) }}
+  register: eget_install
+  changed_when: eget_no_upgrade_marker not in eget_install.stderr
+  loop: "{{ eget_packages }}"
+  loop_control:
+    label: "{{ item.repo }} {{ item.tag }}"