---
# Report installed versions of pinned packages (read-only).
# Run: ansible-playbook -i inventory/hosts.yml playbooks/bf-package-check.yml --limit lab
# Package list overridable: -e "check_packages=['docker-ce','wireguard']".
# No Semaphore Pro feature is used.
- name: Check installed package versions
  hosts: blueforce
  gather_facts: false
  become: true
  vars:
    check_packages:
      - docker-ce
      - wireguard
      - rustdesk
  tasks:
    - name: Query package versions
      # failed_when:false is deliberate: this read-only report tolerates unknown
      # package names (dpkg-query still prints the entries it finds). argv form
      # passes every name as a separate argument, so no shell joining occurs.
      ansible.builtin.command:
        argv: "{{ ['dpkg-query', '-W', '-f=${Package} ${Version}\n'] + check_packages }}"
      register: pkg_out
      changed_when: false
      failed_when: false

    - name: Show package versions
      ansible.builtin.debug:
        msg: "{{ inventory_hostname }}:\n{{ pkg_out.stdout | default('(query failed)') }}"