if check mode, verify packages are installed before continuing

If packages are not installed, commands will fail in check mode.

tasks/main.yml

@@ -10,137 +10,142 @@
     state: present
     use: "{{ (__aide_is_ostree | d(false)) |
              ternary('ansible.posix.rhel_rpm_ostree', omit) }}"
+  register: __aide_install_packages
 
-- name: Get AIDE version
+- name: Packages are installed
-  ansible.builtin.command:
+  # either run mode or check mode and no changes to packages
-    cmd: aide --version
+  when: not ansible_check_mode or (ansible_check_mode and not __aide_install_packages.changed)
-  register: __aide_version_register
-  changed_when: false
-
-# assumes the version starts with a digit and goes to the end of the line
-- name: Set AIDE version
-  set_fact:
-    aide_version: "{{ __output | regex_search('(?m)^A[iI][dD][eE] (\\d.*)$', '\\1') | first }}"
-  vars:
-    __output: "{{ __aide_version_register.stdout if __aide_version_register.stdout | length > 0
-      else __aide_version_register.stderr }}"
-
-- name: Ensure required services are enabled and started
-  ansible.builtin.service:
-    name: "{{ item }}"
-    state: started
-    enabled: true
-  loop: "{{ __aide_services }}"
-
-- name: Generate "/etc/{{ __aide_config }}"
-  ansible.builtin.template:
-    src: "{{ aide_config_template }}"
-    dest: "/etc/{{ __aide_config }}"
-    mode: "0400"
-  when: aide_config_template is not none
-
-# - name: Print Header
-#   ansible.builtin.command: head /etc/aide.conf || true
-
-- name: Initialize AIDE database
-  when: aide_init | bool
   block:
-    - name: Initialize AIDE database
+    - name: Get AIDE version
       ansible.builtin.command:
-        cmd: aide --init
+        cmd: aide --version
-      changed_when: true
+      register: __aide_version_register
-
-    - name: Copy AIDE reference database
-      ansible.builtin.copy:
-        remote_src: true
-        src: "{{ __aide_db_new_name }}"
-        dest: "{{ __aide_db_name }}"
-        owner: root
-        group: root
-        mode: "0440"
-        force: true
-      when: not aide_fetch_db | bool
-
-    - name: Remove remote AIDE database file
-      ansible.builtin.file:
-        path: "{{ __aide_db_new_name }}"
-        state: absent
-      when: not aide_fetch_db | bool
-
-- name: Fetch AIDE database
-  when: aide_fetch_db | bool
-  block:
-    - name: Fetch AIDE database
-      ansible.builtin.fetch:
-        src: "{{ __aide_db_new_name }}"
-        dest: "{{ aide_db_fetch_dir }}"
-
-    - name: Remove remote AIDE database file
-      ansible.builtin.file:
-        path: "{{ __aide_db_new_name }}"
-        state: absent
-
-- name: Check AIDE integrity
-  when: aide_check | bool
-  block:
-    - name: Copy AIDE reference database
-      ansible.builtin.copy:
-        src: >-
-          {{ aide_db_fetch_dir }}/{{ inventory_hostname }}{{ __aide_db_new_name }}
-        dest: "{{ __aide_db_name }}"
-        owner: root
-        group: root
-        mode: "0440"
-      when: aide_fetch_db | bool
-
-    - name: Check against AIDE reference database
-      ansible.builtin.command:
-        cmd: aide --check
       changed_when: false
 
-- name: Update AIDE database and fetch it
+    # assumes the version starts with a digit and goes to the end of the line
-  when: aide_update | bool
+    - name: Set AIDE version
-  block:
+      set_fact:
-    - name: Update AIDE database
+        aide_version: "{{ __output | regex_search('(?m)^A[iI][dD][eE] (\\d.*)$', '\\1') | first }}"
-      ansible.builtin.command:
-        cmd: aide --update
-      register: __aide_update_result
-      failed_when: __msg not in __aide_update_result.stdout
-      changed_when: true
       vars:
-        __msg: >-
+        __output: "{{ __aide_version_register.stdout if __aide_version_register.stdout | length > 0
-          AIDE found NO differences between database and filesystem. Looks okay!!
+          else __aide_version_register.stderr }}"
+
+    - name: Ensure required services are enabled and started
+      ansible.builtin.service:
+        name: "{{ item }}"
+        state: started
+        enabled: true
+      loop: "{{ __aide_services }}"
+
+    - name: Generate "/etc/{{ __aide_config }}"
+      ansible.builtin.template:
+        src: "{{ aide_config_template }}"
+        dest: "/etc/{{ __aide_config }}"
+        mode: "0400"
+      when: aide_config_template is not none
+
+    # - name: Print Header
+    #   ansible.builtin.command: head /etc/aide.conf || true
+
+    - name: Initialize AIDE database
+      when: aide_init | bool
+      block:
+        - name: Initialize AIDE database
+          ansible.builtin.command:
+            cmd: aide --init
+          changed_when: true
+
+        - name: Copy AIDE reference database
+          ansible.builtin.copy:
+            remote_src: true
+            src: "{{ __aide_db_new_name }}"
+            dest: "{{ __aide_db_name }}"
+            owner: root
+            group: root
+            mode: "0440"
+            force: true
+          when: not aide_fetch_db | bool
+
+        - name: Remove remote AIDE database file
+          ansible.builtin.file:
+            path: "{{ __aide_db_new_name }}"
+            state: absent
+          when: not aide_fetch_db | bool
 
     - name: Fetch AIDE database
-      ansible.builtin.fetch:
+      when: aide_fetch_db | bool
-        src: "{{ __aide_db_new_name }}"
+      block:
-        dest: "{{ aide_db_fetch_dir }}"
+        - name: Fetch AIDE database
+          ansible.builtin.fetch:
+            src: "{{ __aide_db_new_name }}"
+            dest: "{{ aide_db_fetch_dir }}"
 
-    - name: Remove remote AIDE database file
+        - name: Remove remote AIDE database file
-      ansible.builtin.file:
+          ansible.builtin.file:
-        path: "{{ __aide_db_new_name }}"
+            path: "{{ __aide_db_new_name }}"
+            state: absent
+
+    - name: Check AIDE integrity
+      when: aide_check | bool
+      block:
+        - name: Copy AIDE reference database
+          ansible.builtin.copy:
+            src: >-
+              {{ aide_db_fetch_dir }}/{{ inventory_hostname }}{{ __aide_db_new_name }}
+            dest: "{{ __aide_db_name }}"
+            owner: root
+            group: root
+            mode: "0440"
+          when: aide_fetch_db | bool
+
+        - name: Check against AIDE reference database
+          ansible.builtin.command:
+            cmd: aide --check
+          changed_when: false
+
+    - name: Update AIDE database and fetch it
+      when: aide_update | bool
+      block:
+        - name: Update AIDE database
+          ansible.builtin.command:
+            cmd: aide --update
+          register: __aide_update_result
+          failed_when: __msg not in __aide_update_result.stdout
+          changed_when: true
+          vars:
+            __msg: >-
+              AIDE found NO differences between database and filesystem. Looks okay!!
+
+        - name: Fetch AIDE database
+          ansible.builtin.fetch:
+            src: "{{ __aide_db_new_name }}"
+            dest: "{{ aide_db_fetch_dir }}"
+
+        - name: Remove remote AIDE database file
+          ansible.builtin.file:
+            path: "{{ __aide_db_new_name }}"
+            state: absent
+
+    - name: Update aide check cron configuration if necessary
+      ansible.builtin.lineinfile:
+        path: /etc/crontab
+        regexp: "^.* root {{ __aide_bin_path }} --check"
+        line: "{{ aide_cron_interval }} root {{ __aide_bin_path }} --check"
+      when:
+        - aide_cron_check is not none
+        - aide_cron_check | bool
+
+    - name: Remove aide check cron configuration if necessary
+      ansible.builtin.lineinfile:
+        path: /etc/crontab
         state: absent
+        regexp: "^.* root {{ __aide_bin_path }} --check"
+      when:
+        - aide_cron_check is not none
+        - not aide_cron_check | bool
 
-- name: Update aide check cron configuration if necessary
+    - name: Record role success fingerprint
-  ansible.builtin.lineinfile:
+      sr_fingerprint:
-    path: /etc/crontab
+        sr_message: >-
-    regexp: "^.* root {{ __aide_bin_path }} --check"
+          success system_role:aide ansible_version={{ ansible_version.full }}
-    line: "{{ aide_cron_interval }} root {{ __aide_bin_path }} --check"
+          {{ ansible_facts['distribution'] }}-{{ ansible_facts['distribution_version'] }}
-  when:
-    - aide_cron_check is not none
-    - aide_cron_check | bool
-
-- name: Remove aide check cron configuration if necessary
-  ansible.builtin.lineinfile:
-    path: /etc/crontab
-    state: absent
-    regexp: "^.* root {{ __aide_bin_path }} --check"
-  when:
-    - aide_cron_check is not none
-    - not aide_cron_check | bool
-
-- name: Record role success fingerprint
-  sr_fingerprint:
-    sr_message: >-
-      success system_role:aide ansible_version={{ ansible_version.full }}
-      {{ ansible_facts['distribution'] }}-{{ ansible_facts['distribution_version'] }}