---
# Preview only. This playbook does not install updates, restart services, or
# change DNS/secrets. A separate, manually reviewed change is required to act.
- name: Preview pending maintenance without changes
  hosts: managed
  become: true
  gather_facts: false
  tasks:
    - name: Check reboot requirement marker
      ansible.builtin.stat:
        path: /var/run/reboot-required
      register: maintenance_reboot_marker

    - name: Preview available package updates on Debian-family hosts
      ansible.builtin.command:
        argv:
          - apt-get
          - --just-print
          - upgrade
      register: maintenance_apt_preview
      changed_when: false
      failed_when: false
      when: ansible_facts.os_family | default('Debian') == 'Debian'

    - name: Report maintenance preview
      ansible.builtin.debug:
        msg:
          host: "{{ inventory_hostname }}"
          reboot_required: "{{ maintenance_reboot_marker.stat.exists }}"
          package_preview: "{{ maintenance_apt_preview.stdout_lines | default([]) }}"