RHEL9-CIS/tasks/post_remediation_audit.yml

---

- name: Post Audit | Run post_remediation {{ benchmark }} audit
  ansible.builtin.shell: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -f {{ audit_format }} -o {{ post_audit_outfile }} -g \"{{ group_names }}\""
  changed_when: true
  environment:
    AUDIT_BIN: "{{ audit_bin }}"
    AUDIT_CONTENT_LOCATION: "{{ audit_conf_dest | default('/opt') }}"
    AUDIT_FILE: goss.yml

- name: Post Audit | Ensure audit files readable by users
  ansible.builtin.file:
    path: "{{ item }}"
    mode: '0644'
    state: file
  loop:
    - "{{ post_audit_outfile }}"
    - "{{ pre_audit_outfile }}"

- name: Post Audit | Capture audit data if json format
  when:
    - audit_format == "json"
  block:
    - name: Post Audit | Capture audit data if json format
      ansible.builtin.shell: grep -E '"summary-line.*Count:.*Failed' "{{ post_audit_outfile }}" | cut -d'"' -f4
      register: post_audit_summary
      changed_when: false

    - name: Post Audit | Set Fact for audit summary
      ansible.builtin.set_fact:
        post_audit_results: "{{ post_audit_summary.stdout }}"

- name: Post Audit | Capture audit data if documentation format
  when:
    - audit_format == "documentation"
  block:
    - name: Post Audit | Capture audit data if documentation format
      ansible.builtin.shell: tail -2 "{{ post_audit_outfile }}" | tac | tr '\n' ' '
      register: post_audit_summary
      changed_when: false

    - name: Post Audit | Set Fact for audit summary
      ansible.builtin.set_fact:
        post_audit_results: "{{ post_audit_summary.stdout }}"