RHEL9-CIS/tasks/pre_remediation_audit.yml

---

- name: Pre Audit Setup | Setup the LE audit
  when:
      - setup_audit
  tags:
      - setup_audit
  ansible.builtin.include_tasks:
      file: LE_audit_setup.yml

- name: Pre Audit Setup | Ensure {{ audit_conf_dir }} exists
  ansible.builtin.file:
      path: "{{ audit_conf_dir }}"
      state: directory
      mode: '0755'

- name: Pre Audit Setup | If using git for content set up
  when:
      - audit_content == 'git'
  block:
      - name: Pre Audit Setup | Install git
        ansible.builtin.package:
            name: git
            state: present

      - name: Pre Audit Setup | Retrieve audit content files from git
        ansible.builtin.git:
            repo: "{{ audit_file_git }}"
            dest: "{{ audit_conf_dir }}"
            version: "{{ audit_git_version }}"

- name: Pre Audit Setup | Copy to audit content files to server
  when:
      - audit_content == 'copy'
  ansible.builtin.copy:
      src: "{{ audit_conf_source }}"
      dest: "{{ audit_conf_dest }}"
      mode: preserve

- name: Pre Audit Setup | Unarchive audit content files on server
  when:
      - audit_content == 'archive'
  ansible.builtin.unarchive:
      src: "{{ audit_conf_source }}"
      dest: "{{ audit_conf_dest }}"

- name: Pre Audit Setup | Get audit content from url
  when:
      - audit_content == 'get_url'
  ansible.builtin.unarchive:
      src: "{{ audit_conf_source }}"
      dest: "{{ audit_conf_dest }}/{{ benchmark }}-Audit"
      remote_src: "{{ ( audit_conf_source is contains ('http'))| ternary(true, false ) }}"
      extra_opts: "{{ (audit_conf_source is contains ('github')) | ternary('--strip-components=1', [] ) }}"

- name: Pre Audit Setup | Check Goss is available
  when:
      - run_audit
  block:
      - name: Pre Audit Setup | Check for goss file
        ansible.builtin.stat:
            path: "{{ audit_bin }}"
        register: goss_available

      - name: Pre Audit Setup | If audit ensure goss is available
        when:
            - not goss_available.stat.exists
        ansible.builtin.assert:
            msg: "Audit has been selected: unable to find goss binary at {{ audit_bin }}"

- name: Pre Audit Setup | Copy ansible default vars values to test audit
  tags:
      - goss_template
      - run_audit
  when:
      - run_audit
  ansible.builtin.template:
      src: ansible_vars_goss.yml.j2
      dest: "{{ audit_vars_path }}"
      mode: '0600'

- name: Pre Audit | Run pre_remediation {{ benchmark }} audit
  ansible.builtin.shell: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -f {{ audit_format }} -o {{ pre_audit_outfile }} -g \"{{ group_names }}\""
  changed_when: true
  environment:
      AUDIT_BIN: "{{ audit_bin }}"
      AUDIT_CONTENT_LOCATION: "{{ audit_conf_dest | default('/opt') }}"
      AUDIT_FILE: goss.yml

- name: Pre Audit | Capture audit data if json format
  when:
      - audit_format == "json"
  block:
      - name: Pre Audit | Capture data {{ pre_audit_outfile }}
        ansible.builtin.shell: "cat {{ pre_audit_outfile }}"
        register: pre_audit
        changed_when: false

      - name: Pre Audit | Capture pre-audit result
        ansible.builtin.set_fact:
            pre_audit_summary: "{{ pre_audit.stdout | from_json | json_query(summary) }}"
        vars:
            summary: summary."summary-line"

- name: Pre Audit | Capture audit data if documentation format
  when:
      - audit_format == "documentation"
  block:
      - name: Pre Audit | Capture data {{ pre_audit_outfile }} | documentation format
        ansible.builtin.shell: "tail -2 {{ pre_audit_outfile }}"
        register: pre_audit
        changed_when: false

      - name: Pre Audit | Capture pre-audit result | documentation format
        ansible.builtin.set_fact:
            pre_audit_summary: "{{ pre_audit.stdout_lines }}"

- name: Audit_Only | Run Audit Only
  when:
      - audit_only
  ansible.builtin.import_tasks: audit_only.yml