added claude role

ansible/roles/claude-code/tasks/apt.yml

@@ -0,0 +1,70 @@
+# roles/claude_code/tasks/apt.yml
+---
+- name: Create apt keyrings directory
+  ansible.builtin.file:
+    path: /etc/apt/keyrings
+    state: directory
+    mode: "0755"
+    owner: root
+    group: root
+  become: true
+
+- name: Download Anthropic release signing key
+  ansible.builtin.get_url:
+    url: "{{ claude_code_apt_key_url }}"
+    dest: "{{ claude_code_apt_key_path }}"
+    mode: "0644"
+    owner: root
+    group: root
+  become: true
+
+- name: Read key fingerprint
+  ansible.builtin.shell:
+    cmd: |
+      set -o pipefail
+      gpg --show-keys --with-colons {{ claude_code_apt_key_path | quote }} | awk -F':' '/^fpr/ {print $10; exit}'
+    executable: /bin/bash
+  register: claude_code_key_fpr
+  changed_when: false
+  check_mode: false
+  become: true
+
+- name: Refuse to continue if the key fingerprint does not match
+  ansible.builtin.assert:
+    that:
+      - claude_code_key_fpr.stdout | trim | upper == claude_code_apt_key_fingerprint | upper
+    fail_msg: >-
+      Signing key fingerprint mismatch: got '{{ claude_code_key_fpr.stdout | trim }}',
+      expected '{{ claude_code_apt_key_fingerprint }}'. Removing the key file.
+    quiet: true
+  register: claude_code_key_check
+  ignore_errors: true
+
+- name: Remove untrusted key file
+  ansible.builtin.file:
+    path: "{{ claude_code_apt_key_path }}"
+    state: absent
+  become: true
+  when: claude_code_key_check is failed
+
+- name: Stop if key check failed
+  ansible.builtin.fail:
+    msg: "{{ claude_code_key_check.msg }}"
+  when: claude_code_key_check is failed
+
+- name: Configure Claude Code apt repository
+  ansible.builtin.apt_repository:
+    repo: >-
+      deb [signed-by={{ claude_code_apt_key_path }}]
+      {{ claude_code_apt_repo_base }}/{{ claude_code_apt_channel }}
+      {{ claude_code_apt_channel }} main
+    filename: claude-code
+    state: present
+    update_cache: true
+  become: true
+
+- name: Install claude-code package
+  ansible.builtin.apt:
+    name: claude-code
+    state: "{{ claude_code_package_state }}"
+  become: true