# roles/claude_code/tasks/apt.yml
---
- name: Create apt keyrings directory
  ansible.builtin.file:
    path: /etc/apt/keyrings
    state: directory
    mode: "0755"
    owner: root
    group: root
  become: true

- name: Download Anthropic release signing key
  ansible.builtin.get_url:
    url: "{{ claude_code_apt_key_url }}"
    dest: "{{ claude_code_apt_key_path }}"
    mode: "0644"
    owner: root
    group: root
  become: true

- name: Read key fingerprint
  ansible.builtin.shell:
    cmd: |
      set -o pipefail
      gpg --show-keys --with-colons {{ claude_code_apt_key_path | quote }} | awk -F':' '/^fpr/ {print $10; exit}'
    executable: /bin/bash
  register: claude_code_key_fpr
  changed_when: false
  check_mode: false
  become: true

- name: Refuse to continue if the key fingerprint does not match
  ansible.builtin.assert:
    that:
      - claude_code_key_fpr.stdout | trim | upper == claude_code_apt_key_fingerprint | upper
    fail_msg: >-
      Signing key fingerprint mismatch: got '{{ claude_code_key_fpr.stdout | trim }}',
      expected '{{ claude_code_apt_key_fingerprint }}'. Removing the key file.
    quiet: true
  register: claude_code_key_check
  ignore_errors: true

- name: Remove untrusted key file
  ansible.builtin.file:
    path: "{{ claude_code_apt_key_path }}"
    state: absent
  become: true
  when: claude_code_key_check is failed

- name: Stop if key check failed
  ansible.builtin.fail:
    msg: "{{ claude_code_key_check.msg }}"
  when: claude_code_key_check is failed

- name: Configure Claude Code apt repository
  ansible.builtin.apt_repository:
    repo: >-
      deb [signed-by={{ claude_code_apt_key_path }}]
      {{ claude_code_apt_repo_base }}/{{ claude_code_apt_channel }}
      {{ claude_code_apt_channel }} main
    filename: claude-code
    state: present
    update_cache: true
  become: true

- name: Install claude-code package
  ansible.builtin.apt:
    name: claude-code
    state: "{{ claude_code_package_state }}"
  become: true