ansible/roles/updates/tasks/main.yml

- name: Clear our set_facts
  set_fact:
    reboot_force: false

- name: Workaround arm64 repo issue
  ansible.builtin.lineinfile:
    path: /etc/apt/apt.conf.d/99phased-updates
    create: yes
    state: present
    insertbefore: BOF
    line: 'APT::Get::Always-Include-Phased-Updates 1;'

- name: Repo updates
  apt:
    update_cache: yes
  changed_when: false
- name: OS updates
  apt:
    upgrade: safe
  register: updates_os_change
- name: Remember to reboot if the OS says so
  stat:
    path: /var/run/reboot-required
  register: updates_os_flag
- name: Remember our OS update status
  set_fact:
    reboot_force: "{{ updates_os_change.changed or updates_os_flag.stat.exists }}"
  when: reboot_force is not defined or updates_os_change.changed or updates_os_flag.stat.exists
- name: Pacakge cleanup
  apt:
    autoremove: yes