main.yml

---
- name: Install build dependencies for GitHub CLI
  apt:
    name:
      - ca-certificates
      - git
      - make
      - build-essential
    state: present
    update_cache: true

- name: Refresh system CA certificates
  command: update-ca-certificates
  changed_when: false

- name: Check if gh is already installed and matches version
  command: gh --version
  register: gh_current_version
  failed_when: false
  changed_when: false

- name: Create build directory
  file:
    path: "{{ gh_build_dir }}"
    state: directory
  when: gh_current_version.rc != 0 or gh_release_version not in gh_current_version.stdout

- name: Clone GitHub CLI repository
  git:
    repo: "{{ gh_git_repo }}"
    dest: "{{ gh_build_dir }}"
    version: "{{ gh_version }}"
    depth: 1
    update: true
  when: gh_current_version.rc != 0 or gh_release_version not in gh_current_version.stdout

- name: Build and Install GitHub CLI from source
  become: true
  shell: |
    export PATH=$PATH:/usr/local/go/bin
    make
    make install prefix=/usr/local
  args:
    chdir: "{{ gh_build_dir }}"
    executable: /bin/bash
  environment:
    SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
    SSL_CERT_DIR: /etc/ssl/certs
    GIT_SSL_CAINFO: /etc/ssl/certs/ca-certificates.crt
    # Prefer the public Go module proxy/checksum database for reproducible
    # module zips. Using GOPROXY=direct can expose source archive drift and
    # a poisoned root module cache as checksum mismatches.
    GOPROXY: "https://proxy.golang.org,direct"
    GOMODCACHE: "{{ gh_build_dir }}/.gomodcache"
    GOCACHE: "{{ gh_build_dir }}/.gocache"
  when: gh_current_version.rc != 0 or gh_release_version not in gh_current_version.stdout

- name: Verify gh installation
  command: gh --version
  register: gh_verify
  changed_when: false

- name: Show gh version
  debug:
    msg: "GitHub CLI installed: {{ gh_verify.stdout_lines[0] }}"