2026-10-21 19:32:59 +02:00
1 changed files with 91 additions and 0 deletions
@@ -0,0 +1,91 @@
+---
+- name: Check PHP versions
+  hosts: all
+  gather_facts: false
+  become: false
+  vars:
+    phpcheck_oldest_branch: "8.2"
+    phpcheck_min_versions:
+      "8.2": "8.2.35"
+      "8.3": "8.3.36"
+      "8.4": "8.4.27"
+      "8.5": "8.5.12"
+  tasks:
+    - name: Get host PHP version
+      ansible.builtin.shell: command -v php >/dev/null 2>&1 && php -r 'echo PHP_VERSION;'
+      register: phpcheck_host
+      changed_when: false
+      failed_when: false
+
+    - name: Check if docker is installed
+      ansible.builtin.command:
+        argv: [sh, -c, command -v docker]
+      register: phpcheck_docker
+      changed_when: false
+      failed_when: false
+
+    - name: List running containers
+      ansible.builtin.command: docker ps --format '{% raw %}{{.Names}}{% endraw %}'
+      register: phpcheck_containers
+      changed_when: false
+      failed_when: false
+      when: phpcheck_docker.rc == 0
+
+    - name: List running containers with sudo
+      ansible.builtin.command: docker ps --format '{% raw %}{{.Names}}{% endraw %}'
+      become: true
+      register: phpcheck_containers_sudo
+      changed_when: false
+      ignore_errors: true
+      when:
+        - phpcheck_docker.rc == 0
+        - phpcheck_containers.rc != 0
+        - phpcheck_containers.stderr is search('permission denied|docker\.sock|docker daemon', ignorecase=true)
+
+    - name: Select container list
+      ansible.builtin.set_fact:
+        phpcheck_use_become: "{{ phpcheck_containers_sudo is not skipped }}"
+        phpcheck_list: "{{ phpcheck_containers_sudo if phpcheck_containers_sudo is not skipped else phpcheck_containers }}"
+
+    - name: Get container PHP versions
+      ansible.builtin.command:
+        argv: [docker, exec, "{{ item }}", php, -r, "echo PHP_VERSION;"]
+      become: "{{ phpcheck_use_become }}"
+      loop: "{{ phpcheck_list.stdout_lines | default([]) if phpcheck_list.rc | default(1) == 0 else [] }}"
+      register: phpcheck_container_php
+      changed_when: false
+      failed_when: false
+
+    - name: Evaluate PHP versions
+      ansible.builtin.set_fact:
+        phpcheck_report: "{{ phpcheck_report | default([]) + [item.0 ~ ': ' ~ phpcheck_status] }}"
+      loop: >-
+        {{ [['host', phpcheck_host.stdout | default('')]]
+           + (phpcheck_container_php.results | default([]) | map(attribute='item') | map('regex_replace', '^', 'container ')
+              | zip(phpcheck_container_php.results | default([]) | map(attribute='stdout', default='')) | list) }}
+      vars:
+        phpcheck_version: "{{ item.1 | regex_search('^[0-9]+\\.[0-9]+\\.[0-9]+') | default('', true) }}"
+        phpcheck_branch: "{{ phpcheck_version.split('.')[:2] | join('.') }}"
+        phpcheck_status: >-
+          {{ 'none' if not phpcheck_version
+             else phpcheck_version ~ ' VULNERABLE (EOL)' if phpcheck_branch is version(phpcheck_oldest_branch, '<')
+             else phpcheck_version ~ ' UNKNOWN (no minimum defined)' if phpcheck_branch not in phpcheck_min_versions
+             else phpcheck_version ~ ' VULNERABLE (< ' ~ phpcheck_min_versions[phpcheck_branch] ~ ')'
+                  if phpcheck_version is version(phpcheck_min_versions[phpcheck_branch], '<')
+             else phpcheck_version ~ ' OK' }}
+
+    - name: Print PHP versions
+      ansible.builtin.debug:
+        msg: "{{ phpcheck_report + ([phpcheck_docker_line] if phpcheck_docker_line else []) }}"
+      vars:
+        phpcheck_sudo_msg: "{{ phpcheck_list.msg | default('') if phpcheck_list is failed else '' }}"
+        phpcheck_need_k: "{{ phpcheck_sudo_msg is search('password is required|terminal is required|missing sudo password', ignorecase=true) }}"
+        phpcheck_wrong_pw: "{{ phpcheck_sudo_msg is search('incorrect|sorry, try again|duplicate become password', ignorecase=true) }}"
+        phpcheck_docker_line: >-
+          {{ 'docker: not installed' if phpcheck_docker.rc != 0
+             else 'docker: no access, run with -K' if phpcheck_need_k
+             else 'docker: no access, wrong sudo password' if phpcheck_wrong_pw
+             else 'docker: error (' ~ (phpcheck_list.stderr | default('', true) or phpcheck_sudo_msg) | trim ~ ')'
+                  if phpcheck_list.rc | default(1) != 0
+             else 'docker: no running containers' if phpcheck_list.stdout_lines | default([]) | length == 0
+             else '' }}