---
- name: Check PHP versions
  hosts: all
  gather_facts: false
  become: false
  vars:
    phpcheck_oldest_branch: "8.2"
    phpcheck_min_versions:
      "8.2": "8.2.35"
      "8.3": "8.3.36"
      "8.4": "8.4.27"
      "8.5": "8.5.12"
  tasks:
    - name: Get host PHP version
      ansible.builtin.shell: command -v php >/dev/null 2>&1 && php -r 'echo PHP_VERSION;'
      register: phpcheck_host
      changed_when: false
      failed_when: false

    - name: Check if docker is installed
      ansible.builtin.command:
        argv: [sh, -c, command -v docker]
      register: phpcheck_docker
      changed_when: false
      failed_when: false

    - name: List running containers
      ansible.builtin.command: docker ps --format '{% raw %}{{.Names}}{% endraw %}'
      register: phpcheck_containers
      changed_when: false
      failed_when: false
      when: phpcheck_docker.rc == 0

    - name: List running containers with sudo
      ansible.builtin.command: docker ps --format '{% raw %}{{.Names}}{% endraw %}'
      become: true
      register: phpcheck_containers_sudo
      changed_when: false
      ignore_errors: true
      when:
        - phpcheck_docker.rc == 0
        - phpcheck_containers.rc != 0
        - phpcheck_containers.stderr is search('permission denied|docker\.sock|docker daemon', ignorecase=true)

    - name: Select container list
      ansible.builtin.set_fact:
        phpcheck_use_become: "{{ phpcheck_containers_sudo is not skipped }}"
        phpcheck_list: "{{ phpcheck_containers_sudo if phpcheck_containers_sudo is not skipped else phpcheck_containers }}"

    - name: Get container PHP versions
      ansible.builtin.command:
        argv: [docker, exec, "{{ item }}", php, -r, "echo PHP_VERSION;"]
      become: "{{ phpcheck_use_become }}"
      loop: "{{ phpcheck_list.stdout_lines | default([]) if phpcheck_list.rc | default(1) == 0 else [] }}"
      register: phpcheck_container_php
      changed_when: false
      failed_when: false

    - name: Evaluate PHP versions
      ansible.builtin.set_fact:
        phpcheck_report: "{{ phpcheck_report | default([]) + [item.0 ~ ': ' ~ phpcheck_status] }}"
      loop: >-
        {{ [['host', phpcheck_host.stdout | default('')]]
           + (phpcheck_container_php.results | default([]) | map(attribute='item') | map('regex_replace', '^', 'container ')
              | zip(phpcheck_container_php.results | default([]) | map(attribute='stdout', default='')) | list) }}
      vars:
        phpcheck_version: "{{ item.1 | regex_search('^[0-9]+\\.[0-9]+\\.[0-9]+') | default('', true) }}"
        phpcheck_branch: "{{ phpcheck_version.split('.')[:2] | join('.') }}"
        phpcheck_status: >-
          {{ 'none' if not phpcheck_version
             else phpcheck_version ~ ' VULNERABLE (EOL)' if phpcheck_branch is version(phpcheck_oldest_branch, '<')
             else phpcheck_version ~ ' UNKNOWN (no minimum defined)' if phpcheck_branch not in phpcheck_min_versions
             else phpcheck_version ~ ' VULNERABLE (< ' ~ phpcheck_min_versions[phpcheck_branch] ~ ')'
                  if phpcheck_version is version(phpcheck_min_versions[phpcheck_branch], '<')
             else phpcheck_version ~ ' OK' }}

    - name: Print PHP versions
      ansible.builtin.debug:
        msg: "{{ phpcheck_report + ([phpcheck_docker_line] if phpcheck_docker_line else []) }}"
      vars:
        phpcheck_sudo_msg: "{{ phpcheck_list.msg | default('') if phpcheck_list is failed else '' }}"
        phpcheck_need_k: "{{ phpcheck_sudo_msg is search('password is required|terminal is required|missing sudo password', ignorecase=true) }}"
        phpcheck_wrong_pw: "{{ phpcheck_sudo_msg is search('incorrect|sorry, try again|duplicate become password', ignorecase=true) }}"
        phpcheck_docker_line: >-
          {{ 'docker: not installed' if phpcheck_docker.rc != 0
             else 'docker: no access, run with -K' if phpcheck_need_k
             else 'docker: no access, wrong sudo password' if phpcheck_wrong_pw
             else 'docker: error (' ~ (phpcheck_list.stderr | default('', true) or phpcheck_sudo_msg) | trim ~ ')'
                  if phpcheck_list.rc | default(1) != 0
             else 'docker: no running containers' if phpcheck_list.stdout_lines | default([]) | length == 0
             else '' }}