---
- name: Check PHP versions
  hosts: all
  gather_facts: false
  become: "{{ phpcheck_become }}"
  vars:
    phpcheck_become: false
    phpcheck_oldest_branch: "8.2"
    phpcheck_min_versions:
      "8.2": "8.2.35"
      "8.3": "8.3.36"
      "8.4": "8.4.27"
      "8.5": "8.5.12"
  tasks:
    - name: Get host PHP version
      ansible.builtin.shell: command -v php >/dev/null 2>&1 && php -r 'echo PHP_VERSION;'
      register: phpcheck_host
      changed_when: false
      failed_when: false

    - name: Check if docker is installed
      ansible.builtin.command:
        argv: [sh, -c, command -v docker]
      register: phpcheck_docker
      changed_when: false
      failed_when: false

    - name: List running containers
      ansible.builtin.command: docker ps --format '{% raw %}{{.Names}}{% endraw %}'
      register: phpcheck_containers
      changed_when: false
      failed_when: false
      when: phpcheck_docker.rc == 0

    - name: Get container PHP versions
      ansible.builtin.command:
        argv: [docker, exec, "{{ item }}", php, -r, "echo PHP_VERSION;"]
      loop: "{{ phpcheck_containers.stdout_lines | default([]) }}"
      register: phpcheck_container_php
      changed_when: false
      failed_when: false
      when: phpcheck_containers.rc | default(1) == 0

    - name: Evaluate PHP versions
      ansible.builtin.set_fact:
        phpcheck_report: "{{ phpcheck_report | default([]) + [item.0 ~ ': ' ~ phpcheck_status] }}"
      loop: >-
        {{ [['host', phpcheck_host.stdout | default('')]]
           + (phpcheck_container_php.results | default([]) | map(attribute='item') | map('regex_replace', '^', 'container ')
              | zip(phpcheck_container_php.results | default([]) | map(attribute='stdout', default='')) | list) }}
      vars:
        phpcheck_version: "{{ item.1 | regex_search('^[0-9]+\\.[0-9]+\\.[0-9]+') | default('', true) }}"
        phpcheck_branch: "{{ phpcheck_version.split('.')[:2] | join('.') }}"
        phpcheck_status: >-
          {{ 'none' if not phpcheck_version
             else phpcheck_version ~ ' VULNERABLE (EOL)' if phpcheck_branch is version(phpcheck_oldest_branch, '<')
             else phpcheck_version ~ ' UNKNOWN (no minimum defined)' if phpcheck_branch not in phpcheck_min_versions
             else phpcheck_version ~ ' VULNERABLE (< ' ~ phpcheck_min_versions[phpcheck_branch] ~ ')'
                  if phpcheck_version is version(phpcheck_min_versions[phpcheck_branch], '<')
             else phpcheck_version ~ ' OK' }}

    - name: Print PHP versions
      ansible.builtin.debug:
        msg: >-
          {{ phpcheck_report
             + (['docker: not installed'] if phpcheck_docker.rc != 0 else [])
             + (['docker: not accessible (' ~ phpcheck_containers.stderr | default('') | trim ~ ')']
                if phpcheck_docker.rc == 0 and phpcheck_containers.rc | default(0) != 0 else []) }}