---
# Update Hermes Agent on every host in the Ansible `hermes` group.
# Run with: ansible-playbook -i inventory.yml hermes-update.yml

- name: Update Hermes Agent
  hosts: hermes
  gather_facts: true
  serial: 1  # update one Hermes instance at a time so both are not down together

  vars:
    # Override per-host/group if Hermes is installed somewhere else.
    hermes_bin: "{{ ansible_env.HOME }}/.local/bin/hermes"
    hermes_branch: main
    # Use true for a full HERMES_HOME backup before updating; false keeps Hermes' default quick snapshot.
    hermes_full_backup: true

  tasks:
    - name: Check Hermes launcher exists
      ansible.builtin.stat:
        path: "{{ hermes_bin }}"
      register: hermes_launcher

    - name: Fail if Hermes launcher is missing
      ansible.builtin.fail:
        msg: "Hermes launcher not found at {{ hermes_bin }}. Set hermes_bin for this host/group."
      when: not hermes_launcher.stat.exists

    - name: Show current Hermes version and install info
      ansible.builtin.command: "{{ hermes_bin }} --version"
      register: hermes_version_before
      changed_when: false

    - name: Show Hermes update plan
      ansible.builtin.command: "{{ hermes_bin }} update --plan --branch {{ hermes_branch }}"
      register: hermes_update_plan
      changed_when: false

    - name: Check whether Hermes update is available
      ansible.builtin.command: "{{ hermes_bin }} update --check --branch {{ hermes_branch }}"
      register: hermes_update_check
      changed_when: false

    - name: Update Hermes when needed
      ansible.builtin.command: >-
        {{ hermes_bin }} update --yes --branch {{ hermes_branch }}
        {{ '--backup' if hermes_full_backup else '' }}
      register: hermes_update_result
      when: "'Update available' in hermes_update_check.stdout"
      changed_when: true

    - name: Verify Hermes is now current
      ansible.builtin.command: "{{ hermes_bin }} update --check --branch {{ hermes_branch }}"
      register: hermes_update_verify
      changed_when: false
      failed_when: >-
        hermes_update_verify.rc != 0 or
        ('Update available' in hermes_update_verify.stdout)

    - name: Show final Hermes version and install info
      ansible.builtin.command: "{{ hermes_bin }} --version"
      register: hermes_version_after
      changed_when: false

    - name: Print Hermes update summary
      ansible.builtin.debug:
        msg:
          host: "{{ inventory_hostname }}"
          before: "{{ hermes_version_before.stdout_lines }}"
          updated: "{{ 'Update available' in hermes_update_check.stdout }}"
          after: "{{ hermes_version_after.stdout_lines }}"
          verify: "{{ hermes_update_verify.stdout_lines }}"