refactor(roles): hoist a repeated when onto the block it guards

Four task files repeated one condition across consecutive tasks, which
is the shape the block lint rejects: the reader has to compare the
conditions to see they are the same, and a later edit can change one
and miss the others.

Each run is wrapped in a block carrying the shared condition, and the
tasks keep only what is theirs. Ansible ands a block's when with each
child's, so every task ends up with the condition it had before.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

roles/sys-stk-front-proxy/tasks/vhost.yml

@@ -75,26 +75,26 @@
 - name: "🔄 Restart Webserver for '{{ front_proxy_domain_conf_dst_resolved }}'"
   ansible.builtin.meta: flush_handlers
 
-- name: "🔍 Verify '{{ front_proxy_domain }}' is served after the reload"
-  uri_probe:
-    url: "{{ front_proxy_probe_url }}"
-    status_code: "{{ front_proxy_status_codes }}"
-  register: front_proxy_reload_check
-  failed_when: false
-  changed_when: false
+- name: "🔁 Re-check '{{ front_proxy_domain }}' after a config change"
   when: nginx_conf.changed
+  block:
+    - name: "🔍 Verify '{{ front_proxy_domain }}' is served after the reload"
+      uri_probe:
+        url: "{{ front_proxy_probe_url }}"
+        status_code: "{{ front_proxy_status_codes }}"
+      register: front_proxy_reload_check
+      failed_when: false
+      changed_when: false
 
-- name: "🔄 Redeploy: reload left {{ front_proxy_reload_check.status | default('none') }}"
-  ansible.builtin.command:
-    cmd: "true"
-  notify: restart-openresty
-  when:
-    - nginx_conf.changed
-    - front_proxy_reload_check.status | default(-1) not in front_proxy_status_codes
-    - >-
-      not openresty_reload.changed
-      or front_proxy_reload_check.status | default(-1) in front_proxy_stale_config_status_codes
+    - name: "🔄 Redeploy: reload left {{ front_proxy_reload_check.status | default('none') }}"
+      ansible.builtin.command:
+        cmd: "true"
+      notify: restart-openresty
+      when:
+        - front_proxy_reload_check.status | default(-1) not in front_proxy_status_codes
+        - >-
+          not openresty_reload.changed
+          or front_proxy_reload_check.status | default(-1) in front_proxy_stale_config_status_codes
 
-- name: "🔄 Flush the fallback redeploy for '{{ front_proxy_domain }}'"
-  ansible.builtin.meta: flush_handlers
-  when: nginx_conf.changed
+    - name: "🔄 Flush the fallback redeploy for '{{ front_proxy_domain }}'"
+      ansible.builtin.meta: flush_handlers

roles/sys-svc-compose/tasks/utils/up.yml

@@ -23,23 +23,24 @@
     - compose_mode == 'compose'
   notify: compose-up
 
-- name: "🔍 Check for a compose up a failed run left pending"
-  ansible.builtin.stat:
-    path: "{{ COMPOSE_UP_PENDING_MARKER }}"
-  register: compose_up_pending
+- name: "🔁 Resume a compose up that a failed run left pending"
   when: compose_mode == 'compose'
+  block:
+    - name: "🔍 Check for a compose up a failed run left pending"
+      ansible.builtin.stat:
+        path: "{{ COMPOSE_UP_PENDING_MARKER }}"
+      register: compose_up_pending
 
-- name: "🔔 Resume the compose up a failed run left pending"
-  ansible.builtin.debug:
-    msg: "{{ COMPOSE_UP_PENDING_MARKER }} is still present, so the last compose up never completed"
-  changed_when: true
-  notify:
-    - compose-build
-    - compose-up
-  when:
-    - compose_mode == 'compose'
-    - compose_up_pending.stat.exists
-    - compose_up_marker is not changed
+    - name: "🔔 Resume the compose up a failed run left pending"
+      ansible.builtin.debug:
+        msg: "{{ COMPOSE_UP_PENDING_MARKER }} is still present, so the last compose up never completed"
+      changed_when: true
+      notify:
+        - compose-build
+        - compose-up
+      when:
+        - compose_up_pending.stat.exists
+        - compose_up_marker is not changed
 
 - name: "🔔 Notify swarm deploy (under DEPLOYMENT_MODE == swarm)"
   ansible.builtin.debug:

roles/test-e2e-playwright/tasks/03_run_pass.yml

@@ -111,23 +111,24 @@
   changed_when: false
   failed_when: false
 
-- name: 💬 Print Playwright output (on failure)
-  ansible.builtin.debug:
-    msg: |
-      rc: {{ _playwright_run.rc | default('<absent: run was aborted>') }}
-
-      stdout:
-      {{ _playwright_run.stdout | default('') }}
-
-      stderr:
-      {{ _playwright_run.stderr | default(_playwright_run.msg | default('')) }}
+- name: 📝 Report and record the failed Playwright run
   when: (_playwright_run.rc | default(1)) != 0
-  changed_when: false
+  block:
+    - name: 💬 Print Playwright output (on failure)
+      ansible.builtin.debug:
+        msg: |
+          rc: {{ _playwright_run.rc | default('<absent: run was aborted>') }}
 
-- name: 📝 Record failure
-  ansible.builtin.set_fact:
-    _playwright_failures: "{{ (_playwright_failures | default([])) + [application_id] }}"
-  when: (_playwright_run.rc | default(1)) != 0
+          stdout:
+          {{ _playwright_run.stdout | default('') }}
+
+          stderr:
+          {{ _playwright_run.stderr | default(_playwright_run.msg | default('')) }}
+      changed_when: false
+
+    - name: 📝 Record failure
+      ansible.builtin.set_fact:
+        _playwright_failures: "{{ (_playwright_failures | default([])) + [application_id] }}"
 
 - name: 🗄️ Archive Playwright reports for this variant + pass
   ansible.builtin.script: >-

roles/web-app-matomo/tasks/08_reinject_consumers.yml

@@ -1,23 +1,22 @@
 ---
-- name: "🔎 Matomo | Stat rendered body_filter Lua of candidate web-svc matomo consumers"
-  ansible.builtin.stat:
-    path: "{{ lookup('nginx', 'directories.configuration.lua') }}{{ lookup('domain', matomo_inj_consumer.id) }}.lua"
-  loop: "{{ lookup('roles_with_service', 'matomo', scope='all') | selectattr('id', 'match', '^web-svc-') | list }}"
-  loop_control:
-    loop_var: matomo_inj_consumer
-    label: "{{ matomo_inj_consumer.id }}"
-  register: matomo_inj_candidates
-  changed_when: false
+- name: "🔁 Matomo | Reinject the tracker into deployed web-svc consumers"
   when:
     - matomo_token_value is defined
     - matomo_token_value | length > 0
+  block:
+    - name: "🔎 Matomo | Stat rendered body_filter Lua of candidate web-svc matomo consumers"
+      ansible.builtin.stat:
+        path: "{{ lookup('nginx', 'directories.configuration.lua') }}{{ lookup('domain', matomo_inj_consumer.id) }}.lua"
+      loop: "{{ lookup('roles_with_service', 'matomo', scope='all') | selectattr('id', 'match', '^web-svc-') | list }}"
+      loop_control:
+        loop_var: matomo_inj_consumer
+        label: "{{ matomo_inj_consumer.id }}"
+      register: matomo_inj_candidates
+      changed_when: false
 
-- name: "📄 Matomo | Re-render injection for every vhost of the deployed web-svc consumers"
-  ansible.builtin.include_tasks: 08_reinject_consumers/vhosts.yml
-  loop: "{{ matomo_inj_candidates.results | selectattr('stat.exists', 'defined') | selectattr('stat.exists') | list }}"
-  loop_control:
-    loop_var: matomo_inj_dir
-    label: "{{ matomo_inj_dir.matomo_inj_consumer.id }}"
-  when:
-    - matomo_token_value is defined
-    - matomo_token_value | length > 0
+    - name: "📄 Matomo | Re-render injection for every vhost of the deployed web-svc consumers"
+      ansible.builtin.include_tasks: 08_reinject_consumers/vhosts.yml
+      loop: "{{ matomo_inj_candidates.results | selectattr('stat.exists', 'defined') | selectattr('stat.exists') | list }}"
+      loop_control:
+        loop_var: matomo_inj_dir
+        label: "{{ matomo_inj_dir.matomo_inj_consumer.id }}"