---
- name: 🧩 Apply role include/exclude filters
  ansible.builtin.set_fact:
    _cli_apps: >-
      {{
        playbook_dir
        | discover_cli_roles(
            group_names=group_names,
            only_roles=TEST_E2E_CLI_ONLY_ROLES,
            skip_roles=TEST_E2E_CLI_SKIP_ROLES
          )
      }}

- name: 🔍 Show detected CLI test roles
  ansible.builtin.debug:
    msg: "CLI-test-enabled roles: {{ _cli_apps }}"
  changed_when: false

- name: 📂 Ensure stage base dir exists
  ansible.builtin.file:
    path: "{{ TEST_E2E_CLI_STAGE_BASE_DIR }}"
    state: directory
    mode: "0700"

- name: 📦 Install DB client modules for the CLI tests
  ansible.builtin.command:
    argv:
      - python3
      - -m
      - pip
      - install
      - --quiet
      - --break-system-packages
      - pymysql
      - psycopg2-binary
      - ldap3
  register: _cli_pip_install
  changed_when: "'Successfully installed' in _cli_pip_install.stdout"
  when: (_cli_apps | length) > 0

- name: 🧪 Run CLI tests, always purging the staged secrets afterwards
  block:
    - name: 🚀 Run CLI test for each detected role
      ansible.builtin.include_tasks: run_one.yml
      loop: "{{ _cli_apps }}"
      loop_control:
        loop_var: application_id # nocheck: loop-var-shadow  the item IS the role id, so run_one reads the same value the tested role declares
        label: "{{ application_id }}"
      when: >-
        not (lookup('role_tests', application_id, 'cli.controller_only', default=false) | bool)
        or (ansible_connection | default('')) == 'local'

    - name: ✅ Fail if there were CLI test failures
      ansible.builtin.fail:
        msg: "CLI tests failed for roles: {{ _cli_failures }}"
      when: (_cli_failures | default([])) | length > 0
  always:
    - name: 🧹 Remove CLI test stage dir (holds decodable DB secrets)
      ansible.builtin.file:
        path: "{{ TEST_E2E_CLI_STAGE_BASE_DIR }}"
        state: absent