---
- name: "🔍 Lookup existing OIDC auth source ID"
  shell: | # nocheck: container-exec-resolver  runtime-resolved CID, delegated at the include site
    container exec -i --user {{ GITEA_USER }} {{ GITEA_LOCAL_CID | quote }} \
      gitea admin auth list \
      | awk -v name="{{ OIDC.BUTTON_TEXT }}" '$0 ~ name {print $1; exit}'
  register: oidc_source_id_raw
  failed_when: false
  changed_when: false

- name: "🗑️ Delete existing OIDC auth source if present"
  shell: | # nocheck: container-exec-resolver  runtime-resolved CID, delegated at the include site
    container exec -i --user {{ GITEA_USER }} {{ GITEA_LOCAL_CID | quote }} \
      gitea admin auth delete --id {{ oidc_source_id_raw.stdout }}
  when: oidc_source_id_raw.stdout != ""
  register: oidc_delete
  failed_when: oidc_delete.rc != 0