From 09f4b9fe4c4b40178f771fa03e84bc21d93042bc Mon Sep 17 00:00:00 2001
From: Markus Pesch <markus.pesch@cryptic.systems>
Date: Thu, 10 Sep 2026 21:18:34 +0200
Subject: [PATCH] fix(tasks): match entries with empty user, group or runas
 values

The conditions relied on 'is defined' and 'is not defined'. An entry which
declares the unused key with an empty string - as documented in
defaults/main.yaml - matched none of the four tasks, so the sudoers drop-in
file was silently not created. Comparing the length of the defaulted values
instead makes exactly one task apply to every entry accepted by the
validation.

Co-authored-by: Copilot <copilot@github.com>
---
 tasks/main.yaml | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/tasks/main.yaml b/tasks/main.yaml
index 16aeebb..39f16ab 100644
--- a/tasks/main.yaml
+++ b/tasks/main.yaml
@@ -59,9 +59,9 @@
     commands: "{{ item.commands | default('ALL') }}"
   with_items:
   - "{{ sudo_users_sudoers }}"
-  when: item.user is defined and item.user | length > 0 and
-        item.group is not defined and
-        item.runas is not defined
+  when: item.user | default('') | length > 0 and
+        item.group | default('') | length == 0 and
+        item.runas | default('') | length == 0
 
 - name: "Create sudoers drop-in file to execute commands for specific unix users as specific unix user"
   community.general.sudoers:
@@ -73,9 +73,9 @@
     commands: "{{ item.commands | default('ALL') }}"
   with_items:
   - "{{ sudo_users_sudoers }}"
-  when: item.user is defined and item.user | length > 0 and
-        item.group is not defined and
-        item.runas is defined and item.runas | length > 0
+  when: item.user | default('') | length > 0 and
+        item.group | default('') | length == 0 and
+        item.runas | default('') | length > 0
 
 - name: "Create sudoers drop-in file to execute commands for specific unix groups"
   community.general.sudoers:
@@ -86,9 +86,9 @@
     commands: "{{ item.commands | default('ALL') }}"
   with_items:
   - "{{ sudo_users_sudoers }}"
-  when: item.user is not defined and
-        item.group is defined and item.group | length > 0 and
-        item.runas is not defined
+  when: item.user | default('') | length == 0 and
+        item.group | default('') | length > 0 and
+        item.runas | default('') | length == 0
 
 - name: "Create sudoers drop-in file to execute commands for specific unix groups as specifix unix user"
   community.general.sudoers:
@@ -100,6 +100,6 @@
     commands: "{{ item.commands | default('ALL') }}"
   with_items:
   - "{{ sudo_users_sudoers }}"
-  when: item.user is not defined and
-        item.group is defined and item.group | length > 0 and
-        item.runas is defined and item.runas | length > 0
+  when: item.user | default('') | length == 0 and
+        item.group | default('') | length > 0 and
+        item.runas | default('') | length > 0