From 7c76a5cc869d08ffabf99d78e30e485d7fb751d9 Mon Sep 17 00:00:00 2001
From: Markus Pesch <markus.pesch@cryptic.systems>
Date: Thu, 10 Sep 2026 20:57:26 +0200
Subject: [PATCH] fix(tasks): include verify_vars.yaml as tasks file

The variable verification was included via include_vars, which is meant for variable files only. Additionally the
first_found lookup had no paths defined, so it searched the files/ subdirectory and the role root instead of tasks/ and
failed with "No file was found". Switching to include_tasks and adding the tasks path makes the verification run at all.

The assertion itself was fully commented out and is now active, so a misconfigured entry fails early instead of being
silently skipped by all four sudoers tasks.

Co-authored-by: Copilot <copilot@github.com>
---
 tasks/main.yaml        |  6 ++++--
 tasks/verify_vars.yaml | 16 ++++++++++------
 2 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/tasks/main.yaml b/tasks/main.yaml
index b65dc17..e9b3554 100644
--- a/tasks/main.yaml
+++ b/tasks/main.yaml
@@ -14,13 +14,15 @@
       - vars
 
 - name: Verify variables
-  ansible.builtin.include_vars: "{{ lookup('first_found', params) }}"
+  ansible.builtin.include_tasks: "{{ lookup('first_found', params) }}"
   vars:
     params:
       files:
       - "{{ ansible_facts['distribution'] }}_verify_vars.yaml"
       - "{{ ansible_facts['os_family'] }}_verify_vars.yaml"
-      - "verify_vars.yaml"
+      - verify_vars.yaml
+      paths:
+      - tasks
 
 - name: Install sudo
   ansible.builtin.package:
diff --git a/tasks/verify_vars.yaml b/tasks/verify_vars.yaml
index 7ace223..78aa77d 100644
--- a/tasks/verify_vars.yaml
+++ b/tasks/verify_vars.yaml
@@ -1,8 +1,12 @@
 ---
 
-# - name: Verify if not user and group exists for each entry
-#   ansible.builtin.assert:
-#     that:
-#     - (item.user is defined and item.group is not defined) or
-#       (item.user is not defined and item.group is defined)
-#   with_items: "{{ sudo_users_sudoers }}"
+- name: Verify that each entry defines either a user or a group
+  ansible.builtin.assert:
+    that:
+    - (item.user is defined and item.user | length > 0) !=
+      (item.group is defined and item.group | length > 0)
+    fail_msg: >
+      Each entry of sudo_users_sudoers must define either 'user' or 'group',
+      but not both and not none.
+    quiet: true
+  with_items: "{{ sudo_users_sudoers }}"