---
- name: kubeseal CLI | Get latest version from GitHub
  ansible.builtin.uri:
    url: https://api.github.com/repos/bitnami-labs/sealed-secrets/releases/latest
    return_content: true
  register: _kubeseal_latest
  when: not sealed_secrets_cli_version
  check_mode: false

- name: kubeseal CLI | Set version fact (latest)
  ansible.builtin.set_fact:
    _kubeseal_version: "{{ _kubeseal_latest.json.tag_name | regex_replace('^v', '') }}"
  when: not sealed_secrets_cli_version

- name: kubeseal CLI | Set version fact (pinned)
  ansible.builtin.set_fact:
    _kubeseal_version: "{{ sealed_secrets_cli_version | regex_replace('^v', '') }}"
  when: sealed_secrets_cli_version

- name: kubeseal CLI | Check installed version
  ansible.builtin.command: kubeseal --version
  register: _kubeseal_installed
  changed_when: false
  failed_when: false

- name: kubeseal CLI | Download and unpack
  ansible.builtin.unarchive:
    src: "https://github.com/bitnami-labs/sealed-secrets/releases/download/v{{ _kubeseal_version }}/kubeseal-{{ _kubeseal_version }}-linux-amd64.tar.gz"
    dest: /usr/local/bin
    remote_src: true
    include:
      - kubeseal
    mode: "0755"
    owner: root
    group: root
  when: >
    _kubeseal_installed.rc != 0 or
    _kubeseal_version not in _kubeseal_installed.stdout

- name: kubeseal CLI | Enable bash completion
  ansible.builtin.shell: /usr/local/bin/kubeseal --help > /dev/null && echo done
  args:
    creates: /etc/bash_completion.d/kubeseal
  changed_when: false