feat: manage Seriatim source prerequisites

tasks/dependencies.yml

@@ -0,0 +1,66 @@
+---
+- name: Install Git build dependency
+  ansible.builtin.apt:
+    name: git
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+  when: seriatim_manage_build_dependencies
+
+- name: Install Go build dependency
+  community.general.snap:
+    name: go
+    state: present
+    classic: true
+    channel: "{{ seriatim_go_snap_channel }}"
+  when: seriatim_manage_build_dependencies
+
+- name: Resolve Git executable
+  ansible.builtin.command:
+    argv:
+      - /usr/bin/which
+      - git
+  register: seriatim_git_path_result
+  changed_when: false
+  failed_when: seriatim_git_path_result.rc != 0
+
+- name: Verify configured Go executable exists
+  ansible.builtin.stat:
+    path: "{{ seriatim_go_binary }}"
+    follow: true
+  register: seriatim_go_binary_stat
+
+- name: Require configured Go executable
+  ansible.builtin.assert:
+    that:
+      - seriatim_go_binary_stat.stat.exists
+      - seriatim_go_binary_stat.stat.isreg
+      - seriatim_go_binary_stat.stat.executable
+    fail_msg: "Configured Go executable is unavailable: {{ seriatim_go_binary }}"
+
+- name: Read Go compiler version
+  ansible.builtin.command:
+    argv:
+      - "{{ seriatim_go_binary }}"
+      - version
+  register: seriatim_go_version_result
+  changed_when: false
+
+- name: Extract Go compiler version components
+  ansible.builtin.set_fact:
+    seriatim_go_version_parts: >-
+      {{ seriatim_go_version_result.stdout
+         | regex_findall('go([0-9]+)\.([0-9]+)')
+         | first
+         | default([]) }}
+
+- name: Require supported Go compiler version
+  ansible.builtin.assert:
+    that:
+      - seriatim_go_version_result.stdout is regex('^go version go[0-9]+\.[0-9]+(?:\.[0-9]+)? ')
+      - seriatim_go_version_parts | length == 2
+      - (seriatim_go_version_parts[0] | int > 1) or
+        (seriatim_go_version_parts[0] | int == 1 and seriatim_go_version_parts[1] | int >= 25)
+    fail_msg: >-
+      Seriatim requires Go 1.25 or newer; detected
+      {{ seriatim_go_version_result.stdout | default('no usable version output') }}.

tasks/main.yml

@@ -1,3 +1,9 @@
 ---
 - name: Validate Seriatim role inputs
   ansible.builtin.import_tasks: validate.yml
+
+- name: Manage Seriatim build dependencies
+  ansible.builtin.import_tasks: dependencies.yml
+
+- name: Manage Seriatim source checkout
+  ansible.builtin.import_tasks: source.yml

tasks/source.yml

@@ -0,0 +1,76 @@
+---
+- name: Create Seriatim source parent directory
+  ansible.builtin.file:
+    path: "{{ seriatim_source_dir | dirname }}"
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Check out selected Seriatim source
+  ansible.builtin.git:
+    repo: "{{ seriatim_repository_url }}"
+    dest: "{{ seriatim_source_dir }}"
+    version: "{{ seriatim_source_ref }}"
+    update: true
+    force: true
+    accept_hostkey: false
+
+- name: Inspect Seriatim checkout cleanliness
+  ansible.builtin.command:
+    argv:
+      - "{{ seriatim_git_path_result.stdout }}"
+      - -C
+      - "{{ seriatim_source_dir }}"
+      - status
+      - --porcelain
+      - --untracked-files=all
+      - --ignored
+  register: seriatim_source_status
+  changed_when: false
+
+- name: Reset tracked Seriatim source changes
+  ansible.builtin.command:
+    argv:
+      - "{{ seriatim_git_path_result.stdout }}"
+      - -C
+      - "{{ seriatim_source_dir }}"
+      - reset
+      - --hard
+      - HEAD
+  when: seriatim_source_status.stdout | length > 0
+  changed_when: true
+
+- name: Remove untracked and ignored Seriatim source content
+  ansible.builtin.command:
+    argv:
+      - "{{ seriatim_git_path_result.stdout }}"
+      - -C
+      - "{{ seriatim_source_dir }}"
+      - clean
+      - -dffx
+  when: seriatim_source_status.stdout | length > 0
+  changed_when: true
+
+- name: Enforce Seriatim source ownership
+  ansible.builtin.file:
+    path: "{{ seriatim_source_dir }}"
+    state: directory
+    owner: root
+    group: root
+    recurse: true
+
+- name: Resolve selected Seriatim source commit
+  ansible.builtin.command:
+    argv:
+      - "{{ seriatim_git_path_result.stdout }}"
+      - -C
+      - "{{ seriatim_source_dir }}"
+      - rev-parse
+      - HEAD
+  register: seriatim_source_commit_result
+  changed_when: false
+
+- name: Record selected Seriatim source commit
+  ansible.builtin.set_fact:
+    seriatim_source_commit: "{{ seriatim_source_commit_result.stdout }}"

tasks/validate.yml

@@ -23,7 +23,7 @@
       - seriatim_go_build_flags | select('equalto', '') | list | length == 0
       - seriatim_go_ldflags | length > 0
       - seriatim_go_package | length > 0
-      - seriatim_build_version is not regex('.*\\s+.*')
+      - seriatim_build_version is not regex('.*\s+.*')
     fail_msg: Seriatim repository, revision, build, and Go values must be nonempty, and the build version cannot contain whitespace.
 
 - name: Verify managed Seriatim paths are safe and distinct