fix: add LTS codename fallback for OpenVPN3 repo on Ubuntu interim releases

Author: Derek

ansible/roles/developer_core/tasks/openvpn.yml

@@ -31,9 +31,17 @@
         dest: /etc/apt/keyrings/openvpn.asc
         mode: '0644'
 
+    # Map unsupported Ubuntu releases to nearest supported LTS
+    # OpenVPN 3 only publishes repos for LTS releases (jammy, noble)
+    - name: Determine OpenVPN repo codename
+      ansible.builtin.set_fact:
+        openvpn_codename: >-
+          {{ (ansible_facts['distribution_version'] is version('24.04', '>'))
+             | ternary('noble', ansible_facts['distribution_release']) }}
+
     - name: Add OpenVPN 3 repository
       ansible.builtin.apt_repository:
-        repo: "deb [signed-by=/etc/apt/keyrings/openvpn.asc] https://packages.openvpn.net/openvpn3/debian {{ ansible_facts['distribution_release'] }} main"
+        repo: "deb [signed-by=/etc/apt/keyrings/openvpn.asc] https://packages.openvpn.net/openvpn3/debian {{ openvpn_codename }} main"
         filename: openvpn3
         state: present
 
@@ -46,7 +54,11 @@
   rescue:
     - name: Warn about OpenVPN 3 installation failure
       ansible.builtin.debug:
-        msg: "⚠️  WARNING: OpenVPN 3 installation failed (repository may not support {{ ansible_facts['distribution_release'] }} yet). Install manually if needed for SSO web auth."
+        msg: "WARNING: OpenVPN 3 installation failed (repository may not support {{ ansible_facts['distribution_release'] }} yet). Install manually if needed for SSO web auth."
+
+    - name: Set OpenVPN 3 install failed fact
+      ansible.builtin.set_fact:
+        openvpn3_install_failed: true
 
   when: ansible_facts['distribution'] == 'Ubuntu'
 

ansible/roles/developer_core/tasks/verify.yml

@@ -88,7 +88,9 @@
   register: verify_openvpn
   changed_when: false
   failed_when: verify_openvpn.rc != 0
-  when: ansible_facts['distribution'] in ['Fedora', 'Ubuntu']
+  when:
+    - ansible_facts['distribution'] in ['Fedora', 'Ubuntu']
+    - not (openvpn3_install_failed | default(false))
 
 - name: Verify OpenVPN 3 (macOS)
   ansible.builtin.command: openvpn --version
@@ -223,7 +225,7 @@
       - Node.js: {{ verify_node.stdout | default('installed') }}
       - semantic-release: {{ verify_semrel.stdout | default('installed') }}
       - Linear CLI: {{ verify_linear.stdout | default('installed') }}
-      - OpenVPN: {{ verify_openvpn.stdout | default('installed') }}
+      - OpenVPN: {{ verify_openvpn.stdout | default('skipped (install failed - manual install required)') }}
       - NetBird CLI: {{ verify_netbird.stdout | default('installed') }}
       - Claude Code CLI: {{ verify_claude.stdout | default('installed') }}
       - Gitleaks: {{ verify_gitleaks.stdout | default('installed') }}