devtools.yml

---
- name: Install dev tools
  hosts: localhost
  connection: local
  vars_files:
    - vars.yml

  tasks:
    # ─── 1. Baseline build deps ──────────────────────────────────────────────────
    - name: Install baseline build tools
      apt:
        name:
          - build-essential
          - pkg-config
          - libssl-dev
          - zsh
          - fzf
          - ripgrep
          - fd-find
          - bat
          - git-delta
          - jq
          - yq
          - apt-transport-https
          - ca-certificates
          - gnupg
          - lsb-release
          - software-properties-common
          - python3-pip
          - python3-venv
          - unzip
          - tree
          - ncdu
          - tmux
          - direnv
          - zoxide
          - yamllint
          - sslscan
          - procps
          - eza
        state: present
        update_cache: yes
        cache_valid_time: 3600
      become: yes
      environment:
        DEBIAN_FRONTEND: noninteractive

    # ─── 2. Swap file ────────────────────────────────────────────────────────────
    - name: Check if swap is active
      command: swapon --show=NAME --noheadings
      register: swap_active
      changed_when: false
      become: yes

    - name: Set up swap file
      block:
        - name: Create swap file
          command: fallocate -l 4G /swapfile
          args:
            creates: /swapfile

        - name: Set swap file permissions
          file:
            path: /swapfile
            mode: '0600'

        - name: Format swap file
          command: mkswap /swapfile

        - name: Enable swap file
          command: swapon /swapfile
      become: yes
      when: "'/swapfile' not in swap_active.stdout"

    - name: Add swap to fstab
      lineinfile:
        path: /etc/fstab
        line: '/swapfile none swap sw 0 0'
        regexp: '/swapfile'
      become: yes

    - name: Set swappiness
      sysctl:
        name: vm.swappiness
        value: "10"
        state: present
        sysctl_file: /etc/sysctl.d/99-swappiness.conf
        reload: yes
      become: yes

    # ─── 3. Node.js LTS ──────────────────────────────────────────────────────────
    - name: Install Node.js via NodeSource setup script
      shell: |
        curl -fsSL https://deb.nodesource.com/setup_lts.x | bash -
      args:
        creates: /etc/apt/sources.list.d/nodesource.list
      become: yes
      environment:
        DEBIAN_FRONTEND: noninteractive

    - name: Install Node.js
      apt:
        name: nodejs
        state: present
        update_cache: yes
        cache_valid_time: 3600
      become: yes
      environment:
        DEBIAN_FRONTEND: noninteractive

    # ─── 4. Claude Code ──────────────────────────────────────────────────────────
    - name: Configure npm global prefix
      shell: |
        mkdir -p "$HOME/.npm-global"
        npm config set prefix "$HOME/.npm-global"
      args:
        creates: "{{ ansible_env.HOME }}/.npm-global"

    - name: Add npm global bin to PATH in .bashrc
      lineinfile:
        path: "{{ ansible_env.HOME }}/.bashrc"
        line: 'export PATH="$HOME/.npm-global/bin:$PATH"'
        regexp: 'npm-global'

    - name: Install Claude Code
      shell: |
        export PATH="{{ ansible_env.HOME }}/.npm-global/bin:$PATH"
        npm install -g @anthropic-ai/claude-code
      args:
        creates: "{{ ansible_env.HOME }}/.npm-global/bin/claude"

    # ─── 5. Go ───────────────────────────────────────────────────────────────────
    - name: Set Go architecture
      set_fact:
        go_arch: "{{ 'arm64' if ansible_architecture == 'aarch64' else 'amd64' }}"

    - name: Install Go
      unarchive:
        src: "https://go.dev/dl/go{{ go_version }}.linux-{{ go_arch }}.tar.gz"
        dest: /usr/local
        remote_src: yes
        creates: /usr/local/go/bin/go
      become: yes

    - name: Add Go to PATH in .bashrc
      blockinfile:
        path: "{{ ansible_env.HOME }}/.bashrc"
        marker: "# {mark} ANSIBLE MANAGED — Go PATH"
        block: |
          export PATH="/usr/local/go/bin:$PATH"
          export PATH="$HOME/go/bin:$PATH"

    # ─── 6. Docker CE ────────────────────────────────────────────────────────────
    - name: Add Docker GPG key
      shell: |
        install -m 0755 -d /etc/apt/keyrings
        curl -fsSL https://download.docker.com/linux/ubuntu/gpg | \
          gpg --dearmor -o /etc/apt/keyrings/docker.gpg
        chmod a+r /etc/apt/keyrings/docker.gpg
      args:
        creates: /etc/apt/keyrings/docker.gpg
      become: yes

    - name: Add Docker apt repository
      shell: |
        echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
          https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" \
          > /etc/apt/sources.list.d/docker.list
      args:
        creates: /etc/apt/sources.list.d/docker.list
      become: yes

    - name: Install Docker CE
      apt:
        name:
          - docker-ce
          - docker-ce-cli
          - containerd.io
          - docker-buildx-plugin
          - docker-compose-plugin
        state: present
        update_cache: yes
        cache_valid_time: 3600
      become: yes
      environment:
        DEBIAN_FRONTEND: noninteractive

    - name: Add user to docker group
      user:
        name: "{{ ansible_user_id }}"
        groups: docker
        append: yes
      become: yes

    # ─── 7. kubectl ──────────────────────────────────────────────────────────────
    - name: Add Kubernetes GPG key
      shell: |
        curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.31/deb/Release.key | \
          gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
      args:
        creates: /etc/apt/keyrings/kubernetes-apt-keyring.gpg
      become: yes

    - name: Add Kubernetes apt repository
      apt_repository:
        repo: "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.31/deb/ /"
        state: present
        filename: kubernetes
      become: yes

    - name: Install kubectl
      apt:
        name: kubectl
        state: present
        update_cache: yes
        cache_valid_time: 3600
      become: yes
      environment:
        DEBIAN_FRONTEND: noninteractive

    # ─── 8. Helm ─────────────────────────────────────────────────────────────────
    - name: Install Helm via official script
      shell: curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
      args:
        creates: /usr/local/bin/helm
      become: yes

    # ─── 9. stern ────────────────────────────────────────────────────────────────
    - name: Set stern architecture
      set_fact:
        stern_arch: "{{ 'arm64' if ansible_architecture == 'aarch64' else 'amd64' }}"

    - name: Check if stern is installed
      stat:
        path: /usr/local/bin/stern
      register: stern_stat

    - name: Download stern tarball
      get_url:
        url: "https://github.com/stern/stern/releases/download/v{{ stern_version }}/stern_{{ stern_version }}_linux_{{ stern_arch }}.tar.gz"
        dest: /tmp/stern.tar.gz
      when: not stern_stat.stat.exists
      become: yes

    - name: Extract and install stern
      shell: |
        tar -xzf /tmp/stern.tar.gz -C /usr/local/bin stern
        chmod +x /usr/local/bin/stern
        rm /tmp/stern.tar.gz
      when: not stern_stat.stat.exists
      become: yes

    # ─── 10. k6 (performance testing) ───────────────────────────────────────────
    - name: Set up k6 apt repo and install
      shell: |
        curl -fsSL https://dl.k6.io/key.gpg | apt-key add -
        echo "deb https://dl.k6.io/deb stable main" > /etc/apt/sources.list.d/k6.list
        apt-get update -qq
        apt-get install -y k6
      args:
        creates: /usr/bin/k6
      become: yes
      environment:
        DEBIAN_FRONTEND: noninteractive

    # ─── 11. kubie ───────────────────────────────────────────────────────────────
    - name: Set kubie architecture
      set_fact:
        kubie_arch: "{{ 'arm64' if ansible_architecture == 'aarch64' else 'amd64' }}"

    - name: Install kubie
      get_url:
        url: "https://github.com/kubie-org/kubie/releases/download/v{{ kubie_version }}/kubie-linux-{{ kubie_arch }}"
        dest: /usr/local/bin/kubie
        mode: '0755'
      become: yes

    # ─── 12. Neovim ──────────────────────────────────────────────────────────────
    - name: Add Neovim stable PPA
      apt_repository:
        repo: ppa:neovim-ppa/stable
        state: present
      become: yes

    - name: Install Neovim
      apt:
        name: neovim
        state: present
        update_cache: yes
        cache_valid_time: 3600
      become: yes
      environment:
        DEBIAN_FRONTEND: noninteractive

    # ─── 12. GitHub CLI ──────────────────────────────────────────────────────────
    - name: Add GitHub CLI GPG key
      shell: |
        curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | \
          dd of=/etc/apt/keyrings/githubcli-archive-keyring.gpg
        chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg
      args:
        creates: /etc/apt/keyrings/githubcli-archive-keyring.gpg
      become: yes

    - name: Add GitHub CLI apt repository
      shell: |
        echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] \
          https://cli.github.com/packages stable main" \
          > /etc/apt/sources.list.d/github-cli.list
      args:
        creates: /etc/apt/sources.list.d/github-cli.list
      become: yes

    - name: Install GitHub CLI
      apt:
        name: gh
        state: present
        update_cache: yes
        cache_valid_time: 3600
      become: yes
      environment:
        DEBIAN_FRONTEND: noninteractive

    # ─── Git identity ────────────────────────────────────────────────────────────
    - name: Configure git user.name
      command: git config --global user.name "{{ git_user_name }}"
      changed_when: false

    - name: Configure git user.email
      command: git config --global user.email "{{ git_user_email }}"
      changed_when: false

    # ─── 13. Fish shell ──────────────────────────────────────────────────────────
    - name: Add Fish shell PPA
      apt_repository:
        repo: ppa:fish-shell/release-3
        state: present
      become: yes

    - name: Install Fish shell
      apt:
        name: fish
        state: present
        update_cache: yes
        cache_valid_time: 3600
      become: yes
      environment:
        DEBIAN_FRONTEND: noninteractive

    # Ubuntu's `bat` package installs the binary as `batcat` to avoid a naming
    # conflict with the `bacula-console-qt` package. Symlink it back to `bat`.
    - name: Create ~/.local/bin directory
      file:
        path: "{{ ansible_env.HOME }}/.local/bin"
        state: directory
        mode: '0755'

    - name: Symlink batcat to bat
      file:
        src: /usr/bin/batcat
        dest: "{{ ansible_env.HOME }}/.local/bin/bat"
        state: link

    - name: Create fish conf.d directory
      file:
        path: "{{ ansible_env.HOME }}/.config/fish/conf.d"
        state: directory
        mode: '0755'

    - name: Write fish PATH config
      copy:
        dest: "{{ ansible_env.HOME }}/.config/fish/conf.d/00-paths.fish"
        content: |
          fish_add_path -g $HOME/.local/bin
          fish_add_path -g $HOME/.npm-global/bin
          fish_add_path -g $HOME/go/bin
          fish_add_path -g /usr/local/go/bin

    - name: Get fish shell path
      command: which fish
      register: fish_path
      changed_when: false

    - name: Set fish as default shell
      user:
        name: "{{ ansible_user_id }}"
        shell: "{{ fish_path.stdout }}"
      become: yes

    # ─── Ghostty terminfo ────────────────────────────────────────────────────────
    # So tmux/less/vim work over SSH when the client is Ghostty (TERM=xterm-ghostty).
    # The terminfo source isn't published as a downloadable file by upstream;
    # generate it once on your Ghostty client with:
    #   infocmp -x xterm-ghostty > files/ghostty.terminfo
    # then commit it. If the file is missing, this section is skipped.
    - name: Check if bundled Ghostty terminfo source exists
      stat:
        path: "{{ playbook_dir }}/files/ghostty.terminfo"
      register: ghostty_terminfo_src

    - name: Check if Ghostty terminfo is already installed
      command: infocmp -x xterm-ghostty
      register: ghostty_terminfo_check
      changed_when: false
      failed_when: false
      environment:
        TERMINFO: "{{ ansible_env.HOME }}/.terminfo"
      when: ghostty_terminfo_src.stat.exists

    - name: Copy Ghostty terminfo source to /tmp
      copy:
        src: files/ghostty.terminfo
        dest: /tmp/ghostty.terminfo
      when:
        - ghostty_terminfo_src.stat.exists
        - ghostty_terminfo_check.rc != 0

    - name: Compile Ghostty terminfo into ~/.terminfo
      command: tic -x -o {{ ansible_env.HOME }}/.terminfo /tmp/ghostty.terminfo
      when:
        - ghostty_terminfo_src.stat.exists
        - ghostty_terminfo_check.rc != 0

    - name: Clean up Ghostty terminfo source
      file:
        path: /tmp/ghostty.terminfo
        state: absent
      when:
        - ghostty_terminfo_src.stat.exists
        - ghostty_terminfo_check.rc != 0

    # ─── Ensure ~/.local/bin exists (shared prereq) ──────────────────────────────
    - name: Ensure ~/.local/bin exists
      file:
        path: "{{ ansible_env.HOME }}/.local/bin"
        state: directory
        mode: '0755'

    - name: Install dev-setup script
      copy:
        src: dev-setup
        dest: "{{ ansible_env.HOME }}/.local/bin/dev-setup"
        mode: '0755'

    # ─── 14. Starship ────────────────────────────────────────────────────────────

    - name: Install Starship
      shell: curl -fsSL https://starship.rs/install.sh | sh -s -- --yes --bin-dir {{ ansible_env.HOME }}/.local/bin
      args:
        creates: "{{ ansible_env.HOME }}/.local/bin/starship"

    - name: Add Starship init to .bashrc
      lineinfile:
        path: "{{ ansible_env.HOME }}/.bashrc"
        line: 'eval "$(starship init bash)"'
        regexp: 'starship init bash'

    - name: Write fish Starship init
      copy:
        dest: "{{ ansible_env.HOME }}/.config/fish/conf.d/starship.fish"
        content: "starship init fish | source\n"
        force: no

    - name: Write Starship config
      copy:
        dest: "{{ ansible_env.HOME }}/.config/starship.toml"
        force: yes
        content: |
          add_newline = true
          command_timeout = 1000

          format = """
          $hostname\
          $username\
          $directory\
          $git_branch\
          $git_status\
          $kubernetes\
          $golang\
          $nodejs\
          $docker_context\
          $line_break\
          $character"""

          [character]
          success_symbol = "[╰─λ](bold yellow)"
          error_symbol   = "[╰─λ](bold red)"

          [hostname]
          ssh_only = false
          format = "[🖥  $hostname](bold orange) "

          [directory]
          truncation_length = 3
          style = "bold cyan"

          [git_branch]
          symbol = " "
          style = "bold purple"

          [git_status]
          style = "bold red"

          [kubernetes]
          disabled = false
          format = '[⎈ $context](bold blue) '

          [golang]
          symbol = " "

          [nodejs]
          symbol = " "

    # ─── 15. chezmoi ─────────────────────────────────────────────────────────────
    - name: Install chezmoi
      shell: sh -c "$(curl -fsLS get.chezmoi.io)" -- -b {{ ansible_env.HOME }}/.local/bin
      args:
        creates: "{{ ansible_env.HOME }}/.local/bin/chezmoi"

    - name: Add .local/bin to PATH in .bashrc
      lineinfile:
        path: "{{ ansible_env.HOME }}/.bashrc"
        line: 'export PATH="$HOME/.local/bin:$PATH"'
        regexp: '\.local/bin'

    - name: Init dotfiles with chezmoi
      command: "{{ ansible_env.HOME }}/.local/bin/chezmoi init --apply {{ dotfiles_repo }}"
      args:
        creates: "{{ ansible_env.HOME }}/.local/share/chezmoi"
      when: dotfiles_repo | length > 0

    - name: Fix tmux fish shell path (replace Nix path with system fish)
      replace:
        path: "{{ ansible_env.HOME }}/.config/tmux/tmux.conf"
        regexp: 'set-option -g default-shell .*fish'
        replace: 'set-option -g default-shell /usr/bin/fish'
      when: dotfiles_repo | length > 0
      ignore_errors: yes

    # ─── 16. just (task runner) ──────────────────────────────────────────────────
    - name: Set just architecture
      set_fact:
        just_arch: "{{ 'aarch64' if ansible_architecture == 'aarch64' else 'x86_64' }}"

    - name: Install just
      shell: |
        curl --proto '=https' --tlsv1.2 -sSf https://just.systems/install.sh | \
          bash -s -- --to /usr/local/bin --tag {{ just_version }}
      args:
        creates: /usr/local/bin/just
      become: yes

    - name: Create fish completions directory
      file:
        path: "{{ ansible_env.HOME }}/.config/fish/completions"
        state: directory
        mode: '0755'

    - name: Generate fish completions for just
      shell: /usr/local/bin/just --completions fish > {{ ansible_env.HOME }}/.config/fish/completions/just.fish
      args:
        creates: "{{ ansible_env.HOME }}/.config/fish/completions/just.fish"

    # ─── 17. lazygit ─────────────────────────────────────────────────────────────
    - name: Set lazygit architecture
      set_fact:
        lazygit_arch: "{{ 'arm64' if ansible_architecture == 'aarch64' else 'x86_64' }}"

    - name: Check if lazygit is installed
      stat:
        path: /usr/local/bin/lazygit
      register: lazygit_stat

    - name: Download and install lazygit
      shell: |
        curl -fsSL "https://github.com/jesseduffield/lazygit/releases/download/v{{ lazygit_version }}/lazygit_{{ lazygit_version }}_Linux_{{ lazygit_arch }}.tar.gz" | \
          tar -xz -C /usr/local/bin lazygit
        chmod +x /usr/local/bin/lazygit
      when: not lazygit_stat.stat.exists
      become: yes

    # ─── 18. crane ───────────────────────────────────────────────────────────────
    - name: Set crane architecture
      set_fact:
        crane_arch: "{{ 'arm64' if ansible_architecture == 'aarch64' else 'x86_64' }}"

    - name: Check if crane is installed
      stat:
        path: /usr/local/bin/crane
      register: crane_stat

    - name: Download and install crane
      shell: |
        curl -fsSL "https://github.com/google/go-containerregistry/releases/download/v{{ crane_version }}/go-containerregistry_Linux_{{ crane_arch }}.tar.gz" | \
          tar -xz -C /usr/local/bin crane
        chmod +x /usr/local/bin/crane
      when: not crane_stat.stat.exists
      become: yes

    # ─── 19. hcloud CLI ──────────────────────────────────────────────────────────
    - name: Set hcloud architecture
      set_fact:
        hcloud_arch: "{{ 'arm64' if ansible_architecture == 'aarch64' else 'amd64' }}"

    - name: Install hcloud CLI
      get_url:
        url: "https://github.com/hetznercloud/cli/releases/download/v{{ hcloud_version }}/hcloud-linux-{{ hcloud_arch }}.tar.gz"
        dest: /tmp/hcloud.tar.gz
      register: hcloud_download
      become: yes

    - name: Extract hcloud binary
      shell: |
        tar -xzf /tmp/hcloud.tar.gz -C /usr/local/bin hcloud
        chmod +x /usr/local/bin/hcloud
        rm /tmp/hcloud.tar.gz
      args:
        creates: /usr/local/bin/hcloud
      become: yes

    # ─── 20. Terraform ───────────────────────────────────────────────────────────
    - name: Add HashiCorp GPG key
      shell: |
        curl -fsSL https://apt.releases.hashicorp.com/gpg | \
          gpg --dearmor -o /etc/apt/keyrings/hashicorp.gpg
      args:
        creates: /etc/apt/keyrings/hashicorp.gpg
      become: yes

    - name: Add HashiCorp apt repository
      apt_repository:
        repo: "deb [signed-by=/etc/apt/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com {{ ansible_distribution_release }} main"
        state: present
        filename: hashicorp
      become: yes

    - name: Install Terraform
      apt:
        name: terraform
        state: present
        update_cache: yes
        cache_valid_time: 3600
      become: yes
      environment:
        DEBIAN_FRONTEND: noninteractive

    # ─── 21. Ginkgo ──────────────────────────────────────────────────────────────
    - name: Install Ginkgo
      shell: |
        export PATH="/usr/local/go/bin:$HOME/go/bin:$PATH"
        go install github.com/onsi/ginkgo/v2/ginkgo@latest
      args:
        creates: "{{ ansible_env.HOME }}/go/bin/ginkgo"
      environment:
        HOME: "{{ ansible_env.HOME }}"
        GOPATH: "{{ ansible_env.HOME }}/go"

    # ─── 22. gotestsum ──────────────────────────────────────────────────────────
    - name: Install gotestsum
      shell: |
        export PATH="/usr/local/go/bin:$HOME/go/bin:$PATH"
        go install gotest.tools/gotestsum@latest
      args:
        creates: "{{ ansible_env.HOME }}/go/bin/gotestsum"
      environment:
        HOME: "{{ ansible_env.HOME }}"
        GOPATH: "{{ ansible_env.HOME }}/go"

    # ─── 22. Playwright browser system deps (Ubuntu 24.04) ──────────────────────
    # Mirrors `npx playwright install-deps` for chromium + firefox + webkit.
    # Browsers themselves are installed per-project via `npx playwright install`.
    - name: Install Playwright browser runtime libraries
      apt:
        name:
          - fonts-liberation
          - fonts-noto-color-emoji
          - libasound2t64
          - libatk-bridge2.0-0t64
          - libatk1.0-0t64
          - libatspi2.0-0t64
          - libavif16
          - libcairo2
          - libcups2t64
          - libdbus-1-3
          - libdbus-glib-1-2
          - libdrm2
          - libenchant-2-2
          - libepoxy0
          - libevdev2
          - libflite1
          - libgbm1
          - libgles2
          - libglib2.0-0t64
          - libgstreamer-gl1.0-0
          - libgstreamer-plugins-base1.0-0
          - libgstreamer1.0-0
          - libgtk-3-0t64
          - libgudev-1.0-0
          - libharfbuzz-icu0
          - libhyphen0
          - libicu74
          - liblcms2-2
          - libmanette-0.2-0
          - libnotify4
          - libnspr4
          - libnss3
          - libopenjp2-7
          - libopus0
          - libpango-1.0-0
          - libpsl5t64
          - libsecret-1-0
          - libsoup-3.0-0
          - libvpx9
          - libwayland-client0
          - libwayland-egl1
          - libwayland-server0
          - libwebp7
          - libwebpdemux2
          - libwebpmux3
          - libwoff1
          - libx11-6
          - libx264-164
          - libxcb1
          - libxcomposite1
          - libxdamage1
          - libxext6
          - libxfixes3
          - libxkbcommon0
          - libxrandr2
          - libxshmfence1
        state: present
      become: yes
      environment:
        DEBIAN_FRONTEND: noninteractive

    # ─── 23. beads (issue tracker for coding agents) ────────────────────────────
    - name: Install beads
      shell: curl -fsSL https://raw.githubusercontent.com/steveyegge/beads/main/scripts/install.sh | bash
      args:
        creates: /usr/local/bin/bd
      become: yes

    # ─── 24. dolt (SQL database with git-like versioning) ───────────────────────
    - name: Install dolt
      shell: curl -fsSL https://github.com/dolthub/dolt/releases/latest/download/install.sh | bash
      args:
        creates: /usr/local/bin/dolt
      become: yes

    # ─── 25. AWS CLI v2 ──────────────────────────────────────────────────────────
    - name: Set AWS CLI architecture
      set_fact:
        awscli_arch: "{{ 'aarch64' if ansible_architecture == 'aarch64' else 'x86_64' }}"

    - name: Check if AWS CLI is installed
      stat:
        path: /usr/local/bin/aws
      register: awscli_stat

    - name: Download AWS CLI v2 bundle
      get_url:
        url: "https://awscli.amazonaws.com/awscli-exe-linux-{{ awscli_arch }}.zip"
        dest: /tmp/awscliv2.zip
      when: not awscli_stat.stat.exists

    - name: Extract AWS CLI v2 bundle
      unarchive:
        src: /tmp/awscliv2.zip
        dest: /tmp
        remote_src: yes
      when: not awscli_stat.stat.exists

    - name: Run AWS CLI v2 installer
      command: /tmp/aws/install
      when: not awscli_stat.stat.exists
      become: yes

    - name: Clean up AWS CLI installer files
      file:
        path: "{{ item }}"
        state: absent
      loop:
        - /tmp/awscliv2.zip
        - /tmp/aws
      when: not awscli_stat.stat.exists

    # ─── 26. Infisical CLI ───────────────────────────────────────────────────────
    - name: Add Infisical GPG key
      shell: |
        install -m 0755 -d /etc/apt/keyrings
        curl -fsSL https://artifacts-cli.infisical.com/infisical.gpg | \
          gpg --dearmor -o /etc/apt/keyrings/infisical-archive-keyring.gpg
        chmod a+r /etc/apt/keyrings/infisical-archive-keyring.gpg
      args:
        creates: /etc/apt/keyrings/infisical-archive-keyring.gpg
      become: yes

    - name: Add Infisical apt repository
      shell: |
        echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/infisical-archive-keyring.gpg] \
          https://artifacts-cli.infisical.com/deb stable main" \
          > /etc/apt/sources.list.d/infisical.list
      args:
        creates: /etc/apt/sources.list.d/infisical.list
      become: yes

    - name: Install Infisical CLI
      apt:
        name: "infisical={{ infisical_version }}"
        state: present
        update_cache: yes
        allow_downgrade: yes
      become: yes
      environment:
        DEBIAN_FRONTEND: noninteractive

    # ─── 27. Argo CD CLI ─────────────────────────────────────────────────────────
    - name: Set argocd architecture
      set_fact:
        argocd_arch: "{{ 'arm64' if ansible_architecture == 'aarch64' else 'amd64' }}"

    - name: Install Argo CD CLI
      get_url:
        url: "https://github.com/argoproj/argo-cd/releases/latest/download/argocd-linux-{{ argocd_arch }}"
        dest: /usr/local/bin/argocd
        mode: '0555'
      become: yes

    # ─── 28. PR-review workflow (gh aliases + fish functions) ───────────────────
    - name: Get current gh aliases
      command: gh alias list
      register: gh_aliases
      changed_when: false
      failed_when: false

    - name: Add gh prview alias (side-by-side delta diff)
      command: gh alias set prview --shell 'gh pr diff "$1" | delta --side-by-side'
      when: "'prview:' not in gh_aliases.stdout"

    - name: Add gh prmerge alias (squash + auto-merge + delete branch)
      command: gh alias set prmerge 'pr merge -s -d --auto'
      when: "'prmerge:' not in gh_aliases.stdout"

    - name: Ensure fish functions directory exists
      file:
        path: "{{ ansible_env.HOME }}/.config/fish/functions"
        state: directory
        mode: '0755'

    - name: Install fish PR-review functions
      copy:
        dest: "{{ ansible_env.HOME }}/.config/fish/functions/{{ item.name }}.fish"
        content: "{{ item.body }}"
        mode: '0644'
      loop:
        - name: prview
          body: |
            function prview
                gh pr diff $argv[1] | delta --side-by-side
            end
        - name: prmerge
          body: |
            function prmerge
                gh pr merge $argv[1] -s -d --auto
            end
        - name: prs
          body: |
            function prs
                gh pr list $argv
            end