Introduce "asdf" Ansible task, install terraform and kubectl with asdf

[bubacoder]

Summary by CodeRabbit

• New Features

  • Added asdf-based version management for Terraform and kubectl with pinned versions (Terraform 1.14.3, kubectl 1.32.0).

• Chores

  • Removed Terraform from Homebrew installation; now managed via asdf.
  • Cleaned up unused Homebrew repository entries.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 66bbf369-2f7b-4fb0-b2d0-64c73533c472

📥 Commits

Reviewing files that changed from the base of the PR and between c09a6e6 and d8272fd.

📒 Files selected for processing (8)

• ansible/inventory/group_vars/debian/vars.yaml
• ansible/inventory/group_vars/mac/vars.yaml
• ansible/roles/common/tasks/asdf.yaml
• ansible/roles/debian_tools/tasks/20-homebrew.yaml
• ansible/roles/debian_tools/tasks/main.yaml
• ansible/roles/mac_base/tasks/20-homebrew.yaml
• ansible/roles/mac_base/tasks/30-user.yaml
• ansible/roles/mac_base/tasks/main.yaml

💤 Files with no reviewable changes (1)

• ansible/roles/debian_tools/tasks/20-homebrew.yaml

🚧 Files skipped from review as they are similar to previous changes (2)

• ansible/inventory/group_vars/mac/vars.yaml
• ansible/inventory/group_vars/debian/vars.yaml

---

Walkthrough

A new shared Ansible task file (ansible/roles/common/tasks/asdf.yaml) is introduced to manage asdf plugin installation, version pinning, and global version configuration idempotently. Both mac_base and debian_tools roles are updated to declare asdf_tools inventory variables for Terraform and kubectl, wire in the shared task, and remove the Homebrew hashicorp/tap delivery path.

Changes

asdf Tool Management for macOS and Debian

Layer / File(s)	Summary
Inventory variables: asdf tool definitions and Homebrew cleanup ansible/inventory/group_vars/mac/vars.yaml, ansible/inventory/group_vars/debian/vars.yaml	Adds mac_base_asdf_tools and debian_tools_asdf_tools lists with pinned Terraform and kubectl versions (including renovate directives); removes hashicorp/tap/terraform from the Debian Homebrew package list and drops stale asdf comments from the macOS Homebrew tools block.
Shared asdf task file: plugin add, install, and global version ansible/roles/common/tasks/asdf.yaml	New file with three idempotent tasks looping over asdf_tools: adds each asdf plugin (suppressing "already added" output via changed_when/failed_when), installs the pinned version (suppressing "already installed"), and writes each global version to ~/.tool-versions via lineinfile; all tasks run without privilege escalation and prepend asdf_brew_bin_path to PATH.
Role entry point wiring and Homebrew tap cleanup ansible/roles/mac_base/tasks/main.yaml, ansible/roles/debian_tools/tasks/main.yaml, ansible/roles/debian_tools/tasks/20-homebrew.yaml	Wires the shared asdf task into mac_base/tasks/main.yaml (new asdf include, Homebrew task renamed to 20-homebrew.yaml, user task renamed to 30-user.yaml) and debian_tools/tasks/main.yaml (conditional include when debian_tools_asdf_tools is defined); removes hashicorp/tap from the Homebrew taps list.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly and specifically describes the main changes: introducing an asdf Ansible task and using it to install terraform and kubectl.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/ansible-asdf

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ansible/roles/debian_tools/tasks/30-asdf.yaml`:
- Around line 29-36: The "Set global versions via asdf" task has `changed_when:
true` which forces it to always report as changed, breaking idempotency and
causing unnecessary noise in playbook runs. Replace this hardcoded
`changed_when: true` with a conditional that actually detects whether the asdf
version setting operation made a real change, such as by checking the command's
return code or output to determine if the version was actually modified or if it
was already set to the desired version.

In `@ansible/roles/debian_tools/tasks/main.yaml`:
- Around line 13-16: The "Install tools via asdf" task's when condition
incorrectly checks for the debian_tools_brew_install_groups variable, which is
unrelated to asdf configuration. Update the when condition to check
debian_tools_asdf_tools is defined instead, since the included 30-asdf.yaml file
loops over that variable. This ensures the asdf include task is only executed
when asdf tools are actually configured, decoupling it from the unrelated
Homebrew variable.

In `@ansible/roles/mac_base/tasks/30-asdf.yaml`:
- Around line 29-36: The "Set global versions via asdf" task uses changed_when:
true which unconditionally marks the task as changed on every run, breaking
idempotency. Replace the changed_when: true statement with a proper condition
that checks the actual output or return code from the asdf set command to
determine if the version was actually changed or was already set, ensuring the
task only reports as changed when the version actually differs from what was
previously set.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 54f65284-76fe-41e7-9460-7d33166d897f

📥 Commits

Reviewing files that changed from the base of the PR and between 9714a86 and c09a6e6.

📒 Files selected for processing (9)

• ansible/inventory/group_vars/debian/vars.yaml
• ansible/inventory/group_vars/mac/vars.yaml
• ansible/roles/debian_tools/tasks/20-homebrew.yaml
• ansible/roles/debian_tools/tasks/30-asdf.yaml
• ansible/roles/debian_tools/tasks/main.yaml
• ansible/roles/mac_base/tasks/20-homebrew.yaml
• ansible/roles/mac_base/tasks/30-asdf.yaml
• ansible/roles/mac_base/tasks/40-user.yaml
• ansible/roles/mac_base/tasks/main.yaml

💤 Files with no reviewable changes (1)

• ansible/roles/debian_tools/tasks/20-homebrew.yaml