---
- name: Check pending apt updates without upgrading
  hosts: all
  gather_facts: false
  become: false
  tasks:
    - name: Check apt upgradable packages
      ansible.builtin.shell: |
        set -o pipefail
        apt list --upgradable 2>/dev/null | sed '1d' || true
      args:
        executable: /bin/bash
      register: apt_upgradable
      changed_when: false

    - name: Count upgradable packages
      ansible.builtin.set_fact:
        upgradable_count: "{{ apt_upgradable.stdout_lines | length }}"

    - name: Report update summary
      ansible.builtin.debug:
        msg:
          host: "{{ inventory_hostname }}"
          update_class: "{{ update_class | default('unset') }}"
          upgradable_count: "{{ upgradable_count }}"
          first_packages: "{{ apt_upgradable.stdout_lines[:10] }}"
