upgrade-playbooks

Update Playbooks

Close the drift between each install task in playbooks/roles/*/tasks/main.yml and the upstream docs it cites, then commit per tool.

Drift takes three forms, and all three are read off the same page — the # comment URL above the task:

• Version drift — the pin trails the newest release of its release line.
• Method drift — upstream now recommends a different way to install.
• Link drift — the doc URL itself moved.

A release line is the version prefix a project treats as a stable series: Node 24.x, Python 3.14.x, kubectl 1.35.x. Every bump stays inside the line (24.15.0 -> 24.18.0 is in-line for Node because Node's line is the major). When a newer line exists (Node 26, Python 3.15, kubectl 1.36), keep the pin on its current line and report the newer line in the final summary so the user can decide.

Two pins live outside the roles and answer to a different source of truth — playbooks/collections/requirements.yml, covered in §4, and CI's ansible-lint action, covered in §5.

1. Scan

grep -rn -E '^# https?://|^- name:' playbooks/roles/*/tasks/main.yml

Adjacent line numbers pair each URL with the task it documents. Done when every install task is listed with its role, its doc URL, and any version pinned in its name, command body, or download URL.

2. Read the upstream docs

Fetch each doc URL once and take all three answers off that one page:

• newest tag inside the release line — gh api repos/OWNER/REPO/releases --jq '.[].tag_name' for a github.com/OWNER/REPO link, WebFetch otherwise.
• the install commands the page currently recommends for macOS — quote them verbatim, including which method the page calls recommended when it ranks them.
• where the URL lands — curl -sIL -o /dev/null -w '%{http_code} %{url_effective}\n' URL.

Done when every task has today's version, install commands, and final URL confirmed from its page. Anything recalled from training data is stale by definition.