fix(roles): refresh apt cache before upgrade on Debian

CHANGELOG.md

@@ -38,6 +38,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+* **role:php**: The `php:update` tag now refreshes the apt cache before the upgrade on Debian-family hosts, so it reliably installs the latest packages (e.g. to roll out security updates) instead of running against a stale cache. RHEL-family hosts are unaffected, since dnf refreshes its metadata on its own.
+* **role:monitoring_plugins**: The role now refreshes the apt cache before installing the monitoring-plugins package on Debian-family hosts, so it reliably installs the latest version (e.g. to roll out security updates) instead of running against a stale cache. RHEL-family hosts are unaffected, since dnf refreshes its metadata on its own.
+* **role:mariadb_server**: The `mariadb_server:upgrade` tag now refreshes the apt cache before the upgrade on Debian-family hosts, so it reliably installs the latest packages (e.g. to roll out security updates) instead of running against a stale cache. RHEL-family hosts are unaffected, since dnf refreshes its metadata on its own.
 * **role:python_venv**: Install `python3-packaging` on EL10 (RHEL/Rocky/Alma 10). EL10 ships Python 3.12, which dropped the stdlib `distutils`, so Ansible's `pip` module needs the external `packaging` library to run. Without it, creating a venv (e.g. during `setup_basic`) failed.
 * **role:icingaweb2_module_vspheredb**: Download the module tarball from the canonical `archive/refs/tags/<version>.tar.gz` URL instead of `archive/<version>.tar.gz`, so the pinned release tag is fetched reliably.
 * **role:monitoring_plugins**: A source install now deploys the sudoers drop-in as `/etc/sudoers.d/linuxfabrik-monitoring-plugins`, the same file name the rpm/deb packages use. Both install methods remove the drop-in under the former name `/etc/sudoers.d/monitoring-plugins`, so sudo no longer warns about a duplicate `Cmnd_Alias` on hosts that got the drop-in twice (for example after switching the install method or after running the monitoring-plugins one-liner installer).

roles/mariadb_server/tasks/main.yml

@@ -42,6 +42,16 @@
         - 'mariadb-server'
       state: 'absent'
 
+  # refresh the apt cache so the following `state: latest` upgrade resolves
+  # against current metadata, e.g. to roll out security updates. apt does not
+  # auto-expire its cache the way dnf does, so without this the upgrade can
+  # silently run against a stale cache and miss newer versions.
+  - name: 'apt update # update the cache'
+    ansible.builtin.apt:
+      update_cache: true
+    changed_when: false # refreshing the package cache is not a config change
+    when: 'ansible_facts["os_family"] == "Debian"'
+
   - name: 'Install latest mariadb-server' # noqa package-latest (latest is necessary for upgrade)
     ansible.builtin.package:
       name:

roles/monitoring_plugins/tasks/linux-package.yml

@@ -21,6 +21,16 @@
 
 - block:
 
+  # refresh the apt cache so the following `state: latest` upgrade resolves
+  # against current metadata, e.g. to roll out security updates. apt does not
+  # auto-expire its cache the way dnf does, so without this the upgrade can
+  # silently run against a stale cache and miss newer versions.
+  - name: 'apt update # update the cache'
+    ansible.builtin.apt:
+      update_cache: true
+    changed_when: false # refreshing the package cache is not a config change
+    when: 'ansible_facts["os_family"] == "Debian"'
+
   - name: 'install linuxfabrik-monitoring-plugins{{ __monitoring_plugins__package_version_separator }}{{ monitoring_plugins__version }}*' # noqa package-latest
     ansible.builtin.package:
       name:

roles/php/tasks/main.yml

@@ -27,6 +27,16 @@
 
 - block:
 
+  # refresh the apt cache so the following `state: latest` upgrade resolves
+  # against current metadata, e.g. to roll out security updates. apt does not
+  # auto-expire its cache the way dnf does, so without this the upgrade can
+  # silently run against a stale cache and miss newer versions.
+  - name: 'apt update # update the cache'
+    ansible.builtin.apt:
+      update_cache: true
+    changed_when: false # refreshing the package cache is not a config change
+    when: 'ansible_facts["os_family"] == "Debian"'
+
   - name: 'Update php php-fpm composer' # noqa package-latest (we explicitly want latest here)
     ansible.builtin.package:
       name:
@@ -88,6 +98,16 @@
     ansible.builtin.debug:
       var: 'php__modules__combined_var'
 
+  # refresh the apt cache so the following `state: latest` upgrade resolves
+  # against current metadata, e.g. to roll out security updates. apt does not
+  # auto-expire its cache the way dnf does, so without this the upgrade can
+  # silently run against a stale cache and miss newer versions.
+  - name: 'apt update # update the cache'
+    ansible.builtin.apt:
+      update_cache: true
+    changed_when: false # refreshing the package cache is not a config change
+    when: 'ansible_facts["os_family"] == "Debian"'
+
   - name: 'Update PHP modules' # noqa package-latest (we explicitly want latest here)
     # providing the packages as a list is much more faster than looping for each
     ansible.builtin.package: