# platform = multi_platform_rhel,multi_platform_fedora,multi_platform_ol,multi_platform_almalinux,multi_platform_rhv,multi_platform_sle
# reboot = true
# strategy = restrict
# complexity = medium
# disruption = low


- name: Check mitigations=off argument exists
  ansible.builtin.command: grep -E '^GRUB_CMDLINE_LINUX=.*mitigations=off=?.*"' /etc/default/grub
  check_mode: False
  failed_when: False
  changed_when: False
  register: argcheck

- name: Replace existing mitigations=off argument
  ansible.builtin.replace:
      path: /etc/default/grub
      regexp: (^GRUB_CMDLINE_LINUX=\".*)mitigations=off(\s|=[0-9a-zA-Z]+)?(.*\")
      replace: '\1 \3'
  when: argcheck is not skipped and argcheck.rc == 0


- name: Check if mitigations=off argument is already present in /etc/default/grub
  ansible.builtin.slurp:
    src: /etc/default/grub
  register: etc_default_grub

- name: Check if mitigations=off argument is present
  ansible.builtin.command: /sbin/grubby --info=ALL
  register: grubby_info
  check_mode: False
  changed_when: False
  failed_when: False

- name: Update grub defaults and the bootloader menu
  ansible.builtin.command: /sbin/grubby --update-kernel=ALL --remove-args="mitigations=off"
  when: (grubby_info.stdout is search('mitigations=off')) or ((etc_default_grub['content'] | b64decode) is search('mitigations=off'))
