---
- name: "Maintenance | Patch operating system"
  hosts: all
  gather_facts: true

  tasks:
    - name: "Debian | Update package cache and upgrade packages"
      when: ansible_facts['os_family'] == 'Debian'
      ansible.builtin.apt:
        update_cache: true
        upgrade: dist

    - name: "RedHat | Upgrade installed packages"
      when: ansible_facts['os_family'] == 'RedHat'
      ansible.builtin.dnf:
        name: '*'
        state: latest

    - name: "Windows | Install available updates"
      when: ansible_facts['os_family'] == 'Windows'
      ansible.windows.win_updates:
        category_names:
          - CriticalUpdates
          - SecurityUpdates
          - UpdateRollups
          - Updates
        reboot: false
      register: windows_updates

    - name: "Windows | Report reboot requirement"
      when:
        - ansible_facts['os_family'] == 'Windows'
        - windows_updates.reboot_required | default(false)
      ansible.builtin.debug:
        msg: "Windows updates were installed and a reboot is required. No reboot was performed."