feat(playbooks): check AIDE before and update its database after every run

[NavidSassan]

With the aide role in setup_basic, nearly every LFOps run changes monitored files, so the next AIDE check fails and someone has to read the log and update the database by hand. This makes the update part of every playbook run, without accepting a finding that was pending before it.

Changes

• all playbooks: two new shared imports, the same in each of the 157 playbooks.
  • pre_tasks: aide-check-before-run.yml. On a host with an active aidecheck.timer, the run stops for that host if aidecheck.service is failed, naming --tags aide:update_db_force as the remedy. A running check is waited for (5 minutes). If an update is pending (request file present or aide-update.service activating), the run passes without checking.
  • post_tasks: aide-update-db-after-run.yml. Only if the check before the run passed: touches /run/aide-update.request and starts aide-update.service with --no-block, so the play does not wait.
  • Skipped under --tags aide:update_db_force, in check mode, and on Windows.
• role:aide: deploys aide-update.service and /usr/local/sbin/aide-update. The script loops: remove the request, aide --update under /run/aide.lock, systemctl start --wait aidecheck.service, repeat while a new request exists. A start request for the running oneshot unit is merged into its job by systemd, so the request file is what keeps a play that ends during an update from being lost. Contract for callers: request an update only after a clean check.
• LFOps-wide variables: lfops__skip_aide_check_before_run (deploy to a host with a pending finding; the database is then not updated after the run either) and lfops__skip_aide_update_db_after_run (keep the check, leave the database alone).
• Docs: root README (both variables), aide README (behaviour, tags, troubleshooting entry for the stopped run), CONTRIBUTING playbook template, CHANGELOG.

The update accepts everything that changed since the last clean check, not only the changes of the run, the same trade-off the role's handler and aide:update_db already make. A failed run gets no update, so its changes are reported and the next run stops until they are accepted.

Tests

Molecule aide scenario on Rocky 8, 9 and 10, Debian 12 and 13, Ubuntu 22.04, 24.04 and 26.04: converge, verify, idempotence (0 changed), verify all green. Re-run on Rocky 8 and Debian 13 after renaming the unit to aide-update. New play in verify.yml:

• One run from a clean check: the change is accepted, the request file is gone, the check afterwards is clean.
• Two runs back to back while a transient unit holds /run/aide.lock: the second run passes on the pending update, and the journal shows two updates, the second one for the second run's request.
• A failed check stops the run at the assert.
• lfops__skip_aide_check_before_run: the run continues, the database is unchanged.
• lfops__skip_aide_update_db_after_run: the check passes, the database is unchanged.

Not run: the setup_basic scenario. On Rocky it fails the AIDE check because of the stale .pyc files in the monitoring-plugins v8.0.0 package (fixed upstream, not released), and with this change its idempotence run now stops at the check before the run.

Open

• The abort message says ansible-navigator, the READMEs say ansible-playbook.