ansible/tasks/dist_upgrade_debian.yml

# vim:ts=2:sw=2:et:filetype=ansible
---
- name: Perform dist-upgrade
  ansible.builtin.apt:
    upgrade: dist
    update_cache: true

- name: Check restart status
  ansible.builtin.command:
    cmd: /usr/sbin/needrestart -pk
  register: restart_status
  check_mode: false # Need to have this working in check mode
  changed_when: restart_status.rc != 0
  failed_when: restart_status.rc > 2
  ignore_errors: true # non zero exit code does not mean "failure" but "action needed"

- name: Show results of needrestart / check_restart_required
  ansible.builtin.debug:
    verbosity: 1
    var: restart_status.stdout_lines

- name: Restart system when allowed
  import_tasks: tasks/reboot_system.yml
  when: restart_status.rc > 0

- name: Clean after dist-upgrade
  ansible.builtin.apt:
    autoremove: yes