From a security perspective, I don't like the idea of relying only on Git tags, as they could be moved later. Unfortunately, I'm not aware of an official solution to enforce checks.
This is the best that I could come up with:
# requirements.yaml: - src: git+https://github.com/geerlingguy/ansible-role-nodejs.git version: 405a113ccbde0c99614f6f815fb4285cb742ad25 # == release 5.0.0 name: geerlingguy.nodejs.trusted_hash
And in the playbook, use it as:
- roles: - role: geerlingguy.nodejs.trusted_hash nodejs_version: "12.x"
It works, but feels a bit overly complicated. Is there an easier way?