From a security perspective, I don't like the idea of relying only on Git tags, as they could be moved later. Unfortunately, I'm not aware of an official solution to enforce checks.
This is the best that I could come up with:
# requirements.yaml:
- src: git+https://github.com/geerlingguy/ansible-role-nodejs.git
version: 405a113ccbde0c99614f6f815fb4285cb742ad25 # == release 5.0.0
name: geerlingguy.nodejs.trusted_hash
And in the playbook, use it as:
- roles:
- role: geerlingguy.nodejs.trusted_hash
nodejs_version: "12.x"
It works, but feels a bit overly complicated. Is there an easier way?