Async roles appear to invert changed status using "changed_when: not <async_result>.changed"

[BigT-77]

Collection: infra.aap_configuration
Version: 4.8.2

Observed behavior:

Several async-enabled roles appear to invert Ansible change reporting.

Example:

roles/gateway_authenticators/tasks/main.yml

contains:

register: __gateway_authenticators_job_async
changed_when: not __gateway_authenticators_job_async.changed

Testing performed:

1. Disable authenticator in AAP UI.
2. Run role.
3. Authenticator is successfully re-enabled.
4. Task reports OK instead of CHANGED.

After changing:

changed_when: not __gateway_authenticators_job_async.changed

to:

changed_when: __gateway_authenticators_job_async.changed

the task correctly reports CHANGED when drift exists and OK when no changes are required.

Additionally, check mode fails because the role uses async:

check mode and async cannot be used on same task

Environment:

AAP Version: 4.7.11
infra.aap_configuration: 4.8.2

The issue appears to affect many roles.

[BigT-77]

To check for the issue:
grep -R "changed_when: not .*changed" \
collections/ansible_collections/infra/aap_configuration/roles

To fix it:
find collections/ansible_collections/infra/aap_configuration/roles \
-type f \
-name ".yml" \
-exec sed -i 's/changed_when: not (..changed)/changed_when: \1/g' {} +

[myllynen]

This was fixed recently with this commit and included in the 4.7.0 release (there is no version 4.8.2):

45f842b

However, it looks like some changes go unreported after that so this might be needed, discussion still ongoing:

#1391

Thanks.

[BigT-77]

Thanks @myllynen.

Sorry about that.. the 4.8.2 was in ref to ansible.controller.

Here is what I am using:

Collection Version

---

ansible.controller 4.8.2
ansible.eda 2.12.1
ansible.hub 1.0.6
ansible.platform 2.7.20260615
infra.aap_configuration 4.6.1

PS.

I also notice when updating my ansible_base.authentication.authenticator_plugins.azuread, SECRET value.. a change is always reported when I have my var set like this:
vault_azuread_client_secret: "the_actual_secret"

If I set it like this below, then no chg is reported and keeps what was set previously:
vault_azuread_client_secret: "$encrypted$"

I would think there should be better detection to see if "the_actual_secret" is what's set or not.

Any comments on this?

Thx again.

[myllynen]

My understanding is that secret updates always report changes because there is no mechanism the verify whether a secret was updated or not. This is because once a secret is created/updated the API only returns that special '$encrypted$' string so no state change check is possible.

I think your second example is a corner case which seems to work by accident, the API returns the special string which happens to match your secret and that then gets reported as unchanged result.

[BigT-77]

Ok thx for the feedback.