Roles only run on intended supported OS, and minor cleanup of when statements to match

roles/ensure_selinux/tasks/main.yml

@@ -1,7 +1,17 @@
 ---
 # tasks file for ensure_selinux
+- name: Assert Target OS Is Supported
+  when:
+    - ansible_facts["system"] is defined
+  ansible.builtin.assert:
+    fail_msg: "Unsupported OS: {{ ansible_facts['distribution'] | default('unknown') }}"
+    quiet: true
+    that:
+      - ansible_facts["system"] == 'Linux'
+      - >-
+        ansible_facts["distribution"] in ['AlmaLinux', 'CentOS', 'Fedora',
+        'OracleLinux', 'Rocky']
 - name: Include Variables
-  when: ["ansible_facts[\"system\"] == 'Linux'"]
   ansible.builtin.include_vars:
     file: '{{ lookup("first_found", findme) }}'
     name: ensure_selinux
@@ -23,17 +33,14 @@
       errors: ignore
 - name: Package Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["packages"] is not defined
   ansible.builtin.package_facts:
 - name: Service Discovery
   when:
-    - ansible_facts["system"] == 'Linux'
     - ansible_facts["services"] is not defined
   ansible.builtin.service_facts:
 - name: Ensure Packages
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_selinux is defined
     - ensure_selinux.package_list is defined
     - ensure_selinux.package_list is iterable
@@ -46,7 +53,6 @@
   notify: [Ensure_Selinux.Package_Facts, Ensure_Selinux.Service_Facts]
 - name: Ensure Configurations
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_selinux is defined
     - ensure_selinux.template_list is defined
     - ensure_selinux.template_list is iterable
@@ -56,7 +62,7 @@
     group: '{{ item.group | default(omit) }}'
     mode: '{{ item.mode | default(omit) }}'
     owner: '{{ item.owner | default(omit) }}'
-    selevel: '{{ iteml.selevel | default(omit) }}'
+    selevel: '{{ item.selevel | default(omit) }}'
     serole: '{{ item.serole | default(omit) }}'
     setype: '{{ item.setype | default(omit) }}'
     seuser: '{{ item.seuser | default(omit) }}'
@@ -71,7 +77,6 @@
     - Ensure_Selinux.Service_Restart
 - name: Ensure Services
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_selinux is defined
     - ensure_selinux.service_list is defined
     - ensure_selinux.service_list is iterable
@@ -85,7 +90,6 @@
   notify: [Ensure_Selinux.Package_Facts, Ensure_Selinux.Service_Facts]
 - name: Ensure Selinux Is Configured
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_selinux is defined
     - ensure_selinux.selinux_policy is defined
     - ensure_selinux.selinux_state is defined
@@ -95,7 +99,6 @@
   register: ensure_selinux_results
 - name: Reboot If Required
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_selinux is defined
     - ensure_selinux.selinux_policy is defined
     - ensure_selinux.selinux_state is defined
@@ -105,7 +108,6 @@
   ansible.builtin.reboot:
 - name: Ensure Seboolean
   when:
-    - ansible_facts["system"] == 'Linux'
     - ensure_selinux is defined
     - ensure_selinux.seboolean_list is defined
     - ensure_selinux.seboolean_list is iterable
@@ -118,3 +120,13 @@
     label: '{{ item.name }} will be {{ item.state }}'
 - name: Flush Handlers
   ansible.builtin.meta: flush_handlers
+- name: Assert SELinux Policy And State
+  when:
+    - ensure_selinux is defined
+    - ensure_selinux.selinux_state is defined
+  ansible.builtin.assert:
+    fail_msg: "SELinux state mismatch"
+    quiet: true
+    that:
+      - ansible_facts["selinux"] is defined
+      - ansible_facts["selinux"]["status"] == 'enabled' or ensure_selinux.selinux_state == 'disabled'