Force updated caches for OS patching. Just because it works without it for Fedora, doesn't mean that was safe for Debian based OS or even some EL based OS.

collections/requirements.yml

@@ -1,6 +1,7 @@
 ---
 collections:
   - name: 'ansible.netcommon'
+  - name: 'ansible.mysql'
   - name: 'ansible.posix'
   - name: 'ansible.windows'
   - name: 'awx.awx'

roles/ensure_apache/tasks/main.yml

@@ -172,8 +172,8 @@
   ansible.builtin.file:
     path: '/srv/http/{{ item.fqdn }}'
     state: 'directory'
-    owner: 'apache'
-    group: 'apache'
+    owner: 'root'
+    group: 'root'
     mode: '0755'
     setype: 'httpd_sys_content_t'
   loop: '{{ http_vhost }}'

roles/ensure_os_patch/tasks/main.yml

@@ -51,17 +51,30 @@
   ansible.builtin.apt:
     autoclean: 'yes'
     autoremove: 'yes'
+    update_cache: 'yes'
     upgrade: 'dist'
   notify:
     - 'ensure_os_patch.package_facts'
     - 'ensure_os_patch.service_facts'
-- name: 'ensure dnf or yum patch'
+- name: 'ensure dnf'
   when:
     - ansible_facts["system"] == 'Linux'
-    - ansible_facts["pkg_mgr"] == 'dnf' or ansible_facts["pkg_mgr"] == 'dnf5' or ansible_facts["pkg_mgr"] == 'yum'
-  ansible.builtin.package:
+    - ansible_facts["pkg_mgr"] == 'dnf'
+  ansible.builtin.dnf:
     name: '*'
     state: 'latest'
+    update_cache: 'yes'
+  notify:
+    - 'ensure_os_patch.package_facts'
+    - 'ensure_os_patch.service_facts'
+- name: 'ensure dnf5'
+  when:
+    - ansible_facts["system"] == 'Linux'
+    - ansible_facts["pkg_mgr"] == 'dnf5'
+  ansible.builtin.dnf5:
+    name: '*'
+    state: 'latest'
+    update_cache: 'yes'
   notify:
     - 'ensure_os_patch.package_facts'
     - 'ensure_os_patch.service_facts'