fix: allow ${distro_codename}-security on Debian bookworm

Signed-off-by: Norman Ziegner <norman.ziegner@ufz.de>

tasks/unattended-upgrades.yml

@@ -1,12 +1,13 @@
 ---
 - name: "Add distribution-specific variables"
-  ansible.builtin.include_vars: "{{ ansible_distribution }}.yml"
-
-- name: "Add Debian Bullseye workaround"
-  ansible.builtin.include_vars: "{{ ansible_distribution }}-{{ ansible_distribution_release }}.yml"
-  when:
-    - "ansible_distribution == 'Debian'"
-    - "ansible_distribution_release == 'bullseye'"
+  ansible.builtin.include_vars: "{{ lookup('ansible.builtin.first_found', params) }}"
+  vars:
+    params:
+      files:
+        - "{{ ansible_distribution }}-{{ ansible_distribution_release }}.yml"
+        - "{{ ansible_distribution }}.yml"
+      paths:
+        - 'vars'
 
 - name: "Install powermgmt-base"
   ansible.builtin.apt:

vars/Debian-bullseye.yml

@@ -1,9 +0,0 @@
----
-# From https://metadata.ftp-master.debian.org/changelogs//main/u/unattended-upgrades/unattended-upgrades_2.8_changelog
-#  Allow both ${distro_codename} or ${distro_codename}-security on Debian
-#  as security update codenames. The latter will be used starting with
-#  Bullseye, but to help backporting and testing the configuration file keeps
-#  working on Buster and older releases. (Closes: #933138)
-__unattended_origins_patterns:
-  - 'origin=Debian,codename=${distro_codename},label=Debian-Security'
-  - 'origin=Debian,codename=${distro_codename}-security,label=Debian-Security'

vars/Debian-buster.yml

@@ -0,0 +1,3 @@
+---
+__unattended_origins_patterns:
+  - 'origin=Debian,codename=${distro_codename},label=Debian-Security'

vars/Debian.yml

@@ -1,3 +1,9 @@
 ---
+# From https://metadata.ftp-master.debian.org/changelogs//main/u/unattended-upgrades/unattended-upgrades_2.8_changelog
+#  Allow both ${distro_codename} or ${distro_codename}-security on Debian
+#  as security update codenames. The latter will be used starting with
+#  Bullseye, but to help backporting and testing the configuration file keeps
+#  working on Buster and older releases. (Closes: #933138)
 __unattended_origins_patterns:
   - 'origin=Debian,codename=${distro_codename},label=Debian-Security'
+  - 'origin=Debian,codename=${distro_codename}-security,label=Debian-Security'