use deb833 module

tasks/apt.yml

@@ -62,17 +62,62 @@
 
       when: ( php_gpg_file.stat.exists | bool )
 
+    - name: Stat PHP repository sources file
+      ansible.builtin.stat:
+        path: /etc/apt/sources.list.d/php.sources
+      register: php_sources_path
+
+    - name: Read the PHP repository sources file
+      ansible.builtin.include_tasks: sources_file.yml
+      when: php_sources_path.stat.exists | bool
+
+    - name: Set a fact for the prior PHP repository sources file contents
+      ansible.builtin.set_fact:
+        php_sources_contents_prior: "{{ php_sources_contents }}"
+      when: php_sources_contents is defined
+
     - name: PHP repository sources file present
-      ansible.builtin.template:
-        src: php.sources.j2
-        dest: /etc/apt/sources.list.d/php.sources
-        mode: "0644"
-        owner: root
-        group: root
-      environment:
-        DEFAULT_MANAGED_STR: "{{ php_ansible_managed }}"
+      ansible.builtin.deb822_repository:
+        allow_downgrade_to_insecure: false
+        allow_insecure: false
+        allow_weak: false
+        architectures: "{{ ansible_facts.ansible_local.dpkg.arch }}"
+        check_date: true
+        check_valid_until: true
+        components: main
+        enabled: true
+        name: php
+        signed_by: /etc/apt/keyrings/php.gpg
+        suites: "{{ ansible_distribution_release }}"
+        types: deb
+        uris: https://packages.sury.org/php/
       register: php_sources
 
+    - name: Stat PHP repository sources file
+      ansible.builtin.stat:
+        path: /etc/apt/sources.list.d/php.sources
+      register: php_sources_path
+
+    - name: Read the PHP repository sources file
+      ansible.builtin.include_tasks: sources_file.yml
+      when: php_sources_path.stat.exists | bool
+
+    - name: Set a fact for the updated PHP repository sources file contents
+      ansible.builtin.set_fact:
+        php_sources_contents_updated: "{{ php_sources_contents }}"
+      when: php_sources_contents is defined
+
+    - name: Diff PHP repository sources file update
+      ansible.utils.fact_diff:
+        before: "{{ php_sources_contents_prior }}"
+        after: "{{ php_sources_contents_updated }}"
+      check_mode: false
+      changed_when: false
+      when:
+        - php_sources_contents_prior is defined
+        - php_sources_contents_updated is defined
+        - php_sources_contents_prior != php_sources_contents_updated
+
     - name: PHP apt preferences present
       ansible.builtin.template:
         src: php.pref.j2

tasks/sources_file.yml

+# Copyright 2019-2024 Chris Croome
+#
+# This file is part of the Webarchitects PHP Ansible role.
+#
+# The Webarchitects PHP Ansible role is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
+#
+# The Webarchitects PHP Ansible role is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along with the Webarchitects PHP Ansible role. If not, see <https://www.gnu.org/licenses/>.
+---
+- name: Read the PHP repository sources file
+  block:
+
+    - name: Slurp /etc/apt/sources.list.d/php.sources
+      ansible.builtin.slurp:
+        src: /etc/apt/sources.list.d/php.sources
+      register: php_sources_contents_b64encoded
+
+    - name: Decode the base64 encoded version of /etc/apt/sources.list.d/php.sources
+      ansible.builtin.set_fact:
+        php_sources_contents: "{{ php_sources_contents_b64encoded['content'] | ansible.builtin.b64decode | community.general.jc('ini') }}"
+
+    - name: Print the contents of /etc/apt/sources.list.d/php.sources
+      ansible.builtin.debug:
+        var: php_sources_contents
+        verbosity: "{% if ansible_check_mode | bool %}0{% else %}1{% endif %}"
+
+  when: php_sources_path.stat.exists | bool
+  tags:
+    - php
+    - php_apt
+...

templates/php.sources.j2

-# {{ ansible_managed }}
-
-Types: deb
-URIs: https://packages.sury.org/php/
-Suites: {{ ansible_distribution_release }}
-Architectures: {{ ansible_facts.ansible_local.dpkg.arch }}
-Components: main
-Signed-By: /etc/apt/keyrings/php.gpg
-
-# vim: ft=debsources