fix: fail clearly when vitals_scan runs in check mode

[Tiyatrotist]

Implements the explicit-refusal option from #38. vitals_scan now stops before discovery with one explanatory assertion when Ansible check mode is active, avoiding the later undefined-fact cascade. Troubleshooting docs describe the contract, and a structural regression test keeps the guard ahead of discovery.

Closes #38.

Local pytest/Ansible execution was not run because the connected development machine is currently offline.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 91ce1e3c-a887-4a73-a251-bd7e29e62e95

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pr-reviewer-bots]

Thanks for opening this PR. Assigned to @sameeralam3127. Labels added: documentation, size/small. Checklist: 3/3 passed (see checks tab for details).

[sameeralam3127]

Thanks @Tiyatrotist. CI is green, and refusing check mode (option 2 in #38) is an acceptable choice. A few things before this can merge:

1. Merge conflict in docs/troubleshooting.md
#101 added the community.general does not support Ansible version 2.16.x entry at the same spot. To resolve it, keep both entries: the 2.16 entry first, then your --check entry. While you're there, please drop the extra blank line before **A run with --check stops before discovery.**.

2. Guard the unguarded dereferences (#38 asks for this whichever option is chosen)

the unguarded dereferences at discovery.yml:19 and :770 should get default() treatment regardless

• roles/vitals_scan/tasks/discovery.yml:19: ansible_facts.services with no default()
• roles/vitals_scan/tasks/discovery.yml:773-806: linux_vitals_bootloader_default_cmd.stdout in the bootloader expressions (the issue cites :770; the lines have moved since)

These are the same kind of latent failure as #25 (stale or partial cached facts), so the new assert doesn't cover them.

3. Acceptance criteria scope
The criterion "the report shows what vitals_heal would have attempted" can't be met by refusing to run. Please change Closes #38 to Refs #38 so the issue stays open for real check-mode support (option 1), or say so in the PR description and we'll split out a follow-up.

4. Local validation
Please run pre-commit run --all-files and pytest -q locally before pushing (see CONTRIBUTING.md).