rdp-server: check mode reports contradictory GPU and VA-API state

[catinspace-au]

Summary

The GPU and VA-API status output is derived from ansible.builtin.shell tasks, which Ansible skips in check mode. Nothing guards for the skipped case, so --check prints a confident and wrong hardware picture.

Observed

On a host with a working NVENC-capable GPU and /dev/dri populated, molecule converge -s existing-host -- --check --diff --tags rdp-server printed:

GPU vendor: none
Class: physical
/dev/dri: PRESENT
Hardware encode expected: False

and then, a few tasks later:

VA-API H.264 encoding: AVAILABLE

Those two statements contradict each other. Both facts trace back to skipped tasks:

• roles/rdp-server/tasks/gpu_groups.yml -- "Detect GPU PCI vendor IDs from DRM cards" (shell) reported skipping, so rdp_gpu_vendor fell through the if/elif chain to none.
• roles/rdp-server/tasks/vaapi.yml -- "Check VA-API H.264 encoding support" (shell) reported skipping, yet vaapi_h264_available still resolved truthy.

Impact

Check mode is the documented way to preview this role (molecule.yml for the existing-host scenario says "Preview first, always"). Because rdp_hw_encode_expected drives whether the priority drop-ins are deployed or removed, the preview shows the opposite branch from what a real run takes on hardware-encode hosts.

Suggested fix

Add check_mode: false to the two read-only detection tasks. They only read /sys and run vainfo, so running them under check mode is safe and makes the preview match reality. Failing that, have the status output say explicitly that detection did not run.