support updating the app if the source is updated

roles/ppm/tasks/copyappdef.yml

@@ -20,6 +20,11 @@
   delegate_to: localhost
   become: false
 
+- name: delete appdefinition directory
+  ansible.builtin.file:
+    path: "{{ ppm_app_user.home }}/appdefinition"
+    state: absent
+
 - name: Create directory
   ansible.builtin.file:
     path: "{{ ppm_app_user.home }}/appdefinition"

roles/ppm/tasks/oneapp.yml

@@ -53,6 +53,10 @@
   ansible.builtin.include_tasks: copyappdef.yml
   when: ppm_app.chicken_egg_appdefinition is defined and not appdefinition.stat.exists
 
+- name: "Update appdefinition ({{ ppm_app.user }})"
+  ansible.builtin.include_tasks: updateappdef.yml
+  when: ppm_app.chicken_egg_appdefinition is defined
+
 - name: "Set up extra files for {{ ppm_app.user }}"
   ansible.builtin.copy:
     src: "{{ item.from }}"

roles/ppm/tasks/updateappdef.yml

@@ -0,0 +1,58 @@
+- name: Check local working tree for uncommitted changes
+  command: git status --porcelain
+  args:
+    chdir: "{{ ppm_app.chicken_egg_appdefinition }}"
+  register: local_status
+  changed_when: false
+  delegate_to: localhost
+
+- name: Get local HEAD hash
+  command: git rev-parse HEAD
+  args:
+    chdir: "{{ ppm_app.chicken_egg_appdefinition }}"
+  register: local_hash
+  changed_when: false
+  delegate_to: localhost
+
+
+- name: Check remote working tree for uncommitted changes
+  command: git status --porcelain
+  args:
+    chdir: "{{ ppm_app_user.home }}/appdefinition"
+  register: remote_status
+  changed_when: false
+  become: true
+  become_user: "{{ ppm_app_user.name }}"
+
+- name: Get remote HEAD hash
+  command: git rev-parse HEAD
+  args:
+    chdir: "{{ ppm_app_user.home }}/appdefinition"
+  register: remote_hash
+  changed_when: false
+  become: true
+  become_user: "{{ ppm_app_user.name }}"
+
+
+- name: Set helper facts
+  set_fact:
+    local_dirty: "{{ (local_status.stdout | default('')) != '' }}"
+    local_hash: "{{ local_hash.stdout }}"
+    remote_dirty: "{{ (remote_status.stdout | default('')) != '' }}"
+    remote_hash: "{{ remote_hash.stdout }}"
+
+- name: Debug when remote is dirty (ignore remote dirty for sync decision)
+  debug:
+    msg: "Remote repository has uncommitted changes; ignoring for sync."
+  changed_when: true
+  when: remote_dirty
+
+- name: Debug when local is dirty
+  debug:
+    msg: "Local repository has uncommitted changes; unconditional - non-idempotent sync."
+  changed_when: true
+  when: local_dirty and not remote_dirty
+
+- name: Include copyappdef.yml when local dirty, hash retrieval failed, or hashes differ
+  include_tasks: copyappdef.yml
+  when: not remote_dirty and (local_hash!=remote_hash or local_dirty)