---
# seed_users is idempotent but RESETS each listed user's password and flags, so
# re-running it is how a rotated vault password reaches the app. It reports
# "N created, M updated"; only a creation counts as a change.
- name: Seed users
  ansible.builtin.command:
    cmd: docker compose exec -T web python manage.py seed_users -
    chdir: "{{ jar_lid_archive_dir }}"
    stdin: "{{ jar_lid_archive_seed_users | to_json }}"
  register: jar_lid_archive_seed
  changed_when: "jar_lid_archive_seed.stdout is not search('Seeded users: 0 created')"
  when: jar_lid_archive_seed_users | length > 0
  no_log: true