update-rolelisted

# update-role Update one or more files in an existing Ansible role. Always shows a diff and waits for confirmation before writing. --- ## Required Inputs 1. **role_name or FQCN** — The role to update (resolved from discovery) 2. **change_description** — What to change (e.g., "add Windows support", "fix bare module names in tasks/main.yml", "add SELinux task to RedHat.yml") --- ## Behavior ### Step 1 — Discovery Locate the role via discovery (`references/discovery.md`). ### Step 2 — Load Target Files Read only the files relevant to the requested change. If the change affects multiple files (e.g., "add multi-OS support"), read all affected files. ### Step 2a — Secret Scan (before any output) Before displaying any content or diff — especially for `defaults/main.yml`, `vars/*.yml`, and `group_vars/` files — scan every loaded file for credential-like values: - Match lines or YAML values where the key contains `password`, `secret`, `token`, `api_key`, `private_key`, `pass`, or `credential` - **Skip** lines where the value is already a vault reference (`{{ vault_* }}`), a task option (`no_log`, `register`, `when`), empty, or `None` - For any remaining matches, **redact the value** in all output: `db_password: "***REDACTED***"` - Emit a warning at the top of each affected file's diff block: ``` ⚠ Warning: N line(s) with credential-like values were redacted from this display. Review the file directly before applying changes. ``` - Never output actual credential valu