---
- name: Check for the Git signing public key
  ansible.builtin.stat:
    path: "{{ git_signing_key }}"
  become: false
  register: git_signing_public_key

- name: Read the Git signing public key
  ansible.builtin.slurp:
    src: "{{ git_signing_key }}"
  become: false
  register: git_signing_public_key_contents
  when: git_signing_public_key.stat.exists

- name: Configure allowed SSH signers
  ansible.builtin.copy:
    dest: "{{ user_home }}/.ssh/allowed_signers"
    owner: "{{ user_name }}"
    mode: "0644"
    content: "{{ git_email }} {{ git_signing_public_key_contents.content | b64decode | trim }}\n"
  become: false
  when: git_signing_public_key.stat.exists