Requirements:

• Playbooks and roles via git should still be possible (especially for developers).
• A mixture of Debian packages and git roles is not required.

Ideas

• playbook_url could either contain a git url or a Debian package name
• playbook_version would correspond to the package version
• git could be installed on demand (if playbook_url points to a git repository)
• a potential update of the playbook package could be inhibited using apt-mark hold PACKAGENAME
• the +deb12 should potentially be stripped from the playbook_version to keep compatibility with the git tag (What about developer versions? Is it possible to add the +deb12 always at the end of the version? Yes: 2.1.0+r12g124ABC+deb12)
• the playbook package could also include the roles --> makes sense.

Future

Should it be possible to ad-hoc add the Debian repository containing the playbook package? Probably yes.
--> playbook_repository (including signed-by)
--> playbook_repository_key (e.g. base64 -w 0 encoded, will be dispatched to signed-by location)
--> future: playbook_repository_credentials
--> /etc/apt/sources.list.d/gitops.list (will be overwritten - no append, eventually check for changes prior to write)

Eventually simpler approach: A gitops repository gets pre-configured within the image (including credentials where needed). If a change is needed it would still be possible through the Mender channel via e.g. a script artifact. So a late change is possible and improvements to the process can be added at a later stage (if needed).