fix(ansible): use dict-form shell tasks with explicit bash

Free-form split_args breaks on quotes/Jinja at AWX runtime,
and default dash rejects pipefail.

ansible/mysql-deploy.yml

@@ -89,18 +89,19 @@
       run_once: true
 
     - name: Probe target-host port occupancy (SQL + GR)
-      ansible.builtin.shell: |
+      # cmd 字典形式不经过 free-form split_args 解析，避免引号/Jinja 块导致的解析失败。
-        set -o pipefail
+      ansible.builtin.shell:
-        for p in {{ mysql_probe_ports | join(' ') }}; do
+        cmd: |
-          if ss -lntH "sport = :${p}" | grep -q .; then
+          set -o pipefail
-            # already listening: only tolerated when owned by this instance service
+          for p in {{ mysql_probe_ports | join(' ') }}; do
-            if ! systemctl is-active --quiet "mysql-delivery@{{ mysql_instance }}.service"; then
+            if ss -lntH "sport = :${p}" | grep -q .; then
-              echo "port ${p} already in use on target host" >&2
+              # already listening: only tolerated when owned by this instance service
-              exit 3
+              if ! systemctl is-active --quiet "mysql-delivery@{{ mysql_instance }}.service"; then
+                echo "port ${p} already in use on target host" >&2
+                exit 3
+              fi
             fi
-          fi
+          done
-        done
-      args:
         executable: /bin/bash
       vars:
         mysql_probe_ports: "{{ [mysql_port_value, mysql_gr_port_value] if topology == 'mgr_3' else [mysql_port_value] }}"
@@ -284,32 +285,33 @@
         timeout: 60
 
     - name: Configure local administrative accounts
-      ansible.builtin.shell: |
+      # cmd 字典形式不经过 free-form split_args 解析，heredoc SQL 中的奇数个单引号才不会报错。
-        set -euo pipefail
+      ansible.builtin.shell:
-        client_file="$(mktemp)"
+        cmd: |
-        sql_file="$(mktemp)"
+          set -euo pipefail
-        trap 'rm -f "$client_file" "$sql_file"' EXIT
+          client_file="$(mktemp)"
-        chmod 600 "$client_file" "$sql_file"
+          sql_file="$(mktemp)"
-        cat >"$client_file" <<'EOF'
+          trap 'rm -f "$client_file" "$sql_file"' EXIT
-        [client]
+          chmod 600 "$client_file" "$sql_file"
-        user=root
+          cat >"$client_file" <<'EOF'
-        password={{ mysql_root_password_value }}
+          [client]
-        socket={{ mysql_run_dir }}/mysql.sock
+          user=root
-        EOF
+          password={{ mysql_root_password_value }}
-        if ! /usr/bin/mysql --defaults-extra-file="$client_file" -e 'SELECT 1' >/dev/null 2>&1; then
+          socket={{ mysql_run_dir }}/mysql.sock
+          EOF
+          if ! /usr/bin/mysql --defaults-extra-file="$client_file" -e 'SELECT 1' >/dev/null 2>&1; then
+            cat >"$sql_file" <<'EOF'
+          ALTER USER 'root'@'localhost' IDENTIFIED BY '{{ mysql_root_password_value | replace("'", "''") }}';
+          EOF
+            /usr/bin/mysql --protocol=socket --socket={{ mysql_run_dir }}/mysql.sock -uroot <"$sql_file"
+          fi
           cat >"$sql_file" <<'EOF'
-        ALTER USER 'root'@'localhost' IDENTIFIED BY '{{ mysql_root_password_value | replace("'", "''") }}';
+          CREATE USER IF NOT EXISTS 'xinfra_admin'@'%' IDENTIFIED BY '{{ mysql_admin_password_value | replace("'", "''") }}';
-        EOF
+          ALTER USER 'xinfra_admin'@'%' IDENTIFIED BY '{{ mysql_admin_password_value | replace("'", "''") }}';
-          /usr/bin/mysql --protocol=socket --socket={{ mysql_run_dir }}/mysql.sock -uroot <"$sql_file"
+          GRANT ALL PRIVILEGES ON *.* TO 'xinfra_admin'@'%' WITH GRANT OPTION;
-        fi
+          FLUSH PRIVILEGES;
-        cat >"$sql_file" <<'EOF'
+          EOF
-        CREATE USER IF NOT EXISTS 'xinfra_admin'@'%' IDENTIFIED BY '{{ mysql_admin_password_value | replace("'", "''") }}';
+          /usr/bin/mysql --defaults-extra-file="$client_file" <"$sql_file"
-        ALTER USER 'xinfra_admin'@'%' IDENTIFIED BY '{{ mysql_admin_password_value | replace("'", "''") }}';
-        GRANT ALL PRIVILEGES ON *.* TO 'xinfra_admin'@'%' WITH GRANT OPTION;
-        FLUSH PRIVILEGES;
-        EOF
-        /usr/bin/mysql --defaults-extra-file="$client_file" <"$sql_file"
-      args:
         executable: /bin/bash
       changed_when: false
       no_log: true