---
- name: Pre-flight checks only.
  hosts: workstation.lab.example.com
  gather_subset: min
  become: no
  roles:
    - role: pull-tools
      tags: prep
    - role: pull-images
      tags: prep
    - role: pull-files
      tags: prep
    - role: check-env
      tags: check
    - role: fix-operators
      tags: fix

  # TODO: convert to role?
  tasks:
    - name: get current eap version
      set_fact:
        eap_version: "{{ lookup('file', '/opt/eap/version.txt') }}"

    - name: patch eap server
      become: yes
      command: /opt/eap/bin/jboss-cli.sh --command="patch apply {{ ansible_facts['user_dir'] }}/Downloads/jboss-eap-{{ eap_z }}-patch.zip"
      when:
        - eap_z not in eap_version
      register: patched

    - name: remove patch when done
      file:
        path: "{{ ansible_facts['user_dir'] }}/Downloads/jboss-eap-{{ eap_z }}-patch.zip"
        state: absent
      when:
        - patched is defined
        - patched.changed
...