show_changes.yml

---
# show_changes.yml - Checks for uncommitted changes and commits if necessary.
#
# Description
# ===========
#
# This issues the 'show config list changes' command to display the modified config elements in the candidate config
# using 'panos_op', and issues the commit command if there are uncommitted changes.
#
# This playbook requires connection details for the device to be specified in the variables 'ip_address', 'username',
# and 'password'.  These may be defined as host variables (see `host_vars/firewall.yml` for an example) or
# extra vars.
#
# Modules Used
# ============
#
# panos_op - https://paloaltonetworks.github.io/pan-os-ansible/modules/panos_op.html
#
# Usage
# =====
#
#   $ ansible-playbook -i inventory show_changes.yml

- hosts: '{{ target | default("firewall") }}'
  connection: local
  gather_facts: false

  vars:
    device:
      ip_address: '{{ ip_address }}'
      username: '{{ username | default(omit) }}'
      password: '{{ password | default(omit) }}'
      api_key: '{{ api_key | default(omit) }}'

  tasks:
    - name: Check for pending changes
      paloaltonetworks.panos.panos_op:
        provider: '{{ device }}'
        cmd: 'show config list changes'
      register: changes

    - name: Display changes
      ansible.builtin.debug:
        msg: '{{ changes.stdout | from_json }}'

    - name: Commit changes if needed
      paloaltonetworks.panos.panos_commit:
        provider: '{{ device }}'
      when: >
        (changes.stdout | from_json).response.result.journal is defined and
        (changes.stdout | from_json).response.result.journal.entry | length > 0