[sjatinkadimcherla]

Finishes DOS-7379

Jira: LP-1289

Changes

• 50unattended-upgrades: add Dpkg::Options { "--force-confdef"; "--force-confold"; }; so unmodified conffiles take the package default and modified ones are kept.
• security-ubuntu.yml: stop retrying on conffile prompt so the task fails fast instead of hanging.

Impact
Affects all plays that use the security role. Locally modified conffiles are kept, not replaced, on upgrade.

Make sure that the following steps are done before merging:

• Have a Site Reliability Engineer review the PR if you don't own all of the services impacted.
• If you are adding any new default values that need to be overridden when this change goes live, update internal repos and add an entry to the top of the CHANGELOG.
• Performed the appropriate testing.

[Copilot]

Copilot review overview

🟡 Changes recommended

Include stderr in the conffile detection condition so retries stop as intended.

Review effort: Lite
Findings: 1

Open (1)

• Check stderr for conffile diagnostic to ensure fail-fast behavior · New

What changed in this PR

Updates Ubuntu unattended upgrades to handle modified conffiles without interactive prompts.

Changes:

• Adds dpkg options to preserve locally modified conffiles.
• Adjusts retry handling for conffile prompts.

File	Summary
playbooks/​roles/​security/​templates/​etc/​apt/​apt.conf.d/​50unattended-upgrades	Configures dpkg conffile handling.
playbooks/​roles/​security/​tasks/​security-ubuntu.yml	Updates retry behavior; the conffile diagnostic is on stderr, so the fail-fast check needs adjustment.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟢 Approval recommended

No unresolved review issues were identified.

Review effort: Lite
Findings: None

Resolved since last review (1)

• Check stderr for conffile diagnostic to ensure fail-fast behavior

[sjatinkadimcherla]

atlantis apply