ansible-infra/playbooks/roles/apt_update_and_upgrade/tasks/main.yaml

- name: update, upgrade and potentially reboot
  become: true
  block:
    - name: apt-get update
      ansible.builtin.apt:
        update-cache: true

    - name: apt-get dist-upgrade
      ansible.builtin.apt:
        upgrade: dist
      register: apt_update_and_upgrade__upgrade_result

    - name: reboot, after package upgrade
      ansible.builtin.reboot:
      when: apt_update_and_upgrade__upgrade_result.changed