From 075353d90ccf2be0f807da26703710da56446c09 Mon Sep 17 00:00:00 2001
From: jakub <jakub@zacekj.cz>
Date: Sun, 30 Aug 2026 01:43:10 +0200
Subject: [PATCH] Update Portainer across release channels

---
 roles/update_portainer/defaults/main.yml |  1 +
 roles/update_portainer/tasks/main.yml    | 40 +++++++++++++++++++++++-
 2 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/roles/update_portainer/defaults/main.yml b/roles/update_portainer/defaults/main.yml
index e132cf0..5a16fe9 100644
--- a/roles/update_portainer/defaults/main.yml
+++ b/roles/update_portainer/defaults/main.yml
@@ -2,3 +2,4 @@
 # Watchtower is used only as a one-shot updater. It recreates the selected
 # Portainer containers with their existing configuration and then removes itself.
 portainer_watchtower_image: containrrr/watchtower:latest
+portainer_target_tag: latest
diff --git a/roles/update_portainer/tasks/main.yml b/roles/update_portainer/tasks/main.yml
index af01678..ca83b3d 100644
--- a/roles/update_portainer/tasks/main.yml
+++ b/roles/update_portainer/tasks/main.yml
@@ -44,12 +44,50 @@
              | map(attribute='item')
              | list }}
 
+    - name: Pull the latest release for each installed Portainer edition
+      ansible.builtin.command:
+        argv:
+          - docker
+          - image
+          - pull
+          - >-
+            {{ 'portainer/portainer-ee:' ~ portainer_target_tag
+               if 'portainer-ee' in item.stdout
+               else 'portainer/portainer-ce:' ~ portainer_target_tag }}
+      loop: "{{ portainer_container_inspections.results }}"
+      loop_control:
+        label: "{{ item.stdout }}"
+      register: portainer_image_pulls
+      changed_when: "'Downloaded newer image' in portainer_image_pulls.stdout"
+      when:
+        - item.stdout is match('^(?:[^/]+/)?portainer/(?:portainer|portainer-(?:ce|ee))(?::|@|$)')
+        - not ansible_check_mode
+
+    - name: Point the existing image reference at the latest release
+      ansible.builtin.command:
+        argv:
+          - docker
+          - image
+          - tag
+          - >-
+            {{ 'portainer/portainer-ee:' ~ portainer_target_tag
+               if 'portainer-ee' in item.stdout
+               else 'portainer/portainer-ce:' ~ portainer_target_tag }}
+          - "{{ item.stdout }}"
+      loop: "{{ portainer_container_inspections.results }}"
+      loop_control:
+        label: "{{ item.stdout }}"
+      changed_when: false
+      when:
+        - item.stdout is match('^(?:[^/]+/)?portainer/(?:portainer|portainer-(?:ce|ee))(?::|$)')
+        - not ansible_check_mode
+
     - name: Update discovered Portainer containers
       ansible.builtin.command:
         argv: >-
           {{ ['docker', 'run', '--rm', '--pull', 'always',
               '--volume', '/var/run/docker.sock:/var/run/docker.sock',
-              portainer_watchtower_image, '--run-once', '--cleanup',
+              portainer_watchtower_image, '--run-once', '--cleanup', '--no-pull',
               '--include-stopped']
              + portainer_container_ids }}
       register: portainer_watchtower