Added users role to manage the playbook as root and remove admin privileges from deck

roles/gpu_governor/defaults/main.yml

@@ -0,0 +1,2 @@
+# Unprivileged user makepkg runs as.
+gpu_governor__build_user: deck

roles/gpu_governor/handlers/main.yml

@@ -1,5 +1,4 @@
 - name: Restart the GPU governor
-  become: true
   ansible.builtin.systemd_service:
     name: cyan-skillfish-governor-smu
     state: restarted

roles/gpu_governor/tasks/main.yml

@@ -12,17 +12,23 @@
   when: is_gov_installed.rc != 0
   block:
     - name: Create temporary dir for build
+      become: true
+      become_user: "{{ gpu_governor__build_user }}"
       ansible.builtin.tempfile:
         state: directory
         suffix: csgov
       register: gov_tmp
 
     - name: Download the AUR snapshot
+      become: true
+      become_user: "{{ gpu_governor__build_user }}"
       ansible.builtin.get_url:
         url: "https://aur.archlinux.org/cgit/aur.git/snapshot/cyan-skillfish-governor-smu.tar.gz"
         dest: "{{ gov_tmp.path }}/cyan-skillfish-governor-smu.tar.gz"
 
     - name: Extract the snapshot
+      become: true
+      become_user: "{{ gpu_governor__build_user }}"
       ansible.builtin.unarchive:
         src: "{{ gov_tmp.path }}/cyan-skillfish-governor-smu.tar.gz"
         dest: "{{ gov_tmp.path }}"
@@ -41,13 +47,15 @@
              | unique }}
 
     - name: Ensure build prerequisites are present
-      become: true
       ansible.builtin.pacman:
         name: "{{ ['base-devel', 'fakeroot'] + gov_build_deps }}"
         state: present
 
+    # makepkg refuses to run as root.
     # Rust build, expect several minutes on Zen 2.
     - name: Build the package (no install)
+      become: true
+      become_user: "{{ gpu_governor__build_user }}"
       ansible.builtin.command:
         argv:
           - makepkg
@@ -64,9 +72,7 @@
         file_type: file
       register: gov_built_pkgs
 
-    # Install with root, but OUTSIDE makepkg
     - name: Install built package(s)
-      become: true
       ansible.builtin.command:
         argv:
           - pacman
@@ -84,7 +90,6 @@
       when: gov_tmp.path is defined
 
 - name: Deploy the governor configuration
-  become: true
   ansible.builtin.template:
     src: config.toml.j2
     dest: /etc/cyan-skillfish-governor-smu/config.toml
@@ -92,7 +97,6 @@
   notify: Restart the GPU governor
 
 - name: Enable and start the GPU governor
-  become: true
   ansible.builtin.systemd_service:
     name: cyan-skillfish-governor-smu
     enabled: true