From 9325eb22a6e9ee9104aefdda95346fb2c7df7b7f Mon Sep 17 00:00:00 2001
From: gregharvey <greg.harvey@gmail.com>
Date: Fri, 3 Feb 2023 12:26:14 +0100
Subject: [PATCH 1/4] Fixing sync jobs.

---
 .../database_apply-drupal7/tasks/ctools.yml   |  8 +++--
 .../database_sync-mysql/tasks/main.yml        |  2 +-
 .../database_sync-mysql/tasks/sync.yml        | 32 ++++++++++---------
 roles/sync/database_sync/tasks/main.yml       |  2 +-
 .../cache_clear-drupal8/tasks/main.yml        | 13 ++++++++
 .../database_apply-drupal7/tasks/main.yml     |  2 +-
 .../database_apply-drupal8/tasks/main.yml     | 13 ++++++++
 roles/sync/files_sync/tasks/main.yml          |  2 +-
 8 files changed, 53 insertions(+), 21 deletions(-)

diff --git a/roles/database_apply/database_apply-drupal7/tasks/ctools.yml b/roles/database_apply/database_apply-drupal7/tasks/ctools.yml
index ce4db921..194226fa 100644
--- a/roles/database_apply/database_apply-drupal7/tasks/ctools.yml
+++ b/roles/database_apply/database_apply-drupal7/tasks/ctools.yml
@@ -1,8 +1,12 @@
 ---
 - name: Check if Ctools module is enabled.
-  shell: "cd {{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }} &&{{ drush_bin }}pm-info ctools | grep ':  enabled' | wc -l"
+  ansible.builtin.shell:
+    cmd: "{{ drush_bin }} pm-info ctools | grep ':  enabled' | wc -l"
+    chdir: "{{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }}"
   register: ctools_enabled
 
 - name: Revert Drupal configuration from Ctools.
-  shell: "cd {{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }} &&{{ drush_bin }}-y ctools-export-revert --all"
+  ansible.builtin.command:
+    cmd: "{{ drush_bin }} -y ctools-export-revert --all"
+    chdir: "{{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }}"
   when: ctools_enabled.stdout == "1"
diff --git a/roles/sync/database_sync/database_sync-mysql/tasks/main.yml b/roles/sync/database_sync/database_sync-mysql/tasks/main.yml
index 11a47d5a..63edc494 100644
--- a/roles/sync/database_sync/database_sync-mysql/tasks/main.yml
+++ b/roles/sync/database_sync/database_sync-mysql/tasks/main.yml
@@ -1,6 +1,6 @@
 ---
 - name: Sync database.
-  include_tasks: "sync.yml"
+  ansible.builtin.include_tasks: "sync.yml"
   with_items: "{{ mysql_sync.databases }}"
   loop_control:
     loop_var: database
diff --git a/roles/sync/database_sync/database_sync-mysql/tasks/sync.yml b/roles/sync/database_sync/database_sync-mysql/tasks/sync.yml
index 98eca0f3..29100ab5 100644
--- a/roles/sync/database_sync/database_sync-mysql/tasks/sync.yml
+++ b/roles/sync/database_sync/database_sync-mysql/tasks/sync.yml
@@ -36,11 +36,11 @@
     - database.target.asg | length > 0
 
 - name: Register remote dump name (from database).
-  set_fact:
+  ansible.builtin.set_fact:
     mysql_sync_source_dump_path: "/tmp/{{ database.source.database }}.sql.bz2"
 
 - name: Get source last known good build number.
-  command:
+  ansible.builtin.command:
     argv:
       - "/bin/sh"
       - "{{ _ce_deploy_base_dir }}/scripts/track-get.sh"
@@ -51,17 +51,17 @@
   when: database.source.type == 'rolling'
 
 - name: Register source database name.
-  set_fact:
+  ansible.builtin.set_fact:
     mysql_sync_source_database: "{{ database.source.database }}_{{ mysql_sync_source_build_number.stdout }}"
   when: database.source.type == 'rolling'
 
 - name: Register source database name.
-  set_fact:
+  ansible.builtin.set_fact:
     mysql_sync_source_database: "{{ database.source.database }}"
   when: not database.source.type == 'rolling'
 
 - name: Take a dump from source database.
-  shell: "mysqldump --defaults-extra-file={{ database.source.credentials_file }} {{ mysql_sync.mysqldump_params }} {{ mysql_sync_source_database }} | bzip2 > {{ mysql_sync_source_dump_path }}"
+  ansible.builtin.shell: "mysqldump --defaults-extra-file={{ database.source.credentials_file }} {{ mysql_sync.mysqldump_params }} {{ mysql_sync_source_database }} | bzip2 > {{ mysql_sync_source_dump_path }}"
   delegate_to: "{{ database.source.host }}"
   when:
     - database.source.fresh_db
@@ -88,11 +88,11 @@
   when: not database.source.fresh_db
 
 - name: Register tmp target dump name.
-  set_fact:
+  ansible.builtin.set_fact:
     mysql_sync_target_dump_path: "/tmp/{{ database.target.database }}.sql.bz2"
 
 - name: Get target last known good build number.
-  command:
+  ansible.builtin.command:
     argv:
       - "/bin/sh"
       - "{{ _ce_deploy_base_dir }}/scripts/track-get.sh"
@@ -103,38 +103,40 @@
   when: database.target.type == 'rolling'
 
 - name: Register target database name.
-  set_fact:
+  ansible.builtin.set_fact:
     mysql_sync_target_database: "{{ database.target.database }}_{{ mysql_sync_target_build_number.stdout }}"
   when: database.target.type == 'rolling'
 
 - name: Register target database name.
-  set_fact:
+  ansible.builtin.set_fact:
     mysql_sync_target_database: "{{ database.target.database }}"
   when: not database.target.type == 'rolling'
 
 - name: Fetch dump file.
-  fetch:
+  ansible.builtin.fetch:
     src: "{{ mysql_sync_source_dump_path }}"
     dest: "{{ _ce_deploy_build_tmp_dir }}/{{ database.target.database }}.sql.bz2"
     flat: true
   delegate_to: "{{ database.source.host }}"
 
 - name: Copy dump file to destination.
-  copy:
+  ansible.builtin.copy:
     src: "{{ _ce_deploy_build_tmp_dir }}/{{ database.target.database }}.sql.bz2"
     dest: "{{ mysql_sync_target_dump_path }}"
 
 - name: Drop target database.
-  shell: "mysql --defaults-extra-file={{ database.target.credentials_file }} -e 'drop database if exists {{ mysql_sync_target_database }};'"
+  ansible.builtin.command:
+    cmd: "mysql --defaults-extra-file={{ database.target.credentials_file }} -e 'drop database if exists {{ mysql_sync_target_database }};'"
 
 - name: Recreate target database.
-  shell: "mysql --defaults-extra-file={{ database.target.credentials_file }} -e 'create database {{ mysql_sync_target_database }};'"
+  ansible.builtin.command:
+    cmd: "mysql --defaults-extra-file={{ database.target.credentials_file }} -e 'create database {{ mysql_sync_target_database }};'"
 
 - name: Repopulate database from dump.
-  shell: "bzcat {{ mysql_sync_target_dump_path }} | mysql --defaults-extra-file={{ database.target.credentials_file }} {{ mysql_sync_target_database }}"
+  ansible.builtin.shell: "bzcat {{ mysql_sync_target_dump_path }} | mysql --defaults-extra-file={{ database.target.credentials_file }} {{ mysql_sync_target_database }}"
 
 - name: Remove tmp dump file.
-  file:
+  ansible.builtin.file:
     path: "{{ mysql_sync_target_dump_path }}"
     state: absent
 
diff --git a/roles/sync/database_sync/tasks/main.yml b/roles/sync/database_sync/tasks/main.yml
index a3992186..650a9e0a 100644
--- a/roles/sync/database_sync/tasks/main.yml
+++ b/roles/sync/database_sync/tasks/main.yml
@@ -1,7 +1,7 @@
 ---
 
 - name: Sync databases.
-  include_role:
+  ansible.builtin.include_role:
     name: "sync/database_sync/database_sync-{{ engine }}"
   with_items: "{{ database_sync.engines }}"
   loop_control:
diff --git a/roles/sync/drupal_sync_tasks/cache_clear/cache_clear-drupal8/tasks/main.yml b/roles/sync/drupal_sync_tasks/cache_clear/cache_clear-drupal8/tasks/main.yml
index 96c721ee..431366cf 100644
--- a/roles/sync/drupal_sync_tasks/cache_clear/cache_clear-drupal8/tasks/main.yml
+++ b/roles/sync/drupal_sync_tasks/cache_clear/cache_clear-drupal8/tasks/main.yml
@@ -1,4 +1,13 @@
 ---
+# Drupal 8 ships drush with the website code so we need the previous build in the path.
+- name: Stash the drush_bin variable.
+  ansible.builtin.set_fact:
+    _drush_bin_deploy: "{{ drush_bin }}"
+
+- name: Update location of drush for the sync cache clear command.
+  ansible.builtin.set_fact:
+    drush_bin: "{{ live_symlink_dest }}/vendor/bin/drush"
+
 - name: Clear Drupal cache.
   ansible.builtin.command:
     cmd: "{{ drush_bin }} -l {{ site.folder }} -y cr"
@@ -9,3 +18,7 @@
   loop_control:
     loop_var: site
   run_once: true
+
+- name: Restore the drush_bin variable.
+  ansible.builtin.set_fact:
+    drush_bin: "{{ _drush_bin_deploy }}"
diff --git a/roles/sync/drupal_sync_tasks/database_apply/database_apply-drupal7/tasks/main.yml b/roles/sync/drupal_sync_tasks/database_apply/database_apply-drupal7/tasks/main.yml
index f520514e..ea4c083b 100644
--- a/roles/sync/drupal_sync_tasks/database_apply/database_apply-drupal7/tasks/main.yml
+++ b/roles/sync/drupal_sync_tasks/database_apply/database_apply-drupal7/tasks/main.yml
@@ -1,6 +1,6 @@
 ---
 - name: Apply Drupal database updates.
-  ansible.builtin.shell:
+  ansible.builtin.command:
     cmd: "{{ drush_bin }} -l {{ site.folder }} -y updb"
     chdir: "{{ live_symlink_dest }}/{{ webroot }}/sites/{{ site.folder }}"
   with_items: "{{ drupal.sites }}"
diff --git a/roles/sync/drupal_sync_tasks/database_apply/database_apply-drupal8/tasks/main.yml b/roles/sync/drupal_sync_tasks/database_apply/database_apply-drupal8/tasks/main.yml
index e050af3f..c62c9915 100644
--- a/roles/sync/drupal_sync_tasks/database_apply/database_apply-drupal8/tasks/main.yml
+++ b/roles/sync/drupal_sync_tasks/database_apply/database_apply-drupal8/tasks/main.yml
@@ -1,4 +1,13 @@
 ---
+# Drupal 8 ships drush with the website code so we need the previous build in the path.
+- name: Stash the drush_bin variable.
+  ansible.builtin.set_fact:
+    _drush_bin_deploy: "{{ drush_bin }}"
+
+- name: Update location of drush for the sync cache clear command.
+  ansible.builtin.set_fact:
+    drush_bin: "{{ live_symlink_dest }}/vendor/bin/drush"
+
 - name: Apply Drupal database updates.
   ansible.builtin.command:
     cmd: "{{ drush_bin }} -l {{ site.folder }} -y updb"
@@ -26,3 +35,7 @@
 - name: Clear the cache.
   ansible.builtin.include_role:
     name: "sync/drupal_sync_tasks/cache_clear/cache_clear-{{ project_type }}"
+
+- name: Restore the drush_bin variable.
+  ansible.builtin.set_fact:
+    drush_bin: "{{ _drush_bin_deploy }}"
diff --git a/roles/sync/files_sync/tasks/main.yml b/roles/sync/files_sync/tasks/main.yml
index 47c3667a..3107eb24 100644
--- a/roles/sync/files_sync/tasks/main.yml
+++ b/roles/sync/files_sync/tasks/main.yml
@@ -1,6 +1,6 @@
 ---
 - name: Sync files.
-  include_tasks: "sync.yml"
+  ansible.builtin.include_tasks: "sync.yml"
   with_items: "{{ files_sync.directories }}"
   loop_control:
     loop_var: files

From 58d96ea09a14f78a5b4fb6d5219f4bf2408a7368 Mon Sep 17 00:00:00 2001
From: gregharvey <greg.harvey@gmail.com>
Date: Fri, 3 Feb 2023 12:55:38 +0100
Subject: [PATCH 2/4] Fixing bad task title.

---
 .../database_apply/database_apply-drupal8/tasks/main.yml        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/roles/sync/drupal_sync_tasks/database_apply/database_apply-drupal8/tasks/main.yml b/roles/sync/drupal_sync_tasks/database_apply/database_apply-drupal8/tasks/main.yml
index c62c9915..96d9b65f 100644
--- a/roles/sync/drupal_sync_tasks/database_apply/database_apply-drupal8/tasks/main.yml
+++ b/roles/sync/drupal_sync_tasks/database_apply/database_apply-drupal8/tasks/main.yml
@@ -4,7 +4,7 @@
   ansible.builtin.set_fact:
     _drush_bin_deploy: "{{ drush_bin }}"
 
-- name: Update location of drush for the sync cache clear command.
+- name: Update location of drush for the update/config import commands.
   ansible.builtin.set_fact:
     drush_bin: "{{ live_symlink_dest }}/vendor/bin/drush"
 

From 0dcb6604969dd49b7003cb58aed542ae2bda37ae Mon Sep 17 00:00:00 2001
From: gregharvey <greg.harvey@gmail.com>
Date: Fri, 17 Feb 2023 12:50:31 +0100
Subject: [PATCH 3/4] Trying to fix D7 drush issues with chdir.

---
 .../maintenance_mode-drupal-core/tasks/offline.yml            | 4 ++--
 .../maintenance_mode-drupal-core/tasks/online.yml             | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/roles/maintenance_mode/maintenance_mode-drupal-core/tasks/offline.yml b/roles/maintenance_mode/maintenance_mode-drupal-core/tasks/offline.yml
index f8ae276c..2d6a9310 100644
--- a/roles/maintenance_mode/maintenance_mode-drupal-core/tasks/offline.yml
+++ b/roles/maintenance_mode/maintenance_mode-drupal-core/tasks/offline.yml
@@ -10,10 +10,10 @@
     - previous_build_number > 0
     - project_type == 'drupal8'
 
+# For some reason D7 drush doesn't respect 'chdir' with command, using shell instead.
 - name: Enable maintenance mode D7.
-  ansible.builtin.command:
+  ansible.builtin.shell:
     cmd: "{{ drush_bin }} -l {{ site.folder }} vset maintenance_mode 1"
-  args:
     chdir: "{{ live_symlink_dest }}/{{ webroot }}/sites/{{ site.folder }}"
   become: "{{ 'no' if www_user == deploy_user else 'yes' }}"
   become_user: "{{ www_user }}"
diff --git a/roles/maintenance_mode/maintenance_mode-drupal-core/tasks/online.yml b/roles/maintenance_mode/maintenance_mode-drupal-core/tasks/online.yml
index dfc3e3b3..6b127f89 100644
--- a/roles/maintenance_mode/maintenance_mode-drupal-core/tasks/online.yml
+++ b/roles/maintenance_mode/maintenance_mode-drupal-core/tasks/online.yml
@@ -9,10 +9,10 @@
   when:
     - project_type == 'drupal8'
 
+# For some reason D7 drush doesn't respect 'chdir' with command, using shell instead.
 - name: Disable maintenance mode D7.
-  ansible.builtin.command:
+  ansible.builtin.shell:
     cmd: "{{ drush_bin }} -l {{ site.folder }} vset maintenance_mode 0"
-  args:
     chdir: "{{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }}"
   become: "{{ 'no' if www_user == deploy_user else 'yes' }}"
   become_user: "{{ www_user }}"

From bc4d4058e230871e54f47e3ad3d26590deadf4dc Mon Sep 17 00:00:00 2001
From: gregharvey <greg.harvey@gmail.com>
Date: Fri, 17 Feb 2023 13:16:57 +0100
Subject: [PATCH 4/4] Moving D7 drush commands back to 'shell'.

---
 .../database_apply-drupal7/tasks/ctools.yml          |  3 ++-
 .../database_apply-drupal7/tasks/features.yml        |  5 +++--
 .../database_apply-drupal7/tasks/main.yml            | 12 ++++++------
 .../admin_creds/admin_creds-drupal7/tasks/admin.yml  |  5 +++--
 .../cache_clear/cache_clear-drupal7/tasks/main.yml   |  3 ++-
 .../database_apply-drupal7/tasks/main.yml            |  3 ++-
 6 files changed, 18 insertions(+), 13 deletions(-)

diff --git a/roles/database_apply/database_apply-drupal7/tasks/ctools.yml b/roles/database_apply/database_apply-drupal7/tasks/ctools.yml
index 194226fa..8102d3d6 100644
--- a/roles/database_apply/database_apply-drupal7/tasks/ctools.yml
+++ b/roles/database_apply/database_apply-drupal7/tasks/ctools.yml
@@ -1,4 +1,5 @@
 ---
+# For some reason D7 drush doesn't respect 'chdir' with command, using shell instead.
 - name: Check if Ctools module is enabled.
   ansible.builtin.shell:
     cmd: "{{ drush_bin }} pm-info ctools | grep ':  enabled' | wc -l"
@@ -6,7 +7,7 @@
   register: ctools_enabled
 
 - name: Revert Drupal configuration from Ctools.
-  ansible.builtin.command:
+  ansible.builtin.shell:
     cmd: "{{ drush_bin }} -y ctools-export-revert --all"
     chdir: "{{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }}"
   when: ctools_enabled.stdout == "1"
diff --git a/roles/database_apply/database_apply-drupal7/tasks/features.yml b/roles/database_apply/database_apply-drupal7/tasks/features.yml
index edba46bf..f55795dc 100644
--- a/roles/database_apply/database_apply-drupal7/tasks/features.yml
+++ b/roles/database_apply/database_apply-drupal7/tasks/features.yml
@@ -1,8 +1,9 @@
 ---
+# For some reason D7 drush doesn't respect 'chdir' with command, using shell instead.
 - name: Check if Features module is enabled.
-  shell: "cd {{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }} && {{ drush_bin }} -l {{ site.folder }} pm-info features | grep ':  enabled' | wc -l"
+  ansible.builtin.shell: "cd {{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }} && {{ drush_bin }} -l {{ site.folder }} pm-info features | grep ':  enabled' | wc -l"
   register: features_enabled
 
 - name: Revert Drupal configuration from Features.
-  shell: "cd {{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }} && {{ drush_bin }} -l {{ site.folder }} -y {{ site.revert_features_command }}"
+  ansible.builtin.shell: "cd {{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }} && {{ drush_bin }} -l {{ site.folder }} -y {{ site.revert_features_command }}"
   when: features_enabled.stdout == "1"
diff --git a/roles/database_apply/database_apply-drupal7/tasks/main.yml b/roles/database_apply/database_apply-drupal7/tasks/main.yml
index fe25bcaa..70b21947 100644
--- a/roles/database_apply/database_apply-drupal7/tasks/main.yml
+++ b/roles/database_apply/database_apply-drupal7/tasks/main.yml
@@ -1,7 +1,7 @@
 ---
-
+# For some reason D7 drush doesn't respect 'chdir' with command, using shell instead.
 - name: Install Drupal.
-  shell:
+  ansible.builtin.shell:
     cmd: "{{ drush_bin }} -l {{ site.folder }} {{ site.install_command }}"
     chdir: "{{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }}"
   become: "{{ 'no' if www_user == deploy_user else 'yes' }}"
@@ -12,7 +12,7 @@
   when: previous_build_number == 0 or (site.force_install is defined and site.force_install)
 
 - name: Fix permissions on Drupal directory.
-  shell:
+  ansible.builtin.shell:
     cmd: "chmod 755 {{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }}"
   with_items: "{{ drupal.sites }}"
   loop_control:
@@ -30,7 +30,7 @@
   when: previous_build_number > 0
 
 - name: Apply Drupal database updates.
-  shell:
+  ansible.builtin.shell:
     cmd: "{{ drush_bin }} -l {{ site.folder }} -y updb"
     chdir: "{{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }}"
   with_items: "{{ drupal.sites }}"
@@ -38,7 +38,7 @@
     loop_var: site
 
 - name: Revert Drupal configuration with Features.
-  include_tasks: features.yml
+  ansible.builtin.include_tasks: features.yml
   with_items: "{{ drupal.sites }}"
   loop_control:
     loop_var: site
@@ -47,7 +47,7 @@
     - site.revert_features_command
 
 - name: Revert Drupal configuration with Ctools.
-  include_tasks: ctools.yml
+  ansible.builtin.include_tasks: ctools.yml
   with_items: "{{ drupal.sites }}"
   loop_control:
     loop_var: site
diff --git a/roles/sanitize/admin_creds/admin_creds-drupal7/tasks/admin.yml b/roles/sanitize/admin_creds/admin_creds-drupal7/tasks/admin.yml
index 22f9e55e..add864cf 100644
--- a/roles/sanitize/admin_creds/admin_creds-drupal7/tasks/admin.yml
+++ b/roles/sanitize/admin_creds/admin_creds-drupal7/tasks/admin.yml
@@ -4,11 +4,12 @@
 - ansible.builtin.set_fact:
     _admin_pwd: "{{ lookup('password', '/tmp/{{ project_name }}-{{ site.folder }}-{{ build_type }}-{{ build_number }}-pwd chars=ascii_letters') }}"
 
+# For some reason D7 drush doesn't respect 'chdir' with command, using shell instead.
 - name: Reset admin username.
-  ansible.builtin.command:
+  ansible.builtin.shell:
     cmd: "{{ drush_bin }} -l {{ site.folder }} sql-query \"UPDATE users SET name='{{ _admin_user }}' WHERE uid=1;\""
     chdir: "{{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }}"
 - name: Reset admin password.
-  ansible.builtin.command:
+  ansible.builtin.shell:
     cmd: "{{ drush_bin }} -l {{ site.folder }} upwd {{ _admin_user }} --password='{{ _admin_pwd }}'"
     chdir: "{{ deploy_path }}/{{ webroot }}/sites/{{ site.folder }}"
diff --git a/roles/sync/drupal_sync_tasks/cache_clear/cache_clear-drupal7/tasks/main.yml b/roles/sync/drupal_sync_tasks/cache_clear/cache_clear-drupal7/tasks/main.yml
index ab9342ba..fd22fbff 100644
--- a/roles/sync/drupal_sync_tasks/cache_clear/cache_clear-drupal7/tasks/main.yml
+++ b/roles/sync/drupal_sync_tasks/cache_clear/cache_clear-drupal7/tasks/main.yml
@@ -1,6 +1,7 @@
 ---
+# For some reason D7 drush doesn't respect 'chdir' with command, using shell instead.
 - name: Clear Drupal 7 cache.
-  ansible.builtin.command:
+  ansible.builtin.shell:
     cmd: "{{ drush_bin }} -l {{ site.folder }} -y cc all"
     chdir: "{{ live_symlink_dest }}/{{ webroot }}/sites/{{ site.folder }}"
   become: "{{ 'no' if www_user == deploy_user else 'yes' }}"
diff --git a/roles/sync/drupal_sync_tasks/database_apply/database_apply-drupal7/tasks/main.yml b/roles/sync/drupal_sync_tasks/database_apply/database_apply-drupal7/tasks/main.yml
index ea4c083b..eeaa2d73 100644
--- a/roles/sync/drupal_sync_tasks/database_apply/database_apply-drupal7/tasks/main.yml
+++ b/roles/sync/drupal_sync_tasks/database_apply/database_apply-drupal7/tasks/main.yml
@@ -1,6 +1,7 @@
 ---
+# For some reason D7 drush doesn't respect 'chdir' with command, using shell instead.
 - name: Apply Drupal database updates.
-  ansible.builtin.command:
+  ansible.builtin.shell:
     cmd: "{{ drush_bin }} -l {{ site.folder }} -y updb"
     chdir: "{{ live_symlink_dest }}/{{ webroot }}/sites/{{ site.folder }}"
   with_items: "{{ drupal.sites }}"