ensure that all config return values are Origin-tagged (#85127)

Co-authored-by: Matt Clay <matt@mystile.com>
(cherry picked from commit fc8a227647)

changelogs/fragments/preserve_config_origin.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - config - Preserve or apply Origin tag to values returned by config.

lib/ansible/cli/arguments/option_helpers.py

@@ -535,13 +535,17 @@ def _tagged_type_factory(name: str, func: t.Callable[[str], object], /) -> t.Cal
     def tag_value(value: str) -> object:
         result = func(value)
 
-        if result is value:
+        if result is value or func is str:
             # Values which are not mutated are automatically trusted for templating.
             # The `is` reference equality is critically important, as other types may only alter the tags, so object equality is
             # not sufficient to prevent them being tagged as trusted when they should not.
+            # Explicitly include all usages using the `str` type factory since it strips tags.
             result = TrustedAsTemplate().tag(result)
 
-        return Origin(description=f'<CLI option {name!r}>').tag(result)
+        if not (origin := Origin.get_tag(value)):
+            origin = Origin(description=f'<CLI option {name!r}>')
+
+        return origin.tag(result)
 
     tag_value._name = name  # simplify debugging by attaching the argument name to the function
 

lib/ansible/config/manager.py

@@ -16,6 +16,7 @@ import typing as t
 from collections.abc import Mapping, Sequence
 from jinja2.nativetypes import NativeEnvironment
 
+from ansible._internal._datatag import _tags
 from ansible.errors import AnsibleOptionsError, AnsibleError, AnsibleUndefinedConfigEntry, AnsibleRequiredOptionError
 from ansible.module_utils._internal._datatag import AnsibleTagHelper
 from ansible.module_utils.common.sentinel import Sentinel
@@ -700,6 +701,9 @@ class ConfigManager:
         else:
             raise AnsibleUndefinedConfigEntry(f'No config definition exists for {_get_config_label(plugin_type, plugin_name, config)}.')
 
+        if not _tags.Origin.is_tagged_on(value):
+            value = _tags.Origin(description=f'<Config {origin}>').tag(value)
+
         return value, origin
 
     def initialize_plugin_configuration_definitions(self, plugin_type, name, defs):