get_url: return no change in check mode when checksum matches

Signed-off-by: Tony Finch <dot@dotat.at>

changelogs/fragments/53070-get_url-check_mode.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - get_url - return no change in check mode when checksum matches

lib/ansible/modules/net_tools/basics/get_url.py

@@ -522,12 +522,6 @@ def main():
     checksum_src = None
     checksum_dest = None
 
-    # If the remote URL exists, we're done with check mode
-    if module.check_mode:
-        os.remove(tmpsrc)
-        res_args = dict(url=url, dest=dest, src=tmpsrc, changed=True, msg=info.get('msg', ''))
-        module.exit_json(**res_args)
-
     # raise an error if there is no tmpsrc file
     if not os.path.exists(tmpsrc):
         os.remove(tmpsrc)
@@ -555,6 +549,16 @@ def main():
             os.remove(tmpsrc)
             module.fail_json(msg="Destination %s is not writable" % (os.path.dirname(dest)))
 
+    if module.check_mode:
+        if os.path.exists(tmpsrc):
+            os.remove(tmpsrc)
+        changed = (checksum_dest is None or
+                   checksum_src != checksum_dest)
+        res_args = dict(url=url, changed=changed, dest=dest, src=tmpsrc,
+                        checksum_dest=checksum_dest, checksum_src=checksum_src,
+                        msg=info.get('msg', ''))
+        module.exit_json(**res_args)
+
     backup_file = None
     if checksum_src != checksum_dest:
         try:

test/integration/targets/get_url/tasks/main.yml

@@ -268,6 +268,19 @@
     that:
       - result is not changed
 
+- name: test checksum match in check mode
+  get_url:
+    url: 'https://{{ httpbin_host }}/get'
+    dest: '{{ output_dir }}/test'
+    checksum: 'sha256:7036ede810fad2b5d2e7547ec703cae8da61edbba43c23f9d7203a0239b765c4.'
+  check_mode: True
+  register: result
+
+- name: Assert that check mode was green
+  assert:
+    that:
+      - result is not changed
+
 # https://github.com/ansible/ansible/issues/27617
 
 - name: set role facts