Add third-party preparation task hook

roles/environment/tasks/main.yml

@@ -151,3 +151,27 @@
                 src: "{{ os | lower }}.repo.j2"
                 dest: /etc/yum.repos.d/{{ os | lower }}.repo
                 mode: "0644"
+
+    - name: Check for third-party preparation tasks
+      ansible.builtin.stat:
+        path: >-
+          {{
+            thirdparty_preparation_tasks_path
+            if thirdparty_preparation_tasks_path | regex_search('^/')
+            else playbook_dir + '/' + thirdparty_preparation_tasks_path
+          }}
+      delegate_to: localhost
+      run_once: true
+      register: environment_thirdparty_tasks_stat
+      changed_when: false
+
+    - name: Run third-party preparation tasks
+      when:
+        - thirdparty_preparation_tasks_path | length > 0
+        - environment_thirdparty_tasks_stat.stat.exists
+      ansible.builtin.include_tasks: >-
+        {{
+          thirdparty_preparation_tasks_path
+          if thirdparty_preparation_tasks_path | regex_search('^/')
+          else playbook_dir + '/' + thirdparty_preparation_tasks_path
+        }}

roles/global_defaults/defaults/main.yml

@@ -8,6 +8,7 @@ firewalld_enabled: true
 zstd_enabled: true
 swap_enabled: true
 chroot_command: "arch-chroot"
+thirdparty_preparation_tasks_path: "dropins/preparation.yml"
 
 cis_enabled: "{{ cis | bool }}"