Pin Git to v2.36.1 on Windows so win_git works

Git for Windows v2.37.3 (and probably all version in the v2.37 series)
cause the unofficial win_git module to hang. Downgrading the v2.36.1
works around this issue for the time being. The Chocolatey package for
Git also does not respect the version flag, so installation is now
performed manually by grabbing the v2.36.1 installer from the GitHub
release asset and running it manually when installation is required.

roles/git/tasks/Windows-installer.yaml

@@ -0,0 +1,34 @@
+---
+- name: get json containing all releases
+  win_uri:
+    url: 'https://api.github.com/repos/git-for-windows/git/releases/tags/v{{git_version}}.windows.1'
+    return_content: true
+  register: git_release
+
+- set_fact:
+    git_installer_exe: 'Git-{{git_version}}-64-bit.exe'
+- set_fact:
+    git_asset_query: '[?contains(name, `{{git_installer_exe}}`)] | [0]'
+    git_installer_path: '{{ansible_env.TEMP}}/{{git_installer_exe}}'
+- name: select asset from release
+  set_fact:
+    git_asset: '{{git_release.json.assets | json_query(git_asset_query)}}'
+
+- name: download installer
+  win_get_url:
+    url: '{{git_asset.browser_download_url}}'
+    dest: '{{git_installer_path}}'
+
+- name: run installer command
+  win_command:
+    argv:
+      - '{{git_installer_path}}'
+      - '/GitAndUnixToolsOnPath'
+      - '/NoShellIntegration'
+      - '/NoGuiHereIntegration'
+      - '/NoCredentialManager'
+      - '/NoOpenSSH'
+      - '/Silent'
+      - '/SuppressMsgBoxes'
+      - '/NoCancel'
+      - '/NoRestart'

roles/git/tasks/Windows.yaml

@@ -1,14 +1,35 @@
 ---
-- name: install chocolatey package
-  win_chocolatey:
-    name: git
-    package_params: >-
-      /GitAndUnixToolsOnPath
-      /NoShellIntegration
-      /NoGuiHereIntegration
-      /NoCredentialManager
-      /NoOpenSSH
-    state: latest
+# Pinned to 2.36.1 because the unofficial win_git module hangs when using
+# 2.37.3, this is either a breaking change in 2.37.x or an incompatibility with
+# the win_git module. The git chocolatey package does not respect the version
+# argument and always installs the most recent version, so instead download the
+# installer from GitHub and install manually.
+- set_fact:
+    git_version: 2.36.1
+    git_cli_exe: '{{ansible_env.ProgramFiles}}/Git/cmd/git.exe'
+    git_run_installer: false
+
+- name: detect if Git for Windows is installed
+  win_stat:
+    path: '{{git_cli_exe}}'
+  register: git_cli_stat
+
+- when: not git_cli_stat.stat.exists
+  set_fact:
+    git_run_installer: true
+
+- name: check installed version
+  when: git_cli_stat.stat.exists
+  win_command: '"{{git_cli_exe}}" --version'
+  register: git_cli_version
+  changed_when: false
+
+- when: git_cli_stat.stat.exists and git_version not in git_cli_version.stdout
+  set_fact:
+    git_run_installer: true
+
+- include_tasks: Windows-installer.yaml
+  when: git_run_installer
 
 - name: clone config repos
   win_git:
@@ -16,6 +37,7 @@
     dest: '{{ansible_env.USERPROFILE}}/.config/{{item.name}}'
     version: master
   with_items: '{{git_config_repos}}'
+  timeout: 30
 
 # - TODO: install pip packages
 #   win_pip: