title: How to make ansible only ask for become password when required
body: <p>I am using ansible 2.0.2.0 to update my static website from any computer. My playbook runs on localhost only and essentially has two parts:</p>
  
  <ul>
  <li>Privileged part: Ensure packages are installed, essentially <code>apt</code> tasks with <code>become: true</code></li>
  <li>Unprivileged part: Fill in templates, minify and sync with web hosting service, essentially <code>command</code> tasks without <code>become</code>.</li>
  </ul>
  
  <p>I would prefer having these two parts in the same playbook so that I do not need to worry about dependencies when switching computers. Ideally, I would like ansible to check if the <code>apt</code> packages are installed and only ask for the become password if it needs to install any.</p>
  
  <p>Other, less satisfactory alternatives that I have explored so far and their drawbacks are highlighted below:</p>
  
  <ul>
  <li><code>sudo ansible-playbook ...</code>: Runs the unprivileged part as <code>root</code>, asks sudo password when not required;</li>
  <li><code>ansible-playbook --ask-become-pass ...</code>: Always asks sudo password, even if no new packages need to be installed;</li>
  <li><code>ansible-playbook ...</code>: Fails with <code>sudo: a password is required</code>.</li>
  </ul>
  
  <p>Is there any way to keep the privileged and unprivileged parts in the same playbook without needlessly typing the sudo password nor giving needless privileges to the unprivileged part?</p>