Ansible role which use pinning instead of holding to keep the Ubuntu packages from being upgraded

Pinning allows to give priority to a certain releases of package and force install the pinned version. To pin a package, set its Pin-Priority to higher number.

To get priorities for packages, run:

apt-cache policy packagename[s]

Here is an Ansible role that performs this:
default/main.yml:

pin_packages:
  - name: filebeat
    version: 7.6.2
  - name: metricbeat
    version: 7.6.0

tasks/main.yml:

- name: Pin packages
  template:
    src: fixed-template.j2
    dest: "/etc/apt/preferences.d/fixed-{{ item.name }}"
    owner: root
    group: root
    mode: 0644
  loop: "{{ pin_packages }}"

templates/fixed-template.j2:

Package: {{ item.name }}
Pin: version {{ item.version }}
Pin-Priority: {{ item.priority | default('1002') }}