I think we need a more complex conditional for this guard. Furthermore, this will leave file descriptors open when running Chef Client as a service (`File#open` does not autoclose) Something like:

```ruby
not_if do
  ::File.exists?(node['ssh_known_hosts']['file']) &&
  ::File.readlines(node['ssh_known_hosts']['file']).any? { |line| line.match(/#{Regexp.escape(comment)}|#{Regexp.escape(key)}/) }
end
```

Furthermore, if this guard is implemented, the actual resource block could be simplified to:

```ruby
ruby_block "add #{new_resource.host} to #{node['ssh_known_hosts']['file']}" do
  block do
    # straight up file operations here
  end
  not_if do
    ::File.exists?(node['ssh_known_hosts']['file']) &&
    ::File.readlines(node['ssh_known_hosts']['file']).any? { |line| line.match(/#{Regexp.escape(comment)}|#{Regexp.escape(key)}/) }
  end
end
new_resource.updated_by_last_action(true)
```