Skip to content

feat(pi): schedule the Pi credential renewal so it runs unattended #254

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ruby-dlee merged 2 commits into from
Aug 19, 2026
Merged

feat(pi): schedule the Pi credential renewal so it runs unattended #254

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1b6ecb1
feat(pi): schedule the Pi credential renewal so it runs unattended
Aug 19, 2026
dba85bb
fix(pi): apply the platform seam to bootstrap's half of the schedule …
Aug 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions bin/fm-bootstrap.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,28 @@ checkout_refresh_ensure() {
fi
}

pi_auth_refresh_ensure() {
local out
# The same seam the Python half uses. Checking uname directly made this
# unreachable on Linux, so the assertion that bootstrap reports an unhealthy
# schedule could only ever run on a developer's Mac.
[ "${FM_PI_REFRESH_PLATFORM:-$(uname)}" = Darwin ] || return 0
[ -x "$SCRIPT_DIR/fm-pi-refresh.py" ] || return 0
# Silent under the test bypass unless a test asks for it, the same seam
# checkout-refresh and report-retention use: this reports one machine-global
# owner, so without the seam every bootstrap assertion in the suite would
# carry its absence.
if [ "${FM_GATE_REFUSE_BYPASS:-0}" = 1 ] && [ "${FM_PI_REFRESH_BOOTSTRAP_TEST:-0}" != 1 ]; then
return 0
fi
# Machine-global, not per-home: one Pi credential pool serves every home, so
# this reports the same one job from whichever home a session starts in.
if ! out=$(python3 "$SCRIPT_DIR/fm-pi-refresh.py" ensure 2>&1); then
[ -n "$out" ] || out="the Pi renewal schedule did not report"
echo "${out%%$'\n'*}"
fi
}

fleet_sync_origin_backed_project_count() {
local count proj
if [ -x "$FM_ROOT/bin/fm-checkout-refresh.sh" ] \
Expand Down Expand Up @@ -899,6 +921,11 @@ if [ "${1:-}" = "install" ]; then
"$SCRIPT_DIR/fm-checkout-refresh.sh" install
continue
fi
if [ "$t" = pi-auth-refresh ]; then
echo "installing pi-auth-refresh LaunchAgent"
python3 "$SCRIPT_DIR/fm-pi-refresh.py" install-scheduler
continue
fi
if ! cmd=$(install_cmd "$t"); then
instructions=$(manual_install_url "$t") || { echo "error: unknown tool $t" >&2; exit 1; }
echo "error: $t requires manual installation (instructions: $instructions)" >&2
Expand Down Expand Up @@ -964,6 +991,7 @@ if ! fm_backlog_backend_manual "$CONFIG" && fm_tasks_axi_compatible; then
fi
author_identity_sweep
checkout_refresh_ensure
pi_auth_refresh_ensure
if [ "${FM_BOOTSTRAP_DETECT_ONLY:-0}" != 1 ]; then
report_retention_ensure
secondmate_sync
Expand Down
Loading
Loading