Gabriel Brown
15d54b16f6
sunhat's failure mode was a question twenty minutes into a run. Walking away from an install meant coming back to a prompt that had been waiting an hour. So the questions move to the front. A new interview stage asks what Panama needs to be told -- hostname, git identity, whether to sign in to GitHub, whether to make an SSH key -- shows the answers back, and asks once to proceed. After that nothing asks again. gum is bootstrapped before it runs, because the interview is built on gum and gum arrives with a stage that has not run yet. Answers reach the stages through a mktemp file that install sources and the existing trap deletes, since a child process cannot export into its siblings. They are not remembered between runs: there is no state file to go stale, and one of the answers is an email address. The interview asks only what a stage in this repository actually consumes. Extras, hardware and debloat questions arrive with the stages that act on them -- a prompt whose answer nothing reads is a control that lies. The new contract pins that in both directions, and four deliberate mutations confirmed it catches a question nobody reads, a stage reading something nobody asks, an answers file left on disk, and a declined interview that fails to stop the run. The run now ends with panama-doctor, because a failed-stage count says nothing about a service that did not start. It never changes the exit code: on a fresh machine, unconfigured is the honest answer, not a failure. espanso and oh-my-posh stop being exceptions -- Terra packages espanso-wayland and Fedora packages oh-my-posh, so the curl installer is gone. bun is now the only remaining one. Claude-Session: https://claude.ai/code/session_01Q84axqUE5inJhf5Jz9CFy1
68 lines
2.4 KiB
Bash
Executable File
68 lines
2.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
# Who this machine belongs to: git identity, GitHub, and an SSH key.
|
|
#
|
|
# Runs last, because gh and git-all arrive with install-packages. Everything here
|
|
# is driven by answers the interview collected before the run started, so nothing
|
|
# in this stage blocks waiting for input -- except `gh auth login`, which is an
|
|
# interactive browser flow by nature and only runs when it was asked for.
|
|
#
|
|
# Every value is optional. A blank answer means "keep whatever is already set",
|
|
# which is what makes this safe to re-run: the interview's prompts start empty
|
|
# every time by design, and an empty answer must never erase a correct name.
|
|
|
|
set -uo pipefail
|
|
|
|
log() { echo -e "\033[1;34m[INFO]\033[0m $*"; }
|
|
|
|
git_name="${PANAMA_GIT_NAME:-}"
|
|
git_email="${PANAMA_GIT_EMAIL:-}"
|
|
git_editor="${PANAMA_GIT_EDITOR:-}"
|
|
|
|
if [[ -n "$git_name" ]]; then
|
|
git config --global user.name "$git_name"
|
|
log "git user.name set to $git_name"
|
|
fi
|
|
if [[ -n "$git_email" ]]; then
|
|
git config --global user.email "$git_email"
|
|
log "git user.email set to $git_email"
|
|
fi
|
|
if [[ -n "$git_editor" ]]; then
|
|
git config --global core.editor "$git_editor"
|
|
log "git core.editor set to $git_editor"
|
|
fi
|
|
|
|
# Aliases and pull behaviour, carried over from sunhat. Setting these is
|
|
# idempotent, so they are applied unconditionally rather than asked about.
|
|
git config --global alias.co checkout
|
|
git config --global alias.br branch
|
|
git config --global alias.ci commit
|
|
git config --global alias.st status
|
|
git config --global pull.rebase true
|
|
log "git aliases and pull.rebase applied"
|
|
|
|
if [[ "${PANAMA_GH_LOGIN:-no}" == yes ]]; then
|
|
if command -v gh >/dev/null 2>&1; then
|
|
log "Signing in to GitHub"
|
|
gh auth login || log "GitHub sign-in did not complete; run 'gh auth login' later"
|
|
else
|
|
log "gh is not installed; skipping GitHub sign-in"
|
|
fi
|
|
fi
|
|
|
|
if [[ "${PANAMA_SSH_KEY:-no}" == yes ]]; then
|
|
key="$HOME/.ssh/id_ed25519"
|
|
if [[ -e "$key" ]]; then
|
|
log "An SSH key already exists at $key; leaving it alone"
|
|
else
|
|
mkdir -p "$HOME/.ssh"
|
|
chmod 700 "$HOME/.ssh"
|
|
# No passphrase prompt: this stage runs inside an install that was
|
|
# promised to need no attention. A key can be given a passphrase later
|
|
# with ssh-keygen -p.
|
|
ssh-keygen -t ed25519 -N "" -C "${git_email:-$USER@$(hostname)}" -f "$key" >/dev/null
|
|
log "SSH key generated at $key"
|
|
log "Public key: $(cat "$key.pub")"
|
|
fi
|
|
fi
|