chore: harden bootstrap flow and add CI validation

Author: liamvibecodes

.github/workflows/validate.yml

@@ -0,0 +1,25 @@
+name: Validate
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Validate shell scripts
+        run: |
+          bash -n bootstrap.sh
+          while IFS= read -r -d '' f; do
+            bash -n "$f"
+          done < <(find scripts -type f -name '*.sh' -print0)
+
+      - name: Validate compose config
+        run: |
+          cp .env.example .env
+          docker compose --profile autoupdate config >/dev/null
+          rm .env

bootstrap.sh

@@ -2,7 +2,7 @@
 # Mac Media Stack - One-Shot Installer
 # Usage: curl -fsSL https://raw.githubusercontent.com/liamvibecodes/mac-media-stack/main/bootstrap.sh | bash
 
-set -e
+set -euo pipefail
 
 RED='\033[0;31m'
 GREEN='\033[0;32m'
@@ -47,7 +47,12 @@ echo ""
 INSTALL_DIR="$HOME/mac-media-stack"
 if [[ -d "$INSTALL_DIR" ]]; then
     echo -e "${YELLOW}Note:${NC} $INSTALL_DIR already exists. Pulling latest..."
-    cd "$INSTALL_DIR" && git pull --ff-only 2>/dev/null || true
+    if ! git -C "$INSTALL_DIR" pull --ff-only; then
+        echo -e "${RED}Failed to update existing repo at $INSTALL_DIR.${NC}"
+        echo "Resolve local git issues, then re-run bootstrap."
+        echo "Suggested check: cd $INSTALL_DIR && git status"
+        exit 1
+    fi
 else
     echo -e "${CYAN}Cloning repo...${NC}"
     git clone https://github.com/liamvibecodes/mac-media-stack.git "$INSTALL_DIR"
@@ -69,7 +74,8 @@ if grep -q "your_wireguard_private_key_here" .env 2>/dev/null; then
     echo "You need your ProtonVPN WireGuard credentials."
     echo "If someone gave you a private key and address, enter them now."
     echo ""
-    read -p "  WireGuard Private Key: " vpn_key
+    read -s -p "  WireGuard Private Key: " vpn_key
+    echo ""
     read -p "  WireGuard Address (e.g. 10.2.0.2/32): " vpn_addr
 
     if [[ -n "$vpn_key" && -n "$vpn_addr" ]]; then

scripts/install-auto-heal.sh

@@ -1,14 +1,18 @@
 #!/bin/bash
 # Installs the auto-heal launchd job (runs hourly).
 
-set -e
+set -euo pipefail
 
 GREEN='\033[0;32m'
 NC='\033[0m'
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+LAUNCH_DIR="$HOME/Library/LaunchAgents"
+LOG_DIR="$HOME/Media/logs/launchd"
 PLIST_NAME="com.media-stack.auto-heal"
-PLIST_PATH="$HOME/Library/LaunchAgents/$PLIST_NAME.plist"
+PLIST_PATH="$LAUNCH_DIR/$PLIST_NAME.plist"
+
+mkdir -p "$LAUNCH_DIR" "$LOG_DIR"
 
 cat > "$PLIST_PATH" <<EOF
 <?xml version="1.0" encoding="UTF-8"?>
@@ -27,9 +31,9 @@ cat > "$PLIST_PATH" <<EOF
     <key>RunAtLoad</key>
     <true/>
     <key>StandardOutPath</key>
-    <string>/dev/null</string>
+    <string>$LOG_DIR/auto-heal.out.log</string>
     <key>StandardErrorPath</key>
-    <string>/dev/null</string>
+    <string>$LOG_DIR/auto-heal.err.log</string>
 </dict>
 </plist>
 EOF
@@ -38,6 +42,6 @@ launchctl unload "$PLIST_PATH" 2>/dev/null || true
 launchctl load "$PLIST_PATH"
 
 echo -e "${GREEN}Auto-heal installed.${NC} Runs every hour + on login."
-echo "Logs: ~/Media/logs/auto-heal.log"
+echo "Logs: ~/Media/logs/auto-heal.log and ~/Media/logs/launchd/"
 echo ""
 echo "To uninstall: launchctl unload $PLIST_PATH && rm $PLIST_PATH"