From 08d5800e47ee998e6da6822b7bf5218caf4f9d9c Mon Sep 17 00:00:00 2001
From: mike <mike@noninjas.com>
Date: Mon, 28 Jul 2025 06:11:39 +0000
Subject: [PATCH] Update setup-auto-updates.sh

---
 setup-auto-updates.sh | 36 ++++++++++++++++++++++--------------
 1 file changed, 22 insertions(+), 14 deletions(-)

diff --git a/setup-auto-updates.sh b/setup-auto-updates.sh
index 12339dc..46c6970 100644
--- a/setup-auto-updates.sh
+++ b/setup-auto-updates.sh
@@ -54,17 +54,16 @@ wait_for_apt() {
 }
 
 prompt_update_scope() {
-  # Honor env/CI first
-  if [[ -n "$UPDATE_SCOPE" ]]; then
+  # Honor env override first (supports: all, full, security)
+  if [[ -n "${UPDATE_SCOPE:-}" ]]; then
     case "${UPDATE_SCOPE,,}" in
-      all|security) ;;  # ok
-      *) echo "[ERROR] UPDATE_SCOPE must be 'all' or 'security'"; exit 1 ;;
+      all|full)  UPDATE_SCOPE="all";     echo "[INFO] Update scope (from env): ALL"; return 0 ;;
+      security)  UPDATE_SCOPE="security"; echo "[INFO] Update scope (from env): SECURITY-only"; return 0 ;;
+      *) echo "[ERROR] UPDATE_SCOPE must be 'all' (or 'full') or 'security'."; exit 1 ;;
     esac
-    echo "[INFO] Update scope (from env): $UPDATE_SCOPE"
-    return 0
   fi
 
-  # If non-interactive, default to ALL
+  # Non-interactive (no TTY): default to Full
   if [[ ! -t 0 ]]; then
     UPDATE_SCOPE="all"
     echo "[INFO] Non-interactive session: defaulting to ALL updates."
@@ -72,15 +71,24 @@ prompt_update_scope() {
   fi
 
   echo
-  read -r -p "Enable installation of ALL updates (not just security)? [Y/n] " reply
-  case "$reply" in
-    ""|[yY]|[yY][eE][sS]) UPDATE_SCOPE="all" ;;
-    [nN]|[nN][oO])        UPDATE_SCOPE="security" ;;
-    *)                    UPDATE_SCOPE="all" ;;  # default
-  esac
-  echo "[INFO] Chosen update scope: $UPDATE_SCOPE"
+  echo "Configure automatic updates. Choose one:"
+  echo "  1) Full updates — install regular and security updates from your distro"
+  echo "     (recommended for most systems; includes -updates and -security pockets)."
+  echo "  2) Security-only — install only security updates from your distro"
+  echo "     (fewer changes; functional fixes may be delayed)."
+  echo
+
+  while true; do
+    read -r -p "Select [1/2] (default: 1): " choice
+    case "$choice" in
+      ""|1) UPDATE_SCOPE="all";      echo "[INFO] Chosen update scope: ALL"; break ;;
+      2)    UPDATE_SCOPE="security"; echo "[INFO] Chosen update scope: SECURITY-only"; break ;;
+      *)    echo "Please enter 1 or 2."; ;;
+    esac
+  done
 }
 
+
 apt_refresh_and_install() {
   wait_for_apt || true
   echo "[INFO] Updating APT cache…"