Move exit-condition script to expected URL path + persistent marker

[george-elphick-talieisin]

Why

The SecondSon Baseline lifecycle script reference rendered by the Terraform secondson-baseline.mobileconfig.tpl expects the script at:

https://raw.githubusercontent.com/Talieisin/macos-scripts/main/scripts/lib/exit-condition.sh

Previously the script lived at config/baseline_exit_condition.sh, so production ADE devices got 404s on download and Baseline's lifecycle Scripts array reported "Script does not exist" / "Script download error". Test framework saw it too as not ok 14 Baseline apps installed successfully (no failures).

Changes

• Renames config/baseline_exit_condition.sh → scripts/lib/exit-condition.sh (git tracks as rename)
• Changes the marker file path from /usr/local/Baseline/baseline_exit_condition (which Baseline's CleanupAfterUse=true deletes immediately after the successful run, defeating the whole mechanism) to /var/db/.talieisin-baseline-complete
  • /var/db/ persists across reboots and Baseline's own cleanup
  • Cleared on device wipe → correct re-run behaviour on re-enrolment
  • Cleared by sudo rm → escape hatch for IT support

Coupled changes in Talieisin/intune (will land separately)

The marker path is now the single source of truth referenced from two places in the intune working tree:

• var.baseline_exit_condition default → rendered as ExitCondition in SecondSon mobileconfig (Baseline checks before doing anything)
• bootstrap.sh Phase 3 short-circuit → skips pkg install + Baseline launch entirely if marker exists (defense-in-depth)

Both will point at /var/db/.talieisin-baseline-complete to match this script.

Important

This file must stay byte-identical to scripts/lib/exit-condition.sh in the Talieisin/intune working tree. The Terraform-rendered SecondSon mobileconfig pins the script's MD5, so any drift makes Baseline reject the download. Current MD5: 2e6894a49ca224e4bab4a9e0e2fe88f2.

Test plan

• CI / gitleaks workflow passes
• Visual diff confirms only the marker path string changed (plus expanded header comment)
• After this lands and the intune side is published, ADE devices should see Baseline lifecycle Scripts array complete without "Script download error"

[Copilot]

Pull request overview

This PR updates the SecondSon Baseline “exit condition” script to write a persistent completion marker outside Baseline’s cleanup directory so Baseline can reliably short-circuit on subsequent runs.

Changes:

• Expanded header documentation clarifying ordering requirements and why the marker must live outside /usr/local/Baseline/.
• Changed the marker file path to /var/db/.talieisin-baseline-complete so it persists across Baseline cleanup.

Comments suppressed due to low confidence (1)

scripts/lib/exit-condition.sh:5

• PR description says this change renames/moves the script from config/baseline_exit_condition.sh to scripts/lib/exit-condition.sh so it can be fetched from the expected raw GitHub URL, but this PR diff only updates content within scripts/lib/exit-condition.sh and does not include a file move/rename. If the move is still required for production to stop 404s, please include it in this PR (or update the PR description if it already happened elsewhere).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.