#!/usr/bin/env bash
# updates_check.sh — pending apt security updates and reboot-required flag.
set -euo pipefail

SECURITY=0
REBOOT=0

if command -v apt >/dev/null 2>&1; then
  apt update -qq >/dev/null 2>&1 || true
  SECURITY=$(apt list --upgradable 2>/dev/null | grep -c '\-security' || true)
fi

if [ -f /var/run/reboot-required ]; then
  REBOOT=1
fi

echo "{\"health\":\"healthy\",\"metrics\":{\"security_updates\":$SECURITY,\"reboot_required\":$REBOOT}}"