fix: Immich v2.7.5 compat, supply-chain hardening, and quality fixes (0.5.2) (#23)

* fix: Immich v2.7.5 compat, supply-chain hardening, and quality fixes (0.5.2)

- Remove assetCount pre-filter broken by Immich v2.7.5 API change; check
  MIN_FACE_COUNT after fetch_all_assets instead
- Replace curl|sh uv installer with COPY --from Docker stage (supply chain)
- Fix HEALTHCHECK to use kill -0 on PID file instead of static file test
- Fix CONFIG_FILE path to resolve inside DATA_DIR for volume persistence
- Fix EmbeddingCache singleton to re-init when cache_dir changes
- Fix fd leak in _suppress_output() with nested finally closes
- Fix silent exception on SQLite connection close in upload_tracker
- Log unexpected Frigate API keys at DEBUG in get_all_frigate_person_files
- Add reconcile FIFO-mapping debug log
- Pin all CI action SHAs; update setup-uv v8.2.0, upload/download-artifact,
  ruff-action v4.0.0

* chore: update lockfile

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

scheduler.py

@@ -15,36 +15,46 @@ except ImportError:
 # resident in memory across all subsequent scheduled runs.
 from winnow.cli import main
 
-SCHEDULE = os.environ["CRON_SCHEDULE"]
-INSIGHTFACE_HOME = os.environ.get("INSIGHTFACE_HOME", "/models/.insightface")
-
 logger = logging.getLogger(__name__)
 
 
-def check_models() -> None:
-    buffalo = Path(INSIGHTFACE_HOME) / "models" / "buffalo_l"
+def _check_models() -> None:
+    insightface_home = os.environ.get("INSIGHTFACE_HOME", "/models/.insightface")
+    buffalo = Path(insightface_home) / "models" / "buffalo_l"
     if not buffalo.exists():
         print("  InsightFace Buffalo_L not found — will download on first run", flush=True)
 
 
-NOW = time.time()
-cron = croniter(SCHEDULE, NOW)
-next_run = cron.get_next(float)
-print(f"Next run: {time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(next_run))}", flush=True)
+def _run_scheduler() -> None:
+    schedule = os.environ.get("CRON_SCHEDULE")
+    if not schedule:
+        print("Error: CRON_SCHEDULE environment variable is required.", flush=True)
+        sys.exit(1)
+
+    Path("/tmp/winnow.pid").write_text(str(os.getpid()))
 
-while True:
     now = time.time()
-    if now >= next_run:
-        print(f"\n[{time.strftime('%Y-%m-%d %H:%M:%S')}] Starting winnow run...", flush=True)
-        check_models()
-        try:
-            main()
-            print("winnow run complete", flush=True)
-        except KeyboardInterrupt:
-            raise
-        except Exception as e:
-            logger.error("winnow run failed: %s", e, exc_info=True)
-            print(f"winnow run failed: {e}", flush=True)
-        next_run = cron.get_next(float)
-        print(f"Next run: {time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(next_run))}", flush=True)
-    time.sleep(max(1, next_run - time.time()))
+    cron = croniter(schedule, now)
+    next_run = cron.get_next(float)
+    print(f"Next run: {time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(next_run))}", flush=True)
+
+    while True:
+        now = time.time()
+        if now >= next_run:
+            print(f"\n[{time.strftime('%Y-%m-%d %H:%M:%S')}] Starting winnow run...", flush=True)
+            _check_models()
+            try:
+                main()
+                print("winnow run complete", flush=True)
+            except KeyboardInterrupt:
+                raise
+            except Exception as e:
+                logger.error("winnow run failed: %s", e, exc_info=True)
+                print(f"winnow run failed: {e}", flush=True)
+            next_run = cron.get_next(float)
+            print(f"Next run: {time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(next_run))}", flush=True)
+        time.sleep(max(1, next_run - time.time()))
+
+
+if __name__ == "__main__":
+    _run_scheduler()