automatic_updates.install

@@ -30,7 +30,7 @@ function automatic_updates_requirements($phase) {
 
     // Check that site has cron updates enabled or not.
     // @todo Remove in https://www.drupal.org/project/automatic_updates/issues/3284443
-    if (\Drupal::configFactory()->get('automatic_updates.settings')->get('cron') !== CronUpdateStage::DISABLED) {
+    if (\Drupal::configFactory()->get('automatic_updates.settings')->get('unattended.level') !== CronUpdateStage::DISABLED) {
       $requirements['automatic_updates_cron'] = [
         'title' => t('Cron installs updates automatically'),
         'severity' => SystemManager::REQUIREMENT_WARNING,

automatic_updates.module

@@ -9,6 +9,7 @@ declare(strict_types = 1);
 
 use Drupal\automatic_updates\BatchProcessor;
 use Drupal\automatic_updates\CronUpdateStage;
+use Drupal\automatic_updates\Validator\AutomatedCronDisabledValidator;
 use Drupal\Core\Routing\RouteMatchInterface;
 use Drupal\automatic_updates\Validation\AdminStatusCheckMessages;
 use Drupal\Core\Url;
@@ -165,7 +166,22 @@ function automatic_updates_module_implements_alter(&$implementations, $hook) {
 function automatic_updates_cron() {
   // @todo Refactor this after https://www.drupal.org/project/drupal/issues/2538292
   // @todo Remove this after https://www.drupal.org/project/drupal/issues/3318964
-  if (defined('MAINTENANCE_MODE') || stripos($_SERVER['PHP_SELF'], 'update.php') !== FALSE) {
+  // We don't want to run status checks if we're on the command line, because
+  // if unattended updates are configured to run via the web, running status
+  // checks on the command line could cause invalid results to get cached.
+  if (defined('MAINTENANCE_MODE') || stripos($_SERVER['PHP_SELF'], 'update.php') !== FALSE || CronUpdateStage::isCommandLine()) {
+    return;
+  }
+
+  /** @var \Drupal\automatic_updates\Validator\AutomatedCronDisabledValidator $automated_cron_validator */
+  $automated_cron_validator = \Drupal::service(AutomatedCronDisabledValidator::class);
+  if ($automated_cron_validator->hasTerminateBeenCalled()) {
+    // Running updates and status checks will not work during kernel
+    // termination.
+    \Drupal::logger('automatic_updates')
+      ->info('Unattended automatic updates were triggered by Automated Cron, which is not supported. No update was performed. See the <a href=":url">status report</a> for more information.', [
+        ':url' => Url::fromRoute('system.status')->toString(),
+      ]);
     return;
   }
 

automatic_updates.services.yml

@@ -67,6 +67,9 @@ services:
       $lock: '@lock'
     tags:
       - { name: event_subscriber }
+  Drupal\automatic_updates\Validator\AutomatedCronDisabledValidator:
+    tags:
+      - { name: event_subscriber }
   automatic_updates.validator.staged_database_updates:
     class: Drupal\automatic_updates\Validator\StagedDatabaseUpdateValidator
     tags:

config/install/automatic_updates.settings.yml

-cron: disable
+unattended:
+  method: web
+  level: disable
 allow_core_minor_updates: false
 status_check_mail: errors_only

config/schema/automatic_updates.schema.yml

@@ -2,9 +2,22 @@ automatic_updates.settings:
   type: config_object
   label: 'Automatic Updates settings'
   mapping:
-    cron:
-      type: string
-      label: 'Enable automatic updates during cron'
+    unattended:
+      type: mapping
+      label: 'Settings for unattended update'
+      mapping:
+        method:
+          type: string
+          label: 'Method of running unattended updates'
+          constraints:
+            NotNull: []
+            Choice: [console, web]
+        level:
+          type: string
+          label: 'Which level of unattended updates to perform'
+          constraints:
+            NotNull: []
+            Choice: [disable, security, patch]
     cron_port:
       type: integer
       label: 'Port to use for finalization sub-request'

src/Commands/AutomaticUpdatesCommands.php

@@ -5,6 +5,9 @@ declare(strict_types = 1);
 namespace Drupal\automatic_updates\Commands;
 
 use Drupal\automatic_updates\DrushUpdateStage;
+use Drupal\automatic_updates\StatusCheckMailer;
+use Drupal\automatic_updates\Validation\StatusChecker;
+use Drupal\Core\Config\ConfigFactoryInterface;
 use Drush\Commands\DrushCommands;
 
 /**
@@ -22,8 +25,19 @@ final class AutomaticUpdatesCommands extends DrushCommands {
    *
    * @param \Drupal\automatic_updates\DrushUpdateStage $stage
    *   The console cron updater service.
+   * @param \Drupal\automatic_updates\Validation\StatusChecker $statusChecker
+   *   The status checker service.
+   * @param \Drupal\automatic_updates\StatusCheckMailer $statusCheckMailer
+   *   The status check mailer service.
+   * @param \Drupal\Core\Config\ConfigFactoryInterface $configFactory
+   *   The config factory service.
    */
-  public function __construct(private readonly DrushUpdateStage $stage) {
+  public function __construct(
+    private readonly DrushUpdateStage $stage,
+    private readonly StatusChecker $statusChecker,
+    private readonly StatusCheckMailer $statusCheckMailer,
+    private readonly ConfigFactoryInterface $configFactory,
+  ) {
     parent::__construct();
   }
 
@@ -60,6 +74,7 @@ final class AutomaticUpdatesCommands extends DrushCommands {
 
       $io->info('Running post-apply tasks and final clean-up...');
       $this->stage->handlePostApply($options['stage-id'], $options['from-version'], $options['to-version']);
+      $this->runStatusChecks();
     }
     else {
       if ($this->stage->getMode() === DrushUpdateStage::DISABLED) {
@@ -75,8 +90,24 @@ final class AutomaticUpdatesCommands extends DrushCommands {
       }
       else {
         $io->info("There is no Drupal core update available.");
+        $this->runStatusChecks();
       }
     }
   }
 
+  /**
+   * Runs status checks, and sends failure notifications if necessary.
+   */
+  private function runStatusChecks(): void {
+    $method = $this->configFactory->get('automatic_updates.settings')
+      ->get('unattended.method');
+
+    // To ensure consistent results, only run the status checks if we're
+    // explicitly configured to do unattended updates on the command line.
+    if ($method === 'console') {
+      $last_results = $this->statusChecker->getResults();
+      $this->statusCheckMailer->sendFailureNotifications($last_results, $this->statusChecker->run()->getResults());
+    }
+  }
+
 }

src/CronUpdateStage.php

@@ -40,6 +40,13 @@ use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
  */
 class CronUpdateStage extends UpdateStage implements CronInterface {
 
+  /**
+   * The current interface between PHP and the server.
+   *
+   * @var string
+   */
+  private static $serverApi = PHP_SAPI;
+
   /**
    * All automatic updates are disabled.
    *
@@ -121,6 +128,16 @@ class CronUpdateStage extends UpdateStage implements CronInterface {
     parent::__construct($composerInspector, $pathLocator, $beginner, $stager, $committer, $fileSystem, $eventDispatcher, $tempStoreFactory, $time, $pathFactory, $failureMarker);
   }
 
+  /**
+   * Indicates if we are currently running at the command line.
+   *
+   * @return bool
+   *   TRUE if we are running at the command line, otherwise FALSE.
+   */
+  final public static function isCommandLine(): bool {
+    return self::$serverApi === 'cli';
+  }
+
   /**
    * Handles updates during cron.
    *
@@ -392,7 +409,7 @@ class CronUpdateStage extends UpdateStage implements CronInterface {
    *     allowed during cron.
    */
   final public function getMode(): string {
-    $mode = $this->configFactory->get('automatic_updates.settings')->get('cron');
+    $mode = $this->configFactory->get('automatic_updates.settings')->get('unattended.level');
     return $mode ?: static::SECURITY;
   }
 
@@ -400,7 +417,14 @@ class CronUpdateStage extends UpdateStage implements CronInterface {
    * {@inheritdoc}
    */
   public function run() {
-    if ($this->handleCron()) {
+    $method = $this->configFactory->get('automatic_updates.settings')
+      ->get('unattended.method');
+
+    // If we are configured to run updates via the web, and we're actually being
+    // accessed via the web (i.e., anything that isn't the command line), go
+    // ahead and try to do the update. In all other circumstances, just run the
+    // normal cron handler.
+    if ($method === 'web' && !self::isCommandLine() && $this->handleCron()) {
       return TRUE;
     }
     return $this->inner->run();

src/Validation/AdminStatusCheckMessages.php

@@ -5,6 +5,7 @@ declare(strict_types = 1);
 namespace Drupal\automatic_updates\Validation;
 
 use Drupal\automatic_updates\CronUpdateStage;
+use Drupal\Core\Config\ConfigFactoryInterface;
 use Drupal\Core\DependencyInjection\ContainerInjectionInterface;
 use Drupal\Core\Messenger\MessengerInterface;
 use Drupal\Core\Messenger\MessengerTrait;
@@ -49,6 +50,8 @@ final class AdminStatusCheckMessages implements ContainerInjectionInterface {
    *   The cron update stage service.
    * @param \Drupal\Core\Render\RendererInterface $renderer
    *   The renderer service.
+   * @param \Drupal\Core\Config\ConfigFactoryInterface $configFactory
+   *   The config factory service.
    */
   public function __construct(
     private readonly StatusChecker $statusChecker,
@@ -56,7 +59,8 @@ final class AdminStatusCheckMessages implements ContainerInjectionInterface {
     private readonly AccountProxyInterface $currentUser,
     private readonly CurrentRouteMatch $currentRouteMatch,
     private readonly CronUpdateStage $stage,
-    private readonly RendererInterface $renderer
+    private readonly RendererInterface $renderer,
+    private readonly ConfigFactoryInterface $configFactory
   ) {}
 
   /**
@@ -69,7 +73,8 @@ final class AdminStatusCheckMessages implements ContainerInjectionInterface {
       $container->get('current_user'),
       $container->get('current_route_match'),
       $container->get('automatic_updates.cron_update_stage'),
-      $container->get('renderer')
+      $container->get('renderer'),
+      $container->get('config.factory')
     );
   }
 
@@ -81,12 +86,21 @@ final class AdminStatusCheckMessages implements ContainerInjectionInterface {
       return;
     }
     if ($this->statusChecker->getResults() === NULL) {
+      $method = $this->configFactory->get('automatic_updates.settings')
+        ->get('unattended.method');
+
       $checker_url = Url::fromRoute('automatic_updates.status_check')->setOption('query', $this->getDestinationArray());
-      if ($checker_url->access()) {
+      if ($method === 'web' && $checker_url->access()) {
         $this->messenger()->addError($this->t('Your site has not recently run an update readiness check. <a href=":url">Rerun readiness checks now.</a>', [
           ':url' => $checker_url->toString(),
         ]));
       }
+      elseif ($method === 'console') {
+        // @todo Link to the documentation on how to set up unattended updates
+        //   via the terminal in https://drupal.org/i/3362695.
+        $message = $this->t('Unattended updates are configured to run via the console, but not appear to have run recently.');
+        $this->messenger()->addError($message);
+      }
     }
     else {
       // Display errors, if there are any. If there aren't, then display

src/Validation/StatusCheckRequirements.php

@@ -4,6 +4,7 @@ declare(strict_types = 1);
 
 namespace Drupal\automatic_updates\Validation;
 
+use Drupal\Core\Config\ConfigFactoryInterface;
 use Drupal\Core\Datetime\DateFormatterInterface;
 use Drupal\Core\DependencyInjection\ContainerInjectionInterface;
 use Drupal\Core\StringTranslation\StringTranslationTrait;
@@ -33,10 +34,13 @@ final class StatusCheckRequirements implements ContainerInjectionInterface {
    *   The status checker service.
    * @param \Drupal\Core\Datetime\DateFormatterInterface $dateFormatter
    *   The date formatter service.
+   * @param \Drupal\Core\Config\ConfigFactoryInterface $configFactory
+   *   The config factory service.
    */
   public function __construct(
     private readonly StatusChecker $statusChecker,
-    private readonly DateFormatterInterface $dateFormatter
+    private readonly DateFormatterInterface $dateFormatter,
+    private readonly ConfigFactoryInterface $configFactory,
   ) {}
 
   /**
@@ -45,10 +49,23 @@ final class StatusCheckRequirements implements ContainerInjectionInterface {
   public static function create(ContainerInterface $container): self {
     return new static(
       $container->get('automatic_updates.status_checker'),
-      $container->get('date.formatter')
+      $container->get('date.formatter'),
+      $container->get('config.factory'),
     );
   }
 
+  /**
+   * Returns the method used to run unattended updates.
+   *
+   * @return string
+   *   The method used to run unattended updates. Will be either 'console' or
+   *   'web'.
+   */
+  private function getMethod(): string {
+    return $this->configFactory->get('automatic_updates.settings')
+      ->get('unattended.method');
+  }
+
   /**
    * Gets requirements arrays as specified in hook_requirements().
    *
@@ -56,8 +73,26 @@ final class StatusCheckRequirements implements ContainerInjectionInterface {
    *   Requirements arrays as specified by hook_requirements().
    */
   public function getRequirements(): array {
-    $results = $this->statusChecker->run()->getResults();
     $requirements = [];
+
+    $results = $this->statusChecker->getResults();
+    // If unattended updates are run on the terminal, we don't want to do the
+    // status check right now, since running them over the web may yield
+    // inaccurate or irrelevant results. The console command runs status checks,
+    // so if there are no results, we can assume it has not been run in a while,
+    // and raise an error about that.
+    if (is_null($results) && $this->getMethod() === 'console') {
+      $requirements['automatic_updates_status_check_console_command_not_run'] = [
+        'title' => $this->t('Update readiness checks'),
+        'severity' => SystemManager::REQUIREMENT_ERROR,
+        // @todo Link to the documentation on how to set up unattended updates
+        //   via the terminal in https://drupal.org/i/3362695.
+        'value' => $this->t('Unattended updates are configured to run via the console, but do not appear to have run recently.'),
+      ];
+      return $requirements;
+    }
+
+    $results ??= $this->statusChecker->run()->getResults();
     if (empty($results)) {
       $requirements['automatic_updates_status_check'] = [
         'title' => $this->t('Update readiness checks'),
@@ -144,6 +179,11 @@ final class StatusCheckRequirements implements ContainerInjectionInterface {
    *   NULL.
    */
   protected function createRunLink(): ?TranslatableMarkup {
+    // Only show this link if unattended updates are being run over the web.
+    if ($this->getMethod() !== 'web') {
+      return NULL;
+    }
+
     $status_check_url = Url::fromRoute('automatic_updates.status_check');
     if ($status_check_url->access()) {
       return $this->t(

src/Validation/StatusChecker.php

@@ -154,13 +154,15 @@ final class StatusChecker implements EventSubscriberInterface {
       $this->clearStoredResults();
     }
     elseif ($config->getName() === 'automatic_updates.settings') {
+      // If anything about how we run unattended updates has changed, clear the
+      // stored results, since they can be affected by these settings.
+      if ($event->isChanged('unattended')) {
+        $this->clearStoredResults();
+      }
       // We only send status check failure notifications if unattended updates
       // are enabled. If notifications were previously disabled but have been
       // re-enabled, or their sensitivity level has changed, clear the stored
       // results so that we'll send accurate notifications next time cron runs.
-      if ($event->isChanged('cron') && $config->getOriginal('cron') === CronUpdateStage::DISABLED) {
-        $this->clearStoredResults();
-      }
       elseif ($event->isChanged('status_check_mail') && $config->get('status_check_mail') !== StatusCheckMailer::DISABLED) {
         $this->clearStoredResults();
       }

src/Validator/AutomatedCronDisabledValidator.php

+<?php
+
+declare(strict_types = 1);
+
+namespace Drupal\automatic_updates\Validator;
+
+use Drupal\automatic_updates\CronUpdateStage;
+use Drupal\Core\Extension\ModuleHandlerInterface;
+use Drupal\Core\StringTranslation\StringTranslationTrait;
+use Drupal\package_manager\Event\StatusCheckEvent;
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+use Symfony\Component\HttpKernel\KernelEvents;
+
+/**
+ * Ensures that updates cannot be triggered by Automated Cron.
+ *
+ * @internal
+ *   This is an internal part of Automatic Updates and may be changed or removed
+ *   at any time without warning. External code should not interact with this
+ *   class.
+ */
+final class AutomatedCronDisabledValidator implements EventSubscriberInterface {
+
+  use StringTranslationTrait;
+
+  /**
+   * Flags whether the KernelEvents::TERMINATE event has been dispatched.
+   *
+   * @var bool
+   */
+  private bool $terminateCalled = FALSE;
+
+  /**
+   * AutomatedCronDisabledValidator constructor.
+   *
+   * @param \Drupal\Core\Extension\ModuleHandlerInterface $moduleHandler
+   *   The module handler.
+   */
+  public function __construct(
+    private readonly ModuleHandlerInterface $moduleHandler,
+  ) {}
+
+  /**
+   * Checks that Automated Cron is not going to trigger unattended updates.
+   *
+   * @param \Drupal\package_manager\Event\StatusCheckEvent $event
+   *   The event being handled.
+   */
+  public function validateStatusCheck(StatusCheckEvent $event): void {
+    if ($event->stage instanceof CronUpdateStage && $this->moduleHandler->moduleExists('automated_cron')) {
+      $event->addWarning([
+        $this->t('This site has the Automated Cron module installed. To use unattended automatic updates, please configure cron manually on your hosting environment. The Automatic Updates module will not do anything if it is triggered by Automated Cron. See the <a href=":url">Automated Cron documentation</a> for information.', [
+          ':url' => 'https://www.drupal.org/docs/administering-a-drupal-site/cron-automated-tasks/cron-automated-tasks-overview#s-more-reliable-enable-cron-using-external-trigger',
+        ]),
+      ]);
+    }
+  }
+
+  /**
+   * {@inheritdoc}
+   */
+  public static function getSubscribedEvents(): array {
+    return [
+      StatusCheckEvent::class => 'validateStatusCheck',
+      // Ensure this runs before
+      // \Drupal\automated_cron\EventSubscriber\AutomatedCron::onTerminate().
+      KernelEvents::TERMINATE => ['setTerminateCalled', PHP_INT_MAX],
+    ];
+  }
+
+  /**
+   * Sets a flag is when the kernel terminates.
+   */
+  public function setTerminateCalled(): void {
+    $this->terminateCalled = TRUE;
+  }
+
+  /**
+   * Determines whether the kernel has terminated.
+   *
+   * @return bool
+   *   TRUE if the kernel has terminated (i.e., KernelEvents::TERMINATE has been
+   *   handled), otherwise FALSE.
+   */
+  public function hasTerminateBeenCalled(): bool {
+    return $this->terminateCalled;
+  }
+
+}

src/Validator/CronFrequencyValidator.php

@@ -7,11 +7,9 @@ namespace Drupal\automatic_updates\Validator;
 use Drupal\automatic_updates\CronUpdateStage;
 use Drupal\Component\Datetime\TimeInterface;
 use Drupal\Core\Config\ConfigFactoryInterface;
-use Drupal\Core\Extension\ModuleHandlerInterface;
 use Drupal\Core\Lock\LockBackendInterface;
 use Drupal\Core\State\StateInterface;
 use Drupal\Core\StringTranslation\StringTranslationTrait;
-use Drupal\Core\Url;
 use Drupal\package_manager\Event\StatusCheckEvent;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 
@@ -23,7 +21,7 @@ use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  *   at any time without warning. External code should not interact with this
  *   class.
  */
-class CronFrequencyValidator implements EventSubscriberInterface {
+final class CronFrequencyValidator implements EventSubscriberInterface {
 
   use StringTranslationTrait;
 
@@ -59,8 +57,6 @@ class CronFrequencyValidator implements EventSubscriberInterface {
    *
    * @param \Drupal\Core\Config\ConfigFactoryInterface $configFactory
    *   The config factory service.
-   * @param \Drupal\Core\Extension\ModuleHandlerInterface $moduleHandler
-   *   The module handler.
    * @param \Drupal\Core\State\StateInterface $state
    *   The state service.
    * @param \Drupal\Component\Datetime\TimeInterface $time
@@ -70,19 +66,18 @@ class CronFrequencyValidator implements EventSubscriberInterface {
    */
   public function __construct(
     private readonly ConfigFactoryInterface $configFactory,
-    private readonly ModuleHandlerInterface $moduleHandler,
     private readonly StateInterface $state,
     private readonly TimeInterface $time,
     private readonly LockBackendInterface $lock,
   ) {}
 
   /**
-   * Validates that cron runs frequently enough to perform automatic updates.
+   * Validates the cron frequency according to the last cron run time.
    *
    * @param \Drupal\package_manager\Event\StatusCheckEvent $event
    *   The event object.
    */
-  public function checkCronFrequency(StatusCheckEvent $event): void {
+  public function validateLastCronRun(StatusCheckEvent $event): void {
     // We only want to do this check if the stage belongs to Automatic Updates.
     if (!$event->stage instanceof CronUpdateStage) {
       return;
@@ -92,43 +87,6 @@ class CronFrequencyValidator implements EventSubscriberInterface {
     if ($event->stage->getMode() === CronUpdateStage::DISABLED) {
       return;
     }
-    elseif ($this->moduleHandler->moduleExists('automated_cron')) {
-      $this->validateAutomatedCron($event);
-    }
-    else {
-      $this->validateLastCronRun($event);
-    }
-  }
-
-  /**
-   * Validates the cron frequency according to Automated Cron settings.
-   *
-   * @param \Drupal\package_manager\Event\StatusCheckEvent $event
-   *   The event object.
-   */
-  protected function validateAutomatedCron(StatusCheckEvent $event): void {
-    $message = $this->t('Cron is not set to run frequently enough. <a href=":configure">Configure it</a> to run at least every @frequency hours or disable automated cron and run it via an external scheduling system.', [
-      ':configure' => Url::fromRoute('system.cron_settings')->toString(),
-      '@frequency' => static::SUGGESTED_INTERVAL,
-    ]);
-
-    $interval = $this->configFactory->get('automated_cron.settings')->get('interval');
-
-    if ($interval > static::ERROR_INTERVAL) {
-      $event->addError([$message]);
-    }
-    elseif ($interval > static::WARNING_INTERVAL) {
-      $event->addWarning([$message]);
-    }
-  }
-
-  /**
-   * Validates the cron frequency according to the last cron run time.
-   *
-   * @param \Drupal\package_manager\Event\StatusCheckEvent $event
-   *   The event object.
-   */
-  protected function validateLastCronRun(StatusCheckEvent $event): void {
     // If cron is running right now, cron is clearly being run recently enough!
     if (!$this->lock->lockMayBeAvailable('cron')) {
       return;
@@ -152,7 +110,7 @@ class CronFrequencyValidator implements EventSubscriberInterface {
    */
   public static function getSubscribedEvents(): array {
     return [
-      StatusCheckEvent::class => 'checkCronFrequency',
+      StatusCheckEvent::class => 'validateLastCronRun',
     ];
   }
 

tests/modules/automatic_updates_test_cron/automatic_updates_test_cron.module

@@ -37,7 +37,7 @@ function automatic_updates_test_cron_form_update_settings_alter(array &$form, Fo
       CronUpdateStage::ALL => t('All supported updates'),
       CronUpdateStage::SECURITY => t('Security updates only'),
     ],
-    '#default_value' => \Drupal::config('automatic_updates.settings')->get('cron'),
+    '#default_value' => \Drupal::config('automatic_updates.settings')->get('unattended.level'),
     '#description' => t(
       'If enabled, Drupal core will be automatically updated when an update is available. Automatic updates are only supported for @current_minor.x versions of Drupal core. Drupal @current_minor will receive security updates until @supported_until_version is released.',
       [
@@ -58,6 +58,6 @@ function automatic_updates_test_cron_form_update_settings_alter(array &$form, Fo
 function _automatic_updates_test_cron_update_settings_form_submit(array &$form, FormStateInterface $form_state) {
   \Drupal::configFactory()
     ->getEditable('automatic_updates.settings')
-    ->set('cron', $form_state->getValue('automatic_updates_cron'))
+    ->set('unattended.level', $form_state->getValue('automatic_updates_cron'))
     ->save();
 }

tests/src/Build/UpdateTestBase.php

@@ -21,7 +21,7 @@ abstract class UpdateTestBase extends TemplateProjectTestBase {
     parent::createTestProject($template);
     // @todo Remove in https://www.drupal.org/project/automatic_updates/issues/3284443
     $code = <<<END
-\$config['automatic_updates.settings']['cron'] = 'security';
+\$config['automatic_updates.settings']['unattended']['level'] = 'security';
 END;
     $this->writeSettings($code);
     // Install Automatic Updates, and other modules needed for testing.
@@ -69,6 +69,7 @@ END;
     $this->visit('/admin/reports/status');
     $mink = $this->getMink();
     $page = $mink->getSession()->getPage();
+    $page->clickLink('Rerun readiness checks');
 
     $readiness_check_summaries = $page->findAll('css', 'summary:contains("Update readiness checks")');
     // There should always either be the summary section indicating the site is

tests/src/Functional/AutomatedCronDisabledValidatorTest.php

+<?php
+
+namespace Drupal\Tests\automatic_updates\Functional;
+
+use Drupal\automatic_updates\CronUpdateStage;
+
+/**
+ * Tests that updates are not run by Automated Cron.
+ *
+ * @covers \Drupal\automatic_updates\Validator\AutomatedCronDisabledValidator
+ * @group automatic_updates
+ */
+class AutomatedCronDisabledValidatorTest extends AutomaticUpdatesFunctionalTestBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected $defaultTheme = 'stark';
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $modules = ['dblog', 'automated_cron'];
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function setUp(): void {
+    parent::setUp();
+    $this->drupalLogin($this->createUser(['access site reports']));
+  }
+
+  /**
+   * Tests that automatic updates are not triggered by Automated Cron.
+   */
+  public function testAutomatedCronUpdate() {
+    // Delete the last cron run time, to ensure that Automated Cron will run.
+    $this->container->get('state')->delete('system.cron_last');
+    $this->config('automatic_updates.settings')
+      ->set('unattended.level', CronUpdateStage::ALL)
+      ->save();
+
+    $this->drupalGet('user');
+    // The `drupalGet()` will not wait for the HTTP kernel to terminate (i.e.,
+    // the `KernelEvents::TERMINATE` event) to complete. Although this event
+    // will likely already be completed, wait 1 second to avoid random test
+    // failures.
+    sleep(1);
+    $this->drupalGet('admin/reports/dblog');
+    $this->assertSession()->elementAttributeContains('css', 'a[title^="Unattended"]', 'title', 'Unattended automatic updates were triggered by Automated Cron, which is not supported. No update was performed. See the status report for more information.');
+  }
+
+}

tests/src/Functional/AutomaticUpdatesFunctionalTestBase.php

@@ -39,7 +39,9 @@ abstract class AutomaticUpdatesFunctionalTestBase extends BrowserTestBase {
     parent::setUp();
     $this->useFixtureDirectoryAsActive(__DIR__ . '/../../../package_manager/tests/fixtures/fake_site');
     // @todo Remove in https://www.drupal.org/project/automatic_updates/issues/3284443
-    $this->config('automatic_updates.settings')->set('cron', CronUpdateStage::SECURITY)->save();
+    $this->config('automatic_updates.settings')
+      ->set('unattended.level', CronUpdateStage::SECURITY)
+      ->save();
   }
 
   /**

tests/src/Functional/StatusCheckTest.php

@@ -127,11 +127,7 @@ class StatusCheckTest extends AutomaticUpdatesFunctionalTestBase {
    */
   public function testStatusChecksOnStatusReport(): void {
     $assert = $this->assertSession();
-
-    // Ensure automated_cron is disabled before installing automatic_updates.
-    // This ensures we are testing that automatic_updates runs the checkers when
-    // the module itself is installed and they weren't run on cron.
-    $this->assertFalse($this->container->get('module_handler')->moduleExists('automated_cron'));
+    $page = $this->getSession()->getPage();
     $this->container->get('module_installer')->install(['automatic_updates', 'automatic_updates_test']);
 
     // If the site is ready for updates, the users will see the same output
@@ -186,49 +182,50 @@ class StatusCheckTest extends AutomaticUpdatesFunctionalTestBase {
     $this->drupalGet('admin/reports/status');
     $this->assertErrors($expected_results);
 
+    $this->drupalLogin($this->checkerRunnerUser);
+    $this->drupalGet('/admin/reports/status');
+
     $expected_results = [
       'error' => $this->createValidationResult(SystemManager::REQUIREMENT_ERROR),
       'warning' => $this->createValidationResult(SystemManager::REQUIREMENT_WARNING),
     ];
     TestSubscriber1::setTestResult($expected_results, StatusCheckEvent::class);
-    // Confirm a new message is displayed if the page is reloaded.
-    $this->getSession()->reload();
-    // On the status page, we should see the summaries and messages, even if
-    // there is only 1 message.
-    $this->assertErrors([$expected_results['error']]);
-    $this->assertWarnings([$expected_results['warning']]);
+    $page->clickLink('Rerun readiness checks');
+    // We should see the summaries and messages, even if there's only 1 message.
+    $this->assertErrors([$expected_results['error']], TRUE);
+    $this->assertWarnings([$expected_results['warning']], TRUE);
 
     // If there's a result with only one message, but no summary, ensure that
     // message is displayed.
     $result = ValidationResult::createError([t('A lone message, with no summary.')]);
     TestSubscriber1::setTestResult([$result], StatusCheckEvent::class);
-    $this->getSession()->reload();
-    $this->assertErrors([$result]);
+    $page->clickLink('Rerun readiness checks');
+    $this->assertErrors([$result], TRUE);
 
     $expected_results = [
       'error' => $this->createValidationResult(SystemManager::REQUIREMENT_ERROR, 2),
       'warning' => $this->createValidationResult(SystemManager::REQUIREMENT_WARNING, 2),
     ];
     TestSubscriber1::setTestResult($expected_results, StatusCheckEvent::class);
-    $this->getSession()->reload();
-    // Confirm that both messages and summaries will be displayed on status
-    // report when there multiple messages.
-    $this->assertErrors([$expected_results['error']]);
-    $this->assertWarnings([$expected_results['warning']]);
+    $page->clickLink('Rerun readiness checks');
+    // Confirm that both messages and summaries will be displayed when there are
+    // multiple messages.
+    $this->assertErrors([$expected_results['error']], TRUE);
+    $this->assertWarnings([$expected_results['warning']], TRUE);
 
     $expected_results = [$this->createValidationResult(SystemManager::REQUIREMENT_WARNING, 2)];
     TestSubscriber1::setTestResult($expected_results, StatusCheckEvent::class);
-    $this->getSession()->reload();
+    $page->clickLink('Rerun readiness checks');
     $assert->pageTextContainsOnce('Update readiness checks');
     // Confirm that warnings will display on the status report if there are no
     // errors.
-    $this->assertWarnings($expected_results);
+    $this->assertWarnings($expected_results, TRUE);
 
     $expected_results = [$this->createValidationResult(SystemManager::REQUIREMENT_WARNING)];
     TestSubscriber1::setTestResult($expected_results, StatusCheckEvent::class);
-    $this->getSession()->reload();
+    $page->clickLink('Rerun readiness checks');
     $assert->pageTextContainsOnce('Update readiness checks');
-    $this->assertWarnings($expected_results);
+    $this->assertWarnings($expected_results, TRUE);
   }
 
   /**
@@ -261,10 +258,6 @@ class StatusCheckTest extends AutomaticUpdatesFunctionalTestBase {
     $assert = $this->assertSession();
     $messages_section_selector = '[data-drupal-messages]';
 
-    // Ensure automated_cron is disabled before installing automatic_updates. This
-    // ensures we are testing that automatic_updates runs the checkers when the
-    // module itself is installed and they weren't run on cron.
-    $this->assertFalse($this->container->get('module_handler')->moduleExists('automated_cron'));
     $this->container->get('module_installer')->install(['automatic_updates', 'automatic_updates_test']);
 
     // If site is ready for updates no message will be displayed on admin pages.
@@ -381,7 +374,9 @@ class StatusCheckTest extends AutomaticUpdatesFunctionalTestBase {
 
     // Confirm status check messages are not displayed when cron updates are
     // disabled.
-    $this->config('automatic_updates.settings')->set('cron', CronUpdateStage::DISABLED)->save();
+    $this->config('automatic_updates.settings')
+      ->set('unattended.level', CronUpdateStage::DISABLED)
+      ->save();
     $this->drupalGet('admin/structure');
     $this->checkForMetaRefresh();
     $assert->pageTextNotContains(static::$warningsExplanation);
@@ -403,7 +398,9 @@ class StatusCheckTest extends AutomaticUpdatesFunctionalTestBase {
     // the functionality to retrieve our fake release history metadata.
     $this->container->get('module_installer')->install(['automatic_updates', 'automatic_updates_test']);
     // @todo Remove in https://www.drupal.org/project/automatic_updates/issues/3284443
-    $this->config('automatic_updates.settings')->set('cron', CronUpdateStage::SECURITY)->save();
+    $this->config('automatic_updates.settings')
+      ->set('unattended.level', CronUpdateStage::SECURITY)
+      ->save();
     $this->drupalGet('admin/reports/status');
     $this->assertNoErrors(TRUE);
 
@@ -578,6 +575,79 @@ class StatusCheckTest extends AutomaticUpdatesFunctionalTestBase {
     $assert_session->pageTextContains($no_results_message);
   }
 
+  /**
+   * Tests that the status report shows cached status check results.
+   */
+  public function testStatusReportShowsCachedResults(): void {
+    $session = $this->getSession();
+    $this->drupalLogin($this->checkerRunnerUser);
+
+    $this->container->get('module_installer')->install([
+      'automatic_updates',
+      'automatic_updates_test',
+    ]);
+    $this->container = $this->container->get('kernel')->getContainer();
+
+    // Clear stored results that were collected when the module was installed.
+    $this->container->get('automatic_updates.status_checker')
+      ->clearStoredResults();
+
+    // Flag a validation error, whose summary will be displayed in the messages
+    // area.
+    $result = $this->createValidationResult(SystemManager::REQUIREMENT_ERROR);
+    TestSubscriber1::setTestResult([$result], StatusCheckEvent::class);
+
+    $this->drupalGet('/admin/reports/status');
+    $this->assertErrors([$result], TRUE);
+
+    // Clear the result, and ensure that it's still visible because it is
+    // cached.
+    TestSubscriber::setTestResult(NULL, StatusCheckEvent::class);
+    $session->reload();
+    $this->assertErrors([$result], TRUE);
+
+    // If unattended updates are configured to run via the command line, we
+    // should see a warning that the status checks have not run recently. This
+    // is because changing the configuration clears the cached results, since
+    // they may be affected by the change.
+    // @see \Drupal\automatic_updates\Validation\StatusChecker::onConfigSave()
+    $this->config('automatic_updates.settings')
+      ->set('unattended.method', 'console')
+      ->save();
+    $session->reload();
+    $assert_session = $this->assertSession();
+    $assert_session->pageTextContainsOnce('Unattended updates are configured to run via the console, but do not appear to have run recently.');
+    $assert_session->pageTextNotContains((string) $result->messages[0]);
+  }
+
+  /**
+   * Tests the status checks when unattended updates are run via the console.
+   */
+  public function testUnattendedUpdatesRunFromConsole(): void {
+    $this->container->get('module_installer')->install(['automatic_updates']);
+    $this->container = $this->container->get('kernel')->getContainer();
+
+    // Clear stored results that were collected when the module was installed.
+    $this->container->get('automatic_updates.status_checker')
+      ->clearStoredResults();
+
+    $this->config('automatic_updates.settings')
+      ->set('unattended.method', 'console')
+      ->save();
+
+    // If we visit the status report, we should see an error requirement because
+    // unattended updates are configured to run via the terminal, and there are
+    // no stored status check results, which means that the console command has
+    // probably not run recently (or ever).
+    $this->drupalGet('/admin/reports/status');
+    $this->assertRequirement('error', 'Unattended updates are configured to run via the console, but do not appear to have run recently.', [], FALSE);
+
+    // We should see a similar message on any other admin page.
+    $this->drupalGet('/admin/structure');
+    $this->assertSession()
+      ->statusMessageContains('Unattended updates are configured to run via the console, but not appear to have run recently.', 'error');
+  }
+
   /**
    * Asserts that the status check requirement displays no errors or warnings.
    *

tests/src/Kernel/AutomaticUpdatesKernelTestBase.php

@@ -51,7 +51,12 @@ abstract class AutomaticUpdatesKernelTestBase extends PackageManagerKernelTestBa
     parent::setUp();
     // Enable cron updates, which will eventually be the default.
     // @todo Remove in https://www.drupal.org/project/automatic_updates/issues/3284443
-    $this->config('automatic_updates.settings')->set('cron', CronUpdateStage::SECURITY)->save();
+    $this->config('automatic_updates.settings')
+      ->set('unattended', [
+        'method' => 'web',
+        'level' => CronUpdateStage::SECURITY,
+      ])
+      ->save();
 
     // By default, pretend we're running Drupal core 9.8.0 and a non-security
     // update to 9.8.1 is available.
@@ -62,6 +67,13 @@ abstract class AutomaticUpdatesKernelTestBase extends PackageManagerKernelTestBa
     // from a sane state.
     // @see \Drupal\automatic_updates\Validator\CronFrequencyValidator
     $this->container->get('state')->set('system.cron_last', time());
+
+    // Cron updates are not done when running at the command line, so override
+    // our cron handler's PHP_SAPI constant to a valid value that isn't `cli`.
+    // The choice of `cgi-fcgi` is arbitrary; see
+    // https://www.php.net/php_sapi_name for some valid values of PHP_SAPI.
+    $property = new \ReflectionProperty(CronUpdateStage::class, 'serverApi');
+    $property->setValue(NULL, 'cgi-fcgi');
   }
 
   /**

tests/src/Kernel/CronUpdateStageTest.php

@@ -156,7 +156,9 @@ class CronUpdateStageTest extends AutomaticUpdatesKernelTestBase {
     $this->setReleaseMetadata($release_data);
     $this->setCoreVersion('9.8.0');
     update_get_available(TRUE);
-    $this->config('automatic_updates.settings')->set('cron', $setting)->save();
+    $this->config('automatic_updates.settings')
+      ->set('unattended.level', $setting)
+      ->save();
 
     // Since we're just trying to ensure that all of Package Manager's services
     // are called as expected, disable validation by replacing the event
@@ -260,7 +262,9 @@ class CronUpdateStageTest extends AutomaticUpdatesKernelTestBase {
     }
     $this->installConfig('automatic_updates');
     // @todo Remove in https://www.drupal.org/project/automatic_updates/issues/3284443
-    $this->config('automatic_updates.settings')->set('cron', CronUpdateStage::SECURITY)->save();
+    $this->config('automatic_updates.settings')
+      ->set('unattended.level', CronUpdateStage::SECURITY)
+      ->save();
     // Ensure that there is a security release to which we should update.
     $this->setReleaseMetadata([
       'drupal' => __DIR__ . "/../../../package_manager/tests/fixtures/release-history/drupal.9.8.1-security.xml",
@@ -368,7 +372,9 @@ class CronUpdateStageTest extends AutomaticUpdatesKernelTestBase {
    * Tests stage is not destroyed if another update is applying.
    */
   public function testStageNotDestroyedIfApplying(): void {
-    $this->config('automatic_updates.settings')->set('cron', CronUpdateStage::ALL)->save();
+    $this->config('automatic_updates.settings')
+      ->set('unattended.level', CronUpdateStage::ALL)
+      ->save();
     $this->setReleaseMetadata([
       'drupal' => __DIR__ . "/../../../package_manager/tests/fixtures/release-history/drupal.9.8.1-security.xml",
     ]);
@@ -406,7 +412,9 @@ class CronUpdateStageTest extends AutomaticUpdatesKernelTestBase {
    * Tests stage is not destroyed if not available and site is on secure version.
    */
   public function testStageNotDestroyedIfSecure(): void {
-    $this->config('automatic_updates.settings')->set('cron', CronUpdateStage::ALL)->save();
+    $this->config('automatic_updates.settings')
+      ->set('unattended.level', CronUpdateStage::ALL)
+      ->save();
     $this->setReleaseMetadata([
       'drupal' => __DIR__ . "/../../../package_manager/tests/fixtures/release-history/drupal.9.8.2.xml",
     ]);
@@ -548,7 +556,7 @@ END;
       'drupal' => __DIR__ . '/../../../package_manager/tests/fixtures/release-history/drupal.9.8.2.xml',
     ]);
     $this->config('automatic_updates.settings')
-      ->set('cron', CronUpdateStage::ALL)
+      ->set('unattended.level', CronUpdateStage::ALL)
       ->save();
 
     $error = ValidationResult::createError([

tests/src/Kernel/HookCronTest.php

+<?php
+
+namespace Drupal\Tests\automatic_updates\Kernel;
+
+use Drupal\automatic_updates\Validation\StatusChecker;
+
+/**
+ * @group automatic_updates
+ */
+class HookCronTest extends AutomaticUpdatesKernelTestBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected static $modules = ['automatic_updates'];
+
+  /**
+   * Tests that our cron hook does not run if we're at the command line.
+   */
+  public function testCronHookBypassedAtCommandLine(): void {
+    if (PHP_SAPI !== 'cli') {
+      $this->markTestSkipped('This test requires that PHP be running at the command line.');
+    }
+
+    // The status check should not have run yet.
+    /** @var \Drupal\automatic_updates\Validation\StatusChecker $status_checker */
+    $status_checker = $this->container->get(StatusChecker::class);
+    $this->assertNull($status_checker->getLastRunTime());
+
+    // Since we're at the command line, status checks should still not run, even
+    // if we do run cron.
+    $this->container->get('cron')->run();
+    $this->assertNull($status_checker->getResults());
+  }
+
+}