Automating svn updates from a server-side cron job
I am running WordPress on Ubuntu with Apache and MySQL. I would like to automatically install minor and security updates to WordPress.
However, as I understand it, the standard auto-update mechanism (see also How exactly do automatic updates work?) is ultimately fired off by a web request, meaning that the update process runs as the apache user (for me it's www-data). So the www-data user has to have permissions to write to WordPress's php files. This makes me uncomfortable - it could let an attacker escalate a "create files" vulnerability to "execute arbitrary code". I would rather keep the WordPress php files and directory owned by someone other than www-data, and leave them read-only to www-data. Thus I would rather not use the standard mechanism.
The only alternative I know of is to run svn sw as documented here. But this requires running a command including the desired new version. So I can't put it in a cron job, since I don't know how the cron job would figure out what the new version number is, without manual intervention. I could create some sort of hack which tries to scrape the latest version number from wordpress.org, but that seems very fragile. Is there a better way, or an existing script I could just use?
Also, the last step in an svn update is to visit wp-admin/config.php with a web browser, logging in as needed. Is there a straightforward way to perform that automatically from a cron job on the server, ideally without hardcoding my admin password into a script?