Abort transactions that would replace the pinned local builds and stage the refresh hook for new users

configs/airootfs/usr/share/omarchy-iso/orchestrator/phases_impl.py

@@ -1383,13 +1383,26 @@ PIN_HOOK_SCRIPT = """#!/bin/bash
 line="{line}"
 grep -qxF "$line" /etc/pacman.conf || sudo sed -i "/^\\[options\\]/a $line" /etc/pacman.conf
 """
+PIN_GUARD = """[Trigger]
+Operation = Upgrade
+Type = Package
+{targets}
+
+[Action]
+Description = Keeping the local Omarchy builds...
+When = PreTransaction
+Exec = /usr/bin/sh -c 'echo "This would replace the local builds of {names}. Put \\"{line}\\" back under [options] in /etc/pacman.conf, or delete /etc/pacman.d/hooks/00-omarchy-pin-local-builds.hook to take the published packages." >&2; exit 1'
+AbortOnFail
+"""
 
 
+# Local-source builds share the published version number, so updates would replace them.
 def pin_local_packages(ctx: InstallContext) -> None:
     if not PINNED_PACKAGES.exists():
         return
 
-    line = "IgnorePkg = " + " ".join(PINNED_PACKAGES.read_text().split())
+    packages = PINNED_PACKAGES.read_text().split()
+    line = "IgnorePkg = " + " ".join(packages)
     info(f"› {line}")
     pacman_conf = ctx.target / "etc" / "pacman.conf"
     conf = pacman_conf.read_text()
@@ -1398,18 +1411,31 @@ def pin_local_packages(ctx: InstallContext) -> None:
             raise RuntimeError(f"{pacman_conf} has no [options] section to pin local builds in")
         pacman_conf.write_text(conf.replace("[options]\n", f"[options]\n{line}\n", 1))
 
-    if ctx.defer_provisioning:
-        return
+    guard = ctx.target / "etc/pacman.d/hooks/00-omarchy-pin-local-builds.hook"
+    guard.parent.mkdir(parents=True, exist_ok=True)
+    guard.write_text(PIN_GUARD.format(
+        targets="\n".join(f"Target = {package}" for package in packages),
+        names=", ".join(packages),
+        line=line,
+    ))
+
+    hook_path = ".config/omarchy/hooks/pre-refresh-pacman.d/pin-local-packages"
+    homes = [ctx.target / "etc/skel"]
+    if not ctx.defer_provisioning:
+        homes.append(ctx.target / "home" / ctx.username)
+    for home in homes:
+        hook = home / hook_path
+        hook.parent.mkdir(parents=True, exist_ok=True)
+        hook.write_text(PIN_HOOK_SCRIPT.format(line=line))
+        hook.chmod(0o755)
+
+    if not ctx.defer_provisioning:
+        subprocess.run(
+            ["arch-chroot", str(ctx.target), "chown", "-R", f"{ctx.username}:{ctx.username}",
+             f"/home/{ctx.username}/.config/omarchy/hooks"],
+            check=True,
+        )
 
-    hooks = f"/home/{ctx.username}/.config/omarchy/hooks"
-    hook = ctx.target / hooks.lstrip("/") / "pre-refresh-pacman.d" / "pin-local-packages"
-    hook.parent.mkdir(parents=True, exist_ok=True)
-    hook.write_text(PIN_HOOK_SCRIPT.format(line=line))
-    hook.chmod(0o755)
-    subprocess.run(
-        ["arch-chroot", str(ctx.target), "chown", "-R", f"{ctx.username}:{ctx.username}", hooks],
-        check=True,
-    )
 
 def configure_dns_resolver(ctx: InstallContext) -> None:
     """Put the installed system in systemd-resolved stub mode.