Upgrade test: work against rc, and say at once when there is nothing to upgrade to

Run against rc, the test stopped at a password prompt and then at a
question, each until its 30 minute limit.

sudo asked for a password although the test had written a rule that
lets it through: sudo takes the last rule that matches and reads its
folder in name order, and the rule's name sorted before the install's
own. The release's updater also runs "sudo -v", which asks unless every
rule for the user lets it through. The rule now sorts last, turns the
question off for the user, and the test checks both before going on.

rc holds what stable holds today. The release's updater, run with
nothing to do, ends at a prompt nobody answers. The test now asks the
channel what it offers before it starts, and with nothing newer on offer
it stops in seconds and says so.

The comment shows the two pictures only when both exist.

.github/workflows/upgrade-test.yml

@@ -195,7 +195,7 @@ jobs:
             else
               echo "**The test did not get as far as a report** (job result: $RESULT)."
             fi
-            if [ -n "$PICTURES" ]; then
+            if [ -n "$PICTURES" ] && [ -s evidence/before.png ] && [ -s evidence/after.png ]; then
               echo
               echo "| Before, $FROM | After, on $TO |"
               echo "| --- | --- |"

test/upgrade-test

@@ -131,7 +131,13 @@ log "Booting the installed system"
 wait_ssh 300 || { echo "upgrade-test: the installed system did not come up" >&2; exit 1; }
 # The overlay is thrown away: let sudo through without asking, so a long
 # update does not stop at a password prompt nobody is there to answer.
-ssh "${ssh_opts[@]}" omarchy@127.0.0.1 "echo $(printf %q "$pw") | sudo -S -p '' sh -c 'echo \"omarchy ALL=(ALL) NOPASSWD: ALL\" >/etc/sudoers.d/99-upgrade-test'" </dev/null
+# sudo takes the last rule that matches, and reads this folder in name order:
+# the name has to sort after the install's own rule for the wheel group.
+ssh "${ssh_opts[@]}" omarchy@127.0.0.1 "echo $(printf %q "$pw") | sudo -S -p '' sh -c 'printf \"%s\\n\" \"omarchy ALL=(ALL:ALL) NOPASSWD: ALL\" \"Defaults:omarchy !authenticate\" >/etc/sudoers.d/zzz-upgrade-test'" </dev/null
+# "sudo -v" is the hard one: it asks unless every rule for the user lets it
+# through, which is why the rule alone is not enough.
+ssh "${ssh_opts[@]}" omarchy@127.0.0.1 'sudo -k; sudo -n true && sudo -n -v' </dev/null ||
+  { echo "upgrade-test: sudo still asks for a password in the guest" >&2; exit 1; }
 guest 'timeout 180 systemctl is-system-running --wait >/dev/null 2>&1 || true'
 facts "$out/before.txt"
 desktop_shot "$out/before.png"
@@ -142,6 +148,23 @@ for migration in ${EXTRA_MIGRATIONS:-}; do
   ssh "${ssh_opts[@]}" omarchy@127.0.0.1 "sudo tee /usr/share/omarchy/migrations/$(basename "$migration") >/dev/null" <"$migration"
 done
 
+# A channel that offers what the machine already has is no upgrade. Say so
+# now: the release's own updater, run with nothing to do, ends at a prompt
+# nobody is there to answer.
+case $channel in edge) package=omarchy-dev ;; *) package=omarchy ;; esac
+offered=$(guest "curl -fsSL --retry 3 https://pkgs.omarchy.org/$channel/\$(uname -m)/omarchy.db | bsdtar -xOf - '$package-[0-9]*/desc' | sed -n '/^%VERSION%\$/{n;p;}'" 2>/dev/null | head -n 1)
+installed=$(guest "pacman -Q $package 2>/dev/null | cut -d' ' -f2" 2>/dev/null)
+log "The $channel channel offers $package ${offered:-nothing}; installed: ${installed:-none}"
+if [[ -z $offered || $offered == "$installed" ]]; then
+  {
+    echo "**Nothing to upgrade to.** The $channel channel offers \`$package ${offered:-nothing}\`, and the machine has \`$(fact "$out/before.txt" omarchy)\`."
+    echo
+    echo "The test did not run: point it at a channel that holds a newer Omarchy."
+  } >"$out/report.md"
+  cat "$out/report.md"
+  exit 1
+fi
+
 log "omarchy-channel-set $channel"
 update_start=$SECONDS
 guest "timeout ${UPDATE_TIMEOUT:-1800} omarchy-channel-set $channel" >"$out/update.log" 2>&1