omarchy-iso/bin/omarchy-iso-make

#!/bin/bash

# Abort if anything fails
set -e

# Parse command line arguments
NO_CACHE=""
LOCAL_INSTALLER_PATH=""
LOCAL_PKGS_PATH=""
while [[ $# -gt 0 ]]; do
  case $1 in
  --no-cache)
    NO_CACHE=1
    shift
    ;;
  --no-boot-offer)
    NO_BOOT_OFFER=1
    shift
    ;;
  --local-source)
    # --local-source <installer-checkout> <pkgs-checkout>
    # Builds omarchy* from the two checkouts and bundles them in the ISO's
    # offline mirror instead of pulling published versions from the omarchy
    # network mirror.
    LOCAL_INSTALLER_PATH="${2:-}"
    LOCAL_PKGS_PATH="${3:-}"
    if [[ -z $LOCAL_INSTALLER_PATH || -z $LOCAL_PKGS_PATH ]]; then
      echo "Error: --local-source requires two args: <installer-checkout> <pkgs-checkout>" >&2
      exit 1
    fi
    OMARCHY_MIRROR=edge
    shift 3
    ;;
  --dev)
    OMARCHY_INSTALLER_REF=dev
    OMARCHY_MIRROR=edge
    shift
    ;;
  --rc)
    OMARCHY_MIRROR=rc
    OMARCHY_INSTALLER_REF=rc
    shift
    ;;
  *)
    echo "Unknown option: $1"
    echo "Usage: $0 [--no-cache] [--no-boot-offer] [--dev|--rc] [--local-source <installer-checkout> <pkgs-checkout>]"
    exit 1
    ;;
  esac
done

# Validate local-source paths up front (before any sudo / network work).
if [[ -n $LOCAL_INSTALLER_PATH ]]; then
  [[ -d $LOCAL_INSTALLER_PATH ]] || { echo "Error: installer checkout not found at $LOCAL_INSTALLER_PATH" >&2; exit 1; }
  [[ -d $LOCAL_PKGS_PATH ]]      || { echo "Error: pkgs checkout not found at $LOCAL_PKGS_PATH"           >&2; exit 1; }
  LOCAL_INSTALLER_PATH=$(realpath "$LOCAL_INSTALLER_PATH")
  LOCAL_PKGS_PATH=$(realpath "$LOCAL_PKGS_PATH")
fi

lint_file_permissions() {
  local profiledef="configs/profiledef.sh"
  local -A declared=()
  local missing=()

  while IFS= read -r path; do
    [[ -n $path ]] && declared["$path"]=1
  done < <(grep -oP '^\s*\["\K[^"]+(?="\])' "$profiledef" || true)

  while IFS= read -r f; do
    [[ -f $f ]] || continue

    local rel="${f#configs/airootfs}"
    local mode
    mode=$(git ls-files --stage -- "$f" | awk '{print $1}')

    if [[ $mode != 100755 && $(head -c 2 "$f") != "#!" ]]; then
      continue
    fi

    if [[ -z ${declared[$rel]+x} ]]; then
      missing+=("$rel")
    fi
  done < <(find configs/airootfs/usr/local/bin configs/airootfs/root -type f 2>/dev/null)

  if (( ${#missing[@]} > 0 )); then
    echo "ERROR: the following executable files are missing from $profiledef file_permissions:" >&2
    printf '  %s\n' "${missing[@]}" >&2
    echo "Add entries like [\"<path>\"]=\"0:0:755\" to profiledef.sh and retry." >&2
    exit 1
  fi
}

lint_file_permissions

# Clear out old packages
sudo rm -rf /var/cache/pacman/pkg/*

# Ensure we have the submodule checked out
git submodule update --init --recursive --jobs=8

# Prepare build repo
BUILD_SCRIPT="builder/build-iso.sh"
BUILD_ROOT=$(realpath "${BASH_SOURCE[0]%/*}/..")
BUILD_RELEASE_PATH="$BUILD_ROOT/release"
mkdir -p "$BUILD_RELEASE_PATH"

OMARCHY_INSTALLER_REPO="${OMARCHY_INSTALLER_REPO:-basecamp/omarchy}"
OMARCHY_INSTALLER_REF="${OMARCHY_INSTALLER_REF:-master}"
OMARCHY_MIRROR="${OMARCHY_MIRROR:-stable}"

DOCKER_ARGS=(
  --rm
  --privileged
  -e "OMARCHY_INSTALLER_REPO=$OMARCHY_INSTALLER_REPO"
  -e "OMARCHY_INSTALLER_REF=$OMARCHY_INSTALLER_REF"
  -e "OMARCHY_MIRROR=$OMARCHY_MIRROR"
  -e "HOST_UID=$(id -u)"
  -e "HOST_GID=$(id -g)"
  -v "$BUILD_RELEASE_PATH/:/out/"
  -v "$BUILD_ROOT/$BUILD_SCRIPT:/$BUILD_SCRIPT:ro"
  -v "$BUILD_ROOT/archiso:/archiso:ro"
  -v "$BUILD_ROOT/builder:/builder:ro"
  -v "$BUILD_ROOT/configs:/configs:ro"
)

# Mount the local checkouts when --local-source was passed (paths already
# validated/resolved above).
if [[ -n $LOCAL_INSTALLER_PATH ]]; then
  DOCKER_ARGS+=(
    -v "$LOCAL_INSTALLER_PATH:/omarchy-installer:ro"
    -v "$LOCAL_PKGS_PATH:/omarchy-pkgs:ro"
  )
fi

# Use local pacman cache if you already have one on host to speed up repeat runs
if [ -d "/var/cache/pacman/pkg" ]; then
  DOCKER_ARGS+=(-v "/var/cache/pacman/pkg:/var/cache/pacman/pkg")
fi

# Mount the build cache directory where packages are downloaded. Keyed by
# channel so stable/edge/rc don't pollute each other but the cache persists
# across days (different channels have different package sets; days don't).
# omarchy* packages always rebuild fresh inside the container regardless of
# what's in the cache (build-omarchy-packages.sh nukes its work dir and the
# final mv overwrites the cached .pkg.tar.zst). --no-cache bypasses the mount
# entirely if you want a truly clean download.
if [[ -z "$NO_CACHE" ]]; then
  OFFLINE_REPO_BUILD_CACHE_DIR="$HOME/.cache/omarchy/iso_${OMARCHY_MIRROR}/airootfs/var/cache/omarchy"
  mkdir -p "$OFFLINE_REPO_BUILD_CACHE_DIR"
  DOCKER_ARGS+=(-v "$OFFLINE_REPO_BUILD_CACHE_DIR:/var/cache/airootfs/var/cache/omarchy")
fi

# Run the builder with assembled args
docker run "${DOCKER_ARGS[@]}" archlinux/archlinux:latest /$BUILD_SCRIPT

# Move as install ref
latest_iso=$(\ls -t "$BUILD_RELEASE_PATH"/*.iso | head -n1)
iso_ref="${latest_iso%.*}-$OMARCHY_INSTALLER_REF.iso"
mv -f "$latest_iso" "$iso_ref"

# Offer to boot the new build
if [[ -z "$NO_BOOT_OFFER" ]]; then
  echo
  gum confirm "Boot $iso_ref?" && omarchy-iso-boot "$iso_ref"
fi