ZacharyZhang-NY/omarchy-pkgs
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Replace migrate with manifest-driven advance-channel and add the release lock

Browse Source 
bin/repo advance --from/--to moves packages forward through the pipeline
(edge → rc → stable), driven by the source channel's database rather than the
raw directory, copying packages AND their detached signatures (fixing the old
migrate bug that left promoted packages unverifiable), refusing to rewrite any
published filename, and requiring a .sig for everything it moves. stable → rc
is allowed only as --fast-ring parity replication or the one-time
--bootstrap seed (bin/repo bootstrap-rc). 'migrate' stays as a deprecated
alias for the transition.

helpers/lock-helpers.sh adds a host-wide flock shared by bin/release,
advance-channel, and upload-prebuilt (reentrant via OMARCHY_RELEASE_LOCK_HELD)
so timers and operators serialize instead of interleaving partial publishes.

bin/release gains a stable-only step 7: replicate fast-ring artifacts to rc so
rc and stable stay in parity between release trains (skipped until rc is
bootstrapped).
This commit is contained in:
Ryan Hughes
2026-08-27 01:10:33 -04:00
parent 26bde8fae3
commit 63f6156f25
6 changed files with 388 additions and 131 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/advance-channel
Executable
+299
View File
@@ -0,0 +1,299 @@
#!/bin/bash
# Move packages forward through the channel pipeline: edge -> rc -> stable.
#
# Copies package artifacts AND their detached signatures from one channel to
# the next, driven by the source channel's database (not the raw directory, so
# historical files never leak forward), then cleans, rebuilds, and syncs the
# destination. Published filenames are never overwritten: a same-name file
# that already exists at the destination is skipped (and reported when its
# bytes differ), because the R2 cache cannot recover from a rewrite.
set -e
BUILD_ROOT=$(realpath "${BASH_SOURCE[0]%/*}/..")
source "$BUILD_ROOT/helpers/message-helpers.sh"
source "$BUILD_ROOT/helpers/paths.sh"
source "$BUILD_ROOT/helpers/lock-helpers.sh"
source "$BUILD_ROOT/helpers/package-metadata.sh"
FROM=""
TO=""
DRY_RUN=false
SYNC_REMOTE=""
SKIP_PROD_CHECK=false
FAST_RING_ONLY=false
BOOTSTRAP=false
PACKAGES=""
usage() {
echo "Usage: $0 --from <channel> --to <channel> [OPTIONS]"
echo ""
echo "Directions:"
echo " --from edge --to rc Open a release train: carry edge forward into rc"
echo " --from rc --to stable Ship: promote the tested rc channel to stable"
echo " --from stable --to rc Only with --fast-ring (parity replication)"
echo " or --bootstrap (one-time initial seed)"
echo ""
echo "Options:"
echo " --arch <arch> Target architecture (x86_64 or aarch64, default: x86_64)"
echo " --package <names...> Advance only the named package(s)"
echo " --fast-ring Restrict to fast-ring packages (stable -> rc parity copy)"
echo " --bootstrap One-time stable -> rc seed before forward-only enforcement"
echo " --dry-run Preview without changing files"
echo " --sync-remote <path> Rclone remote for sync (default: pkgs.omarchy.org:omarchy-pkgs)"
echo " --skip-prod-check Skip production confirmation during sync"
echo " -h, --help Show this help message"
echo ""
echo "What it does:"
echo " 1) Read the source channel database for the current package set"
echo " 2) Copy eligible packages + .sig files not yet at the destination"
echo " 3) Clean the destination (keep 2 versions)"
echo " 4) Rebuild the destination database"
echo " 5) Sync the destination to the remote (packages first, database last)"
exit "${1:-0}"
}
while [[ $# -gt 0 ]]; do
case $1 in
--from)
FROM="$2"
shift 2
;;
--to)
TO="$2"
shift 2
;;
--arch)
ARCH="$2"
update_arch_paths
shift 2
;;
--package)
shift
while [[ $# -gt 0 && ! "$1" =~ ^-- ]]; do
PACKAGES="$PACKAGES $1"
shift
done
PACKAGES="${PACKAGES# }"
;;
--fast-ring)
FAST_RING_ONLY=true
shift
;;
--bootstrap)
BOOTSTRAP=true
shift
;;
--dry-run)
DRY_RUN=true
shift
;;
--sync-remote)
SYNC_REMOTE="$2"
shift 2
;;
--skip-prod-check)
SKIP_PROD_CHECK=true
shift
;;
-h | --help)
usage 0
;;
*)
print_error "Unknown option: $1"
usage 1
;;
esac
done
require_valid_mirror "$FROM"
require_valid_mirror "$TO"
# The pipeline only moves forward. stable -> rc is allowed for exactly two
# labeled purposes: fast-ring parity replication and the one-time bootstrap.
# edge -> stable is the legacy migrate path, kept for the transition cycle.
case "$FROM->$TO" in
"edge->rc" | "rc->stable") ;;
"edge->stable")
print_warning "edge -> stable is the legacy migrate path; new releases flow edge -> rc -> stable"
;;
"stable->rc")
if [[ "$FAST_RING_ONLY" != true && "$BOOTSTRAP" != true ]]; then
print_error "stable -> rc requires --fast-ring (parity replication) or --bootstrap (initial seed)"
exit 1
fi
;;
*)
print_error "Refusing $FROM -> $TO: packages only move forward (edge -> rc -> stable)"
exit 1
;;
esac
SOURCE_DIR="$REPO_ROOT/$FROM/$ARCH"
TARGET_DIR="$REPO_ROOT/$TO/$ARCH"
SOURCE_DB="$SOURCE_DIR/omarchy.db.tar.zst"
print_header "Advance Channel: $FROM -> $TO"
print_info "Architecture: $ARCH"
print_info "Source: $SOURCE_DIR"
print_info "Target: $TARGET_DIR"
[[ "$FAST_RING_ONLY" == true ]] && print_info "Scope: fast-ring packages only"
[[ "$BOOTSTRAP" == true ]] && print_info "Mode: bootstrap (initial rc seed)"
[[ -n "$PACKAGES" ]] && print_info "Packages: $PACKAGES"
if [[ ! -f "$SOURCE_DB" ]]; then
print_error "Source database not found: $SOURCE_DB"
echo "Nothing has been published to the $FROM channel on this host."
exit 1
fi
if [[ "$DRY_RUN" == true ]]; then
print_warning "DRY RUN MODE - No changes will be made"
else
acquire_release_lock || exit 1
fi
# Manifest: "name<TAB>base<TAB>filename" per current package in the source db.
# Each desc record begins with %FILENAME%, so that marker both closes the
# previous record and opens the next.
read_manifest() {
tar -xOf "$SOURCE_DB" --wildcards '*/desc' 2>/dev/null | awk '
function emit() {
if (name != "" && filename != "") printf "%s\t%s\t%s\n", name, base, filename
name = ""; base = ""; filename = ""
}
$0 == "%FILENAME%" { emit(); getline; filename = $0; next }
$0 == "%NAME%" { getline; name = $0; next }
$0 == "%BASE%" { getline; base = $0; next }
END { emit() }
'
}
package_wanted() {
local name="$1" base="$2"
[[ -z "$PACKAGES" ]] && return 0
local want
for want in $PACKAGES; do
[[ "$want" == "$name" || "$want" == "$base" ]] && return 0
done
return 1
}
# Split packages publish under their pkgname; eligibility metadata lives in
# the pkgbase directory. Packages whose PKGBUILD has since been removed from
# this repo default to moving: they are part of the source channel's set and
# leaving them behind would hole the destination.
package_eligible() {
local name="$1" base="$2"
local pkgdir
pkgdir=$(package_dir_for_name "$name" 2>/dev/null) ||
pkgdir=$(package_dir_for_name "$base" 2>/dev/null) || pkgdir=""
if [[ -z "$pkgdir" ]]; then
[[ "$FAST_RING_ONLY" == true ]] && return 1
return 0
fi
if [[ "$FAST_RING_ONLY" == true ]]; then
package_is_fast_ring "$pkgdir" || return 1
fi
package_moves_to_channel "$pkgdir" "$TO"
}
mkdir -p "$TARGET_DIR"
COPIED=0
PRESENT=0
SKIPPED=0
MISSING_FILES=()
MISSING_SIGS=()
DIFFERING=()
while IFS=$'\t' read -r name base filename; do
package_wanted "$name" "$base" || continue
if ! package_eligible "$name" "$base"; then
SKIPPED=$((SKIPPED + 1))
continue
fi
src="$SOURCE_DIR/$filename"
sig="$src.sig"
dest="$TARGET_DIR/$filename"
if [[ ! -f "$src" ]]; then
MISSING_FILES+=("$filename")
continue
fi
if [[ ! -f "$sig" ]]; then
MISSING_SIGS+=("$filename")
continue
fi
if [[ -f "$dest" ]]; then
if cmp -s "$src" "$dest"; then
PRESENT=$((PRESENT + 1))
else
DIFFERING+=("$filename")
fi
continue
fi
if [[ "$DRY_RUN" == true ]]; then
echo " would copy: $filename (+ .sig)"
else
cp -p "$src" "$dest"
cp -p "$sig" "$dest.sig"
echo " copied: $filename (+ .sig)"
fi
COPIED=$((COPIED + 1))
done < <(read_manifest)
echo ""
print_info "Copied: $COPIED | Already present: $PRESENT | Not eligible: $SKIPPED"
if [[ ${#MISSING_FILES[@]} -gt 0 ]]; then
print_error "${#MISSING_FILES[@]} package(s) named in the $FROM database are missing on disk:"
printf ' %s\n' "${MISSING_FILES[@]}"
echo "The $FROM channel is inconsistent; rebuild its database before advancing."
exit 1
fi
if [[ ${#MISSING_SIGS[@]} -gt 0 ]]; then
print_error "${#MISSING_SIGS[@]} package(s) have no detached signature in $FROM:"
printf ' %s\n' "${MISSING_SIGS[@]}"
echo "Signatures must travel with their packages. Re-sign these in $FROM"
echo "(bin/repo sign) and re-run."
exit 1
fi
if [[ ${#DIFFERING[@]} -gt 0 ]]; then
print_warning "${#DIFFERING[@]} file(s) already published in $TO with different bytes (kept as-is):"
printf ' %s\n' "${DIFFERING[@]}"
echo "Published filenames are never rewritten. The destination copy stays"
echo "authoritative; a genuinely new build needs a new pkgver/pkgrel."
fi
if [[ "$DRY_RUN" == true ]]; then
print_info "Dry run: skipping clean, database update, and sync"
exit 0
fi
print_info "Cleaning $TO repository..."
"$BUILD_ROOT/bin/clean-repo" --mirror "$TO" --arch "$ARCH"
print_info "Updating $TO repository database..."
"$BUILD_ROOT/bin/update-repo" --mirror "$TO" --arch "$ARCH"
echo ""
print_info "Syncing $TO repository to remote..."
SYNC_ARGS=("--mirror" "$TO" "--arch" "$ARCH")
[[ -n "$SYNC_REMOTE" ]] && SYNC_ARGS+=("--remote" "$SYNC_REMOTE")
[[ "$SKIP_PROD_CHECK" == true ]] && SYNC_ARGS+=("--skip-prod-check")
"$BUILD_ROOT/bin/sync-repo" "${SYNC_ARGS[@]}" || {
print_error "Sync failed"
exit 1
}
print_success "Advance complete: $FROM -> $TO"
bin/migrate-edge-to-stable
-129
View File
@@ -1,129 +0,0 @@
#!/bin/bash
# Promote tested edge package artifacts into stable without overwriting
set -e
BUILD_ROOT=$(realpath "${BASH_SOURCE[0]%/*}/..")
source "$BUILD_ROOT/helpers/message-helpers.sh"
source "$BUILD_ROOT/helpers/paths.sh"
DRY_RUN=false
SYNC_REMOTE=""
SKIP_PROD_CHECK=false
PACKAGE=""
while [[ $# -gt 0 ]]; do
case $1 in
--arch)
ARCH="$2"
update_arch_paths
shift 2
;;
--package)
PACKAGE="$2"
shift 2
;;
--dry-run)
DRY_RUN=true
shift
;;
--sync-remote)
SYNC_REMOTE="$2"
shift 2
;;
--skip-prod-check)
SKIP_PROD_CHECK=true
shift
;;
-h | --help)
echo "Usage: $0 [OPTIONS]"
echo ""
echo "Options:"
echo " --arch <arch> Target architecture (x86_64 or aarch64, default: x86_64)"
echo " --package <name> Migrate only the specified package"
echo " --dry-run Preview migration and cleanup without changing files"
echo " --sync-remote <path> Rclone remote for sync (default: pkgs.omarchy.org:omarchy-pkgs)"
echo " --skip-prod-check Skip production environment check during sync"
echo " -h, --help Show this help message"
echo ""
echo "What it does:"
echo " 1) Rsync tested package artifacts from edge -> stable (without overwriting existing files)"
echo " 2) Run stable cleanup (keep 2 versions)"
echo " 3) Update stable repository database"
echo " 4) Sync stable repository to remote (prompts for confirmation)"
exit 0
;;
*)
print_error "Unknown option: $1"
exit 1
;;
esac
done
SOURCE_DIR="$BUILD_ROOT/pkgs.omarchy.org/edge/$ARCH"
TARGET_DIR="$BUILD_ROOT/pkgs.omarchy.org/stable/$ARCH"
print_header "Promote Edge Artifacts to Stable"
print_info "Architecture: $ARCH"
print_info "Source: $SOURCE_DIR"
print_info "Target: $TARGET_DIR"
if [[ ! -d "$SOURCE_DIR" ]]; then
print_error "Source directory not found: $SOURCE_DIR"
exit 1
fi
# Version segment starts with a digit (same assumption as bin/clean-repo),
# so omarchy-nvim doesn't also match omarchy-nvim-extras
PACKAGE_GLOB="*"
if [[ -n "$PACKAGE" ]]; then
print_info "Package: $PACKAGE"
PACKAGE_GLOB="$PACKAGE-[0-9]*"
if ! compgen -G "$SOURCE_DIR/$PACKAGE_GLOB.pkg.tar.*" >/dev/null; then
print_error "No artifacts matching $PACKAGE_GLOB.pkg.tar.* found in $SOURCE_DIR"
exit 1
fi
fi
mkdir -p "$TARGET_DIR"
if [[ "$DRY_RUN" == true ]]; then
print_warning "DRY RUN MODE - No changes will be made"
fi
print_info "Syncing package files from edge to stable (ignore existing)..."
RSYNC_FLAGS="-av --ignore-existing --include=*/ --include=$PACKAGE_GLOB.pkg.tar.* --exclude=*"
if [[ "$DRY_RUN" == true ]]; then
RSYNC_FLAGS="$RSYNC_FLAGS -n"
fi
# shellcheck disable=SC2086
rsync $RSYNC_FLAGS "$SOURCE_DIR/" "$TARGET_DIR/"
print_info "Cleaning stable repository..."
if [[ "$DRY_RUN" == true ]]; then
"$BUILD_ROOT/bin/repo" clean --mirror stable --arch "$ARCH" --dry-run
print_info "Skipping database update in dry run mode"
else
"$BUILD_ROOT/bin/repo" clean --mirror stable --arch "$ARCH"
print_info "Updating stable repository database..."
"$BUILD_ROOT/bin/repo" update --mirror stable --arch "$ARCH"
fi
if [[ "$DRY_RUN" != true ]]; then
echo ""
print_info "Syncing stable repository to remote..."
SYNC_ARGS=("--mirror" "stable" "--arch" "$ARCH")
if [[ -n "$SYNC_REMOTE" ]]; then
SYNC_ARGS+=("--remote" "$SYNC_REMOTE")
fi
if [[ "$SKIP_PROD_CHECK" == true ]]; then
SYNC_ARGS+=("--skip-prod-check")
fi
"$BUILD_ROOT/bin/sync-repo" "${SYNC_ARGS[@]}" || {
print_error "Sync failed"
exit 1
}
fi
print_success "Migration workflow complete"
bin/release
+27
View File
@@ -6,6 +6,7 @@ set -e
BUILD_ROOT=$(realpath "${BASH_SOURCE[0]%/*}/..")
source "$BUILD_ROOT/helpers/message-helpers.sh"
source "$BUILD_ROOT/helpers/paths.sh"
source "$BUILD_ROOT/helpers/lock-helpers.sh"
source "$BUILD_ROOT/helpers/basecamp-notifier.sh"
SYNC_REMOTE=""
@@ -85,6 +86,12 @@ print_info "Target architecture: $ARCH"
print_info "Mirror: $MIRROR"
print_info "Build workspace: $BUILD_OUTPUT_DIR"
# One channel mutation at a time: a timer firing mid-run or a second operator
# waits here instead of interleaving a partial publish.
if [[ "$DRY_RUN" != true ]]; then
acquire_release_lock || exit 1
fi
# Step 1: Build
echo ""
if [[ "$DRY_RUN" == true ]]; then
@@ -156,5 +163,25 @@ fi
exit 1
}
# Step 7 (stable only): fast-ring packages publish to rc and stable together,
# so rc never falls behind what stable users actually run. Skipped until the
# rc channel has been bootstrapped.
if [[ "$MIRROR" == "stable" ]]; then
echo ""
if [[ -f "$REPO_ROOT/rc/$ARCH/omarchy.db.tar.zst" ]]; then
print_info "Step 7: Replicating fast-ring packages to rc (parity)..."
REPLICATE_ARGS=(--from stable --to rc --fast-ring --arch "$ARCH")
[[ -n "$SYNC_REMOTE" ]] && REPLICATE_ARGS+=(--sync-remote "$SYNC_REMOTE")
[[ "$SKIP_PROD_CHECK" == true ]] && REPLICATE_ARGS+=(--skip-prod-check)
"$BUILD_ROOT/bin/advance-channel" "${REPLICATE_ARGS[@]}" || {
print_error "Fast-ring replication to rc failed"
notify_error "Release failed: rc parity replication failed" "Mirror: $MIRROR | Arch: $ARCH"
exit 1
}
else
print_info "rc channel not bootstrapped; skipping fast-ring replication"
fi
fi
echo ""
print_success "Release workflow completed successfully!"
bin/repo
+13 -2
View File
@@ -54,7 +54,9 @@ show_usage() {
echo " promote Promote build to production (build-output → pkgs.omarchy.org)"
echo " update Update repository database"
echo " clean Clean old package versions"
echo " migrate Migrate edge packages into stable (no overwrite), then clean + update"
echo " advance Move packages forward through the pipeline (edge → rc → stable)"
echo " bootstrap-rc One-time seed of the rc channel from stable"
echo " migrate DEPRECATED alias for 'advance --from edge --to stable'"
echo " list List source package metadata (use --repo for published repo)"
echo " remove Remove a specific package"
echo " sync Sync repository to remote"
@@ -112,8 +114,17 @@ clean)
"$SCRIPT_DIR/clean-repo" "$@" 2>&1 | tee "$LOG_FILE"
exit ${PIPESTATUS[0]}
;;
advance)
"$SCRIPT_DIR/advance-channel" "$@" 2>&1 | tee "$LOG_FILE"
exit ${PIPESTATUS[0]}
;;
bootstrap-rc)
"$SCRIPT_DIR/advance-channel" --from stable --to rc --bootstrap "$@" 2>&1 | tee "$LOG_FILE"
exit ${PIPESTATUS[0]}
;;
migrate)
"$SCRIPT_DIR/migrate-edge-to-stable" "$@" 2>&1 | tee "$LOG_FILE"
print_warning "'migrate' is deprecated; releases now flow edge → rc → stable (bin/repo advance)"
"$SCRIPT_DIR/advance-channel" --from edge --to stable "$@" 2>&1 | tee "$LOG_FILE"
exit ${PIPESTATUS[0]}
;;
list)
bin/upload-prebuilt
+5
View File
@@ -4,6 +4,11 @@
set -e
SCRIPT_DIR=$(realpath "${BASH_SOURCE[0]%/*}")
BUILD_ROOT=$(realpath "$SCRIPT_DIR/..")
source "$BUILD_ROOT/helpers/paths.sh"
source "$BUILD_ROOT/helpers/lock-helpers.sh"
acquire_release_lock || exit 1
# Only sync understands the publishing flags; sign, promote and update reject
# unknown options outright, so they cannot be forwarded blindly.