Auto-merge upstream updates for trusted packages (#892)

* Auto-merge upstream updates for trusted packages The unattended lane already runs every upstream provider, not only branch watches, so trusted release feeds can ship without waiting on the reviewed sync PR. Opt in the browsers, large vendors' apps, Omacom's own projects, and the vendor binaries that hold fresh releases for 24h: 39 packages, including rawmakase-bin and gliff. Drivers, firmware, the bootloader, core desktop components, beta and nightly channels, and community projects stay on the reviewed lane. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * Auto-merge grok-bot, perplexity, disktree-bin, cliamp, openclaw, voxtype-bin and ttfx Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-09 16:42:23 +02:00
1 parent c104b20285
commit 88947c367b
@@ -1,9 +1,11 @@
 name: Track upstream branches

-# The unattended lane. Packages marked "auto_merge": true follow a moving
-# upstream branch (omarchy-dev and omarchy-settings-dev on quattro, omasnap-git
-# on main) rather than tagged releases, so nothing in this repository changes
-# when their source does. This workflow makes each new branch tip a commit pin
+# The unattended lane. Packages marked "auto_merge": true update without a
+# human: some follow a moving upstream branch (omarchy-dev and
+# omarchy-settings-dev on quattro, omasnap-git on main) rather than tagged
+# releases, so nothing in this repository changes when their source does;
+# the rest are release feeds trusted to ship unreviewed (browsers, large
+# vendors, Omacom's own projects). This workflow makes each new branch tip a commit pin
 # in the recipe, which publish.yml then treats like any other version bump:
 # the PR builds on the droplets, auto-merge lands it when `result` is green,
 # and the merge publishes the artifacts. A tip that fails to build stays an
@@ -121,10 +123,11 @@ jobs:
          commit-message: ${{ steps.describe.outputs.title }}
          title: ${{ steps.describe.outputs.title }}
          body: |
-            Automated pin of packages that follow a moving upstream branch
-            (`"auto_merge": true` in `.omarchy/package.json`). Each package's
-            `_commit` now points at the branch tip. Fresh tips wait until
-            their commit timestamp is at least `min_release_age` old.
+            Automated update of packages on the unattended lane
+            (`"auto_merge": true` in `.omarchy/package.json`). Branch-tracking
+            packages now pin their branch tip; release-feed packages move to
+            their newest upstream release. Fresh releases and tips wait until
+            they are at least `min_release_age` old.

            This PR auto-merges once the build checks pass. A failing build
            leaves it open; the next tracker run replaces it with the newer tip.
@@ -391,7 +391,7 @@ on `auto/sync-upstream-<packages>` or `auto/sync-rebuilds-<packages>`.
 |---|---|---|---|
 | `sync-upstream.yml` | every 6 hours | one PR on `auto/sync-upstream` with every new upstream release | **a maintainer merges it** |
 | `sync-rebuilds.yml` | every 6 hours | one PR on `auto/sync-rebuilds` bumping `pkgrel` where a `rebuild_on` dependency moved | itself, when green |
-| `track-branches.yml` | every 2 hours | one PR on `auto/track-branches` pinning `"auto_merge": true` packages to their branch tip | itself, when green |
+| `track-branches.yml` | every 2 hours | one PR on `auto/track-branches` updating `"auto_merge": true` packages to their newest upstream release or branch tip | itself, when green |

 - **Each PR is a batch.** One package that fails to build keeps the whole PR
  red and unmerged. Fix that package on `master`. For the two sync workflows,
@@ -427,7 +427,7 @@ Details: [docs/upstream-sources.md](docs/upstream-sources.md),
 | `source` | Always `local`. |
 | `upstream` | Where releases come from. Mutually exclusive with an `.omarchy/upstream.sh` hook. |
 | `min_release_age` | Hold a new upstream release back this long (`"24h"`, `"2d"`). A release whose age cannot be proven fails the sync. |
-| `auto_merge` | `true` moves the package's updates from the reviewed sync PR to `track-branches.yml`. For packages that follow a moving branch. Needs an upstream declaration. |
+| `auto_merge` | `true` moves the package's updates from the reviewed sync PR to `track-branches.yml`. For packages that follow a moving branch, and for trusted vendor and Omacom release feeds. Needs an upstream declaration. |
 | `release_ring` | `fast`: publish to `rc` and `stable` on merge, not only `edge`. Takes effect with the package's next version: bump `pkgrel` in the same PR. |
 | `channels` | The only channels the package may be published to. `omarchy-dev` is held to `["edge"]` this way. |
 | `pinned` | Version is set per release on the `rc` branch. Used by `omarchy` and `omarchy-settings`. |
@@ -79,7 +79,10 @@ pushed. `BYPASS_MIN_RELEASE_AGE=1` bypasses the hold.

 Packages marked `"auto_merge": true` ride the unattended lane
 (`track-branches.yml`) instead of the reviewed sync PR: their bump PR is opened
-and auto-merged as soon as the build checks pass. `bin/sync-upstream --lane
+and auto-merged as soon as the build checks pass. The lane works with every
+provider, not only branch watches, so it also carries release feeds trusted to
+ship without review: the browsers, large vendors' apps, Omacom's own projects,
+and vendor binaries that hold fresh releases with `min_release_age`. `bin/sync-upstream --lane
 reviewed|auto-merge|all` selects a lane; the scheduled workflows each pass their
 own. Packages that pin the same branch move in lockstep: if one of them fails
 to update, the run restores the others and reports the group as failed. A
@@ -333,7 +333,8 @@ packages_for_upstream_sync() {
 # "auto_merge": true rides the unattended lane instead: its bump PR is opened
 # and auto-merged by the branch tracker as soon as CI is green, which is how a
 # package that follows a moving branch (omarchy-dev, omasnap-git) gets rebuilt
-# without anyone clicking. The lanes are disjoint so a branch tip can never
+# without anyone clicking, and how trusted release feeds (browsers, large
+# vendors, Omacom's own projects) ship without waiting for review. The lanes are disjoint so a branch tip can never
 # hold up a reviewed vendor release, or the other way round.
 package_auto_merge() {
  local pkgdir="$1" metadata
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "debian": "https://downloads.1password.com/linux/debian/amd64/dists/stable/main/binary-amd64/Packages",
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "debian": "https://downloads.claude.ai/claude-desktop/apt/stable/dists/stable/main/binary-amd64/Packages",
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "upstream": {
    "watch": {
      "github": "bjarneo/cliamp",
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "min_release_age": "24h",
  "upstream": {
    "github": "tobi/disktree",
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "npm": "@github/copilot",
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "upstream": {
    "git_tags": "https://github.com/omacom/gliff.git",
    "tag_pattern": "v{pkgver}",
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "origin": {
    "aur": "grok-bot",
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "upstream": {
    "git_tags": "https://github.com/omacom/hype.git",
    "tag_pattern": "v{pkgver}",
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "min_release_age": "24h",
  "upstream": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "upstream": {
    "git_tags": "https://github.com/omacom/monologue.git",
    "tag_pattern": "v{pkgver}",
@@ -1,3 +1,4 @@
 {
-  "source": "local"
+  "source": "local",
+  "auto_merge": true
 }
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "upstream": {
    "watch": {
      "github": "omacom/omawrite",
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {
@@ -1,4 +1,5 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast"
 }
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "min_release_age": "24h",
  "upstream": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {
@@ -1,4 +1,5 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast"
 }
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "min_release_age": "24h",
  "upstream": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "min_release_age": "24h",
  "upstream": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "min_release_age": "24h",
  "upstream": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "upstream": {
    "watch": {
      "github": "omacom/ttfx",
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "upstream": {
    "watch": {
      "debian": "https://downloads.typora.io/linux/Packages",
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "min_release_age": "24h",
  "upstream": {
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "upstream": {
    "watch": {
      "github": "zed-industries/zed",
@@ -1,5 +1,6 @@
 {
  "source": "local",
+  "auto_merge": true,
  "release_ring": "fast",
  "upstream": {
    "watch": {