Replace scheduled AUR imports with direct upstream watches

.github/workflows/sync-aur.yml

@@ -1,91 +0,0 @@
-name: Sync AUR Packages
-
-on:
-  schedule:
-    # Every 6 hours
-    - cron: '0 */6 * * *'
-  workflow_dispatch:
-    inputs:
-      packages:
-        description: 'Specific packages to sync (space-separated, leave empty for all)'
-        required: false
-        default: ''
-
-jobs:
-  sync:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-
-      - name: Sync AUR packages
-        run: |
-          docker run --rm \
-            -e PACKAGES="$PACKAGES" \
-            -e HOST_UID="$(id -u)" \
-            -e HOST_GID="$(id -g)" \
-            -v "$PWD/bin:/workspace/bin:ro" \
-            -v "$PWD/helpers:/workspace/helpers:ro" \
-            -v "$PWD/pkgbuilds:/workspace/pkgbuilds" \
-            -w /workspace \
-            archlinux:base-devel bash -lc '
-              set -euo pipefail
-
-              pacman -Syu --noconfirm git jq
-
-              groupadd -g "$HOST_GID" runner
-              useradd -m -u "$HOST_UID" -g "$HOST_GID" runner
-              chown -R runner:runner /workspace/pkgbuilds
-
-              if [[ -n "${PACKAGES:-}" ]]; then
-                read -r -a package_args <<< "$PACKAGES"
-                runuser -u runner -- ./bin/sync-aur "${package_args[@]}"
-              else
-                runuser -u runner -- ./bin/sync-aur
-              fi
-            '
-        env:
-          PACKAGES: ${{ github.event.inputs.packages }}
-
-      - name: Check for changes
-        id: changes
-        run: |
-          if [ -z "$(git status --porcelain)" ]; then
-            echo "has_changes=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "has_changes=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Create Pull Request
-        if: steps.changes.outputs.has_changes == 'true'
-        uses: peter-evans/create-pull-request@v7
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          commit-message: 'chore: sync AUR packages'
-          title: 'chore: sync AUR packages'
-          body: |
-            Automated AUR package sync.
-
-            Package sync behavior is controlled by `.omarchy/package.json`.
-          branch: auto/sync-aur
-          delete-branch: true
-          labels: automated
-          reviewers: ryanrhughes
-
-      - name: Notify Basecamp on failure
-        if: failure() && env.BASECAMP_CHATBOT_URL != ''
-        env:
-          BASECAMP_CHATBOT_URL: ${{ secrets.BASECAMP_CHATBOT_URL }}
-        run: |
-          curl -s -o /dev/null \
-            -H "Content-Type: application/json" \
-            -d "$(jq -n --arg content \
-              "🔴 <strong>AUR sync failed</strong><br><a href=\"${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\">View run</a>" \
-              '{content: $content}')" \
-            "$BASECAMP_CHATBOT_URL"

.github/workflows/sync-upstream.yml

@@ -27,9 +27,11 @@ jobs:
       # Runs in an Arch container for vercmp: whether a release is an upgrade has
       # to be decided by the same comparator pacman will use on users' machines.
       - name: Update packages from upstream release feeds
+        id: sync
         run: |
           docker run --rm \
             -e PACKAGES="$PACKAGES" \
+            -e UPSTREAM_GITHUB_TOKEN="$UPSTREAM_GITHUB_TOKEN" \
             -e HOST_UID="$(id -u)" \
             -e HOST_GID="$(id -g)" \
             -v "$PWD/bin:/workspace/bin:ro" \
@@ -39,7 +41,7 @@ jobs:
             archlinux:base-devel bash -lc '
               set -euo pipefail
 
-              pacman -Syu --noconfirm git jq
+              pacman -Syu --noconfirm git jq python libarchive
 
               groupadd -g "$HOST_GID" runner
               useradd -m -u "$HOST_UID" -g "$HOST_GID" runner
@@ -54,8 +56,12 @@ jobs:
             '
         env:
           PACKAGES: ${{ github.event.inputs.packages }}
+          UPSTREAM_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      # Failed feeds leave their recipes untouched; completed updates still
+      # reach review. The failed sync step keeps the workflow red and notifies.
       - name: Check for changes
+        if: ${{ !cancelled() && steps.sync.outcome != 'skipped' }}
         id: changes
         run: |
           if [ -z "$(git status --porcelain)" ]; then
@@ -65,7 +71,7 @@ jobs:
           fi
 
       - name: Create Pull Request
-        if: steps.changes.outputs.has_changes == 'true'
+        if: ${{ !cancelled() && steps.changes.outputs.has_changes == 'true' }}
         uses: peter-evans/create-pull-request@v7
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -75,8 +81,9 @@ jobs:
             Automated update of packages that track an upstream vendor release
             feed rather than the AUR.
 
-            Each package reports its newest release through
-            `.omarchy/upstream.sh`.
+            Release watches and providers are declared in `.omarchy/package.json`;
+            exceptional feeds use `.omarchy/upstream.sh`. Failed package updates
+            are left untouched; check the workflow result for outstanding failures.
           branch: auto/sync-upstream
           delete-branch: true
           labels: automated

.github/workflows/test.yml

@@ -39,7 +39,8 @@ jobs:
             -w /workspace \
             archlinux:base-devel bash -lc '
               set -euo pipefail
-              pacman -Syu --noconfirm git jq
+              pacman -Syu --noconfirm git jq python libarchive
+              python tests/upstream-watch.py
               ./bin/sync-upstream self-test
               ./bin/sync-rebuilds --self-test
               ./bin/omarchy-pkgs self-test