Open one auto-merging PR per package from every sync workflow

sync-upstream.yml, sync-rebuilds.yml and track-branches.yml each opened one
batch PR, so one package with a failing build held back every other update
in it (#788, #837). All three now group their changes with
package-pr-groups.sh and hand them to package-prs.yml, which opens a PR per
package and arms auto-merge. Packages pinned from the same upstream branch
still share one. Green packages land on their own and only the failures stay
open; a red PR conflicting with master, and each lane's old batch PR, get
closed.

sync-upstream.yml loses its human-merged lane: it now pushes with the PAT
like the other two, so its builds start without an approval hold and its PRs
auto-merge when green. min_release_age still quarantines fresh releases. Its
approve job, approve-sync-push.cjs, and auto-merge-pr.cjs's exception for
auto/sync-upstream go with it.

.github/scripts/approve-sync-push.cjs

@@ -1,34 +0,0 @@
-const approvePrWorkflows = require('./approve-pr-workflows.cjs');
-
-const BOT = 'github-actions[bot]';
-
-// A sync workflow pushes its branch with GITHUB_TOKEN. GitHub holds the
-// resulting pull_request runs for approval and, unlike a person's push,
-// creates no pull_request_target run, so approve-pr.yml never sees it. The
-// sync workflow therefore releases the runs for the commit it just pushed,
-// under the same rule approve-pr.yml applies: only while build-approved is
-// on the PR. The sync applies that label itself, so its pushes build without
-// a maintainer. It acts only on its own bot-authored, same-repository PR for
-// the branch and commit it pushed.
-module.exports = async function approveSyncPush({ github, context, core,
-  number, branch, headSha, since, approve = approvePrWorkflows, ...options }) {
-  if (!Number.isInteger(number) || !branch || !headSha || !since) {
-    throw new Error('Missing sync PR number, branch, head SHA or push time.');
-  }
-  const { data: pr } = await github.rest.pulls.get({ ...context.repo, pull_number: number });
-  const repository = `${context.repo.owner}/${context.repo.repo}`;
-  if (pr.user?.login !== BOT || pr.head.repo?.full_name !== repository ||
-      pr.base.repo?.full_name !== repository || pr.head.ref !== branch) {
-    throw new Error(`PR #${number} is not ${BOT}'s ${branch} PR in ${repository}; refusing to approve.`);
-  }
-  if (pr.state !== 'open' || pr.head.sha !== headSha) {
-    core.info(`PR #${number} is closed or has moved past ${headSha}; nothing to approve.`);
-    return;
-  }
-  if (!pr.labels.some(label => label.name === 'build-approved')) {
-    core.info(`PR #${number} has no build-approved label; its runs stay held.`);
-    return;
-  }
-  await approve({ github, context, core, vouchStatus: 'bot', pullRequest: pr,
-    action: 'synchronize', since, ...options });
-};

.github/scripts/auto-merge-pr.cjs

@@ -14,9 +14,6 @@
 //   test.yml runs on PRs only; an existing test may also run on master
 //   (builder-images.yml runs tests/build-isolation.sh with packages: write),
 //   so editing one still needs a maintainer.
-// - Not the upstream sync. It labels its own PR build-approved to release
-//   GitHub's hold on its pushes, which is no one's approval; it stays on the
-//   reviewed lane.
 const PACKAGES = 'pkgbuilds/';
 const TESTS = 'tests/';
 const TEST_WORKFLOW = '.github/workflows/test.yml';
@@ -38,7 +35,6 @@ function packageChange(file) {
   if (file.filename === TEST_WORKFLOW) return file.status === 'modified' && onlyRunsTests(file.patch);
   return false;
 }
-const REVIEWED_BRANCHES = /^auto\/sync-upstream(\/|$)/;
 
 function decide({ pr, files, vouchStatus, repository }) {
   if (pr.state !== 'open') return { enable: false, reason: 'PR is not open' };
@@ -55,10 +51,6 @@ function decide({ pr, files, vouchStatus, repository }) {
     return { enable: false, reason: `author not trusted to build (${vouchStatus || 'missing'}${labelled ? ', labelled' : ''})` };
   }
 
-  if (pr.head.repo?.full_name === repository && REVIEWED_BRANCHES.test(pr.head.ref)) {
-    return { enable: false, reason: `${pr.head.ref} stays on the reviewed lane` };
-  }
-
   if (!files.length) return { enable: false, reason: 'PR changes no files' };
   const outside = files.filter(file => !packageChange(file));
   if (outside.length) {

.github/scripts/package-pr-groups.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+# Usage: package-pr-groups.sh BRANCH_PREFIX PATCH_OUT
+#
+# Run from the repository root after a sync has rewritten recipes in the
+# working tree. Writes those changes to PATCH_OUT and prints, as one JSON
+# line, the PRs they split into: [{"branch": ..., "packages": "a b"}, ...].
+#
+# One PR per package, so a package whose build fails holds back only itself.
+# Packages pinned from the same upstream branch (omarchy-dev and
+# omarchy-settings-dev) share a PR: sync-upstream moves them in lockstep, and
+# merging one without the other would ship the pair from different commits.
+# Branch names come from sync-pr-branch.sh, so a scheduled run and a dispatch
+# naming the same packages update the same PR.
+set -euo pipefail
+
+prefix=${1:?branch prefix required}
+patch=${2:?patch path required}
+scripts=$(dirname "$0")
+
+git diff --binary -- pkgbuilds > "$patch"
+
+declare -A members=()
+while IFS= read -r package; do
+  key=$(jq -r '(.upstream.watch? | objects | select(has("git_branch")) | "\(.git_branch)#\(.branch)") // empty' \
+    "pkgbuilds/$package/.omarchy/package.json" 2>/dev/null || true)
+  members["${key:-$package}"]+="$package "
+done < <(git diff --name-only -- pkgbuilds | cut -d/ -f2 | sort -u)
+
+groups='[]'
+for key in "${!members[@]}"; do
+  read -r -a packages <<<"${members[$key]}"
+  branch=$("$scripts/sync-pr-branch.sh" "$prefix" "${packages[@]}" | sed -n 's/^branch=//p')
+  groups=$(jq -c --arg branch "$branch" --arg packages "${packages[*]}" \
+    '. + [{branch: $branch, packages: $packages}]' <<<"$groups")
+done
+jq -c 'sort_by(.branch)' <<<"$groups"

.github/workflows/package-prs.yml

@@ -0,0 +1,134 @@
+name: Open package PRs
+
+# Shared by the three bot lanes (sync-upstream.yml, sync-rebuilds.yml and
+# track-branches.yml). The caller's sync job rewrites recipes, groups the
+# changes with .github/scripts/package-pr-groups.sh and uploads them as the
+# `package-pins` artifact. This opens or updates one PR per group and arms
+# auto-merge, so every green package lands on its own and only the failures
+# stay open. A single batch PR let one red package hold back every other one
+# (#788, #837).
+#
+# Everything goes through the PAT in PKGS_BOT_TOKEN: its pushes build without
+# an approval hold, and a merge made with it starts publish.yml. A merge made
+# with the built-in GITHUB_TOKEN would not publish.
+
+on:
+  workflow_call:
+    inputs:
+      groups:
+        description: 'JSON from package-pr-groups.sh: [{"branch", "packages"}]'
+        required: true
+        type: string
+      prefix:
+        description: 'Branch prefix the caller owns, e.g. auto/sync-upstream'
+        required: true
+        type: string
+      title:
+        description: 'PR title; ": <package> <version>, ..." is appended'
+        required: true
+        type: string
+      body:
+        description: 'PR body'
+        required: true
+        type: string
+    secrets:
+      PKGS_BOT_TOKEN:
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  pr:
+    if: ${{ inputs.groups != '[]' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      max-parallel: 4
+      matrix:
+        group: ${{ fromJSON(inputs.groups) }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Fetch the pins
+        uses: actions/download-artifact@v4
+        with:
+          name: package-pins
+          path: ${{ runner.temp }}
+
+      # The PR title names what moved, so the merged history reads like a
+      # changelog: "Sync upstream releases: zed 1.23.2-1".
+      - name: Apply this PR's packages
+        id: apply
+        env:
+          PACKAGES: ${{ matrix.group.packages }}
+          TITLE: ${{ inputs.title }}
+        run: |
+          read -r -a packages <<<"$PACKAGES"
+          git apply $(printf -- '--include=pkgbuilds/%s/* ' "${packages[@]}") "$RUNNER_TEMP/pins.patch"
+          git status --porcelain
+          field() { sed -n "s/^$2=//p" "pkgbuilds/$1/PKGBUILD" | head -1 | tr -d "\"'"; }
+          versions=$(for package in "${packages[@]}"; do
+            printf '%s %s-%s, ' "$package" "$(field "$package" pkgver)" "$(field "$package" pkgrel)"
+          done)
+          title="$TITLE: ${versions%, }"
+          echo "title=$title" >> "$GITHUB_OUTPUT"
+          echo "- $title" >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Open or update the PR
+        id: pr
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ secrets.PKGS_BOT_TOKEN }}
+          commit-message: ${{ steps.apply.outputs.title }}
+          title: ${{ steps.apply.outputs.title }}
+          body: ${{ inputs.body }}
+          branch: ${{ matrix.group.branch }}
+          delete-branch: true
+          labels: automated
+
+      # Auto-merge, not a direct merge: branch protection still has to see
+      # `result`, `self-tests` and `build-isolation` green. auto-merge-pr.yml
+      # may arm the same PR at the same moment; either one arming it is the
+      # outcome wanted.
+      - name: Enable auto-merge
+        if: ${{ steps.pr.outputs.pull-request-number != '' }}
+        env:
+          GH_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
+          PR: ${{ steps.pr.outputs.pull-request-number }}
+        run: |
+          armed() { [[ "$(gh pr view "$PR" -R "$GITHUB_REPOSITORY" --json autoMergeRequest --jq '.autoMergeRequest != null')" == true ]]; }
+          if armed; then
+            echo "auto-merge already enabled on #$PR"
+            exit 0
+          fi
+          gh pr merge --auto --merge "$PR" -R "$GITHUB_REPOSITORY" || armed
+
+  # A PR on this lane's prefix that the run did not refresh, and that
+  # conflicts with master, is stale: master moved its packages on without it.
+  # Close it rather than leave a red PR behind. Not being refreshed is not
+  # enough on its own, since a feed that failed this run (one of dozens timing
+  # out is routine) leaves a still-valid PR unrefreshed too. The lane's old
+  # batch PR, on the bare prefix, is retired outright.
+  close-superseded:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Close superseded PRs
+        env:
+          GH_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
+          GROUPS_JSON: ${{ inputs.groups }}
+          PREFIX: ${{ inputs.prefix }}
+        run: |
+          gh pr list -R "$GITHUB_REPOSITORY" --state open --limit 500 --json number,headRefName,mergeable \
+            --jq '.[] | select(.headRefName == env.PREFIX or (.headRefName | startswith(env.PREFIX + "-"))) | "\(.number) \(.headRefName) \(.mergeable)"' |
+          while read -r number branch mergeable; do
+            jq -e --arg branch "$branch" 'any(.[]; .branch == $branch)' <<<"$GROUPS_JSON" >/dev/null && continue
+            [[ $branch == "$PREFIX" || $mergeable == CONFLICTING ]] || continue
+            echo "closing #$number ($branch): superseded"
+            gh pr close "$number" -R "$GITHUB_REPOSITORY" --delete-branch \
+              --comment "Superseded: master has moved these packages on, or per-package PRs carry them now."
+          done

.github/workflows/sync-rebuilds.yml

@@ -1,9 +1,11 @@
 name: Sync Rebuild Triggers
 
-# Rebuilds ride the unattended lane, like track-branches.yml: the pkgrel bump
-# PR builds on the droplets, auto-merge lands it once `result`, `self-tests`
-# and `build-isolation` are green, and the merge publishes. A rebuild that
-# fails stays an unmerged red PR for a maintainer.
+# Rebuilds ride the unattended lane, like track-branches.yml: each package's
+# pkgrel bump gets its own PR on auto/sync-rebuilds-<package>, opened by
+# package-prs.yml. It builds on the droplets, auto-merge lands it once
+# `result`, `self-tests` and `build-isolation` are green, and the merge
+# publishes. A rebuild that fails stays an unmerged red PR for a maintainer
+# without holding back any other package.
 #
 # The PR and auto-merge use the PAT in PKGS_BOT_TOKEN, because a merge made
 # with the built-in GITHUB_TOKEN does not start publish.yml, and its pushes
@@ -20,12 +22,19 @@ on:
         required: false
         default: ''
 
+# One sync at a time: two runs racing on one auto/sync-rebuilds-* branch
+# would each force-push their own bump over the other's.
+concurrency:
+  group: sync-rebuilds
+  cancel-in-progress: false
+
 jobs:
   sync:
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-      pull-requests: write
+      contents: read
+    outputs:
+      groups: ${{ steps.groups.outputs.groups }}
 
     steps:
       - name: Require the bot token
@@ -42,23 +51,13 @@ jobs:
         with:
           persist-credentials: false
 
-      # A scoped dispatch regenerates only the named packages. Pushed to the
-      # shared branch, that would replace every other pending update in its
-      # PR, so it gets a branch and PR of its own.
-      - name: Choose the PR branch
-        id: branch
-        env:
-          PACKAGES: ${{ github.event.inputs.packages }}
-        run: |
-          read -r -a package_args <<< "${PACKAGES:-}"
-          .github/scripts/sync-pr-branch.sh auto/sync-rebuilds "${package_args[@]}" | tee -a "$GITHUB_OUTPUT"
-
       # Runs in an Arch container against the mirror the x86_64 builder itself
       # uses, because the question being asked is what that builder will link
       # against and a different mirror can be hours ahead of it. Recording a
       # version the build never saw is the one failure this command must not
       # have: nothing re-fires once the record matches.
       - name: Bump pkgrel for packages whose dependencies moved
+        id: sync
         run: |
           docker run --rm \
             -e PACKAGES="$PACKAGES" \
@@ -88,56 +87,53 @@ jobs:
         env:
           PACKAGES: ${{ github.event.inputs.packages }}
 
-      - name: Check for changes
-        id: changes
+      - name: Group the bumps into PRs
+        if: ${{ !cancelled() && steps.sync.outcome != 'skipped' }}
+        id: groups
         run: |
-          if [ -z "$(git status --porcelain)" ]; then
-            echo "has_changes=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "has_changes=true" >> "$GITHUB_OUTPUT"
-          fi
+          groups=$(.github/scripts/package-pr-groups.sh auto/sync-rebuilds "$RUNNER_TEMP/pins.patch")
+          echo "groups=$groups" >> "$GITHUB_OUTPUT"
 
-      - name: Create Pull Request
-        if: steps.changes.outputs.has_changes == 'true'
-        id: cpr
-        uses: peter-evans/create-pull-request@v7
+      - name: Hand the bumps to the PR jobs
+        if: ${{ !cancelled() && steps.groups.outputs.groups != '' && steps.groups.outputs.groups != '[]' }}
+        uses: actions/upload-artifact@v4
         with:
-          token: ${{ secrets.PKGS_BOT_TOKEN }}
-          commit-message: 'chore: rebuild against updated dependencies'
-          title: "chore: rebuild against updated dependencies${{ steps.branch.outputs.scope && format(' ({0})', steps.branch.outputs.scope) || '' }}"
-          body: |
-            Automated pkgrel bump for packages that link against a dependency
-            which has moved in the official repositories.
+          name: package-pins
+          path: ${{ runner.temp }}/pins.patch
+          retention-days: 1
 
-            Each package names those dependencies in `rebuild_on` and carries the
-            versions its current pkgrel was bumped for in `rebuilt_against`. The
-            bump is what makes the rebuilt package an upgrade pacman will offer;
-            without it the build produces the version already published and no
-            one receives it.
+  prs:
+    needs: sync
+    if: ${{ !cancelled() && needs.sync.outputs.groups != '' }}
+    permissions:
+      contents: read
+    uses: ./.github/workflows/package-prs.yml
+    with:
+      groups: ${{ needs.sync.outputs.groups }}
+      prefix: auto/sync-rebuilds
+      title: Rebuild against updated dependencies
+      body: |
+        Automated pkgrel bump for a package that links against a dependency
+        which has moved in the official repositories.
 
-            This PR auto-merges once the build checks pass. A failing rebuild
-            leaves it open for a maintainer.
-          branch: ${{ steps.branch.outputs.branch }}
-          delete-branch: true
-          labels: automated
+        Each package names those dependencies in `rebuild_on` and carries the
+        versions its current pkgrel was bumped for in `rebuilt_against`. The
+        bump is what makes the rebuilt package an upgrade pacman will offer;
+        without it the build produces the version already published and no
+        one receives it.
 
-      # Auto-merge, not a direct merge: branch protection still has to see
-      # the build checks green before the rebuild lands.
-      - name: Enable auto-merge
-        if: steps.cpr.outputs.pull-request-number != ''
-        env:
-          GH_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
-          PR: ${{ steps.cpr.outputs.pull-request-number }}
-        run: |
-          # Idempotent across re-runs of an updated PR: enabling twice errors.
-          if [[ "$(gh pr view "$PR" -R "${{ github.repository }}" --json autoMergeRequest --jq '.autoMergeRequest != null')" == true ]]; then
-            echo "auto-merge already enabled on #$PR"
-            exit 0
-          fi
-          gh pr merge --auto --merge "$PR" -R "${{ github.repository }}"
+        This PR auto-merges once the build checks pass. A failing rebuild
+        leaves it open for a maintainer without holding back any other package.
+    secrets:
+      PKGS_BOT_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
 
+  notify:
+    needs: [sync, prs]
+    if: ${{ failure() }}
+    runs-on: ubuntu-latest
+    steps:
       - name: Notify Basecamp on failure
-        if: failure() && env.BASECAMP_CHATBOT_URL != ''
+        if: ${{ env.BASECAMP_CHATBOT_URL != '' }}
         env:
           BASECAMP_CHATBOT_URL: ${{ secrets.BASECAMP_CHATBOT_URL }}
         run: |

.github/workflows/sync-upstream.yml

@@ -1,5 +1,17 @@
 name: Sync Upstream Releases
 
+# Bumps every package whose upstream release feed has moved, except the
+# "auto_merge": true packages that track-branches.yml checks hourly. Each
+# package gets its own PR on auto/sync-upstream-<package>, opened by
+# package-prs.yml: the PR builds on the droplets, auto-merge lands it when
+# `result` is green, and the merge publishes. A package that fails to build
+# stays an open red PR for a maintainer without holding back any other; the
+# next run updates it if upstream moves again. `min_release_age` still
+# quarantines fresh releases before they are proposed.
+#
+# The PRs and auto-merge use the PAT in PKGS_BOT_TOKEN, so their pushes
+# build without an approval hold and their merges start publish.yml.
+
 on:
   schedule:
     # Every 6 hours, off the hour to dodge the scheduling backlog at :00
@@ -11,36 +23,35 @@ on:
         required: false
         default: ''
 
+# One sync at a time: two runs racing on one auto/sync-upstream-* branch
+# would each force-push their own update over the other's.
+concurrency:
+  group: sync-upstream
+  cancel-in-progress: false
+
 jobs:
   sync:
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-      pull-requests: write
+      contents: read
     outputs:
-      branch: ${{ steps.branch.outputs.branch }}
-      pushed_at: ${{ steps.pushed.outputs.at }}
-      number: ${{ steps.cpr.outputs.pull-request-number }}
-      operation: ${{ steps.cpr.outputs.pull-request-operation }}
-      head_sha: ${{ steps.cpr.outputs.pull-request-head-sha }}
+      groups: ${{ steps.groups.outputs.groups }}
 
     steps:
+      - name: Require the bot token
+        env:
+          PKGS_BOT_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
+        run: |
+          if [[ -z "$PKGS_BOT_TOKEN" ]]; then
+            echo "::error::Set PKGS_BOT_TOKEN to a PAT with Contents: write and Pull requests: write on this repository, owned by an account trusted to trigger builds."
+            exit 1
+          fi
+
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           persist-credentials: false
 
-      # A scoped dispatch regenerates only the named packages. Pushed to the
-      # shared branch, that would replace every other pending update in its
-      # PR, so it gets a branch and PR of its own.
-      - name: Choose the PR branch
-        id: branch
-        env:
-          PACKAGES: ${{ github.event.inputs.packages }}
-        run: |
-          read -r -a package_args <<< "${PACKAGES:-}"
-          .github/scripts/sync-pr-branch.sh auto/sync-upstream "${package_args[@]}" | tee -a "$GITHUB_OUTPUT"
-
       # Runs in an Arch container for vercmp: whether a release is an upgrade has
       # to be decided by the same comparator pacman will use on users' machines.
       - name: Update packages from upstream release feeds
@@ -64,8 +75,8 @@ jobs:
               useradd -m -u "$HOST_UID" -g "$HOST_GID" runner
               chown -R runner:runner /workspace/pkgbuilds
 
-              # The reviewed lane only: packages marked auto_merge ride
-              # track-branches.yml, which merges without a human.
+              # Packages marked auto_merge ride track-branches.yml instead,
+              # which checks them hourly.
               if [[ -n "${PACKAGES:-}" ]]; then
                 read -r -a package_args <<< "$PACKAGES"
                 runuser -u runner -- ./bin/sync-upstream --lane reviewed "${package_args[@]}"
@@ -78,50 +89,50 @@ jobs:
           UPSTREAM_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       # Failed feeds leave their recipes untouched; completed updates still
-      # reach review. The failed sync step keeps the workflow red and notifies.
-      - name: Check for changes
+      # get their PRs. The failed sync step keeps the workflow red and notifies.
+      - name: Group the updates into PRs
         if: ${{ !cancelled() && steps.sync.outcome != 'skipped' }}
-        id: changes
+        id: groups
         run: |
-          if [ -z "$(git status --porcelain)" ]; then
-            echo "has_changes=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "has_changes=true" >> "$GITHUB_OUTPUT"
-          fi
+          groups=$(.github/scripts/package-pr-groups.sh auto/sync-upstream "$RUNNER_TEMP/pins.patch")
+          echo "groups=$groups" >> "$GITHUB_OUTPUT"
 
-      # Runs created by this push are newer than this; the approve job
-      # waits for them. A minute's slack absorbs runner clock skew.
-      - name: Record push time
-        if: ${{ !cancelled() && steps.changes.outputs.has_changes == 'true' }}
-        id: pushed
-        run: echo "at=$(date -u -d '-1 minute' +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
-
-      - name: Create Pull Request
-        if: ${{ !cancelled() && steps.changes.outputs.has_changes == 'true' }}
-        id: cpr
-        uses: peter-evans/create-pull-request@v7
+      - name: Hand the updates to the PR jobs
+        if: ${{ !cancelled() && steps.groups.outputs.groups != '' && steps.groups.outputs.groups != '[]' }}
+        uses: actions/upload-artifact@v4
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          commit-message: 'chore: sync upstream releases'
-          title: "chore: sync upstream releases${{ steps.branch.outputs.scope && format(' ({0})', steps.branch.outputs.scope) || '' }}"
-          body: |
-            Automated update of packages that track an upstream vendor release
-            feed rather than the AUR.
+          name: package-pins
+          path: ${{ runner.temp }}/pins.patch
+          retention-days: 1
 
-            Release watches and providers are declared in `.omarchy/package.json`;
-            exceptional feeds use `.omarchy/upstream.sh`. Failed package updates
-            are left untouched; check the workflow result for outstanding failures.
-          branch: ${{ steps.branch.outputs.branch }}
-          delete-branch: true
-          # The bot is trusted; build-approved lets the approve job below
-          # release GitHub's hold on its pushes without a maintainer.
-          labels: |
-            automated
-            build-approved
-          reviewers: ryanrhughes
+  prs:
+    needs: sync
+    if: ${{ !cancelled() && needs.sync.outputs.groups != '' }}
+    permissions:
+      contents: read
+    uses: ./.github/workflows/package-prs.yml
+    with:
+      groups: ${{ needs.sync.outputs.groups }}
+      prefix: auto/sync-upstream
+      title: Sync upstream releases
+      body: |
+        Automated update of a package that tracks an upstream vendor release
+        feed rather than the AUR.
 
+        Release watches and providers are declared in `.omarchy/package.json`;
+        exceptional feeds use `.omarchy/upstream.sh`. This PR auto-merges once
+        the build checks pass. A failing build leaves it open for a maintainer
+        without holding back any other package.
+    secrets:
+      PKGS_BOT_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
+
+  notify:
+    needs: [sync, prs]
+    if: ${{ failure() }}
+    runs-on: ubuntu-latest
+    steps:
       - name: Notify Basecamp on failure
-        if: failure() && env.BASECAMP_CHATBOT_URL != ''
+        if: ${{ env.BASECAMP_CHATBOT_URL != '' }}
         env:
           BASECAMP_CHATBOT_URL: ${{ secrets.BASECAMP_CHATBOT_URL }}
         run: |
@@ -131,36 +142,3 @@ jobs:
               "🔴 <strong>Upstream sync failed</strong><br><a href=\"${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\">View run</a>" \
               '{content: $content}')" \
             "$BASECAMP_CHATBOT_URL"
-
-  # GitHub holds pull_request runs from a GITHUB_TOKEN push for approval and
-  # creates no pull_request_target run for it, so approve-pr.yml never sees
-  # the sync's own pushes. The sync labels its PR build-approved, so release
-  # the held runs for the commit just pushed, whether it opened the PR or
-  # updated it. A separate job, so the sync container's token never holds
-  # actions: write.
-  approve:
-    needs: sync
-    if: ${{ !cancelled() && (needs.sync.outputs.operation == 'created' || needs.sync.outputs.operation == 'updated') }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-      pull-requests: read
-      actions: write
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - name: Release held build and test runs
-        uses: actions/github-script@v7
-        env:
-          NUMBER: ${{ needs.sync.outputs.number }}
-          BRANCH: ${{ needs.sync.outputs.branch }}
-          HEAD_SHA: ${{ needs.sync.outputs.head_sha }}
-          SINCE: ${{ needs.sync.outputs.pushed_at }}
-        with:
-          script: |
-            const approve = require('./.github/scripts/approve-sync-push.cjs');
-            const { NUMBER, BRANCH, HEAD_SHA, SINCE } = process.env;
-            await approve({ github, context, core, number: Number(NUMBER),
-              branch: BRANCH, headSha: HEAD_SHA, since: SINCE });

.github/workflows/track-branches.yml

@@ -1,21 +1,21 @@
 name: Track upstream branches
 
-# The unattended lane. Packages marked "auto_merge": true update without a
-# human: some follow a moving upstream branch (omarchy-dev and
-# omarchy-settings-dev on quattro, omasnap-git on main) rather than tagged
-# releases, so nothing in this repository changes when their source does;
-# the rest are release feeds trusted to ship unreviewed (browsers, large
-# vendors, Omacom's own projects). This workflow makes each new branch tip a commit pin
-# in the recipe, which publish.yml then treats like any other version bump:
-# the PR builds on the droplets, auto-merge lands it when `result` is green,
-# and the merge publishes the artifacts. A tip that fails to build stays an
-# unmerged red PR that the next tick supersedes.
+# The hourly lane. Packages marked "auto_merge": true update here instead of
+# in sync-upstream.yml's 6-hourly run: some follow a moving upstream branch
+# (omarchy-dev and omarchy-settings-dev on quattro, omasnap-git on main)
+# rather than tagged releases, so nothing in this repository changes when
+# their source does; the rest are release feeds worth shipping within the
+# hour (browsers, large vendors, Omacom's own projects). This workflow makes
+# each new branch tip a commit pin in the recipe, which publish.yml then
+# treats like any other version bump: the PR builds on the droplets,
+# auto-merge lands it when `result` is green, and the merge publishes the
+# artifacts. A tip that fails to build stays an unmerged red PR that the next
+# tick supersedes.
 #
-# One PR per package, on auto/track-branches-<package>. Packages pinned from
-# the same upstream branch (omarchy-dev and omarchy-settings-dev) share one,
-# because sync-upstream moves them in lockstep. A single batch PR let one
-# package with a broken build hold every other package back: omasnap-git's
-# smoke suite kept the quattro pins unmerged for four days (#788).
+# One PR per package, on auto/track-branches-<package>, opened by
+# package-prs.yml. Packages pinned from the same upstream branch
+# (omarchy-dev and omarchy-settings-dev) share one, because sync-upstream
+# moves them in lockstep.
 #
 # The PR and auto-merge use the PAT in PKGS_BOT_TOKEN so they trigger the
 # build and publish workflows. The built-in GITHUB_TOKEN cannot drive this
@@ -64,7 +64,7 @@ jobs:
         with:
           persist-credentials: false
 
-      # Same container as the reviewed sync: vercmp decides whether a pin is
+      # Same container as sync-upstream.yml: vercmp decides whether a pin is
       # an upgrade with the comparator pacman uses on users' machines.
       - name: Pin tracked branches to their current tips
         id: sync
@@ -98,147 +98,45 @@ jobs:
           PACKAGES: ${{ github.event.inputs.packages }}
           UPSTREAM_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      # The PR a pin rides: one per package, or one per upstream branch for
-      # packages that must move together. The pins travel to the PR jobs as
-      # a patch, so the upstream feeds are read once and every PR is cut
-      # from the same answers.
       - name: Group the pins into PRs
         if: ${{ !cancelled() && steps.sync.outcome != 'skipped' }}
         id: groups
         run: |
-          git diff --binary -- pkgbuilds > "$RUNNER_TEMP/pins.patch"
-          declare -A members=()
-          while IFS= read -r package; do
-            key=$(jq -r '(.upstream.watch? | objects | select(has("git_branch")) | "\(.git_branch)#\(.branch)") // empty' \
-              "pkgbuilds/$package/.omarchy/package.json" 2>/dev/null || true)
-            members["${key:-$package}"]+="$package "
-          done < <(git diff --name-only -- pkgbuilds | cut -d/ -f2 | sort -u)
-          groups='[]'
-          for key in "${!members[@]}"; do
-            read -r -a packages <<<"${members[$key]}"
-            branch=$(.github/scripts/sync-pr-branch.sh auto/track-branches "${packages[@]}" | sed -n 's/^branch=//p')
-            groups=$(jq -c --arg branch "$branch" --arg packages "${packages[*]}" \
-              '. + [{branch: $branch, packages: $packages}] | sort_by(.branch)' <<<"$groups")
-          done
+          groups=$(.github/scripts/package-pr-groups.sh auto/track-branches "$RUNNER_TEMP/pins.patch")
           echo "groups=$groups" >> "$GITHUB_OUTPUT"
-          jq -r '.[] | "- `\(.branch)`: \(.packages)"' <<<"$groups" | sed '1i ### Tracker PRs' >> "$GITHUB_STEP_SUMMARY"
 
       - name: Hand the pins to the PR jobs
         if: ${{ !cancelled() && steps.groups.outputs.groups != '' && steps.groups.outputs.groups != '[]' }}
         uses: actions/upload-artifact@v4
         with:
-          name: pins
+          name: package-pins
           path: ${{ runner.temp }}/pins.patch
           retention-days: 1
 
-      # A tracker PR that this run did not refresh and that conflicts with
-      # master is stale: master moved its packages on without it. Close it
-      # rather than leave a red PR behind. Whether a PR was refreshed is not
-      # enough on its own, since a feed that failed this run (one of fifty
-      # timing out is routine) leaves a still-valid PR unrefreshed too. The
-      # old single auto/track-branches PR is retired outright: the per-package
-      # PRs replace it.
-      - name: Close superseded tracker PRs
-        if: ${{ !cancelled() && steps.groups.outcome == 'success' }}
-        env:
-          GH_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
-          GROUPS_JSON: ${{ steps.groups.outputs.groups }}
-        run: |
-          gh pr list -R "${{ github.repository }}" --state open --limit 200 --json number,headRefName,mergeable \
-            --jq '.[] | select(.headRefName | startswith("auto/track-branches")) | "\(.number) \(.headRefName) \(.mergeable)"' |
-          while read -r number branch mergeable; do
-            jq -e --arg branch "$branch" 'any(.[]; .branch == $branch)' <<<"$GROUPS_JSON" >/dev/null && continue
-            [[ $branch == auto/track-branches || $mergeable == CONFLICTING ]] || continue
-            echo "closing #$number ($branch): superseded"
-            gh pr close "$number" -R "${{ github.repository }}" --delete-branch \
-              --comment "Superseded: master has moved these packages on, or a per-package tracker PR carries them now."
-          done
-
-  pr:
+  prs:
     needs: track
-    if: ${{ !cancelled() && needs.track.outputs.groups != '' && needs.track.outputs.groups != '[]' }}
-    runs-on: ubuntu-latest
+    if: ${{ !cancelled() && needs.track.outputs.groups != '' }}
     permissions:
       contents: read
-    strategy:
-      fail-fast: false
-      max-parallel: 4
-      matrix:
-        group: ${{ fromJSON(needs.track.outputs.groups) }}
+    uses: ./.github/workflows/package-prs.yml
+    with:
+      groups: ${{ needs.track.outputs.groups }}
+      prefix: auto/track-branches
+      title: Track upstream branches
+      body: |
+        Automated pin of a package that follows a moving upstream branch or a
+        trusted release feed (`"auto_merge": true` in `.omarchy/package.json`).
+        Its recipe now points at the newest upstream release, or the newest
+        branch tip whose commit timestamp is at least `min_release_age` old.
 
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-
-      - name: Fetch the pins
-        uses: actions/download-artifact@v4
-        with:
-          name: pins
-          path: ${{ runner.temp }}
-
-      - name: Apply this PR's pins
-        env:
-          PACKAGES: ${{ matrix.group.packages }}
-        run: |
-          read -r -a packages <<<"$PACKAGES"
-          git apply $(printf -- '--include=pkgbuilds/%s/* ' "${packages[@]}") "$RUNNER_TEMP/pins.patch"
-          git status --porcelain
-          {
-            echo "### Pinned"
-            git diff --unified=0 -- 'pkgbuilds/*/PKGBUILD' | grep -E '^\+(pkgver|_commit)=' | sed 's/^+/- /'
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      # The PR title names what moved, so the merged history reads like a
-      # changelog: "Track upstream branches: omarchy-dev 4.0.0.r6520.g1a2b3c4, ...".
-      - name: Describe the pins
-        id: describe
-        run: |
-          title=$(git diff --unified=0 -- 'pkgbuilds/*/PKGBUILD' \
-            | awk '/^\+\+\+ b\/pkgbuilds\//{split($2,p,"/"); pkg=p[3]} /^\+pkgver=/{sub(/^\+pkgver=/,""); printf "%s %s, ", pkg, $0}' \
-            | sed 's/, $//')
-          echo "title=Track upstream branches: ${title}" >> "$GITHUB_OUTPUT"
-
-      - name: Open or update the tracking PR
-        id: pr
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          token: ${{ secrets.PKGS_BOT_TOKEN }}
-          commit-message: ${{ steps.describe.outputs.title }}
-          title: ${{ steps.describe.outputs.title }}
-          body: |
-            Automated pin of packages that follow a moving upstream branch
-            or a trusted release feed (`"auto_merge": true` in
-            `.omarchy/package.json`). Each package's recipe now points at the
-            newest upstream release, or the newest branch tip whose commit
-            timestamp is at least `min_release_age` old.
-
-            This PR auto-merges once the build checks pass. A failing build
-            leaves it open without holding back any other package; the next
-            tracker run replaces it with the newer tip.
-          branch: ${{ matrix.group.branch }}
-          delete-branch: true
-          labels: automated
-
-      # Auto-merge, not a direct merge: branch protection still has to see
-      # `result`, `self-tests` and `build-isolation` green, and this lane
-      # inherits every rule the reviewed lane has except the human.
-      - name: Enable auto-merge
-        if: ${{ steps.pr.outputs.pull-request-number != '' }}
-        env:
-          GH_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
-          PR: ${{ steps.pr.outputs.pull-request-number }}
-        run: |
-          # Idempotent across re-runs of an updated PR: enabling twice errors.
-          if [[ "$(gh pr view "$PR" -R "${{ github.repository }}" --json autoMergeRequest --jq '.autoMergeRequest != null')" == true ]]; then
-            echo "auto-merge already enabled on #$PR"
-            exit 0
-          fi
-          gh pr merge --auto --merge "$PR" -R "${{ github.repository }}"
+        This PR auto-merges once the build checks pass. A failing build leaves
+        it open without holding back any other package; the next tracker run
+        replaces it with the newer tip.
+    secrets:
+      PKGS_BOT_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
 
   notify:
-    needs: [track, pr]
+    needs: [track, prs]
     if: ${{ failure() }}
     runs-on: ubuntu-latest
     steps: