Automate Grok Bot releases (#583)

* Automate Grok Bot releases

* Refresh Grok Bot to apt 0.66.0 and harden upstream.sh

Bump both architectures to Cursor apt 0.66.0 with matching SHA256s,
introduce a versioned _pool URL helper, and filter Packages stanzas by
Package: grok-bot so sync stays correct if the index grows.

* grok-bot: bump to 0.68.1, drop manual hold, validate pool filename

Bump both architectures to Cursor apt 0.68.1 with the SHA256s from the
amd64/arm64 Packages indexes (verified against the downloaded debs).

Drop grok-bot from the manual holds list in docs/upstream-sources.md and
have upstream.sh check that the newest stanza's Filename is the versioned
pool path the PKGBUILD downloads from. Both additions come from #848.

pkgbuilds/grok-bot/.omarchy/package.json

@@ -1,6 +1,6 @@
 {
   "source": "local",
-  "sync": false,
+  "release_ring": "fast",
   "origin": {
     "aur": "grok-bot",
     "commit": "05eb78fca06b482affda28b26223cbf249d4bbcd"

pkgbuilds/grok-bot/.omarchy/upstream.sh

@@ -0,0 +1,84 @@
+#!/bin/bash
+# Cursor publishes Grok Bot from its own Debian repository, one index per
+# architecture. Each index carries the version and the SHA256, so an update
+# is two small HTTP requests instead of downloading the debs, and the pool
+# URL is keyed by version. bin/sync-upstream can rewrite pkgver and the
+# checksums; it cannot rewrite a commit id embedded in the old
+# downloads.cursor.com/grokbot/stable/<commit>/ URL.
+set -euo pipefail
+
+BASE_URL="https://downloads.cursor.com/aptrepo"
+declare -A DEB_ARCHES=([x86_64]=amd64 [aarch64]=arm64)
+
+# Print "<version> <sha256>" for the newest grok-bot stanza. Newest is
+# vercmp's opinion, which is the one bin/sync-upstream and pacman both use;
+# sort -V disagrees with it over versions like 1.0a. The winner's Filename
+# must be the versioned pool path the PKGBUILD downloads from.
+newest_release() {
+  local index="$1" debarch="$2"
+  local version sha256 filename best_version="" best_sha256="" best_filename=""
+
+  while read -r version sha256 filename; do
+    [[ -n "$version" && -n "$sha256" ]] || continue
+    if [[ -z "$best_version" ]] || [[ "$(vercmp "$version" "$best_version")" -gt 0 ]]; then
+      best_version="$version"
+      best_sha256="$sha256"
+      best_filename="$filename"
+    fi
+  done < <(awk '
+    { sub(/\r$/, "") }
+    /^Package:/ { package = $2 }
+    /^Version:/ { version = $2 }
+    /^SHA256:/  { sha256 = $2 }
+    /^Filename:/ { filename = $2 }
+    /^$/ {
+      if (package == "grok-bot" && version && sha256) print version, sha256, filename
+      package = version = sha256 = filename = ""
+    }
+    END {
+      if (package == "grok-bot" && version && sha256) print version, sha256, filename
+    }
+  ' <<<"$index")
+
+  [[ -n "$best_version" ]] || return 1
+
+  local expected="pool/grok-bot/g/gr/grok-bot_${best_version}_${debarch}.deb"
+  if [[ "$best_filename" != "$expected" ]]; then
+    echo "Unexpected Grok Bot $best_version $debarch Filename: '${best_filename}' (expected $expected)" >&2
+    return 1
+  fi
+
+  echo "$best_version $best_sha256"
+}
+
+versions=()
+declare -A checksums=()
+
+for arch in "${!DEB_ARCHES[@]}"; do
+  index=$(curl -fsSL "$BASE_URL/dists/grok-bot/main/binary-${DEB_ARCHES[$arch]}/Packages")
+
+  read -r version sha256 <<<"$(newest_release "$index" "${DEB_ARCHES[$arch]}")"
+  if [[ -z "${version:-}" || -z "${sha256:-}" ]]; then
+    echo "No usable Grok Bot release found for $arch" >&2
+    exit 1
+  fi
+
+  versions+=("$version")
+  checksums[$arch]="$sha256"
+done
+
+# A release can land one architecture at a time. Wait until both agree so one
+# pkgver always describes both artifacts.
+for version in "${versions[@]}"; do
+  if [[ "$version" != "${versions[0]}" ]]; then
+    echo "Upstream architectures are mid-release (${versions[*]}); skipping" >&2
+    echo '{}'
+    exit 0
+  fi
+done
+
+jq -n \
+  --arg pkgver "${versions[0]}" \
+  --arg x86_64 "${checksums[x86_64]}" \
+  --arg aarch64 "${checksums[aarch64]}" \
+  '{pkgver: $pkgver, sha256sums: {x86_64: [$x86_64], aarch64: [$aarch64]}}'