Track upstream branches as pinned releases on an unattended lane

Since publishing moved to CI on merge, a package whose PKGBUILD never
changes while its source moves was never rebuilt: omarchy-dev and
omarchy-settings-dev followed quattro through "#branch=" and a pkgver()
function, and nothing in this repository changed when quattro did. The
host timers that used to notice are off, so edge fell days behind.

The rule now: no git source without a commit or tag pin
(tests/pinned-sources.sh, run in CI). A package that has to follow a
branch declares a git_branch upstream watch, and the pin moves through
the same PR/build/publish path as every other version bump.

Watch (helpers/upstream-watch.py)
  git_branch gains tag_pattern: the newest release tag in the pinned
  commit's own history, exposed as {tag}/{version}/{distance}, so a
  branch build is versioned <tag>.r<n>.g<sha>, above the release it
  follows and below the next one. One blobless clone per branch per
  run, shared by every package on it. min_release_age selects the
  newest commit older than the window, so a push burst builds once.

Lane (helpers/package-metadata.sh, bin/sync-upstream --lane)
  "auto_merge": true moves a package from the reviewed 6-hourly sync
  PR to the unattended lane. Packages pinned from the same branch move
  together: a failure on one restores the others and fails the group,
  so the dev pair can never ship from two quattro commits.

Tracker (.github/workflows/track-branches.yml)
  Every two hours: pin, open one PR with a GitHub App token, enable
  auto-merge. Branch protection still gates the merge on result,
  self-tests and build-isolation. A tip that fails to build stays an
  open red PR until the next tick supersedes it. The App is required:
  a PR opened with GITHUB_TOKEN has its checks held for approval and
  its auto-merge would not fire publish.yml.

The reviewed workflows (sync-upstream, sync-rebuilds) open their PRs
with the same App so their builds start without a maintainer clicking
"Approve workflows to run"; without the App they fall back to
GITHUB_TOKEN and behave as before.

Recipes
  The dev pair pins _commit and a real sha256sum, keeps the OMARCHY_SRC
  override, and drops pkgver(). Its r-number stays the branch's total
  commit count because the published history used it and pacman must
  never see the version go down. omasnap-git is new: omacom/omasnap
  main, versioned <tag>.r<distance>.g<sha>, provides/conflicts omasnap.

pkgbuilds/omarchy-dev/.omarchy/package.json

@@ -1 +1,17 @@
-{ "source": "local", "channels": ["edge"] }
+{
+  "source": "local",
+  "channels": ["edge"],
+  "auto_merge": true,
+  "min_release_age": "30m",
+  "upstream": {
+    "watch": {
+      "git_branch": "https://github.com/basecamp/omarchy.git",
+      "branch": "quattro",
+      "tag_pattern": "v(?P<version>[0-9]+\\.[0-9]+\\.[0-9]+)",
+      "version": "{version}.r{count}.g{commit:.7}",
+      "variables": {
+        "_commit": "{commit}"
+      }
+    }
+  }
+}

pkgbuilds/omarchy-dev/PKGBUILD

@@ -1,9 +1,13 @@
 # Maintainer: Ryan Hughes <ryan@omarchy.org>
 pkgname='omarchy-dev'
-pkgver=4.0.0.r847.g4de185b
+pkgver=4.0.0.r6514.gee8ebf6
 pkgrel=1
-_pkgver_base=4.0.0
-_pkgver_base_tag=v3.8.2
+# Pinned by the upstream watch in .omarchy/package.json (bin/sync-upstream):
+# every quattro tip becomes a commit pin here, so the package is versioned,
+# checksummed and built exactly like a release, just more often. The r-number
+# is the branch's total commit count, not the distance from the last tag: the
+# published history used the total, and pacman must never see it go down.
+_commit=ee8ebf615dcbf9e1a126b22a894f907d6795a9a5
 pkgdesc='Beautiful, modern, and opinionated Arch Linux by DHH (quattro branch tip)'
 # The payload is architecture-independent, but the dependency set is not: the
 # boot stack differs per architecture (see depends_x86_64 / depends_aarch64),
@@ -73,30 +77,16 @@ makedepends=(
   'git'
 )
 
-# Source: quattro branch tip by default; set OMARCHY_SRC=/path/to/checkout
-# to build from a local source tree instead (mirrors omarchy-zsh/omarchy-fish DX).
+# Source: the pinned quattro commit. Set OMARCHY_SRC=/path/to/checkout to
+# build from a local source tree instead (mirrors omarchy-zsh/omarchy-fish DX);
+# the arrays are emptied below so nothing is downloaded in that case.
+source=("omarchy::git+https://github.com/basecamp/omarchy.git#commit=${_commit}")
+sha256sums=('4f55a96e32143c766f925ec7f721a374c32bd20e66f9a081f5dbe0772c609ecd')
 if [[ -n "${OMARCHY_SRC:-}" ]]; then
   source=()
   sha256sums=()
-else
-  source=("omarchy::git+https://github.com/basecamp/omarchy.git#branch=quattro")
-  sha256sums=('SKIP')
 fi
 
-pkgver() {
-  cd "$srcdir/omarchy"
-
-  local commit_count commit_hash
-  if git rev-parse --verify "${_pkgver_base_tag}^{commit}" >/dev/null 2>&1; then
-    commit_count=$(git rev-list --count "${_pkgver_base_tag}..HEAD")
-  else
-    commit_count=$(git rev-list --count HEAD)
-  fi
-  commit_hash=$(git rev-parse --short=7 HEAD)
-
-  printf "%s.r%s.g%s" "$_pkgver_base" "$commit_count" "$commit_hash"
-}
-
 prepare() {
   if [[ -n "${OMARCHY_SRC:-}" ]]; then
     rm -rf "$srcdir/omarchy"

pkgbuilds/omarchy-settings-dev/.omarchy/package.json

@@ -1 +1,17 @@
-{ "source": "local", "channels": ["edge"] }
+{
+  "source": "local",
+  "channels": ["edge"],
+  "auto_merge": true,
+  "min_release_age": "30m",
+  "upstream": {
+    "watch": {
+      "git_branch": "https://github.com/basecamp/omarchy.git",
+      "branch": "quattro",
+      "tag_pattern": "v(?P<version>[0-9]+\\.[0-9]+\\.[0-9]+)",
+      "version": "{version}.r{count}.g{commit:.7}",
+      "variables": {
+        "_commit": "{commit}"
+      }
+    }
+  }
+}

pkgbuilds/omarchy-settings-dev/PKGBUILD

@@ -1,9 +1,13 @@
 # Maintainer: Ryan Hughes <ryan@omarchy.org>
 pkgname='omarchy-settings-dev'
-pkgver=4.0.0.r847.g4de185b
-pkgrel=2
-_pkgver_base=4.0.0
-_pkgver_base_tag=v3.8.2
+pkgver=4.0.0.r6514.gee8ebf6
+pkgrel=1
+# Pinned by the upstream watch in .omarchy/package.json (bin/sync-upstream):
+# every quattro tip becomes a commit pin here, so the package is versioned,
+# checksummed and built exactly like a release, just more often. The r-number
+# is the branch's total commit count, not the distance from the last tag: the
+# published history used the total, and pacman must never see it go down.
+_commit=ee8ebf615dcbf9e1a126b22a894f907d6795a9a5
 pkgdesc='Omarchy user defaults, /etc/skel content, fonts, plymouth theme, and support helpers (quattro branch tip)'
 # Arch-specific because the shipped /etc tree is not the same on every
 # architecture: the Limine, mkinitcpio, zram and oomd drop-ins belong to the
@@ -109,30 +113,16 @@ _etc_override_paths=(
   'etc/plymouth/plymouthd.conf'
 )
 
-# Source: quattro branch tip by default; set OMARCHY_SRC=/path/to/checkout
-# to build from a local source tree instead (mirrors omarchy-zsh/omarchy-fish DX).
+# Source: the pinned quattro commit. Set OMARCHY_SRC=/path/to/checkout to
+# build from a local source tree instead (mirrors omarchy-zsh/omarchy-fish DX);
+# the arrays are emptied below so nothing is downloaded in that case.
+source=("omarchy::git+https://github.com/basecamp/omarchy.git#commit=${_commit}")
+sha256sums=('4f55a96e32143c766f925ec7f721a374c32bd20e66f9a081f5dbe0772c609ecd')
 if [[ -n "${OMARCHY_SRC:-}" ]]; then
   source=()
   sha256sums=()
-else
-  source=("omarchy::git+https://github.com/basecamp/omarchy.git#branch=quattro")
-  sha256sums=('SKIP')
 fi
 
-pkgver() {
-  cd "$srcdir/omarchy"
-
-  local commit_count commit_hash
-  if git rev-parse --verify "${_pkgver_base_tag}^{commit}" >/dev/null 2>&1; then
-    commit_count=$(git rev-list --count "${_pkgver_base_tag}..HEAD")
-  else
-    commit_count=$(git rev-list --count HEAD)
-  fi
-  commit_hash=$(git rev-parse --short=7 HEAD)
-
-  printf "%s.r%s.g%s" "$_pkgver_base" "$commit_count" "$commit_hash"
-}
-
 prepare() {
   if [[ -n "${OMARCHY_SRC:-}" ]]; then
     rm -rf "$srcdir/omarchy"

pkgbuilds/omasnap-git/.omarchy/package.json

@@ -0,0 +1,17 @@
+{
+  "source": "local",
+  "channels": ["edge"],
+  "auto_merge": true,
+  "min_release_age": "30m",
+  "upstream": {
+    "watch": {
+      "git_branch": "https://github.com/omacom/omasnap.git",
+      "branch": "main",
+      "tag_pattern": "v(?P<version>[0-9]+\\.[0-9]+\\.[0-9]+)",
+      "version": "{version}.r{distance}.g{commit:.7}",
+      "variables": {
+        "_commit": "{commit}"
+      }
+    }
+  }
+}

pkgbuilds/omasnap-git/PKGBUILD

@@ -0,0 +1,72 @@
+# Maintainer: Ryan Hughes <ryan@omarchy.org>
+# The main-branch build of omasnap. Pinned by the upstream watch in
+# .omarchy/package.json (bin/sync-upstream): every main tip becomes a commit
+# pin here, versioned <last tag>.r<commits since>.g<sha> so it sorts above the
+# tagged release it follows and below the next one.
+
+pkgname=omasnap-git
+pkgver=1.21.0.r15.geb22bfe
+pkgrel=1
+_commit=eb22bfe5b79a2235f9bf5a8ffd026bc882969c1e
+pkgdesc="Native Wayland screenshot and annotation overlay for Hyprland (main branch)"
+arch=('x86_64' 'aarch64')
+url="https://github.com/omacom/omasnap"
+license=('MIT' 'OFL-1.1')
+depends=(
+  'hyprland'
+  'layer-shell-qt'
+  'qt6-base'
+  'tesseract'
+  'tesseract-data-eng'
+  'wayland'
+  'wl-clipboard'
+)
+makedepends=(
+  'cmake'
+  'git'
+  'ninja'
+  'pkgconf'
+  'wayland-protocols'
+)
+provides=('omasnap')
+conflicts=('omasnap')
+options=('!debug')
+
+source=("omasnap::git+$url.git#commit=${_commit}")
+sha256sums=('c8717bae97faa3798cce25038d42429185f832cd47b09f20c232f684c721952a')
+
+build() {
+  cmake -S omasnap -B build -G Ninja \
+    -DCMAKE_BUILD_TYPE=Release \
+    -DCMAKE_INSTALL_PREFIX=/usr
+  cmake --build build --parallel
+}
+
+check() {
+  # The smoke suite fsyncs its working documents under /tmp. On the CI
+  # droplets the build leaves about a gigabyte of dirty pages, and the
+  # flush that starts a few seconds into the suite makes those fsyncs stall
+  # long enough to overrun the suite's 5-second settle windows. Flush first.
+  local runtime_dir status started
+  started=$(date +%s%N); sync
+  echo "flushed dirty pages in $(( ($(date +%s%N) - started) / 1000000 )) ms"
+  runtime_dir=$(mktemp -d /dev/shm/omasnap-runtime.XXXXXX)
+  if QT_QPA_PLATFORM=offscreen QT_FORCE_STDERR_LOGGING=1 \
+    XDG_RUNTIME_DIR="$runtime_dir" \
+    ./build/omasnap-smoke "$srcdir/omasnap-smoke-output"; then
+    status=0
+  else
+    status=$?
+    echo "omasnap-smoke exited with status $status" >&2
+  fi
+  rm -r -- "$runtime_dir"
+  return "$status"
+}
+
+package() {
+  cmake --install build --prefix "$pkgdir/usr"
+  install -Dm644 omasnap/README.md \
+    "$pkgdir/usr/share/doc/omasnap/README.md"
+  install -Dm644 omasnap/LICENSE \
+    "$pkgdir/usr/share/licenses/omasnap/LICENSE"
+}