Add rc as a first-class channel: validation, shared repo root, rc build mirror

- helpers/paths.sh: validate_mirror/require_valid_mirror for the edge|rc|stable
  set, and REPO_ROOT (OMARCHY_REPO_ROOT override) so a secondary checkout like
  the rc branch worktree publishes into the same channel tree as the primary
- validate --mirror everywhere it previously accepted any string (sync-repo,
  promote-build, update-repo, clean-repo, remove-package) and widen the
  edge|stable checks in build, deploy, push-build, auto-release
- build/Dockerfile: rc builds compile against rc-mirror.omarchy.org

bin/auto-release

@@ -13,12 +13,12 @@ STATE_DIR="${OMARCHY_STATE_DIR:-/root/.state}"
 
 if [[ -z "$MIRROR" ]]; then
   print_error "Usage: $0 <mirror>"
-  echo "  mirror: edge or stable"
+  echo "  mirror: edge, rc, or stable"
   exit 1
 fi
 
-if [[ "$MIRROR" != "edge" && "$MIRROR" != "stable" ]]; then
+if [[ "$MIRROR" != "edge" && "$MIRROR" != "rc" && "$MIRROR" != "stable" ]]; then
-  print_error "Invalid mirror: $MIRROR (must be 'edge' or 'stable')"
+  print_error "Invalid mirror: $MIRROR (must be 'edge', 'rc', or 'stable')"
   exit 1
 fi
 

bin/build

@@ -23,8 +23,8 @@ while [[ $# -gt 0 ]]; do
     ;;
   --mirror)
     MIRROR="$2"
-    if [[ "$MIRROR" != "edge" && "$MIRROR" != "stable" ]]; then
+    if ! validate_mirror "$MIRROR"; then
-      print_error "Invalid mirror: $MIRROR (must be 'edge' or 'stable')"
+      print_error "Invalid mirror: $MIRROR (must be one of: $VALID_MIRRORS)"
       exit 1
     fi
     update_arch_paths
@@ -48,7 +48,7 @@ while [[ $# -gt 0 ]]; do
     echo ""
     echo "Options:"
     echo "  --arch <arch>        Target architecture (x86_64 or aarch64, default: x86_64)"
-    echo "  --mirror <mirror>    Mirror to use (edge or stable, default: edge)"
+    echo "  --mirror <mirror>    Mirror to use (edge, rc, or stable, default: edge)"
     echo "  --package <names>    Build only the specified package(s) (space-separated)"
     echo "  --dry-run           Show what would build without running makepkg"
     echo "  -h, --help           Show this help message"
@@ -144,7 +144,7 @@ DOCKER_ARGS=(
   -e MIRROR="$MIRROR"
   -e PACKAGES="$PACKAGES"
   -v "$BUILD_ROOT/build-output:/build-output"
-  -v "$BUILD_ROOT/pkgs.omarchy.org:/pkgs.omarchy.org"
+  -v "$REPO_ROOT:/pkgs.omarchy.org"
   -v "$BUILD_DIR:/build:ro"
   -v "$BUILD_ROOT/helpers:/helpers:ro"
   -v "$BUILD_ROOT/pkgbuilds:/pkgbuilds:ro"

bin/check-versions

@@ -19,7 +19,7 @@ print_header "Package Version Check"
 get_repo_version() {
   local pkg="$1"
   local mirror="$2"
-  local repo_db="$BUILD_ROOT/pkgs.omarchy.org/$mirror/$ARCH/omarchy.db.tar.zst"
+  local repo_db="$REPO_ROOT/$mirror/$ARCH/omarchy.db.tar.zst"
 
   [[ -f "$repo_db" ]] || return 0
 

bin/clean-repo

@@ -161,6 +161,7 @@ main() {
       ;;
     --mirror)
       MIRROR="$2"
+      require_valid_mirror "$MIRROR"
       update_arch_paths
       shift 2
       ;;
@@ -185,7 +186,7 @@ main() {
       echo ""
       echo "Options:"
       echo "  --arch <arch>      Target architecture (x86_64 or aarch64, default: x86_64)"
-      echo "  --mirror <mirror>  Mirror to use (edge or stable, default: edge)"
+      echo "  --mirror <mirror>  Mirror to use (edge, rc, or stable, default: edge)"
       echo "  --keep N           Keep N versions of each package (default: 2)"
       echo "  --dry-run          Preview what would be removed without removing"
       echo "  --all              Remove ALL packages (dangerous!)"

bin/deploy

@@ -31,8 +31,8 @@ while [[ $# -gt 0 ]]; do
     ;;
   --mirror)
     MIRROR="$2"
-    if [[ "$MIRROR" != "edge" && "$MIRROR" != "stable" ]]; then
+    if ! validate_mirror "$MIRROR"; then
-      print_error "Invalid mirror: $MIRROR (must be 'edge' or 'stable')"
+      print_error "Invalid mirror: $MIRROR (must be one of: $VALID_MIRRORS)"
       exit 1
     fi
     update_arch_paths
@@ -69,7 +69,7 @@ while [[ $# -gt 0 ]]; do
     echo ""
     echo "Options:"
     echo "  --arch <arch>          Target architecture (default: x86_64)"
-    echo "  --mirror <mirror>      Mirror to publish to (edge or stable, default: edge)"
+    echo "  --mirror <mirror>      Mirror to publish to (edge, rc, or stable, default: edge)"
     echo "  --package <names>      Build and push only these packages (space-separated)"
     echo "  --host <host>          ssh destination (default: \$OMARCHY_REPO_HOST or .repo-host)"
     echo "  --remote-root <path>   Repository path on the host (default: /root/omarchy-pkgs)"

bin/list-packages

@@ -27,7 +27,7 @@ Options:
   --release-ring <ring>      Filter by release ring, e.g. fast
   --repo                     List packages from the published repo database instead
   --arch <arch>              Target architecture for --repo (default: x86_64)
-  --mirror <mirror>          Mirror for --repo (edge or stable, default: edge)
+  --mirror <mirror>          Mirror for --repo (edge, rc, or stable, default: edge)
   -h, --help                 Show this help message
 
 Examples:

bin/promote-build

@@ -20,6 +20,7 @@ while [[ $# -gt 0 ]]; do
     ;;
   --mirror)
     MIRROR="$2"
+    require_valid_mirror "$MIRROR"
     update_arch_paths
     shift 2
     ;;
@@ -32,7 +33,7 @@ while [[ $# -gt 0 ]]; do
     echo ""
     echo "Options:"
     echo "  --arch <arch>      Target architecture (x86_64 or aarch64, default: x86_64)"
-    echo "  --mirror <mirror>  Mirror to use (edge or stable, default: edge)"
+    echo "  --mirror <mirror>  Mirror to use (edge, rc, or stable, default: edge)"
     echo "  --dry-run          Show what would be copied without copying"
     echo "  -h, --help         Show this help message"
     echo ""

bin/push-build

@@ -34,8 +34,8 @@ while [[ $# -gt 0 ]]; do
     ;;
   --mirror)
     MIRROR="$2"
-    if [[ "$MIRROR" != "edge" && "$MIRROR" != "stable" ]]; then
+    if ! validate_mirror "$MIRROR"; then
-      print_error "Invalid mirror: $MIRROR (must be 'edge' or 'stable')"
+      print_error "Invalid mirror: $MIRROR (must be one of: $VALID_MIRRORS)"
       exit 1
     fi
     update_arch_paths
@@ -78,7 +78,7 @@ while [[ $# -gt 0 ]]; do
     echo ""
     echo "Options:"
     echo "  --arch <arch>          Target architecture (default: x86_64)"
-    echo "  --mirror <mirror>      Mirror to publish to (edge or stable, default: edge)"
+    echo "  --mirror <mirror>      Mirror to publish to (edge, rc, or stable, default: edge)"
     echo "  --package <names>      Only push these packages (space-separated)"
     echo "  --host <host>          ssh destination (default: \$OMARCHY_REPO_HOST or .repo-host)"
     echo "  --remote-root <path>   Repository path on the host (default: $REMOTE_ROOT)"

bin/release

@@ -62,7 +62,7 @@ while [[ $# -gt 0 ]]; do
     echo ""
     echo "Options:"
     echo "  --arch <arch>         Target architecture (x86_64 or aarch64, default: x86_64)"
-    echo "  --mirror <mirror>     Mirror to use (edge or stable, default: edge)"
+    echo "  --mirror <mirror>     Mirror to use (edge, rc, or stable, default: edge)"
     echo "  --package <name>      Build only the specified package"
     echo "  --sync-remote <path>  Rclone remote for sync (default: pkgs.omarchy.org:omarchy-pkgs)"
     echo "  --skip-prod-check     Skip production environment check during sync

bin/remove-package

@@ -19,6 +19,7 @@ while [[ $# -gt 0 ]]; do
     ;;
   --mirror)
     MIRROR="$2"
+    require_valid_mirror "$MIRROR"
     update_arch_paths
     shift 2
     ;;
@@ -27,7 +28,7 @@ while [[ $# -gt 0 ]]; do
     echo ""
     echo "Options:"
     echo "  --arch <arch>      Target architecture (x86_64 or aarch64, default: x86_64)"
-    echo "  --mirror <mirror>  Mirror to use (edge or stable, default: edge)"
+    echo "  --mirror <mirror>  Mirror to use (edge, rc, or stable, default: edge)"
     echo "  -h, --help         Show this help message"
     exit 0
     ;;
@@ -98,7 +99,7 @@ make_dir_writable "$REPO_DIR"
 docker run --rm --platform linux/amd64 \
   -e ARCH="$ARCH" \
   -e MIRROR="$MIRROR" \
-  -v "$BUILD_ROOT/pkgs.omarchy.org:/pkgs.omarchy.org" \
+  -v "$REPO_ROOT:/pkgs.omarchy.org" \
   -v "$BUILD_DIR:/build:ro" \
   omarchy-pkg-builder:latest-x86_64-$MIRROR /build/remove-package.sh "$PACKAGE_NAME"
 

bin/sign

@@ -28,7 +28,7 @@ while [[ $# -gt 0 ]]; do
     echo ""
     echo "Options:"
     echo "  --arch <arch>      Target architecture (x86_64 or aarch64, default: x86_64)"
-    echo "  --mirror <mirror>  Mirror to use (edge or stable, default: edge)"
+    echo "  --mirror <mirror>  Mirror to use (edge, rc, or stable, default: edge)"
     echo "  -h, --help         Show this help message"
     echo ""
     echo "This script signs all packages in build-output/"

bin/sync-repo

@@ -35,6 +35,7 @@ while [[ $# -gt 0 ]]; do
   --mirror)
     require_value "$@"
     MIRROR="$2"
+    require_valid_mirror "$MIRROR"
     update_arch_paths
     shift 2
     ;;
@@ -56,7 +57,7 @@ while [[ $# -gt 0 ]]; do
     echo ""
     echo "Options:"
     echo "  --arch <arch>      Target architecture (x86_64 or aarch64, default: x86_64)"
-    echo "  --mirror <mirror>  Mirror to use (edge or stable, default: edge)"
+    echo "  --mirror <mirror>  Mirror to use (edge, rc, or stable, default: edge)"
     echo "  --remote <remote>  Rclone remote destination (default: $DEFAULT_REMOTE)"
     echo "  --skip-prod-check  Skip production sync confirmation"
     echo "  --prune            Also delete remote packages missing locally"

bin/update-repo

@@ -34,7 +34,7 @@ update_database() {
   docker run --rm --platform linux/amd64 \
     -e ARCH="$ARCH" \
     -e MIRROR="$MIRROR" \
-    -v "$BUILD_ROOT/pkgs.omarchy.org:/output" \
+    -v "$REPO_ROOT:/output" \
     -v "$BUILD_DIR:/build:ro" \
     omarchy-pkg-builder:latest-x86_64-$MIRROR /build/update-repo.sh
 }
@@ -53,6 +53,7 @@ main() {
       ;;
     --mirror)
       MIRROR="$2"
+      require_valid_mirror "$MIRROR"
       update_arch_paths
       shift 2
       ;;
@@ -61,7 +62,7 @@ main() {
       echo ""
       echo "Options:"
       echo "  --arch <arch>      Target architecture (x86_64 or aarch64, default: x86_64)"
-      echo "  --mirror <mirror>  Mirror to use (edge or stable, default: edge)"
+      echo "  --mirror <mirror>  Mirror to use (edge, rc, or stable, default: edge)"
       echo "  -h, --help         Show this help message"
       exit 0
       ;;

build/Dockerfile

@@ -39,6 +39,8 @@ RUN mkdir -p /etc/pacman.d && \
 RUN if [ "${TARGETARCH}" = "amd64" ]; then \
         if [ "${MIRROR}" = "stable" ]; then \
             printf 'Server = https://stable-mirror.omarchy.org/$repo/os/$arch\n' > /etc/pacman.d/mirrorlist; \
+        elif [ "${MIRROR}" = "rc" ]; then \
+            printf 'Server = https://rc-mirror.omarchy.org/$repo/os/$arch\n' > /etc/pacman.d/mirrorlist; \
         else \
             printf 'Server = https://mirror.omarchy.org/$repo/os/$arch\n' > /etc/pacman.d/mirrorlist; \
         fi; \

helpers/paths.sh

@@ -5,17 +5,39 @@
 ARCH=${ARCH:-x86_64}
 MIRROR=${MIRROR:-edge}
 
+# Valid package channels, in pipeline order: packages move edge -> rc -> stable
+VALID_MIRRORS="edge rc stable"
+
+validate_mirror() {
+  case "$1" in
+  edge | rc | stable) return 0 ;;
+  *) return 1 ;;
+  esac
+}
+
+require_valid_mirror() {
+  if ! validate_mirror "$1"; then
+    echo "Invalid mirror: $1 (must be one of: $VALID_MIRRORS)" >&2
+    exit 1
+  fi
+}
+
 # Core directories (architecture-independent)
 BUILD_DIR="$BUILD_ROOT/build"
 SRC_DIR="$BUILD_ROOT/src"
 LOG_DIR="$BUILD_ROOT/logs"
 PKGBUILDS_DIR="$BUILD_ROOT/pkgbuilds"
 
+# The published repository tree. Secondary checkouts (like the rc branch
+# worktree on the build host) set OMARCHY_REPO_ROOT so every channel lives in
+# one shared tree regardless of which checkout ran the command.
+REPO_ROOT="${OMARCHY_REPO_ROOT:-$BUILD_ROOT/pkgs.omarchy.org}"
+
 # Function to update architecture and mirror-specific paths
 # Call this after changing ARCH or MIRROR variables
 update_arch_paths() {
   BUILD_OUTPUT_DIR="$BUILD_ROOT/build-output/$MIRROR/$ARCH" # Unsigned packages
-  REPO_DIR="$BUILD_ROOT/pkgs.omarchy.org/$MIRROR/$ARCH"            # Repository (signed packages)
+  REPO_DIR="$REPO_ROOT/$MIRROR/$ARCH"                       # Repository (signed packages)
 }
 
 # Initialize architecture-specific directories with default ARCH and MIRROR