The controller created every builder without a DigitalOcean account key, so
DigitalOcean set a root password, emailed it to the token's owner, and turned
password logins on: one email and one password-reachable box per builder,
146 of them on Oct 8.
DO_SSH_KEYS lists account key IDs attached at creation (Ryan, DHH and Emir
in the template). It needs ssh_key:read on the controller's token; without it
every create is refused with 403, so it stays empty until the token has it.
Builders also turn password SSH off in cloud-init, which holds even while no
account key is attached, and Emir joins the operators whose GitHub keys reach
root.
RAWmakase is a Lightroom-compatible RAW photo editor. Upstream publishes
self-contained Linux tarballs for x86_64 and aarch64 (LibRaw, lcms2,
libjpeg and ONNX Runtime bundled under /usr/lib/rawmakase) with a
SHA256SUMS manifest, so the package re-wraps that usr/ tree and
sync-upstream follows releases declaratively with a 24h quarantine.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Superwhisper 1.0.0 is its first stable release. The watch matched only beta
tags, so sync-upstream would never offer it; it now follows stable releases
and ignores prereleases.
Co-authored-by: superduck00 <294879536+superduck00@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Pin GenAI 2026.4.1.0 to match Arch OpenVINO 2026.4.1. Restrict the package to edge while rc and stable retain 2026.3.1, derive the exact core dependency from the GenAI version, and keep updates manual. Set standard PCRE2 install paths for the current CMake build.
Co-authored-by: GPT 6.1 Sol High <noreply@openai.com>
Driver 0.28.3 through 0.33.3 refused desktop capture on Hyprland with more than one output or one output away from the origin (trycua/cua#4161), which is why the package was held at 0.28.2; 0.33.4 fixes it (trycua/cua#4305). The plugin sources are unchanged from 0.32.0 through 0.33.4 and speak the same input protocol, so the plugin package stays and only its README names the new pairing.
A Qt Quick application for remapping keys, building Fn-style layers and
managing shortcuts, per keyboard. It generates real XKB keymaps with
libxkbcommon and loads them through Hyprland's per-device kb_file; no
input daemon or third-party remapping engine is involved.
Builds from the published v0.1.0 tag. check() runs the project's tests,
which need no display.
Co-authored-by: Claude <noreply@anthropic.com>
The publish job runs in the concurrency group "publish" with
cancel-in-progress: false. By default such a group holds one running job
and one waiting job: when a third arrives, GitHub cancels the one that was
waiting and puts the new one in its place. That merge's publish is dropped,
with no publish record, PR comment or log line, and nothing reruns it.
17 of the last 181 publish runs ended cancelled, 12 of them from one burst
of merges on 2026-09-28. openvino-genai 2026.4.0.0-1 (#620) was one of
those and is still in no channel.
queue: max lets up to 100 jobs wait in the group and run in the order they
reach it. Nothing else changes: one publish at a time, and a running one is
not interrupted. unpublish.yml shares the group, so it gets the same
setting.
actionlint 1.7.12, the latest release, predates the key and reports it as
unexpected in both files (rhysd/actionlint#654). It reports nothing else.
The README described the repository host as the publisher: bin/repo
release as the main workflow, five-minute systemd timers, a signing key
that lives on the host and nowhere else, aarch64 under emulation. Since
September 18 packages are built by build-pr.yml and published by
publish.yml, and neither workflow was mentioned. ci/README.md still opened
with "Status: spike. Nothing here publishes."
The README now covers, in order: contributing a package, how a package
reaches users, where it is published, the maintainer tasks (republish,
build, retire, check that a version is live, read the publish log), what
to do when a publish fails, who can build and merge, the three scheduled
update workflows, package metadata, releases, and the rules that keep two
publishers from colliding.
Text about the old host pipeline moved to docs/repository-host.md, marked
abandoned. The rest moved to docs/ largely unchanged:
- docs/releases.md: the release train and versioning rules
- docs/rebuild-triggers.md: rebuild_on and bin/sync-rebuilds
- docs/builds.md: dependency order, isolation, builder images
- docs/upstream-sources.md: gains the provider and hook reference
ci/README.md is rewritten as the operating guide for the x86_64 builder
pool. Statements the move would have carried over wrong are corrected,
among them the signing key's location, AUR sync, and which architecture
list CI reads. bin/sync-upstream's help now points at the docs page that
holds the provider schemas.
main now has omarchy-mac-pkgs#20: a factory reset's reboot unlocks the disk
with a key from the Boot partition, and systemd could mount that partition
again just before switching to the real root without unmounting it
(systemd/systemd#28021), leaving /boot read-only so owner setup's re-key
failed. An initramfs drop-in makes the unmount finish before the switch. It
also has #18 (first-boot encryption progress on the splash) and test-only
changes (#11, #19). New UTC commit date, so 20261008-1. omarchy-mac stays at
2a3ed89.
Omarchy 4 no longer uses Elephant or the omarchy-walker meta package, and
omarchy-upgrade-to-quattro removes them; every channel serves Omarchy 4.0.4.
Nothing else here depends on them. walker itself stays.
Deleting a recipe stops it building but leaves it in the channel databases,
and the only removal tool worked on the old repository host's local tree.
Add bin/unpublish-packages, publish-artifact's counterpart: pull the channel
database, repo-remove every entry built from the named pkgbases, upload it.
Package files stay in the bucket. unpublish.yml runs it per channel and
architecture under the publish lock, for packages with no recipe on master.
* Automate Grok Bot releases
* Refresh Grok Bot to apt 0.66.0 and harden upstream.sh
Bump both architectures to Cursor apt 0.66.0 with matching SHA256s,
introduce a versioned _pool URL helper, and filter Packages stanzas by
Package: grok-bot so sync stays correct if the index grows.
* grok-bot: bump to 0.68.1, drop manual hold, validate pool filename
Bump both architectures to Cursor apt 0.68.1 with the SHA256s from the
amd64/arm64 Packages indexes (verified against the downloaded debs).
Drop grok-bot from the manual holds list in docs/upstream-sources.md and
have upstream.sh check that the newest stanza's Filename is the versioned
pool path the PKGBUILD downloads from. Both additions come from #848.
The split in #869 sent every tree without an artifact to the rebuild job,
so a dispatch whose x86 halves were already published waited eight minutes
for eleven droplets that each found nothing to build in five seconds. Make
the publish job's plan check in the changes job, on its hosted runner,
before a builder is requested.
A one-package merge took 9 to 15 minutes to publish for about 15 seconds of
signing and upload. The run-wide concurrency group made each merge wait for
every earlier run, builds included (#854 waited 13 minutes behind an aarch64
batch), and the publish job waited about 3 minutes for a builder droplet
even when every package had a PR artifact and nothing needed building.
Build x86_64 trees that have no artifact in the rebuild job, one droplet per
entry, as aarch64 already builds there on arm64 runners: in parallel, with
no secrets, and outside any lock. The publish job now only collects
artifacts, signs and uploads, on ubuntu-latest with the GHCR builder image
(#850), and only it holds the publish group.
#867 auto-merged only PRs changing nothing outside pkgbuilds/, so it would
have left #854 open too: like voxtype-bin and the IPU7 camera before it,
Superwhisper added tests/superwhisper-bin-install.sh and one test.yml line
running it.
Count those as package changes: a new file under tests/, and a test.yml
change whose every line adds a ./tests/*.sh call. test.yml runs on PRs only.
Editing an existing test still needs a maintainer, since builder-images.yml
runs tests/build-isolation.sh on master with packages: write.
A builder droplet starts with no images, so publish.yml built
omarchy-pkg-builder from the Dockerfile each time: about 100 s of
pacstrap, keyring setup and toolchain install, to run gpg, repo-add,
bsdtar and rclone for about 14 s.
builder-images.yml already publishes the tested image for the current
build inputs to ghcr.io/omacom/omarchy-pkg-builder under bin/builder-image
key. Pull that, check its org.omarchy.builder.key label, and tag it as the
local name the rest of the step uses.
Build as before when no image carries the key, which is what a merge
that changes build/ sees until the refresh it triggered has finished.
Co-authored-by: Ryan Hughes <ryan@heyoodle.com>
A package PR approved to build, by its author being trusted or by the
build-approved label, sat open after going green until someone merged it by
hand, so nothing it built was published. Enable GitHub's auto-merge on it
with PKGS_BOT_TOKEN, so the merge lands once the required checks pass and
starts publish.yml.
The trust rule is build-pr.yml's. Only PRs changing nothing outside
pkgbuilds/ qualify: a PR's own tooling never runs in its build, and after
merge it runs with the publish secrets. The upstream sync, which labels its
own PRs, stays on the reviewed lane. Removing build-approved withdraws the
auto-merge.
tobi/omatrack no longer exists on GitHub, so the pinned commit's archive is
404 and 1.8.6 cannot be rebuilt; the old repository host's sync deleted the
published 1.8.6-1 from R2, leaving edge at 1.2.0. A public copy serves the
same commit with an archive matching the pinned sha256 byte for byte.
pkgrel 2 gives the rebuild a new filename, so no cache can serve the
deleted 1.8.6-1 bytes for it.
A droplet DigitalOcean still reports as "new" never registers a runner, but
the controller counted it as one booting and created no replacement until
MAX_AGE_MINUTES. A publish job sat queued for minutes behind one in mkc1.
Delete droplets still provisioning after MAX_BOOT_MINUTES (10) and leave them
out of the live count, so the same tick creates a replacement.
sync-rebuilds now runs on the unattended lane like track-branches: it
opens the pkgrel bump PR with PKGS_BOT_TOKEN and enables auto-merge, so a
Qt (or any rebuild_on) update reaches users without a maintainer merge.
Branch protection still requires result, self-tests and build-isolation
to pass; a failed rebuild stays an open red PR.
The PAT is required because a GITHUB_TOKEN merge does not start
publish.yml. PAT pushes are not held for approval, so the approve job,
the build-approved label and the review request go away.
Co-authored-by: David Heinemeier Hansson <david@hey.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* Keep builders coming when DigitalOcean sells out a droplet size
ric1 sold out of g5-32vcpu-64gb-50gb, and every create came back 422. curl -f
dropped the reason and set -e ended the tick, so builders only appeared when
capacity happened to free up, and the journal showed nothing but "curl: (22)".
Try each of SIZES in turn, logging DigitalOcean's refusal message, and fail
the tick only when every size is refused. Builders now power off however
start.sh exits, so a failed registration is reaped instead of counting as a
booting runner until MAX_AGE_MINUTES. The controller unit pulls the checkout
before each tick, so merged controller fixes reach the box.
* Create builders in any region that has the size in stock
ric1 sold out of g5-32vcpu-128gb-50gb within minutes of the box switching to
it. Builders need nothing from a particular region, so read DigitalOcean's
size catalog once per tick and try each of SIZES in every region it lists in
stock, REGIONS first if set. A refused pair is dropped for the rest of the
tick.
Tracks tagged releases from the quickshell-mirror GitHub repository
through an upstream watch, so new versions arrive via sync-upstream.
The recipe follows Arch's extra/quickshell, builds for x86_64 and
aarch64, ships the Qt compatibility check hook, and rebuilds on Qt
updates like quickshell-git. It conflicts with quickshell-git.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The native Hyprland plugin behind Omarchy's floating workspaces: themed
titlebars and edge snapping, built from a hyprbars fork. It is rebuilt
with every Hyprland change, since a plugin only loads into the exact
build it was compiled against.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
The 2026-10-07 nightly ships the same six compatibility libraries with
their full versioned file names beside the short ones (libXss.so.1.0.0),
and two under their GTK 3 names (libappindicator3, libindicator3). The
guard in package() listed the short names only, so it stopped the build
on both architectures and with it the bundled upstream sync (#837).
Accept an optional 3 and trailing version numbers. Anything else in
usr/ still stops the build. t3code-bin carries the same guard and gets
the same pattern before the change reaches a stable release.
Upstream's 6771b19 ("keep smoke artifacts in the build directory") made
omasnap-smoke reject positional paths; the directory is now passed with
--output-dir. check() still passed it positionally, so every build of a
pin at or past that commit failed with "Unexpected positional argument;
use --output-dir <directory>."
Pass it as --output-dir and move the pin to 6771b19, the tip the branch
tracker has been trying to merge since October 4. The two have to land
together: the old pin does not know --output-dir.
Ryan Hughes