Merge pull request #984 from omacom/auto/track-branches-omarchy-dev-omarchy-settings-dev

Track upstream branches: omarchy-dev 4.0.0.r6911.g9480d1b-1, omarchy-settings-dev 4.0.0.r6911.g9480d1b-1

.github/scripts/approve-sync-push.cjs

@@ -1,34 +0,0 @@
-const approvePrWorkflows = require('./approve-pr-workflows.cjs');
-
-const BOT = 'github-actions[bot]';
-
-// A sync workflow pushes its branch with GITHUB_TOKEN. GitHub holds the
-// resulting pull_request runs for approval and, unlike a person's push,
-// creates no pull_request_target run, so approve-pr.yml never sees it. The
-// sync workflow therefore releases the runs for the commit it just pushed,
-// under the same rule approve-pr.yml applies: only while build-approved is
-// on the PR. The sync applies that label itself, so its pushes build without
-// a maintainer. It acts only on its own bot-authored, same-repository PR for
-// the branch and commit it pushed.
-module.exports = async function approveSyncPush({ github, context, core,
-  number, branch, headSha, since, approve = approvePrWorkflows, ...options }) {
-  if (!Number.isInteger(number) || !branch || !headSha || !since) {
-    throw new Error('Missing sync PR number, branch, head SHA or push time.');
-  }
-  const { data: pr } = await github.rest.pulls.get({ ...context.repo, pull_number: number });
-  const repository = `${context.repo.owner}/${context.repo.repo}`;
-  if (pr.user?.login !== BOT || pr.head.repo?.full_name !== repository ||
-      pr.base.repo?.full_name !== repository || pr.head.ref !== branch) {
-    throw new Error(`PR #${number} is not ${BOT}'s ${branch} PR in ${repository}; refusing to approve.`);
-  }
-  if (pr.state !== 'open' || pr.head.sha !== headSha) {
-    core.info(`PR #${number} is closed or has moved past ${headSha}; nothing to approve.`);
-    return;
-  }
-  if (!pr.labels.some(label => label.name === 'build-approved')) {
-    core.info(`PR #${number} has no build-approved label; its runs stay held.`);
-    return;
-  }
-  await approve({ github, context, core, vouchStatus: 'bot', pullRequest: pr,
-    action: 'synchronize', since, ...options });
-};

.github/scripts/auto-merge-pr.cjs

@@ -0,0 +1,76 @@
+// Whether a PR rides to master on its own once the required checks pass.
+//
+// The rule is the build gate's, from build-pr.yml: a PR trusted to build is
+// trusted to ship. Collaborators, vouched authors and bots are trusted; an
+// unknown author is trusted while the PR carries build-approved; a
+// denouncement is absolute. Two limits on top of it:
+//
+// - Only package changes. A PR's workflows, scripts and build tooling never
+//   run in its own build (build-pr.yml overlays only its package directories
+//   onto base tooling), so green checks say nothing about them, and after
+//   merge they run with the publish secrets. Allowed: anything under
+//   pkgbuilds/, plus the test a package PR brings with it, which is a new
+//   file under tests/ and lines in test.yml that only run new tests/*.sh.
+//   test.yml runs on PRs only; an existing test may also run on master
+//   (builder-images.yml runs tests/build-isolation.sh with packages: write),
+//   so editing one still needs a maintainer.
+const PACKAGES = 'pkgbuilds/';
+const TESTS = 'tests/';
+const TEST_WORKFLOW = '.github/workflows/test.yml';
+const TEST_LINE = /^\+\s*\.\/tests\/[A-Za-z0-9._-]+\.sh\s*$/;
+
+// Every changed line adds a ./tests/<name>.sh call; nothing removed. A diff
+// too large for the API has no patch and does not qualify.
+function onlyRunsTests(patch) {
+  if (!patch) return false;
+  const changed = patch.split('\n').filter(line =>
+    /^[+-]/.test(line) && !line.startsWith('+++') && !line.startsWith('---'));
+  return changed.length > 0 && changed.every(line => TEST_LINE.test(line));
+}
+
+function packageChange(file) {
+  if (file.previous_filename && !file.previous_filename.startsWith(PACKAGES)) return false;
+  if (file.filename.startsWith(PACKAGES)) return true;
+  if (file.filename.startsWith(TESTS)) return file.status === 'added';
+  if (file.filename === TEST_WORKFLOW) return file.status === 'modified' && onlyRunsTests(file.patch);
+  return false;
+}
+
+function decide({ pr, files, vouchStatus, repository }) {
+  if (pr.state !== 'open') return { enable: false, reason: 'PR is not open' };
+  if (pr.draft) return { enable: false, reason: 'PR is a draft' };
+
+  const labelled = pr.labels.some(label => label.name === 'build-approved');
+  let trusted;
+  switch (vouchStatus) {
+    case 'bot': case 'collaborator': case 'vouched': trusted = true; break;
+    case 'unknown': trusted = labelled; break;
+    default: trusted = false; // denounced, or a failed lookup
+  }
+  if (!trusted) {
+    return { enable: false, reason: `author not trusted to build (${vouchStatus || 'missing'}${labelled ? ', labelled' : ''})` };
+  }
+
+  if (!files.length) return { enable: false, reason: 'PR changes no files' };
+  const outside = files.filter(file => !packageChange(file));
+  if (outside.length) {
+    const names = outside.slice(0, 3).map(file => file.filename).join(', ');
+    return { enable: false, reason: `changes more than packages and their new tests: ${names}${outside.length > 3 ? ', ...' : ''}` };
+  }
+  return { enable: true, reason: `${vouchStatus === 'unknown' ? 'build-approved' : vouchStatus} author, package changes only` };
+}
+
+module.exports = async function autoMerge({ github, context, core, number, vouchStatus }) {
+  const { data: pr } = await github.rest.pulls.get({ ...context.repo, pull_number: number });
+  const files = await github.paginate(github.rest.pulls.listFiles, {
+    ...context.repo, pull_number: number, per_page: 100,
+  });
+  const decision = decide({
+    pr, files, vouchStatus, repository: `${context.repo.owner}/${context.repo.repo}`,
+  });
+  core.info(`#${number}: ${decision.enable ? 'auto-merge' : 'leave for a maintainer'} (${decision.reason})`);
+  core.setOutput('enable', String(decision.enable));
+  core.setOutput('head_sha', pr.head.sha);
+  return decision;
+};
+module.exports.decide = decide;

.github/scripts/package-pr-groups.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+# Usage: package-pr-groups.sh BRANCH_PREFIX PATCH_OUT
+#
+# Run from the repository root after a sync has rewritten recipes in the
+# working tree. Writes those changes to PATCH_OUT and prints, as one JSON
+# line, the PRs they split into: [{"branch": ..., "packages": "a b"}, ...].
+#
+# One PR per package, so a package whose build fails holds back only itself.
+# Packages pinned from the same upstream branch (omarchy-dev and
+# omarchy-settings-dev) share a PR: sync-upstream moves them in lockstep, and
+# merging one without the other would ship the pair from different commits.
+# Branch names come from sync-pr-branch.sh, so a scheduled run and a dispatch
+# naming the same packages update the same PR.
+set -euo pipefail
+
+prefix=${1:?branch prefix required}
+patch=${2:?patch path required}
+scripts=$(dirname "$0")
+
+git diff --binary -- pkgbuilds > "$patch"
+
+declare -A members=()
+while IFS= read -r package; do
+  key=$(jq -r '(.upstream.watch? | objects | select(has("git_branch")) | "\(.git_branch)#\(.branch)") // empty' \
+    "pkgbuilds/$package/.omarchy/package.json" 2>/dev/null || true)
+  members["${key:-$package}"]+="$package "
+done < <(git diff --name-only -- pkgbuilds | cut -d/ -f2 | sort -u)
+
+groups='[]'
+for key in "${!members[@]}"; do
+  read -r -a packages <<<"${members[$key]}"
+  branch=$("$scripts/sync-pr-branch.sh" "$prefix" "${packages[@]}" | sed -n 's/^branch=//p')
+  groups=$(jq -c --arg branch "$branch" --arg packages "${packages[*]}" \
+    '. + [{branch: $branch, packages: $packages}]' <<<"$groups")
+done
+jq -c 'sort_by(.branch)' <<<"$groups"

.github/workflows/auto-merge-pr.yml

@@ -0,0 +1,108 @@
+name: Auto-merge approved package PRs
+
+# A package PR trusted to build is trusted to ship: once its builds are
+# green it should merge and publish without a maintainer pressing the
+# button. This enables GitHub's auto-merge on such PRs; branch protection
+# still holds the merge until `result`, `self-tests` and `build-isolation`
+# pass, and a red build stays an open PR. .github/scripts/auto-merge-pr.cjs
+# has the rule.
+#
+# Auto-merge is enabled with the PAT in PKGS_BOT_TOKEN: a merge made with the
+# built-in GITHUB_TOKEN does not start publish.yml.
+#
+# pull_request_target runs this default-branch code with secrets; the PR's
+# code is never checked out here.
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize, ready_for_review, labeled, unlabeled]
+  workflow_dispatch:
+    inputs:
+      pr:
+        description: 'PR number to evaluate'
+        required: true
+
+permissions:
+  contents: read
+  pull-requests: read
+
+concurrency:
+  group: auto-merge-pr-${{ github.event.pull_request.number || github.event.inputs.pr }}
+  cancel-in-progress: true
+
+jobs:
+  auto-merge:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          persist-credentials: false
+
+      - name: Find the PR's author
+        id: pr
+        uses: actions/github-script@v7
+        env:
+          NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr }}
+        with:
+          script: |
+            const { data: pr } = await github.rest.pulls.get({
+              ...context.repo, pull_number: Number(process.env.NUMBER),
+            });
+            core.setOutput('number', String(pr.number));
+            core.setOutput('author', pr.user.login);
+
+      - id: vouch
+        uses: mitchellh/vouch/action/check-user@f23dbb5e745334f97414ec70463ce7301071a661 # v1
+        with:
+          user: ${{ steps.pr.outputs.author }}
+          allow-fail: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Decide
+        id: decide
+        uses: actions/github-script@v7
+        env:
+          NUMBER: ${{ steps.pr.outputs.number }}
+          VOUCH_STATUS: ${{ steps.vouch.outputs.status }}
+        with:
+          script: |
+            const autoMerge = require('./.github/scripts/auto-merge-pr.cjs');
+            await autoMerge({ github, context, core,
+              number: Number(process.env.NUMBER), vouchStatus: process.env.VOUCH_STATUS });
+
+      - name: Enable auto-merge
+        if: steps.decide.outputs.enable == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
+          PR: ${{ steps.pr.outputs.number }}
+          HEAD_SHA: ${{ steps.decide.outputs.head_sha }}
+        run: |
+          if [[ -z "$GH_TOKEN" ]]; then
+            echo "::error::Set PKGS_BOT_TOKEN; a GITHUB_TOKEN merge would not publish."
+            exit 1
+          fi
+          # Idempotent: enabling twice errors. Bot lanes enable their own.
+          if [[ "$(gh pr view "$PR" -R "$GITHUB_REPOSITORY" --json autoMergeRequest --jq '.autoMergeRequest != null')" == true ]]; then
+            echo "auto-merge already enabled on #$PR"
+            exit 0
+          fi
+          # --match-head-commit: never arm a merge for a commit newer than
+          # the one just judged.
+          gh pr merge --auto --squash --match-head-commit "$HEAD_SHA" "$PR" -R "$GITHUB_REPOSITORY"
+
+      # Removing build-approved withdraws the approval, so withdraw the
+      # auto-merge it armed too. Only on that event: auto-merge a maintainer
+      # enabled by hand on any other PR is theirs to keep.
+      - name: Withdraw auto-merge
+        if: >-
+          steps.decide.outputs.enable == 'false' &&
+          github.event.action == 'unlabeled' && github.event.label.name == 'build-approved'
+        env:
+          GH_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
+          PR: ${{ steps.pr.outputs.number }}
+        run: |
+          if [[ "$(gh pr view "$PR" -R "$GITHUB_REPOSITORY" --json autoMergeRequest --jq '.autoMergeRequest != null')" == true ]]; then
+            gh pr merge --disable-auto "$PR" -R "$GITHUB_REPOSITORY"
+          fi

.github/workflows/build-pr.yml

@@ -20,16 +20,18 @@ on:
         description: "Space-separated package directories to build"
         required: true
 
-# A new push normally cancels the PR's in-flight build. The sync bots'
+# A new push normally cancels the PR's in-flight build. The bots' branches
-# branches (auto/sync-*) are the exception: they are force-pushed with fresh
+# (auto/sync-* and auto/track-branches-*) are the exception: they are
-# upstream releases several times a day, which kept cancelling multi-hour
+# force-pushed with fresh upstream releases several times a day, which kept
-# aarch64 builds before they could finish. There the newest run waits
+# cancelling multi-hour aarch64 builds before they could finish. There the
-# instead (GitHub keeps at most one pending run per group, replacing older
+# newest run waits instead (GitHub keeps at most one pending run per group,
-# pending ones), and when it starts it reuses every artifact the finished
+# replacing older pending ones), and when it starts it reuses every artifact
-# build uploaded, so only packages whose tree changed are built again.
+# the finished build uploaded, so only packages whose tree changed are built
+# again. The tracker labels the PR it opens, so a new tracker PR starts two
+# runs at once; cancelling the first left a red `result` on the PR (#901).
 concurrency:
   group: build-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: ${{ !(github.event.pull_request.head.repo.full_name == github.repository && startsWith(github.head_ref, 'auto/sync-')) }}
+  cancel-in-progress: ${{ !(github.event.pull_request.head.repo.full_name == github.repository && (startsWith(github.head_ref, 'auto/sync-') || startsWith(github.head_ref, 'auto/track-branches'))) }}
 
 jobs:
   # Builds cost real machines, so they run only for trusted authors:

.github/workflows/package-prs.yml

@@ -0,0 +1,134 @@
+name: Open package PRs
+
+# Shared by the three bot lanes (sync-upstream.yml, sync-rebuilds.yml and
+# track-branches.yml). The caller's sync job rewrites recipes, groups the
+# changes with .github/scripts/package-pr-groups.sh and uploads them as the
+# `package-pins` artifact. This opens or updates one PR per group and arms
+# auto-merge, so every green package lands on its own and only the failures
+# stay open. A single batch PR let one red package hold back every other one
+# (#788, #837).
+#
+# Everything goes through the PAT in PKGS_BOT_TOKEN: its pushes build without
+# an approval hold, and a merge made with it starts publish.yml. A merge made
+# with the built-in GITHUB_TOKEN would not publish.
+
+on:
+  workflow_call:
+    inputs:
+      groups:
+        description: 'JSON from package-pr-groups.sh: [{"branch", "packages"}]'
+        required: true
+        type: string
+      prefix:
+        description: 'Branch prefix the caller owns, e.g. auto/sync-upstream'
+        required: true
+        type: string
+      title:
+        description: 'PR title; ": <package> <version>, ..." is appended'
+        required: true
+        type: string
+      body:
+        description: 'PR body'
+        required: true
+        type: string
+    secrets:
+      PKGS_BOT_TOKEN:
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  pr:
+    if: ${{ inputs.groups != '[]' }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      max-parallel: 4
+      matrix:
+        group: ${{ fromJSON(inputs.groups) }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Fetch the pins
+        uses: actions/download-artifact@v4
+        with:
+          name: package-pins
+          path: ${{ runner.temp }}
+
+      # The PR title names what moved, so the merged history reads like a
+      # changelog: "Sync upstream releases: zed 1.23.2-1".
+      - name: Apply this PR's packages
+        id: apply
+        env:
+          PACKAGES: ${{ matrix.group.packages }}
+          TITLE: ${{ inputs.title }}
+        run: |
+          read -r -a packages <<<"$PACKAGES"
+          git apply $(printf -- '--include=pkgbuilds/%s/* ' "${packages[@]}") "$RUNNER_TEMP/pins.patch"
+          git status --porcelain
+          field() { sed -n "s/^$2=//p" "pkgbuilds/$1/PKGBUILD" | head -1 | tr -d "\"'"; }
+          versions=$(for package in "${packages[@]}"; do
+            printf '%s %s-%s, ' "$package" "$(field "$package" pkgver)" "$(field "$package" pkgrel)"
+          done)
+          title="$TITLE: ${versions%, }"
+          echo "title=$title" >> "$GITHUB_OUTPUT"
+          echo "- $title" >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Open or update the PR
+        id: pr
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ secrets.PKGS_BOT_TOKEN }}
+          commit-message: ${{ steps.apply.outputs.title }}
+          title: ${{ steps.apply.outputs.title }}
+          body: ${{ inputs.body }}
+          branch: ${{ matrix.group.branch }}
+          delete-branch: true
+          labels: automated
+
+      # Auto-merge, not a direct merge: branch protection still has to see
+      # `result`, `self-tests` and `build-isolation` green. auto-merge-pr.yml
+      # may arm the same PR at the same moment; either one arming it is the
+      # outcome wanted.
+      - name: Enable auto-merge
+        if: ${{ steps.pr.outputs.pull-request-number != '' }}
+        env:
+          GH_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
+          PR: ${{ steps.pr.outputs.pull-request-number }}
+        run: |
+          armed() { [[ "$(gh pr view "$PR" -R "$GITHUB_REPOSITORY" --json autoMergeRequest --jq '.autoMergeRequest != null')" == true ]]; }
+          if armed; then
+            echo "auto-merge already enabled on #$PR"
+            exit 0
+          fi
+          gh pr merge --auto --merge "$PR" -R "$GITHUB_REPOSITORY" || armed
+
+  # A PR on this lane's prefix that the run did not refresh, and that
+  # conflicts with master, is stale: master moved its packages on without it.
+  # Close it rather than leave a red PR behind. Not being refreshed is not
+  # enough on its own, since a feed that failed this run (one of dozens timing
+  # out is routine) leaves a still-valid PR unrefreshed too. The lane's old
+  # batch PR, on the bare prefix, is retired outright.
+  close-superseded:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Close superseded PRs
+        env:
+          GH_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
+          GROUPS_JSON: ${{ inputs.groups }}
+          PREFIX: ${{ inputs.prefix }}
+        run: |
+          gh pr list -R "$GITHUB_REPOSITORY" --state open --limit 500 --json number,headRefName,mergeable \
+            --jq '.[] | select(.headRefName == env.PREFIX or (.headRefName | startswith(env.PREFIX + "-"))) | "\(.number) \(.headRefName) \(.mergeable)"' |
+          while read -r number branch mergeable; do
+            jq -e --arg branch "$branch" 'any(.[]; .branch == $branch)' <<<"$GROUPS_JSON" >/dev/null && continue
+            [[ $branch == "$PREFIX" || $mergeable == CONFLICTING ]] || continue
+            echo "closing #$number ($branch): superseded"
+            gh pr close "$number" -R "$GITHUB_REPOSITORY" --delete-branch \
+              --comment "Superseded: master has moved these packages on, or per-package PRs carry them now."
+          done

.github/workflows/publish.yml

@@ -24,11 +24,10 @@ on:
         description: "Space-separated package directories to publish from master"
         required: true
 
-# Merges serialize. Two publishes into one channel at once would race on
+# Only the publish job serializes (see its concurrency group): two publishes
-# the database; queued is fine, cancelled is not.
+# into one channel at once would race on the database. Builds run outside the
-concurrency:
+# lock, so a merge waits behind another merge's signing and upload, seconds,
-  group: publish
+# never behind its kernel build.
-  cancel-in-progress: false
 
 jobs:
   changes:
@@ -58,11 +57,10 @@ jobs:
           echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
           echo "count=$(jq '.include | length' <<<"$matrix")" >> "$GITHUB_OUTPUT"
           jq -r '.include[] | "\(.package) \(.arch) -> \(.channels)"' <<<"$matrix"
-          # Reuse or rebuild, decided per entry and said out loud. An aarch64
+          # Reuse or rebuild, decided per entry and said out loud. A tree with
-          # tree with no build artifact (PR artifacts last 7 days; a dispatch
+          # no build artifact (PR artifacts last 7 days; a dispatch may name
-          # may name any package) goes to the rebuild job, which builds it
+          # any package) goes to the rebuild job: aarch64 natively on GitHub's
-          # natively on GitHub's arm64 runner. x86_64 builds inside the
+          # arm64 runner, x86_64 on a builder droplet, one runner per entry.
-          # publish job on the droplet, as before.
           rebuild=()
           echo "| package | arch | tree | decision |" >> "$GITHUB_STEP_SUMMARY"
           echo "| --- | --- | --- | --- |" >> "$GITHUB_STEP_SUMMARY"
@@ -73,13 +71,23 @@ jobs:
             found=$(curl -fsS -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github+json" \
               "https://api.github.com/repos/${{ github.repository }}/actions/artifacts?name=$label&per_page=5" \
               | jq -r '[.artifacts[] | select(.expired|not)] | sort_by(.created_at) | last | select(. != null) | "run \(.workflow_run.id), expires \(.expires_at)"')
+            # The plan the publish job makes, made here before a runner is
+            # asked for: a tree the channel already holds at master's version
+            # (a re-run, or a dispatch naming a package that is fine) needs
+            # no build, and an x86 rebuild would wait minutes for a droplet
+            # to find that out in seconds.
+            plan=""
+            [[ -n "$found" ]] || plan=$(bin/build --dry-run --mirror edge --arch "$arch" --package "$package" 2>&1 | grep -E '^==> Plan complete' || true)
             if [[ -n "$found" ]]; then
               decision="reuse the build artifact ($found)"
+            elif [[ -n "$plan" && -z "$(sed -E 's/.*would build: *//' <<<"$plan" | tr -d '[:space:]')" ]]; then
+              decision="already published at master's version, nothing to build"
             elif [[ $arch == aarch64 ]]; then
               decision="no build artifact: rebuild natively on ubuntu-24.04-arm"
-              rebuild+=("$entry")
+              rebuild+=("$(jq -c '. + {runner: "[\"ubuntu-24.04-arm\"]"}' <<<"$entry")")
             else
-              decision="no build artifact: build in the publish job on the self-hosted builder"
+              decision="no build artifact: rebuild on a builder droplet"
+              rebuild+=("$(jq -c '. + {runner: "[\"self-hosted\",\"omarchy-builder\"]"}' <<<"$entry")")
             fi
             echo "==> $label: $decision"
             echo "| $package | $arch | ${hash:0:12} | $decision |" >> "$GITHUB_STEP_SUMMARY"
@@ -87,16 +95,19 @@ jobs:
           echo "rebuild=$(printf '%s\n' "${rebuild[@]}" | jq -sc '{include: .}')" >> "$GITHUB_OUTPUT"
           echo "rebuild_count=${#rebuild[@]}" >> "$GITHUB_OUTPUT"
 
-  # The aarch64 half of "build it now when there is none". It builds exactly
+  # "Build it now when there is none". Each entry builds exactly as
-  # as build-pr.yml's aarch64 path does (same runner, same builder image,
+  # build-pr.yml builds it (same runner kind, same builder image, same
-  # same bin/build call) and uploads under the same label, so the publish
+  # bin/build call) and uploads under the same label, so the publish job
-  # job collects this run's artifact the way it collects a PR's. No secret
+  # collects this run's artifact the way it collects a PR's. No secret
-  # reaches this runner; signing and upload stay on the self-hosted builder.
+  # reaches these runners, and they hold no lock: entries build in parallel,
+  # and other merges publish while they do.
   rebuild:
     needs: changes
     if: needs.changes.outputs.rebuild_count != '0'
-    runs-on: ubuntu-24.04-arm
+    runs-on: ${{ fromJSON(matrix.runner) }}
-    timeout-minutes: 180
+    # The droplets are x86, so aarch64 never builds there. omarchy-mac-boot
+    # under QEMU took 2h47m; native arm64 and x86 kernels fit easily.
+    timeout-minutes: 240
     permissions:
       contents: read
     strategy:
@@ -109,7 +120,7 @@ jobs:
       # The same check the publish job makes before building: a re-run for a
       # package the channel already holds at master's version builds
       # nothing, and uploads nothing that could shadow the published file.
-      - name: Build ${{ matrix.package }} (${{ matrix.arch }}, native)
+      - name: Build ${{ matrix.package }} (${{ matrix.arch }})
         id: build
         env:
           CONTAINER_ENGINE: docker
@@ -140,23 +151,30 @@ jobs:
           if-no-files-found: error
           retention-days: 7
 
-  # One job for the whole merge. It collects every PR artifact for the
+  # One job for the whole merge. It collects every artifact for the merged
-  # merged tree (building only what has none; aarch64 comes from the
+  # tree (PR builds, or the rebuild job above), then walks each channel and
-  # rebuild job above), then walks each channel and
   # architecture slot exactly once: pull that database, add every package
   # that belongs in it, upload. Six slots, six round trips, however many
   # packages the merge carried. One process is the only writer, so there
-  # is no race between packages; the run-level concurrency group above
+  # is no race between packages; the concurrency group keeps one merge's
-  # keeps one merge from overlapping the next.
+  # publish from overlapping the next. It builds nothing, so it runs on a
+  # hosted runner in about a minute instead of waiting for a droplet.
   # It waits for the rebuild job and runs whatever that job's result: a
   # failed rebuild leaves its package without an artifact, and the collect
   # step below records that and stops before any publish.
   publish:
     needs: [changes, rebuild]
     if: ${{ !cancelled() && needs.changes.result == 'success' && needs.changes.outputs.count != '0' }}
-    runs-on: [self-hosted, omarchy-builder]
+    runs-on: ubuntu-latest
     environment: publish
-    timeout-minutes: 240
+    timeout-minutes: 30
+    # queue: max, because by default a group holds one waiting job: a third
+    # merge arriving cancels the second one's publish, and nothing reruns it.
+    # With it up to 100 wait, in the order they reach this job.
+    concurrency:
+      group: publish
+      cancel-in-progress: false
+      queue: max
     steps:
       - uses: actions/checkout@v4
         with:
@@ -172,8 +190,8 @@ jobs:
           EOF_MATRIX
           cat plan.txt
 
-      # Fetch each package's PR artifact into build-output/edge/<arch>/, or
+      # Fetch each package's artifact into build-output/edge/<arch>/: the PR's,
-      # build it when no artifact exists for exactly this tree. An artifact
+      # or the rebuild job's when the PR's had expired. An artifact
       # carries its package files inside packages.tar (see build-pr.yml and
       # helpers/artifact-helpers.sh: the upload action rejects the colon in
       # an epoch filename).
@@ -199,8 +217,8 @@ jobs:
             mkdir -p "build-output/edge/$arch"
             if [[ -n "$found" ]]; then
               if [[ $from_run == "${{ github.run_id }}" ]]; then
-                kind=native-rebuild
+                kind=rebuild
-                echo "==> $label: artifact from this run's native $arch rebuild"
+                echo "==> $label: artifact from this run's $arch rebuild"
               else
                 kind=pr-artifact
                 echo "==> $label: reusing the build artifact from run $from_run"
@@ -225,21 +243,12 @@ jobs:
                 jq -nc --arg p "$package" --arg a "$arch" '{package:$p, arch:$a, source:"already-published"}' >> sources.jsonl
                 continue
               fi
-              # aarch64 never builds here: this droplet is x86 and would
+              # Nothing builds here. No artifact means the rebuild failed (see
-              # emulate it. No artifact means the native rebuild failed (see
+              # the rebuild job), or an artifact expired between planning and
-              # the rebuild job), or an artifact expired between planning
+              # now (re-run all jobs).
-              # and now (re-run all jobs).
+              echo "::error::$label: no artifact from the rebuild job"
-              if [[ $arch == aarch64 ]]; then
-                echo "::error::$label: no artifact from the native rebuild; not building aarch64 under emulation"
-                jq -nc --arg p "$package" --arg a "$arch" '{package:$p, arch:$a, source:"native-build-failed"}' >> sources.jsonl; failed=1; break
-              fi
-              echo "==> $label: no artifact for this tree, building"
-              if OMARCHY_KEEP_BUILD_WORKSPACE=1 bin/build --mirror edge --arch "$arch" --package "$package"; then
-                jq -nc --arg p "$package" --arg a "$arch" '{package:$p, arch:$a, source:"built"}' >> sources.jsonl
-              else
               jq -nc --arg p "$package" --arg a "$arch" '{package:$p, arch:$a, source:"build-failed"}' >> sources.jsonl; failed=1; break
             fi
-            fi
           done < plan.txt
           ls -1 build-output/edge/*/*.pkg.tar.zst 2>/dev/null || true
           if (( failed )); then
@@ -280,8 +289,26 @@ jobs:
             cat publish-record.json
             exit 0
           fi
-          docker image inspect omarchy-pkg-builder:latest-x86_64-edge >/dev/null 2>&1 \
+          # A fresh runner has no images, and building this one here cost
-            || docker buildx build --load -t omarchy-pkg-builder:latest-x86_64-edge --build-arg MIRROR=edge build
+          # every publish about 100 s (and 20 s more to start a container
+          # from it) for the 14 s of signing and upload it is needed for.
+          # builder-images.yml already publishes the tested image for exactly
+          # these build inputs under their key; pull that. Build only when no
+          # image carries the key: a merge that changed build/ publishes
+          # before the refresh it triggered has finished.
+          builder=omarchy-pkg-builder:latest-x86_64-edge
+          if ! docker image inspect "$builder" >/dev/null 2>&1; then
+            key=$(bin/builder-image key --arch x86_64 --mirror edge)
+            published="ghcr.io/omacom/omarchy-pkg-builder:$key"
+            if docker pull --quiet "$published" &&
+              [[ $(docker image inspect "$published" --format '{{index .Config.Labels "org.omarchy.builder.key"}}') == "$key" ]]; then
+              docker tag "$published" "$builder"
+              echo "==> Builder image: pulled $published"
+            else
+              echo "==> Builder image: none published for $key, building it"
+              docker buildx build --load -t "$builder" --build-arg MIRROR=edge build
+            fi
+          fi
 
           # Group the merge's files by the (channel, architecture) slot each
           # belongs to. A package's files live under build-output/edge/<built
@@ -374,7 +401,7 @@ jobs:
         run: |
           jq -r --arg outcome "${{ needs.publish.result }}" '
             def pkgs: [.packages[] | select(test("-debug-")|not)] | join(", ");
-            def src: if .source=="pr-artifact" then "PR artifact" elif .source=="native-rebuild" then "rebuilt natively on arm64" elif .source=="built" then "built here" elif .source=="already-published" then "already published, skipped" else "**" + .source + "**" end;
+            def src: if .source=="pr-artifact" then "PR artifact" elif .source=="rebuild" or .source=="native-rebuild" then "rebuilt at merge" elif .source=="built" then "built here" elif .source=="already-published" then "already published, skipped" else "**" + .source + "**" end;
             "### Publish " + (if $outcome=="success" then "succeeded" else "FAILED" end) +
             " → **" + .target + "**" + (if .target!="live" then " (proof prefix, not live)" else "" end),
             "",

.github/workflows/sync-rebuilds.yml

@@ -1,5 +1,16 @@
 name: Sync Rebuild Triggers
 
+# Rebuilds ride the unattended lane, like track-branches.yml: each package's
+# pkgrel bump gets its own PR on auto/sync-rebuilds-<package>, opened by
+# package-prs.yml. It builds on the droplets, auto-merge lands it once
+# `result`, `self-tests` and `build-isolation` are green, and the merge
+# publishes. A rebuild that fails stays an unmerged red PR for a maintainer
+# without holding back any other package.
+#
+# The PR and auto-merge use the PAT in PKGS_BOT_TOKEN, because a merge made
+# with the built-in GITHUB_TOKEN does not start publish.yml, and its pushes
+# are held for approval instead of building.
+
 on:
   schedule:
     # Every 6 hours, off the hour to dodge the scheduling backlog at :00
@@ -11,42 +22,42 @@ on:
         required: false
         default: ''
 
+# One sync at a time: two runs racing on one auto/sync-rebuilds-* branch
+# would each force-push their own bump over the other's.
+concurrency:
+  group: sync-rebuilds
+  cancel-in-progress: false
+
 jobs:
   sync:
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
-      pull-requests: write
     outputs:
-      branch: ${{ steps.branch.outputs.branch }}
+      groups: ${{ steps.groups.outputs.groups }}
-      pushed_at: ${{ steps.pushed.outputs.at }}
-      number: ${{ steps.cpr.outputs.pull-request-number }}
-      operation: ${{ steps.cpr.outputs.pull-request-operation }}
-      head_sha: ${{ steps.cpr.outputs.pull-request-head-sha }}
 
     steps:
+      - name: Require the bot token
+        env:
+          PKGS_BOT_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
+        run: |
+          if [[ -z "$PKGS_BOT_TOKEN" ]]; then
+            echo "::error::Set PKGS_BOT_TOKEN to a PAT with Contents: write and Pull requests: write on this repository, owned by an account trusted to trigger builds."
+            exit 1
+          fi
+
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           persist-credentials: false
 
-      # A scoped dispatch regenerates only the named packages. Pushed to the
-      # shared branch, that would replace every other pending update in its
-      # PR, so it gets a branch and PR of its own.
-      - name: Choose the PR branch
-        id: branch
-        env:
-          PACKAGES: ${{ github.event.inputs.packages }}
-        run: |
-          read -r -a package_args <<< "${PACKAGES:-}"
-          .github/scripts/sync-pr-branch.sh auto/sync-rebuilds "${package_args[@]}" | tee -a "$GITHUB_OUTPUT"
-
       # Runs in an Arch container against the mirror the x86_64 builder itself
       # uses, because the question being asked is what that builder will link
       # against and a different mirror can be hours ahead of it. Recording a
       # version the build never saw is the one failure this command must not
       # have: nothing re-fires once the record matches.
       - name: Bump pkgrel for packages whose dependencies moved
+        id: sync
         run: |
           docker run --rm \
             -e PACKAGES="$PACKAGES" \
@@ -56,7 +67,7 @@ jobs:
             -v "$PWD/helpers:/workspace/helpers:ro" \
             -v "$PWD/pkgbuilds:/workspace/pkgbuilds" \
             -w /workspace \
-            archlinux:base-devel bash -lc '
+            ghcr.io/archlinux/archlinux:base-devel bash -lc '
               set -euo pipefail
 
               printf "Server = https://mirror.omarchy.org/\$repo/os/\$arch\n" > /etc/pacman.d/mirrorlist
@@ -76,32 +87,33 @@ jobs:
         env:
           PACKAGES: ${{ github.event.inputs.packages }}
 
-      - name: Check for changes
+      - name: Group the bumps into PRs
-        id: changes
+        if: ${{ !cancelled() && steps.sync.outcome != 'skipped' }}
+        id: groups
         run: |
-          if [ -z "$(git status --porcelain)" ]; then
+          groups=$(.github/scripts/package-pr-groups.sh auto/sync-rebuilds "$RUNNER_TEMP/pins.patch")
-            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+          echo "groups=$groups" >> "$GITHUB_OUTPUT"
-          else
-            echo "has_changes=true" >> "$GITHUB_OUTPUT"
-          fi
 
-      # Runs created by this push are newer than this; the approve job
+      - name: Hand the bumps to the PR jobs
-      # waits for them. A minute's slack absorbs runner clock skew.
+        if: ${{ !cancelled() && steps.groups.outputs.groups != '' && steps.groups.outputs.groups != '[]' }}
-      - name: Record push time
+        uses: actions/upload-artifact@v4
-        if: steps.changes.outputs.has_changes == 'true'
-        id: pushed
-        run: echo "at=$(date -u -d '-1 minute' +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
-
-      - name: Create Pull Request
-        if: steps.changes.outputs.has_changes == 'true'
-        id: cpr
-        uses: peter-evans/create-pull-request@v7
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          name: package-pins
-          commit-message: 'chore: rebuild against updated dependencies'
+          path: ${{ runner.temp }}/pins.patch
-          title: "chore: rebuild against updated dependencies${{ steps.branch.outputs.scope && format(' ({0})', steps.branch.outputs.scope) || '' }}"
+          retention-days: 1
+
+  prs:
+    needs: sync
+    if: ${{ !cancelled() && needs.sync.outputs.groups != '' }}
+    permissions:
+      contents: read
+    uses: ./.github/workflows/package-prs.yml
+    with:
+      groups: ${{ needs.sync.outputs.groups }}
+      prefix: auto/sync-rebuilds
+      title: Rebuild against updated dependencies
       body: |
-            Automated pkgrel bump for packages that link against a dependency
+        Automated pkgrel bump for a package that links against a dependency
         which has moved in the official repositories.
 
         Each package names those dependencies in `rebuild_on` and carries the
@@ -109,17 +121,19 @@ jobs:
         bump is what makes the rebuilt package an upgrade pacman will offer;
         without it the build produces the version already published and no
         one receives it.
-          branch: ${{ steps.branch.outputs.branch }}
-          delete-branch: true
-          # The bot is trusted; build-approved lets the approve job below
-          # release GitHub's hold on its pushes without a maintainer.
-          labels: |
-            automated
-            build-approved
-          reviewers: ryanrhughes
 
+        This PR auto-merges once the build checks pass. A failing rebuild
+        leaves it open for a maintainer without holding back any other package.
+    secrets:
+      PKGS_BOT_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
+
+  notify:
+    needs: [sync, prs]
+    if: ${{ failure() }}
+    runs-on: ubuntu-latest
+    steps:
       - name: Notify Basecamp on failure
-        if: failure() && env.BASECAMP_CHATBOT_URL != ''
+        if: ${{ env.BASECAMP_CHATBOT_URL != '' }}
         env:
           BASECAMP_CHATBOT_URL: ${{ secrets.BASECAMP_CHATBOT_URL }}
         run: |
@@ -129,36 +143,3 @@ jobs:
               "🔴 <strong>Rebuild trigger sync failed</strong><br><a href=\"${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\">View run</a>" \
               '{content: $content}')" \
             "$BASECAMP_CHATBOT_URL"
-
-  # GitHub holds pull_request runs from a GITHUB_TOKEN push for approval and
-  # creates no pull_request_target run for it, so approve-pr.yml never sees
-  # the sync's own pushes. The sync labels its PR build-approved, so release
-  # the held runs for the commit just pushed, whether it opened the PR or
-  # updated it. A separate job, so the sync container's token never holds
-  # actions: write.
-  approve:
-    needs: sync
-    if: ${{ !cancelled() && (needs.sync.outputs.operation == 'created' || needs.sync.outputs.operation == 'updated') }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-      pull-requests: read
-      actions: write
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - name: Release held build and test runs
-        uses: actions/github-script@v7
-        env:
-          NUMBER: ${{ needs.sync.outputs.number }}
-          BRANCH: ${{ needs.sync.outputs.branch }}
-          HEAD_SHA: ${{ needs.sync.outputs.head_sha }}
-          SINCE: ${{ needs.sync.outputs.pushed_at }}
-        with:
-          script: |
-            const approve = require('./.github/scripts/approve-sync-push.cjs');
-            const { NUMBER, BRANCH, HEAD_SHA, SINCE } = process.env;
-            await approve({ github, context, core, number: Number(NUMBER),
-              branch: BRANCH, headSha: HEAD_SHA, since: SINCE });

.github/workflows/sync-upstream.yml

@@ -1,5 +1,17 @@
 name: Sync Upstream Releases
 
+# Bumps every package whose upstream release feed has moved, except the
+# "auto_merge": true packages that track-branches.yml checks hourly. Each
+# package gets its own PR on auto/sync-upstream-<package>, opened by
+# package-prs.yml: the PR builds on the droplets, auto-merge lands it when
+# `result` is green, and the merge publishes. A package that fails to build
+# stays an open red PR for a maintainer without holding back any other; the
+# next run updates it if upstream moves again. `min_release_age` still
+# quarantines fresh releases before they are proposed.
+#
+# The PRs and auto-merge use the PAT in PKGS_BOT_TOKEN, so their pushes
+# build without an approval hold and their merges start publish.yml.
+
 on:
   schedule:
     # Every 6 hours, off the hour to dodge the scheduling backlog at :00
@@ -11,36 +23,35 @@ on:
         required: false
         default: ''
 
+# One sync at a time: two runs racing on one auto/sync-upstream-* branch
+# would each force-push their own update over the other's.
+concurrency:
+  group: sync-upstream
+  cancel-in-progress: false
+
 jobs:
   sync:
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
-      pull-requests: write
     outputs:
-      branch: ${{ steps.branch.outputs.branch }}
+      groups: ${{ steps.groups.outputs.groups }}
-      pushed_at: ${{ steps.pushed.outputs.at }}
-      number: ${{ steps.cpr.outputs.pull-request-number }}
-      operation: ${{ steps.cpr.outputs.pull-request-operation }}
-      head_sha: ${{ steps.cpr.outputs.pull-request-head-sha }}
 
     steps:
+      - name: Require the bot token
+        env:
+          PKGS_BOT_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
+        run: |
+          if [[ -z "$PKGS_BOT_TOKEN" ]]; then
+            echo "::error::Set PKGS_BOT_TOKEN to a PAT with Contents: write and Pull requests: write on this repository, owned by an account trusted to trigger builds."
+            exit 1
+          fi
+
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           persist-credentials: false
 
-      # A scoped dispatch regenerates only the named packages. Pushed to the
-      # shared branch, that would replace every other pending update in its
-      # PR, so it gets a branch and PR of its own.
-      - name: Choose the PR branch
-        id: branch
-        env:
-          PACKAGES: ${{ github.event.inputs.packages }}
-        run: |
-          read -r -a package_args <<< "${PACKAGES:-}"
-          .github/scripts/sync-pr-branch.sh auto/sync-upstream "${package_args[@]}" | tee -a "$GITHUB_OUTPUT"
-
       # Runs in an Arch container for vercmp: whether a release is an upgrade has
       # to be decided by the same comparator pacman will use on users' machines.
       - name: Update packages from upstream release feeds
@@ -55,7 +66,7 @@ jobs:
             -v "$PWD/helpers:/workspace/helpers:ro" \
             -v "$PWD/pkgbuilds:/workspace/pkgbuilds" \
             -w /workspace \
-            archlinux:base-devel bash -lc '
+            ghcr.io/archlinux/archlinux:base-devel bash -lc '
               set -euo pipefail
 
               pacman -Syu --noconfirm git jq python libarchive
@@ -64,8 +75,8 @@ jobs:
               useradd -m -u "$HOST_UID" -g "$HOST_GID" runner
               chown -R runner:runner /workspace/pkgbuilds
 
-              # The reviewed lane only: packages marked auto_merge ride
+              # Packages marked auto_merge ride track-branches.yml instead,
-              # track-branches.yml, which merges without a human.
+              # which checks them hourly.
               if [[ -n "${PACKAGES:-}" ]]; then
                 read -r -a package_args <<< "$PACKAGES"
                 runuser -u runner -- ./bin/sync-upstream --lane reviewed "${package_args[@]}"
@@ -78,50 +89,50 @@ jobs:
           UPSTREAM_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       # Failed feeds leave their recipes untouched; completed updates still
-      # reach review. The failed sync step keeps the workflow red and notifies.
+      # get their PRs. The failed sync step keeps the workflow red and notifies.
-      - name: Check for changes
+      - name: Group the updates into PRs
         if: ${{ !cancelled() && steps.sync.outcome != 'skipped' }}
-        id: changes
+        id: groups
         run: |
-          if [ -z "$(git status --porcelain)" ]; then
+          groups=$(.github/scripts/package-pr-groups.sh auto/sync-upstream "$RUNNER_TEMP/pins.patch")
-            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+          echo "groups=$groups" >> "$GITHUB_OUTPUT"
-          else
-            echo "has_changes=true" >> "$GITHUB_OUTPUT"
-          fi
 
-      # Runs created by this push are newer than this; the approve job
+      - name: Hand the updates to the PR jobs
-      # waits for them. A minute's slack absorbs runner clock skew.
+        if: ${{ !cancelled() && steps.groups.outputs.groups != '' && steps.groups.outputs.groups != '[]' }}
-      - name: Record push time
+        uses: actions/upload-artifact@v4
-        if: ${{ !cancelled() && steps.changes.outputs.has_changes == 'true' }}
-        id: pushed
-        run: echo "at=$(date -u -d '-1 minute' +%Y-%m-%dT%H:%M:%SZ)" >> "$GITHUB_OUTPUT"
-
-      - name: Create Pull Request
-        if: ${{ !cancelled() && steps.changes.outputs.has_changes == 'true' }}
-        id: cpr
-        uses: peter-evans/create-pull-request@v7
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          name: package-pins
-          commit-message: 'chore: sync upstream releases'
+          path: ${{ runner.temp }}/pins.patch
-          title: "chore: sync upstream releases${{ steps.branch.outputs.scope && format(' ({0})', steps.branch.outputs.scope) || '' }}"
+          retention-days: 1
+
+  prs:
+    needs: sync
+    if: ${{ !cancelled() && needs.sync.outputs.groups != '' }}
+    permissions:
+      contents: read
+    uses: ./.github/workflows/package-prs.yml
+    with:
+      groups: ${{ needs.sync.outputs.groups }}
+      prefix: auto/sync-upstream
+      title: Sync upstream releases
       body: |
-            Automated update of packages that track an upstream vendor release
+        Automated update of a package that tracks an upstream vendor release
         feed rather than the AUR.
 
         Release watches and providers are declared in `.omarchy/package.json`;
-            exceptional feeds use `.omarchy/upstream.sh`. Failed package updates
+        exceptional feeds use `.omarchy/upstream.sh`. This PR auto-merges once
-            are left untouched; check the workflow result for outstanding failures.
+        the build checks pass. A failing build leaves it open for a maintainer
-          branch: ${{ steps.branch.outputs.branch }}
+        without holding back any other package.
-          delete-branch: true
+    secrets:
-          # The bot is trusted; build-approved lets the approve job below
+      PKGS_BOT_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
-          # release GitHub's hold on its pushes without a maintainer.
-          labels: |
-            automated
-            build-approved
-          reviewers: ryanrhughes
 
+  notify:
+    needs: [sync, prs]
+    if: ${{ failure() }}
+    runs-on: ubuntu-latest
+    steps:
       - name: Notify Basecamp on failure
-        if: failure() && env.BASECAMP_CHATBOT_URL != ''
+        if: ${{ env.BASECAMP_CHATBOT_URL != '' }}
         env:
           BASECAMP_CHATBOT_URL: ${{ secrets.BASECAMP_CHATBOT_URL }}
         run: |
@@ -131,36 +142,3 @@ jobs:
               "🔴 <strong>Upstream sync failed</strong><br><a href=\"${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\">View run</a>" \
               '{content: $content}')" \
             "$BASECAMP_CHATBOT_URL"
-
-  # GitHub holds pull_request runs from a GITHUB_TOKEN push for approval and
-  # creates no pull_request_target run for it, so approve-pr.yml never sees
-  # the sync's own pushes. The sync labels its PR build-approved, so release
-  # the held runs for the commit just pushed, whether it opened the PR or
-  # updated it. A separate job, so the sync container's token never holds
-  # actions: write.
-  approve:
-    needs: sync
-    if: ${{ !cancelled() && (needs.sync.outputs.operation == 'created' || needs.sync.outputs.operation == 'updated') }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-      pull-requests: read
-      actions: write
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-      - name: Release held build and test runs
-        uses: actions/github-script@v7
-        env:
-          NUMBER: ${{ needs.sync.outputs.number }}
-          BRANCH: ${{ needs.sync.outputs.branch }}
-          HEAD_SHA: ${{ needs.sync.outputs.head_sha }}
-          SINCE: ${{ needs.sync.outputs.pushed_at }}
-        with:
-          script: |
-            const approve = require('./.github/scripts/approve-sync-push.cjs');
-            const { NUMBER, BRANCH, HEAD_SHA, SINCE } = process.env;
-            await approve({ github, context, core, number: Number(NUMBER),
-              branch: BRANCH, headSha: HEAD_SHA, since: SINCE });

.github/workflows/test.yml

@@ -45,10 +45,12 @@ jobs:
           docker run --rm \
             -v "$PWD:/workspace:ro" \
             -w /workspace \
-            archlinux:base-devel bash -lc '
+            ghcr.io/archlinux/archlinux:base-devel bash -lc '
               set -euo pipefail
               pacman -Syu --noconfirm git jq python libarchive neovim tmux
+              python tests/owe-package-restart.py
               python tests/oma-service-removal.py
+              python tests/passwordless-package-lifecycle.py
               python tests/upstream-watch.py
               bash tests/ipu7-install.sh
               bash tests/ipu7-headers.sh
@@ -62,11 +64,17 @@ jobs:
               ./tests/published-build-plan.sh
               ./tests/settings-boot-config.sh
               ./tests/settings-runtime-profile.sh
+              ./tests/passwordless-package-files.sh
               ./tests/pinned-sources.sh
               ./tests/controller.sh
               ./tests/artifact-helpers.sh
               ./tests/limine-mkinitcpio-hook.sh
               ./tests/voxtype-bin-install.sh
+              ./tests/superwhisper-bin-install.sh
               pacman -S --noconfirm --quiet rclone >/dev/null
               ./tests/publish-artifact.sh
+              shopt -s nullglob
+              for test in pkgbuilds/*/test.sh; do
+                bash "$test"
+              done
             '

.github/workflows/track-branches.yml

@@ -1,13 +1,21 @@
 name: Track upstream branches
 
-# The unattended lane. Packages marked "auto_merge": true follow a moving
+# The hourly lane. Packages marked "auto_merge": true update here instead of
-# upstream branch (omarchy-dev and omarchy-settings-dev on quattro, omasnap-git
+# in sync-upstream.yml's 6-hourly run: some follow a moving upstream branch
-# on main) rather than tagged releases, so nothing in this repository changes
+# (omarchy-dev and omarchy-settings-dev on quattro, omasnap-git on main)
-# when their source does. This workflow makes each new branch tip a commit pin
+# rather than tagged releases, so nothing in this repository changes when
-# in the recipe, which publish.yml then treats like any other version bump:
+# their source does; the rest are release feeds worth shipping within the
-# the PR builds on the droplets, auto-merge lands it when `result` is green,
+# hour (browsers, large vendors, Omacom's own projects). This workflow makes
-# and the merge publishes the artifacts. A tip that fails to build stays an
+# each new branch tip a commit pin in the recipe, which publish.yml then
-# unmerged red PR that the next tick supersedes.
+# treats like any other version bump: the PR builds on the droplets,
+# auto-merge lands it when `result` is green, and the merge publishes the
+# artifacts. A tip that fails to build stays an unmerged red PR that the next
+# tick supersedes.
+#
+# One PR per package, on auto/track-branches-<package>, opened by
+# package-prs.yml. Packages pinned from the same upstream branch
+# (omarchy-dev and omarchy-settings-dev) share one, because sync-upstream
+# moves them in lockstep.
 #
 # The PR and auto-merge use the PAT in PKGS_BOT_TOKEN so they trigger the
 # build and publish workflows. The built-in GITHUB_TOKEN cannot drive this
@@ -16,8 +24,10 @@ name: Track upstream branches
 
 on:
   schedule:
-    # Every 2 hours, off the hour to dodge the scheduling backlog at :00
+    # Hourly, off the hour to dodge the scheduling backlog at :00. GitHub
-    - cron: '35 */2 * * *'
+    # drops scheduled runs under load: the old every-2-hours entry fired
+    # every 6 to 9 hours in practice.
+    - cron: '35 * * * *'
   workflow_dispatch:
     inputs:
       packages:
@@ -25,8 +35,8 @@ on:
         required: false
         default: ''
 
-# One tracker at a time: two runs racing on auto/track-branches would each
+# One tracker at a time: two runs racing on one auto/track-branches-* branch
-# force-push their own pin over the other's.
+# would each force-push their own pin over the other's.
 concurrency:
   group: track-branches
   cancel-in-progress: false
@@ -36,6 +46,8 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+    outputs:
+      groups: ${{ steps.groups.outputs.groups }}
 
     steps:
       - name: Require the tracking token
@@ -52,7 +64,7 @@ jobs:
         with:
           persist-credentials: false
 
-      # Same container as the reviewed sync: vercmp decides whether a pin is
+      # Same container as sync-upstream.yml: vercmp decides whether a pin is
       # an upgrade with the comparator pacman uses on users' machines.
       - name: Pin tracked branches to their current tips
         id: sync
@@ -66,7 +78,7 @@ jobs:
             -v "$PWD/helpers:/workspace/helpers:ro" \
             -v "$PWD/pkgbuilds:/workspace/pkgbuilds" \
             -w /workspace \
-            archlinux:base-devel bash -lc '
+            ghcr.io/archlinux/archlinux:base-devel bash -lc '
               set -euo pipefail
 
               pacman -Syu --noconfirm git jq python libarchive
@@ -86,70 +98,50 @@ jobs:
           PACKAGES: ${{ github.event.inputs.packages }}
           UPSTREAM_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Check for changes
+      - name: Group the pins into PRs
         if: ${{ !cancelled() && steps.sync.outcome != 'skipped' }}
-        id: changes
+        id: groups
         run: |
-          if [ -z "$(git status --porcelain)" ]; then
+          groups=$(.github/scripts/package-pr-groups.sh auto/track-branches "$RUNNER_TEMP/pins.patch")
-            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+          echo "groups=$groups" >> "$GITHUB_OUTPUT"
-          else
-            echo "has_changes=true" >> "$GITHUB_OUTPUT"
-            git status --porcelain
-            {
-              echo "### Pinned"
-              git diff --unified=0 -- 'pkgbuilds/*/PKGBUILD' | grep -E '^\+(pkgver|_commit)=' | sed 's/^+/- /'
-            } >> "$GITHUB_STEP_SUMMARY"
-          fi
 
-      # The PR title names what moved, so the merged history reads like a
+      - name: Hand the pins to the PR jobs
-      # changelog: "Track upstream branches: omarchy-dev 4.0.0.r6520.g1a2b3c4, ...".
+        if: ${{ !cancelled() && steps.groups.outputs.groups != '' && steps.groups.outputs.groups != '[]' }}
-      - name: Describe the pins
+        uses: actions/upload-artifact@v4
-        if: ${{ !cancelled() && steps.changes.outputs.has_changes == 'true' }}
-        id: describe
-        run: |
-          title=$(git diff --unified=0 -- 'pkgbuilds/*/PKGBUILD' \
-            | awk '/^\+\+\+ b\/pkgbuilds\//{split($2,p,"/"); pkg=p[3]} /^\+pkgver=/{sub(/^\+pkgver=/,""); printf "%s %s, ", pkg, $0}' \
-            | sed 's/, $//')
-          echo "title=Track upstream branches: ${title}" >> "$GITHUB_OUTPUT"
-
-      - name: Open or update the tracking PR
-        if: ${{ !cancelled() && steps.changes.outputs.has_changes == 'true' }}
-        id: pr
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
-          token: ${{ secrets.PKGS_BOT_TOKEN }}
+          name: package-pins
-          commit-message: ${{ steps.describe.outputs.title }}
+          path: ${{ runner.temp }}/pins.patch
-          title: ${{ steps.describe.outputs.title }}
+          retention-days: 1
+
+  prs:
+    needs: track
+    if: ${{ !cancelled() && needs.track.outputs.groups != '' }}
+    permissions:
+      contents: read
+    uses: ./.github/workflows/package-prs.yml
+    with:
+      groups: ${{ needs.track.outputs.groups }}
+      prefix: auto/track-branches
+      title: Track upstream branches
       body: |
-            Automated pin of packages that follow a moving upstream branch
+        Automated pin of a package that follows a moving upstream branch or a
-            (`"auto_merge": true` in `.omarchy/package.json`). Each package's
+        trusted release feed (`"auto_merge": true` in `.omarchy/package.json`).
-            `_commit` now points at the branch tip. Fresh tips wait until
+        Its recipe now points at the newest upstream release, or the newest
-            their commit timestamp is at least `min_release_age` old.
+        branch tip whose commit timestamp is at least `min_release_age` old.
 
-            This PR auto-merges once the build checks pass. A failing build
+        This PR auto-merges once the build checks pass. A failing build leaves
-            leaves it open; the next tracker run replaces it with the newer tip.
+        it open without holding back any other package; the next tracker run
-          branch: auto/track-branches
+        replaces it with the newer tip.
-          delete-branch: true
+    secrets:
-          labels: automated
+      PKGS_BOT_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
-
-      # Auto-merge, not a direct merge: branch protection still has to see
-      # `result`, `self-tests` and `build-isolation` green, and this lane
-      # inherits every rule the reviewed lane has except the human.
-      - name: Enable auto-merge
-        if: ${{ !cancelled() && steps.pr.outputs.pull-request-number != '' }}
-        env:
-          GH_TOKEN: ${{ secrets.PKGS_BOT_TOKEN }}
-          PR: ${{ steps.pr.outputs.pull-request-number }}
-        run: |
-          # Idempotent across re-runs of an updated PR: enabling twice errors.
-          if [[ "$(gh pr view "$PR" -R "${{ github.repository }}" --json autoMergeRequest --jq '.autoMergeRequest != null')" == true ]]; then
-            echo "auto-merge already enabled on #$PR"
-            exit 0
-          fi
-          gh pr merge --auto --merge "$PR" -R "${{ github.repository }}"
 
+  notify:
+    needs: [track, prs]
+    if: ${{ failure() }}
+    runs-on: ubuntu-latest
+    steps:
       - name: Notify Basecamp on failure
-        if: failure() && env.BASECAMP_CHATBOT_URL != ''
+        if: ${{ env.BASECAMP_CHATBOT_URL != '' }}
         env:
           BASECAMP_CHATBOT_URL: ${{ secrets.BASECAMP_CHATBOT_URL }}
         run: |

.github/workflows/unpublish.yml

@@ -0,0 +1,81 @@
+name: Unpublish retired packages
+
+# Takes packages out of the channel databases after their recipes are gone
+# from master. Deleting a recipe stops it building; this stops pacman
+# offering it. Files stay in the bucket (see bin/unpublish-packages).
+#
+# Only packages with no recipe on master: one that still has a recipe would
+# come back on its next publish, and refusing it keeps a typo from pulling a
+# live package out of every channel.
+
+on:
+  workflow_dispatch:
+    inputs:
+      packages:
+        description: "Space-separated pkgbases whose recipes were removed from master"
+        required: true
+      channels:
+        description: "Channels to remove them from"
+        required: true
+        default: "edge rc stable"
+
+jobs:
+  unpublish:
+    runs-on: ubuntu-latest
+    environment: publish
+    timeout-minutes: 15
+    # The publish job's group: one writer per channel database at a time.
+    # queue: max, as there: a waiting job is queued, not replaced.
+    concurrency:
+      group: publish
+      cancel-in-progress: false
+      queue: max
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Refuse packages that still have a recipe
+        env:
+          PACKAGES: ${{ github.event.inputs.packages }}
+          CHANNELS: ${{ github.event.inputs.channels }}
+        run: |
+          set -euo pipefail
+          for c in $CHANNELS; do
+            [[ $c == edge || $c == rc || $c == stable ]] || { echo "::error::Unknown channel: $c"; exit 1; }
+          done
+          for p in $PACKAGES; do
+            [[ $p =~ ^[a-z0-9@._+-]+$ ]] || { echo "::error::Not a package name: $p"; exit 1; }
+            if [[ -e pkgbuilds/$p ]]; then
+              echo "::error::pkgbuilds/$p still exists on master; remove the recipe first"
+              exit 1
+            fi
+          done
+
+      - name: Unpublish
+        env:
+          PACKAGES: ${{ github.event.inputs.packages }}
+          CHANNELS: ${{ github.event.inputs.channels }}
+          RCLONE_CONFIG_R2_TYPE: s3
+          RCLONE_CONFIG_R2_PROVIDER: Cloudflare
+          RCLONE_CONFIG_R2_NO_CHECK_BUCKET: "true"
+          RCLONE_CONFIG_R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+          RCLONE_CONFIG_R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+          RCLONE_CONFIG_R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
+          OMARCHY_PUBLISH_PREFIX: ${{ vars.OMARCHY_PUBLISH_PREFIX }}
+        run: |
+          set -euo pipefail
+          # repo-remove and bsdtar are Arch tools: run in the tested builder
+          # image, as the publish job does.
+          builder=ghcr.io/omacom/omarchy-pkg-builder:$(bin/builder-image key --arch x86_64 --mirror edge)
+          docker pull --quiet "$builder"
+          for mirror in $CHANNELS; do
+            for arch in x86_64 aarch64; do
+              docker run --rm \
+                -e OMARCHY_PUBLISH_PREFIX \
+                -e RCLONE_CONFIG_R2_TYPE -e RCLONE_CONFIG_R2_PROVIDER -e RCLONE_CONFIG_R2_ENDPOINT -e RCLONE_CONFIG_R2_NO_CHECK_BUCKET \
+                -e RCLONE_CONFIG_R2_ACCESS_KEY_ID -e RCLONE_CONFIG_R2_SECRET_ACCESS_KEY \
+                -v "$PWD:/w:ro" -w /w "$builder" \
+                bin/unpublish-packages --remote R2:omarchy-pkgs --mirror "$mirror" --arch "$arch" $PACKAGES
+            done
+          done

bin/build

@@ -86,7 +86,7 @@ while [[ $# -gt 0 ]]; do
     echo "  $0 --arch aarch64"
     echo "  $0 --mirror stable"
     echo "  $0 --package yay"
-    echo "  $0 --package yay elephant cursor-bin"
+    echo "  $0 --package yay walker cursor-bin"
     echo ""
     echo "Environment (for CI and resumed builds; defaults keep today's behaviour):"
     echo "  OMARCHY_KEEP_BUILD_WORKSPACE=1   keep build-output and reuse packages already there"

bin/sync-rebuilds

@@ -329,6 +329,43 @@ write_pkgrel() {
   mv "$scratch" "$pkgbuild"
 }
 
+# A package built against a trigger's ABI pins it exactly, once per architecture
+# because Arch Linux ARM can trail x86_64: depends_x86_64=('hyprland=0.56.2').
+# Rebuilding against a newer trigger has to move that pin with it, or the
+# rebuilt package demands the version it no longer loads into. Unpinned
+# dependencies, and pins outside the per-architecture arrays, are left alone.
+write_pins() {
+  local package_dir="$1"
+  local current="$2"
+  local pkgbuild="$package_dir/PKGBUILD"
+  local scratch="$pkgbuild.sync-rebuilds"
+  local arch trigger version pattern
+
+  cp "$pkgbuild" "$scratch" || return 1
+  while IFS=$'\t' read -r arch trigger version; do
+    pattern=$(printf '%s' "$trigger" | sed 's/[][\.*^$+?(){}|/]/\\&/g')
+    if ! awk -v array="depends_$arch" -v pattern="$pattern" -v pin="$trigger=$(version_pkgver "$version")" '
+      $0 ~ "^" array "=\\(" { inside = 1 }
+      inside { gsub("[\"\047]" pattern "=[^\"\047]*[\"\047]", "\047" pin "\047") }
+      inside && /\)/ { inside = 0 }
+      { print }
+    ' "$scratch" > "$scratch.new"; then
+      rm -f "$scratch" "$scratch.new"
+      return 1
+    fi
+    mv "$scratch.new" "$scratch"
+  done < <(jq -r 'to_entries[] | .key as $arch | .value | to_entries[] | [$arch, .key, .value] | @tsv' <<<"$current")
+
+  if ! bash -n "$scratch" 2>/dev/null; then
+    print_error "PKGBUILD with moved pins is not valid shell"
+    rm -f "$scratch"
+    return 1
+  fi
+
+  chmod --reference="$pkgbuild" "$scratch"
+  mv "$scratch" "$pkgbuild"
+}
+
 write_metadata() {
   local package_dir="$1"
   local filter="$2"
@@ -551,6 +588,12 @@ sync_package() {
     return 0
   fi
 
+  if ! write_pins "$package_dir" "$current"; then
+    print_error "  Failed to move pinned trigger versions for $package"
+    ((++FAILED))
+    return 0
+  fi
+
   if [[ -n "$suffix" ]] && ! write_metadata "$package_dir" '.pkgrel.suffix = ($suffix | tonumber)' --arg suffix "$suffix"; then
     print_error "  Failed to record pkgrel suffix for $package"
     ((++FAILED))
@@ -792,6 +835,17 @@ cmd_self_test() {
   check "run succeeds" 0 "$(run_case "$root")"
   check "pkgrel untouched" 1 "$(pkgrel_of "$root/pkgbuilds/t-current")"
 
+  echo "A rebuild moves the trigger's exact pin for the architecture it ran for:"
+  root=$(selftest_root pins)
+  selftest_package "$root" t-pins 1 '{"source":"local","rebuild_on":["dep-a"],"rebuilt_against":{"dep-a":"1.0-1"}}'
+  printf "depends_x86_64=('dep-a=1.0' 'dep-b')\ndepends_aarch64=('dep-a=1.0')\n" >> "$root/pkgbuilds/t-pins/PKGBUILD"
+  selftest_pacman "$root" dep-a=2.0-1
+  selftest_published "$root"
+  check "run succeeds" 0 "$(run_case "$root")"
+  check "pkgrel bumped" 2 "$(pkgrel_of "$root/pkgbuilds/t-pins")"
+  check "x86_64 pin moved" "depends_x86_64=('dep-a=2.0' 'dep-b')" "$(grep '^depends_x86_64=' "$root/pkgbuilds/t-pins/PKGBUILD")"
+  check "aarch64 pin left for its own run" "depends_aarch64=('dep-a=1.0')" "$(grep '^depends_aarch64=' "$root/pkgbuilds/t-pins/PKGBUILD")"
+
   echo "Metadata that does not parse fails the run instead of vanishing from it:"
   root=$(selftest_root unreadable)
   selftest_package "$root" t-broken 1 '{"source":"local","rebuild_on":["dep-a"'

bin/sync-upstream

@@ -23,7 +23,7 @@ Update packages that track an upstream vendor release feed instead of the AUR.
 Packages opt in declaratively through "upstream" in .omarchy/package.json.
 Providers cover GitHub Releases with checksum manifests or API asset digests,
 semver-shaped git tags, npm dist-tags, and plain Debian Packages indexes. See
-README.md for the schemas. Anything outside those conventions may provide
+docs/upstream-sources.md for the schemas. Anything outside those conventions may provide
 pkgbuilds/<package>/.omarchy/upstream.sh, a hook that reports JSON on stdout:
 
   {

bin/unpublish-packages

@@ -0,0 +1,80 @@
+#!/bin/bash
+# Retire packages from one channel of the remote repository.
+#
+#   unpublish-packages --mirror <edge|rc|stable> --arch <arch> <pkgbase...>
+#
+# The counterpart of publish-artifact, with the same steps:
+#   1. pull the channel's current database from the remote
+#   2. find every entry built from the named pkgbases (so a package's split
+#      outputs and -debug go with it)
+#   3. repo-remove them
+#   4. upload the database
+#
+# Package files stay in the bucket. Published filenames are immutable and the
+# R2 cache cannot recover from a rewrite; an unreferenced file costs nothing
+# and pacman never sees it. Naming a package the channel does not hold is not
+# an error, so a re-run is harmless.
+#
+# The remote is an rclone remote (REMOTE, default the production one);
+# OMARCHY_PUBLISH_PREFIX can point a proof run at a scratch prefix.
+set -euo pipefail
+BUILD_ROOT=$(realpath "${BASH_SOURCE[0]%/*}/..")
+source "$BUILD_ROOT/helpers/message-helpers.sh"
+source "$BUILD_ROOT/helpers/paths.sh"
+
+REMOTE=${REMOTE:-pkgs.omarchy.org:omarchy-pkgs}
+PREFIX=${OMARCHY_PUBLISH_PREFIX:-}
+BASES=()
+while [[ $# -gt 0 ]]; do
+  case $1 in
+  --mirror) MIRROR=$2; require_valid_mirror "$MIRROR"; shift 2 ;;
+  --arch) ARCH=$2; require_valid_arch "$ARCH"; shift 2 ;;
+  --remote) REMOTE=$2; shift 2 ;;
+  -h|--help) sed -n '2,19p' "$0"; exit 0 ;;
+  -*) print_error "Unknown option: $1"; exit 1 ;;
+  *) BASES+=("$1"); shift ;;
+  esac
+done
+(( ${#BASES[@]} )) || { print_error "No packages given"; exit 1; }
+
+DEST="$REMOTE/${PREFIX:+$PREFIX/}$MIRROR/$ARCH"
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+print_header "Unpublish from $DEST"
+
+# --- 1. pull the current database -----------------------------------------
+mkdir -p "$WORK/repo"
+listing=$(rclone lsf "$DEST/" --s3-no-head 2>/dev/null || true)
+if ! grep -q '^omarchy.db.tar.zst$' <<<"$listing"; then
+  print_info "No database at $DEST; nothing to remove"
+  exit 0
+fi
+rclone copy "$DEST/omarchy.db.tar.zst" "$WORK/repo" --s3-no-head
+rclone copy "$DEST/omarchy.files.tar.zst" "$WORK/repo" --s3-no-head 2>/dev/null || true
+before=$(tar -tf "$WORK/repo/omarchy.db.tar.zst" | grep -c '/$')
+print_info "Pulled current database ($before entries)"
+
+# --- 2. entries built from the named pkgbases -----------------------------
+names=$(bsdtar -xOf "$WORK/repo/omarchy.db.tar.zst" --include '*/desc' |
+  awk -v bases=" ${BASES[*]} " '
+    /^%NAME%$/ { getline name }
+    /^%BASE%$/ { getline base; if (index(bases, " " base " ")) print name }')
+if [[ -z "$names" ]]; then
+  print_info "None of ${BASES[*]} is in $MIRROR/$ARCH; nothing to remove"
+  exit 0
+fi
+mapfile -t NAMES <<<"$names"
+for n in "${NAMES[@]}"; do print_step "removing $n"; done
+
+# --- 3. repo-remove ---------------------------------------------------------
+( cd "$WORK/repo" && repo-remove --quiet omarchy.db.tar.zst "${NAMES[@]}" )
+ln -sf omarchy.db.tar.zst "$WORK/repo/omarchy.db"
+ln -sf omarchy.files.tar.zst "$WORK/repo/omarchy.files"
+after=$(tar -tf "$WORK/repo/omarchy.db.tar.zst" | grep -c '/$')
+(( before - after == ${#NAMES[@]} )) || {
+  print_error "Expected to remove ${#NAMES[@]} entries, removed $((before - after))"; exit 1; }
+print_info "Database now has $after entries"
+
+# --- 4. upload the database -------------------------------------------------
+rclone copy "$WORK/repo" "$DEST" --s3-no-head --checksum --copy-links --filter '+ omarchy.db*' --filter '+ omarchy.files*' --filter '- *'
+print_success "Removed ${#NAMES[@]} package(s) from $DEST"

build/build.sh

@@ -88,6 +88,10 @@ if [[ "$DRY_RUN" != true ]]; then
 
   mkdir -p "$BUILD_OUTPUT_DIR" "$FINAL_OUTPUT_DIR"
 
+  # The image drops pacman's private signing key. Keyring upgrades need a
+  # container-local key to sign newly trusted keys.
+  sudo pacman-key --init || exit 1
+
   # Bring the container up to date before any makedepends are installed. The
   # image is layer-cached, so its glibc drifts behind the mirror while makepkg
   # -s pulls makedepends from the freshly synced database -- a partial upgrade

ci/README.md

@@ -1,83 +1,118 @@
-# CI spike: build PRs on ephemeral DigitalOcean droplets
+# The x86_64 builder pool
 
-Status: spike. Nothing here publishes. The repository host keeps building and
+x86_64 package builds run on DigitalOcean droplets that exist for one job
-signing on merge exactly as before.
+each. aarch64 builds run on GitHub's `ubuntu-24.04-arm` runners and need
+nothing here.
 
-## Pieces
+## How it works
 
-- `.github/workflows/build-pr.yml` — on a PR touching `pkgbuilds/**`, one job
+- **Jobs ask for a runner labelled `omarchy-builder`.** `build-pr.yml` builds
-  per changed package on runners labelled `omarchy-builder`. aarch64 jobs
+  x86_64 packages there, and so does the `rebuild` job in `publish.yml`.
-  run on GitHub's native `ubuntu-24.04-arm` runners instead. Uploads the unsigned
+- **A controller creates one droplet per queued job.** `controller.sh` runs
-  `.pkg.tar.zst` as a workflow artifact (7 days).
+  from a systemd timer every minute on a small always-on droplet (tag
-- `runner-cloud-init.yaml` — Ubuntu 24.04 user-data: docker + buildx, the
+  `omarchy-controller`). It polls GitHub for queued jobs with the label and
-  GitHub runner registered `--ephemeral`, runs one job, powers off.
+  creates droplets up to `MAX_DROPLETS`. It has no inbound endpoint.
-- `controller.sh` — systemd timer every minute on a small always-on droplet.
+- **A droplet runs one job and powers off.** `runner-cloud-init.yaml` installs
-  Polls for queued jobs with our label, creates one g5-32vcpu-64gb-50gb droplet (ric1) per job up
+  Docker and the GitHub runner, registers it `--ephemeral` with a
-  to `MAX_DROPLETS`, deletes droplets that are powered off or older than
+  registration token that expires in an hour, runs the job, and powers off, also when the runner download or
-  `MAX_AGE_MINUTES`. No inbound endpoint. Plain curl against both APIs, no
+  registration fails. The controller removes any other failed droplet at
-  doctl and no gh: a token in the environment cannot pick the wrong account
+  `MAX_AGE_MINUTES`.
-  the way a saved doctl context can. Needs curl and jq.
+- **The controller deletes droplets** that are powered off, older than
-  `tests/controller.sh` exercises every decision against canned responses.
+  `MAX_AGE_MINUTES`, or still provisioning after `MAX_BOOT_MINUTES`, and
-- `controller-box/` — the always-on droplet: unit, timer, env template,
+  replaces a stuck one in the same tick.
-  cloud-init, and `create.sh` to stand it up with one API call.
+- **Sizes and regions fall back.** Each tick tries every size in `SIZES`, in
+  every region DigitalOcean lists it in stock. `REGIONS` only sets which
+  regions go first. A refused create is logged with DigitalOcean's message.
 
-## Standing up the controller box
+No secret reaches a builder. Signing and upload happen in the `publish` job on
+a GitHub-hosted runner.
 
-    DIGITALOCEAN_TOKEN=<omarchy account> GITHUB_TOKEN=<fine-grained PAT> \
+## Operate it
-      REPO=omacom/omarchy-pkgs ci/controller-box/create.sh <branch>
 
-The GitHub PAT is fine-grained, scoped to the one repo: Actions read,
+SSH to the controller droplet as root. It is the droplet tagged
-Administration read+write (registration tokens). The DO token is baked into
+`omarchy-controller` in the DigitalOcean account that pays for the builders;
-the box's env file, so it is the account that pays for builder droplets.
+the operators' keys were installed when it was created.
-Watch it with `journalctl -u omarchy-controller -f` on the box.
 
-## What the spike proved (2026-09-17, fork ryanrhughes/omarchy-pkgs)
+```bash
+journalctl -u omarchy-controller -n 50 --no-pager   # What it is doing
+journalctl -u omarchy-controller -f                 # Follow it
+systemctl list-timers omarchy-controller.timer      # Is it ticking
+```
 
-- `bin/build` works from a bare clone: with no local published tree it
+| Log line | Meaning |
-  plans against and resolves from `https://pkgs.omarchy.org/<mirror>/<arch>`.
+|---|---|
-- Droplet create → runner registered: ~70 s. omarchy-fish PR job: 2 min
+| `creating <name> (<size> in <region>)` | A queued job is getting a droplet |
-  including the builder image build. Droplet powers off after the job.
+| `<size> in <region> refused: <message>` | DigitalOcean refused; the next region or size is tried |
-- linux-omarchy on a c-32 droplet: 30 min wall clock for the build job
+| `no size in '<sizes>' can be created in any region` | Every create was refused. Read the `refused:` lines above it for why: out of stock (add a size to `SIZES`), or the account's droplet limit |
-  (23:39 → 00:09), 254 MB artifact. Cold start ~90 s before the job began.
+| `at cap (<live>/<max>, <busy> busy) with <queued> queued` | `MAX_DROPLETS` is reached. Raise it if the queue is long |
-- A PR whose PKGBUILD fails to build turns the required check red and GitHub
+| `deleting droplet <id> (status=<status> age=<n>m)` | Reaping a finished, old or stuck droplet |
-  refuses the merge (`mergeStateStatus=BLOCKED`, `gh pr merge` refuses
-  without `--admin`).
-- Controller: one queued job + one busy droplet ⇒ creates exactly one more;
-  reaps powered-off droplets on the next tick.
 
-## Not done (required before this touches the real repo)
+Check the pool from anywhere:
 
-- Tooling from base: check out master's `bin/ helpers/ build/` and overlay
+```bash
-  only the PR's `pkgbuilds/<name>`; today a PR can edit the build script
+gh api repos/omacom/omarchy-pkgs/actions/runners --jq \
-  and it runs on the droplet. The vouch gate limits who can do that, not
+  '"online \([.runners[]|select(.status=="online")]|length), busy \([.runners[]|select(.busy)]|length)"'
-  what they can do.
+```
-- DigitalOcean cloud firewall on the `omarchy-builder` tag: no inbound, no
-  egress to private ranges or the metadata address.
-- A fine-grained GitHub token for the real repository (the one on the
-  controller box is scoped to the fork), and the publish environment's
-  secrets set there.
-- Disable the host's auto-release timers for any channel CI publishes to,
-  so two writers never touch one database.
 
-## Done since the spike README was first written
+Jobs queued with no runner online for several minutes means the controller is
+not creating droplets: read its journal. See what is waiting:
 
-- Controller as a systemd timer on its own droplet, plain curl, self-test.
+```bash
-- Build once against edge; one artifact per package per architecture,
+gh run list -R omacom/omarchy-pkgs --workflow build-pr.yml --status queued
-  published into every channel it belongs to (fast ring: all three at
+```
-  once). arch=any builds once for every architecture database.
-- Publish is incremental and immutable: pull the channel db, refuse
-  different bytes under an existing name, accept identical bytes, upload
-  packages then signatures then the db.
-- aarch64 under QEMU with credential-preserving binfmt. PR builds now run
-  aarch64 natively on `ubuntu-24.04-arm` (QEMU was up to ~15x slower). When a
-  merged aarch64 tree has no artifact, publish.yml rebuilds it there too, in its
-  own job, and signs and uploads it on the droplet like a PR artifact.
-- Vouch gate: collaborators, `.github/VOUCHED.td`, or the `build-approved`
-  label; denounced authors cannot be overridden by the label.
-- Tests run on PRs only; `result`, `self-tests`, `build-isolation` are the
-  required checks with strict up-to-date branches.
 
-## Cleanup
+Only x86_64 jobs use this pool. A queued aarch64 job is waiting on GitHub's
+own runners.
 
-    doctl compute droplet list --tag-name omarchy-builder
+### Change settings
-    doctl compute droplet delete -f <id>
+
+Edit `/etc/omarchy-controller.env` on the box. The next tick reads it.
+
+| Setting | Default in `controller-box/controller.env.example` | |
+|---|---|---|
+| `MAX_DROPLETS` | 6 | Builders alive at once. The DigitalOcean account's droplet limit also applies |
+| `SIZES` | `g5-32vcpu-64gb-50gb g5-32vcpu-128gb-50gb` | Tried in order |
+| `REGIONS` | empty | Regions to try first; empty means any |
+| `MAX_AGE_MINUTES` | 200 | Delete a droplet older than this |
+| `MAX_BOOT_MINUTES` | 10 | Delete a droplet still provisioning after this |
+| `DO_SSH_KEYS` | Ryan, DHH and Emir's account key IDs | Attached to every builder. Without one, DigitalOcean emails a root password per builder |
+
+### Change the controller
+
+Merge the change to `master`. The unit pulls `/opt/omarchy-pkgs` before every
+tick, so it is live within a minute. The unit and timer files are copies made
+when the box was created; after changing them, on the box:
+
+```bash
+cp /opt/omarchy-pkgs/ci/controller-box/omarchy-controller.{service,timer} /etc/systemd/system/
+systemctl daemon-reload
+```
+
+`tests/controller.sh` exercises every controller decision against canned API
+responses. Run it before merging a change.
+
+### Reach a builder
+
+Operators can SSH to a builder as root while it lives. It powers off after its
+one job.
+
+### Clean up by hand
+
+The controller reaps on its own. To do it manually, delete droplets tagged
+`omarchy-builder` in the DigitalOcean account.
+
+## Stand up a controller
+
+```bash
+DIGITALOCEAN_TOKEN=<account that pays for builders> GITHUB_TOKEN=<fine-grained PAT> \
+  REPO=omacom/omarchy-pkgs ci/controller-box/create.sh
+```
+
+- The GitHub PAT is fine-grained and scoped to this repository: Actions read,
+  Administration read and write (for runner registration tokens).
+- The DigitalOcean token is written into the box's env file, so it is the
+  account that pays. It needs ssh_key:read to attach `DO_SSH_KEYS`; without
+  it every create is refused with 403.
+- `ADMIN_GITHUB_USERS` names whose GitHub SSH keys get root on the box and
+  the builders. Set it; the default is a fixed list in `create.sh`.
+- The script refuses to create a second controller.

ci/controller-box/controller.env.example

@@ -5,11 +5,20 @@ GITHUB_TOKEN=github_pat_...
 REPO=omacom/omarchy-pkgs
 LABEL=omarchy-builder
 TAG=omarchy-builder
-REGION=ric1
+# Builder sizes, tried in order in any region that has them in stock.
-SIZE=g5-32vcpu-64gb-50gb
+SIZES="g5-32vcpu-64gb-50gb g5-32vcpu-128gb-50gb"
+# Optional: regions to try first, e.g. "ric1". Empty means any.
+REGIONS=
 MAX_DROPLETS=6
 MAX_AGE_MINUTES=200
+# Delete a droplet DigitalOcean still reports as provisioning after this long.
+MAX_BOOT_MINUTES=10
 LOCK=/run/omarchy-controller/lock
 # Operator public keys for root on every builder droplet (JSON array).
 # create.sh fills this from the operators' GitHub keys.
 SSH_KEYS_JSON=[]
+# DigitalOcean account SSH key IDs attached to every builder (JSON array), so
+# DigitalOcean does not email a root password for each one. Needs ssh_key:read
+# on DIGITALOCEAN_TOKEN. List them with: doctl compute ssh-key list
+# Ryan R. Hughes, DHH, Emir.
+DO_SSH_KEYS=[59143572,59143588,59779105]

ci/controller-box/create.sh

@@ -18,7 +18,7 @@ SSH_KEYS=${SSH_KEYS:-[]}
 # Public keys authorized for root: the operators' GitHub keys, fetched at
 # creation so the box never depends on an ssh_key API scope. Override with
 # ADMIN_GITHUB_USERS.
-ADMIN_GITHUB_USERS=${ADMIN_GITHUB_USERS:-ryanrhughes dhh}
+ADMIN_GITHUB_USERS=${ADMIN_GITHUB_USERS:-ryanrhughes dhh emirb}
 ssh_keys_json=$(for u in $ADMIN_GITHUB_USERS; do curl -fsS "https://github.com/$u.keys"; done | jq -R . | jq -sc .)
 [[ $(jq length <<<"$ssh_keys_json") -gt 0 ]] || { echo "no ssh keys fetched for $ADMIN_GITHUB_USERS" >&2; exit 1; }
 

ci/controller-box/omarchy-controller.service

@@ -7,6 +7,9 @@ Wants=network-online.target
 Type=oneshot
 User=controller
 EnvironmentFile=/etc/omarchy-controller.env
+# Run the branch's current controller, not the one cloned when the box was
+# built. As root (the checkout's owner); a failed pull keeps the last one.
+ExecStartPre=-+/usr/bin/git -C /opt/omarchy-pkgs pull --ff-only --quiet
 ExecStart=/opt/omarchy-pkgs/ci/controller.sh
 # The reaper's safety net is time, not state; a hung tick must not hold the lock.
 TimeoutStartSec=240

ci/controller.sh

@@ -4,7 +4,8 @@
 # Run from a systemd timer every minute on a small always-on droplet. No
 # inbound endpoint: it polls GitHub for queued jobs wanting our label, creates
 # one ephemeral droplet per job (up to MAX_DROPLETS), and deletes droplets
-# that have powered off or exceeded MAX_AGE_MINUTES. The reaper does not
+# that have powered off, exceeded MAX_AGE_MINUTES, or are still provisioning
+# after MAX_BOOT_MINUTES. The reaper does not
 # trust its own bookkeeping: it lists by tag and acts on what DigitalOcean
 # reports.
 #
@@ -21,16 +22,30 @@ REPO=${REPO:?owner/name}
 : "${DIGITALOCEAN_TOKEN:?}" "${GITHUB_TOKEN:?}"
 LABEL=${LABEL:-omarchy-builder}
 TAG=${TAG:-omarchy-builder}
-REGION=${REGION:-ric1}
+# Sizes to try, in order, in any region DigitalOcean lists them in stock. A
-SIZE=${SIZE:-g5-32vcpu-64gb-50gb}
+# size can sell out in a region for hours; the create is then refused with
+# 422 and the next region, then the next size, is tried. REGIONS only orders
+# the regions tried first. SIZE and REGION, if set, are one-item lists.
+SIZES=${SIZES:-${SIZE:-g5-32vcpu-64gb-50gb g5-32vcpu-128gb-50gb}}
+REGIONS=${REGIONS:-${REGION:-}}
 IMAGE=${IMAGE:-ubuntu-24-04-x64}
 MAX_DROPLETS=${MAX_DROPLETS:-4}
 MAX_AGE_MINUTES=${MAX_AGE_MINUTES:-200}
+# A droplet DigitalOcean still reports as "new" this long after creation is
+# stuck provisioning. Left alone it counts as a runner booting, and holds a
+# queued job until MAX_AGE_MINUTES.
+MAX_BOOT_MINUTES=${MAX_BOOT_MINUTES:-10}
 RUNNER_VERSION=${RUNNER_VERSION:-2.337.0}
 CLOUD_INIT=${CLOUD_INIT:-$(dirname "$0")/runner-cloud-init.yaml}
 # Operator public keys authorized on every builder (JSON array of strings).
 # The box's env file carries them; empty means no root login.
 SSH_KEYS_JSON=${SSH_KEYS_JSON:-[]}
+# DigitalOcean account SSH key IDs or fingerprints attached at creation (JSON
+# array). A droplet created with none gets a root password that DigitalOcean
+# emails to the token's owner, once per builder. Attaching one needs the
+# ssh_key:read scope on DIGITALOCEAN_TOKEN; without it every create is
+# refused with 403.
+DO_SSH_KEYS=${DO_SSH_KEYS:-[]}
 LOCK=${LOCK:-/tmp/omarchy-controller.lock}
 
 log() { echo "$(date '+%F %T') $*"; }
@@ -39,7 +54,8 @@ log() { echo "$(date '+%F %T') $*"; }
 # both, so every decision below is exercised against canned responses.
 do_api() { # do_api <path> [curl args...]
   local path=$1; shift
-  curl -fsS -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \
+  # --fail-with-body: a refused create still prints why.
+  curl -sS --fail-with-body -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \
     -H "Content-Type: application/json" "https://api.digitalocean.com/v2/$path" "$@"
 }
 gh_api() { # gh_api <path> [curl args...]
@@ -55,7 +71,8 @@ reap() {
   while read -r id status created; do
     [[ -n "$id" ]] || continue
     age=$(( (now - $(date -d "$created" +%s)) / 60 ))
-    if [[ $status == off ]] || (( age > MAX_AGE_MINUTES )); then
+    if [[ $status == off ]] || (( age > MAX_AGE_MINUTES )) ||
+       { [[ $status == new ]] && (( age > MAX_BOOT_MINUTES )); }; then
       log "deleting droplet $id (status=$status age=${age}m)"
       do_api "droplets/$id" -X DELETE
     fi
@@ -64,18 +81,40 @@ reap() {
 }
 
 # --- demand ----------------------------------------------------------------
+# Emit every item, including later pages of large build matrices. Keep API
+# failures fatal so a failed query cannot look like an empty queue.
+gh_items() {
+  local path=$1 key=$2 page=1 response count separator="?"
+  [[ $path != *"?"* ]] || separator="&"
+  while :; do
+    response=$(gh_api "${path}${separator}per_page=100&page=$page") || return 1
+    count=$(jq -er --arg key "$key" '.[$key] | arrays | length' <<< "$response") || return 1
+    jq -c --arg key "$key" '.[$key][]' <<< "$response" || return 1
+    (( count == 100 )) || break
+    ((page += 1))
+  done
+}
+
 queued_jobs() {
-  local run
+  local status runs run
-  gh_api "repos/$REPO/actions/runs?status=queued&per_page=50" --get \
+  # A workflow can be in progress while most of its matrix is still queued.
-    | jq -r '.workflow_runs[].id' |
+  runs=$(
+    for status in queued in_progress; do
+      gh_items "repos/$REPO/actions/runs?status=$status" workflow_runs || exit 1
+    done
+  ) || return 1
+  jq -r '.id' <<< "$runs" | sort -u |
   while read -r run; do
-    gh_api "repos/$REPO/actions/runs/$run/jobs" \
+    gh_items "repos/$REPO/actions/runs/$run/jobs" jobs |
-      | jq -r --arg l "$LABEL" '.jobs[] | select(.status=="queued") | select(.labels | index($l)) | .id'
+      jq -r --arg l "$LABEL" 'select(.status=="queued") | select(.labels | index($l)) | .id' || return 1
-  done | wc -l
+  done | sort -u | wc -l
 }
 
 live_droplets() {
-  do_api "droplets?tag_name=$TAG&per_page=200" | jq '[.droplets[] | select(.status != "off")] | length'
+  # Not the ones reap() just deleted: DigitalOcean can list them for a while.
+  do_api "droplets?tag_name=$TAG&per_page=200" | jq --argjson boot "$MAX_BOOT_MINUTES" '
+    [.droplets[] | select(.status != "off")
+      | select(.status != "new" or (now - (.created_at | fromdateiso8601)) / 60 <= $boot)] | length'
 }
 
 busy_runners() {
@@ -83,22 +122,59 @@ busy_runners() {
     | jq --arg l "$LABEL" '[.runners[] | select(.busy) | select(any(.labels[]; .name == $l))] | length'
 }
 
+# --- capacity --------------------------------------------------------------
+# "size region" lines to try, best first: SIZES order, then REGIONS order,
+# then every other region where DigitalOcean lists the size in stock.
+candidates() {
+  local page=1 response count catalog=""
+  while :; do
+    response=$(do_api "sizes?per_page=200&page=$page") || return 1
+    count=$(jq -er '.sizes | arrays | length' <<< "$response") || return 1
+    catalog+=$(jq -c '.sizes[]' <<< "$response")$'\n'
+    (( count == 200 )) || break
+    ((page += 1))
+  done
+  jq -rs --arg sizes "$SIZES" --arg regions "$REGIONS" '
+    ($regions | split(" ") | map(select(length > 0))) as $pref
+    | INDEX(.slug) as $by
+    | $sizes | split(" ") | map(select(length > 0)) | .[]
+    | . as $size | $by[$size] // {} | select(.available == true)
+    | .regions as $in
+    | (($pref | map(select(. as $r | $in | index($r)))) + ($in - $pref))[]
+    | "\($size) \(.)"' <<< "$catalog"
+}
+
 # --- create ----------------------------------------------------------------
+# Built once per tick by the first create; a refused pair is dropped from it.
+CANDIDATES=""
 create_droplet() {
-  local token userdata name body
+  local token userdata name size region body response
+  [[ -n $CANDIDATES ]] || CANDIDATES=$(candidates) || return 1
   token=$(gh_api "repos/$REPO/actions/runners/registration-token" -X POST | jq -r .token)
   userdata=$(sed -e "s|__REPO__|$REPO|g" -e "s|__RUNNER_TOKEN__|$token|g" \
                  -e "s|__RUNNER_LABELS__|$LABEL|g" -e "s|__RUNNER_VERSION__|$RUNNER_VERSION|g" \
                  -e "s|__SSH_KEYS_JSON__|$SSH_KEYS_JSON|" "$CLOUD_INIT")
   name="$TAG-$(date +%s)-$RANDOM"
-  body=$(jq -n --arg name "$name" --arg region "$REGION" --arg size "$SIZE" --arg image "$IMAGE" \
+  while read -r size region; do
-    --arg tag "$TAG" --arg ud "$userdata" \
+    [[ -n $size ]] || continue
-    '{name:$name, region:$region, size:$size, image:$image, tags:[$tag], user_data:$ud, monitoring:false}')
+    body=$(jq -n --arg name "$name" --arg region "$region" --arg size "$size" --arg image "$IMAGE" \
-  log "creating $name ($SIZE)"
+      --arg tag "$TAG" --arg ud "$userdata" --argjson keys "$DO_SSH_KEYS" \
-  do_api droplets -X POST -d "$body" | jq -r '"created droplet \(.droplet.id)"'
+      '{name:$name, region:$region, size:$size, image:$image, tags:[$tag], user_data:$ud, ssh_keys:$keys, monitoring:false}')
+    log "creating $name ($size in $region)"
+    if response=$(do_api droplets -X POST -d "$body"); then
+      jq -r '"created droplet \(.droplet.id)"' <<< "$response"
+      return 0
+    fi
+    log "$size in $region refused: $(jq -r .message <<< "$response" 2>/dev/null || echo "$response")"
+    CANDIDATES=$(grep -Fvx "$size $region" <<< "$CANDIDATES" || true)
+  done <<< "$CANDIDATES"
+  # Every size refused everywhere: the rest of this tick's creates would be too.
+  log "no size in '$SIZES' can be created in any region"
+  return 1
 }
 
 controller_tick() {
+  CANDIDATES=""
   reap
   local queued live busy available need room
   queued=$(queued_jobs)

ci/runner-cloud-init.yaml

@@ -14,7 +14,10 @@
 
 # Operators can reach a builder by key while it lives; it powers off after
 # one job anyway. Keys are substituted by the controller (__SSH_KEYS_JSON__).
+# Never by password: DigitalOcean sets and emails one when no account key is
+# attached, and its vendor data turns password logins on to match.
 disable_root: false
+ssh_pwauth: false
 chpasswd:
   expire: false
 ssh_authorized_keys: __SSH_KEYS_JSON__
@@ -45,6 +48,10 @@ write_files:
     content: |
       #!/bin/bash
       set -euo pipefail
+      # Power off after the one job, and also when the download or the
+      # registration fails: the controller deletes powered-off droplets, but
+      # counts a running one as a runner still booting until MAX_AGE_MINUTES.
+      trap 'sudo poweroff' EXIT
       cd /home/runner
       mkdir -p actions-runner && cd actions-runner
       arch=$(uname -m); [[ $arch == x86_64 ]] && arch=x64
@@ -58,8 +65,6 @@ write_files:
         --labels "__RUNNER_LABELS__" \
         --replace
       ./run.sh
-      # One job done. Power off; the controller deletes powered-off droplets.
-      sudo poweroff
 
 runcmd:
   # With no account ssh key attached, DO expires root's password, and sshd

docs/builds.md

@@ -0,0 +1,80 @@
+# How a package builds
+
+`bin/build` is the one builder: PR builds, rebuilds at merge and local builds
+all call it.
+
+## Dependency resolution
+
+Within one `bin/build` run, the build system handles dependencies between the
+packages it was asked to build. CI builds each package in its own job, so a
+PR's packages do not see each other's fresh builds; they resolve from `edge`.
+
+1. Plans dependency order once, including `depends`, `makedepends`,
+   `checkdepends`, and their architecture-specific arrays.
+2. Builds each package in a fresh container. Installed packages and changes
+   to the container's system files cannot carry over to the next build.
+3. Shares successful artifacts through the temporary `[omarchy-build]` repo,
+   installing newly built prerequisites in each consumer's container.
+4. Blocks consumers of a failed prerequisite while continuing independent
+   builds.
+
+Example: If `aether` depends on `hyprshade`, `hyprshade` is built first.
+
+Isolation also lets the release and dev Omarchy pairs build in the same run:
+Flea can install `omarchy` without preventing `omarchy-dev` from installing
+its conflicting settings package in a different container.
+
+Pacman downloads are cached under `cache/pacman/<channel>/<arch>/` across
+containers and runs. The installed package database is never shared. Each
+container updates its base system before resolving build dependencies, so a
+cached builder image cannot cause a partial system upgrade. The existing
+`OMARCHY_KEEP_BUILD_WORKSPACE`, `OMARCHY_SKIP_BUILDER_IMAGE`, and
+`OMARCHY_DEFER_RUNTIME_DEPS` flags retain their behavior.
+
+`tests/build-isolation.sh` exercises conflicting package pairs, failed
+prerequisites, resumed builds, cache replacement, and deferred dependencies
+using real containers and pacman transactions. It uses the prepared builder
+image, or an image named by `TEST_BUILDER_IMAGE`; CI builds the small fixture
+image in `tests/build-isolation.Dockerfile`.
+
+## Daily builder images
+
+`Refresh builder images` builds fresh `edge` environments daily at 04:23 UTC,
+when their inputs change on `master`, and on manual dispatch. x86_64 and
+aarch64 build on native GitHub-hosted runners, without occupying the DO
+package-builder pool. Each candidate must pass `tests/build-isolation.sh`,
+including real package builds, before publication to
+`ghcr.io/omacom/omarchy-pkg-builder`. Only `master` in this repository can
+publish; PR workflows cannot replace the shared images.
+PRs that change image inputs also build and test both candidates on native
+runners, with a read-only token and no registry publication.
+
+The compatibility tag contains the architecture, mirror, and a hash of the
+entire `build/` context, including executable bits and symlink targets but
+excluding checkout timestamps and ownership. This deliberately invalidates
+images when mounted build scripts change too. `v1` identifies the image build
+contract; change it if the invocation or compatibility rules change. Each
+successful refresh also gets a run-specific tag for diagnosis and rollback.
+A failed build, isolation test, or push leaves the previous compatible image
+selected. Scheduled builds use `--pull --no-cache` so unchanged Dockerfiles
+still pick up fresh Arch packages.
+
+To build and test a candidate locally:
+
+```bash
+bin/builder-image key --arch x86_64 --mirror edge
+bin/builder-image build --arch x86_64 --mirror edge --tag builder-candidate:test --fresh
+CONTAINER_ENGINE=docker TEST_BUILDER_IMAGE=builder-candidate:test tests/build-isolation.sh
+```
+
+The workflow uses its repository `GITHUB_TOKEN` with `packages: write`; no
+registry PAT is needed. **One-time setup when the image package is first
+created:** GHCR
+creates the package private. In the `omacom/omarchy-pkg-builder` package
+settings, change visibility to **Public**, then rerun the failed refresh job.
+The workflow checks anonymous registry access before advancing the compatible
+tag, so fork PRs will not be directed to an image they cannot pull. Subsequent
+refreshes preserve that package visibility.
+
+`publish.yml` and `unpublish.yml` pull the compatible image to sign and update
+databases. Package build jobs still build their own image on the runner.

docs/rebuild-triggers.md

@@ -0,0 +1,44 @@
+# Rebuild triggers
+
+```bash
+bin/sync-rebuilds                       # Bump every package whose dependencies moved
+bin/sync-rebuilds quickshell-git        # Update specific packages
+bin/sync-rebuilds --self-test           # Run the regression tests
+```
+
+Some packages have to be rebuilt when something they link against changes, even though nothing in their own source moved. A Qt private-API consumer is the usual case: `Qt_6_PRIVATE_API` symbols are not covered by the soname, so a qt6-base point release can leave an installed binary unable to resolve a symbol at startup, and pacman upgrades Qt out from under it because the dependency is unversioned. The package still builds from the same git commit, so its version alone would not trigger a rebuild.
+
+A package names those dependencies in `.omarchy/package.json`:
+
+```json
+{ "source": "local", "rebuild_on": ["qt6-base", "qt6-declarative", "qt6-wayland"] }
+```
+
+`bin/sync-rebuilds` reads each named package's version from the official
+repositories for every architecture a merge builds (`CI_ARCHES` in
+`helpers/paths.sh`, both by default) that the package supports and compares
+it to `rebuilt_against`. Records are kept per architecture because Arch and
+Arch Linux ARM can carry different dependency versions. pkgrel is bumped once
+when any recorded version moves; that one source revision is then built for
+each architecture by the PR that carries the bump.
+
+The bump is the point of the command, and it has to land in git rather than in the builder. A rebuild that reuses the published version string produces a package pacman will never offer anyone, so rebuilding without a version change would ship nothing. Bumping pkgrel needs no other change: the PR that carries the bump builds the package, and the merge publishes it.
+
+The bumped version is checked against the published one as well as the checked-in one, and refused when pacman would not order it higher. The checked-in version is not the floor; what a user already has is, and a checkout that has fallen behind the repository can otherwise be bumped to something that loses to the package it means to replace. That check is skipped with a warning when the published database cannot be read.
+
+x86_64 versions are read from the local pacman database, so the workflow runs
+in an Arch container pointed at `mirror.omarchy.org`, the same mirror as the
+x86_64 builder. aarch64 versions are read directly from the live Arch Linux ARM
+repository database, which is also what the ARM builder uses. Testing and
+staging repositories do not count. A legacy flat `rebuilt_against` record is
+read as x86_64 and is migrated naturally the next time a rebuild is needed.
+
+A dependency this repository carries for an architecture (a recipe here that builds for edge on it, such as aquamarine on aarch64) shadows the distribution's, because the builder lists `[omarchy]` first. Its version is the recipe's, and it counts only once edge publishes that version: until then the builder still links against the previous one, so dependents are left alone for that run.
+
+## The workflow
+
+`sync-rebuilds.yml` runs `bin/sync-rebuilds` every 6 hours and opens one PR per
+package on `auto/sync-rebuilds-<package>` with auto-merge enabled. Each PR lands
+once `result`, `self-tests` and `build-isolation` pass, and the merge publishes.
+A rebuild that fails stays an open red PR for a maintainer without holding back
+the others.

docs/releases.md

@@ -0,0 +1,119 @@
+# Cutting an Omarchy release
+
+The release train runs from `bin/omarchy-release`. Nothing in the GitHub
+workflows promotes a channel: its channel moves and RC builds were written to
+execute on the old repository host, which is abandoned (see
+[repository-host.md](repository-host.md)), against a local copy of the
+published tree.
+
+> `rc` and `ship` build the release pair with `bin/repo release` and move
+> channels with `bin/repo advance`, on the machine that holds the published
+> tree. No workflow replaces them yet. That machine's tree has to match the
+> bucket first: `advance` reads the source channel from local disk.
+
+`bin/omarchy-release` is the front door. A release train has three human
+moments, each one command — and bare `omarchy-release` observes reality
+(branches, pins, published channels, tags) and walks you to the next one:
+
+```bash
+bin/omarchy-release              # shepherd: status + guided next step
+bin/omarchy-release start 4.0.2  # open the train: branch v4-0-2 + staging PR
+bin/omarchy-release pick         # choose merged PRs to cherry-pick (multi-select)
+bin/omarchy-release rc           # publish the next 4.0.2rcN to the rc channel
+bin/omarchy-release ship         # tag, final pins, promote rc → stable,
+                                 # draft GitHub release, ISO, website — one swoop
+bin/omarchy-release doctor       # verify credentials/connections up front
+```
+
+Versions are inferred from branch names (`v4-0-2` ⇒ `4.0.2rcN` ⇒ tag
+`v4.0.2`); `start` is the only place a version is typed. Every command is
+idempotent — re-runs skip whatever is already done. `ship` refuses to promote
+a commit no RC was cut from. One exception: `ship` carries on past a failed
+ISO or website step, and a later `ship` exits once stable holds the version
+and the GitHub release exists. Finish a failed ISO or website step by hand.
+
+## Promoting a channel
+
+Ship the tested rc channel to stable (copies packages + signatures, then
+cleans, rebuilds the database, and syncs):
+
+```
+bin/repo advance --from rc --to stable --arch all
+```
+
+Open a release train that ships new edge packages by carrying edge into rc
+first:
+
+```
+bin/repo advance --from edge --to rc --arch all
+```
+
+`advance` moves x86_64 alone unless given `--arch`. `--arch all` covers the
+architectures in `PUBLISHED_ARCHES` (`helpers/paths.sh`), x86_64 only by
+default; set `OMARCHY_ARCHES="x86_64 aarch64"` on the machine that runs it to
+promote both. The variable is not carried over when `bin/repo` forwards a
+command over ssh, and `omarchy-release ship` promotes through the same path. It refuses to
+carry a package into a channel its `channels` metadata excludes.
+
+## The pin engine
+
+The release pair is marked `"pinned": true`. It is built for `rc` only from
+the `rc` branch worktree, with `OMARCHY_RC_PINS=1` set (`omarchy-release rc`
+sets it), and never built for `stable`: stable gets it by promotion. A merge to
+`master` therefore cannot overwrite an RC in flight.
+
+The `omarchy` and `omarchy-settings` packages are released as a pair, always
+built from the same upstream commit of basecamp/omarchy.
+
+**Use `bin/omarchy-release`** — it drives the whole train across all four repositories and
+calls the pin engine below for you.
+
+`bin/omarchy-pkgs` is that engine, available directly for one-off pins and
+debugging. It rewrites both PKGBUILDs in lockstep (same `_tag`/`_commit`/
+`pkgver`/`sha256sums`), validates ordering with `vercmp`, commits, and pushes
+the current branch. Driven by `omarchy-release` it pins to the release branch
+on the `rc` branch and orders against the rc channel; invoked directly it
+targets the current branch and edge.
+
+```bash
+bin/omarchy-pkgs release v4.0.0          # Final release from the upstream v4.0.0 tag
+bin/omarchy-pkgs release rc v4.0.0       # Newest upstream v4.0.0-rcN tag -> 4.0.0rcN
+bin/omarchy-pkgs release beta v4.0.0     # Same for beta (alpha also supported)
+bin/omarchy-pkgs release latest          # Newest upstream tag, rc/beta included (prompts)
+bin/omarchy-pkgs release rc              # Untagged RC from the quattro tip, auto-numbered
+bin/omarchy-pkgs release --commit abc123 --base 4.1.0   # Untagged RC from a commit
+bin/omarchy-pkgs release ... --dry-run   # Show the plan; write nothing
+bin/omarchy-pkgs release ... --no-push   # Full flow, local commit only (testing)
+bin/omarchy-pkgs self-test               # Version normalization + ordering tests
+```
+
+## Versioning rules
+
+- Finals are `X.Y.Z`; pre-releases are `X.Y.ZalphaN` / `X.Y.ZbetaN` /
+  `X.Y.ZrcN` in the **attached** form only. pacman's vercmp orders
+  `4.0.0alpha1 < 4.0.0beta1 < 4.0.0rc1 < 4.0.0`, but separator forms
+  (`4.0.0.rc1`, `4.0.0_rc1`) sort **after** `4.0.0` and would strand users on
+  the pre-release — the tooling normalizes upstream tags (`v4.0.0-rc1`,
+  `v4.0.0-rc.1`, ...) to the attached form and refuses anything it cannot
+  normalize. Upstream tags are cut on the quattro branch.
+- `pkgrel` resets to 1 on every version change. Bump `pkgrel` by hand only to
+  repackage the same source.
+- `epoch` is never set by tooling. It is sticky forever; adding one is a
+  human decision of last resort.
+
+## Where releases land
+
+- **RCs build for the rc channel.** RC testers and RC ISO installs run the real
+  `omarchy` package against the package set stable users will actually get.
+  Stable never sees an rc version; rc testers upgrade rc1 → rc2 → final
+  naturally.
+- **Finals build into rc, then the whole channel promotes.** After testing, the
+  ship step promotes the exact tested artifacts (packages and signatures)
+  forward:
+
+```bash
+bin/repo advance --from rc --to stable --arch all
+```
+
+Neither package is on the `fast` ring, and `bin/omarchy-pkgs` never touches
+stable — promotion is always this explicit step.

docs/repository-host.md

@@ -0,0 +1,586 @@
+# The repository host (abandoned)
+
+**This pipeline is abandoned.** Packages are built and published by GitHub
+workflows: see the [README](../README.md). Don't follow this page to publish
+anything.
+
+The package pipeline used to run on one machine that built, signed and
+published every channel on a timer. This page is kept as the reference for
+the tooling that was written for it and is still in the tree: `bin/repo`, the
+units in `systemd/`, and the host side of the release train
+([releases.md](releases.md)).
+
+**That tooling writes to the same bucket as CI.** If you run any of it
+(`release`, `sync`, `promote`, `push`, `deploy`, `advance`, `remove`), these
+rules apply:
+
+- Do not run `bin/repo release`, `sync`, `push` or `deploy` for a package CI
+  publishes. Merge a PR, or dispatch `publish.yml`, instead.
+- Keep the `omarchy-auto-release-*` and `omarchy-check-versions` timers
+  disabled while CI publishes the same channels. Two writers on one channel
+  database overwrite each other.
+- Never pass `--prune` to `bin/repo sync`. The host's tree does not hold what
+  CI published, and `--prune` deletes remote files the local tree lacks.
+- Never rebuild a version that is already published. Bump `pkgrel`.
+
+## Setting up a host
+
+> Abandoned. Kept as reference for the tooling; don't follow it to publish.
+
+### aarch64 under emulation
+
+The repository host builds every architecture it publishes on the same
+machine. A foreign architecture runs under QEMU user emulation, which
+`bin/build` checks by actually running a container for the target platform.
+Rootful Docker registers QEMU on first use. Rootless Podman uses the host's
+registration and prints the one-time Arch setup commands when it is missing or
+lacks the credential flag required by `sudo` inside the builder:
+
+```bash
+# Verify
+podman run --rm --platform linux/arm64 docker.io/library/alpine:latest uname -m
+# Should output: aarch64
+```
+
+**Note**: emulated builds are much slower than native ones.
+
+## Published architectures
+
+> Abandoned. Kept as reference for the tooling; don't follow it to publish.
+
+`helpers/paths.sh` names the architectures the host's scheduled pipeline and
+release train work on. CI does not read it:
+
+```bash
+PUBLISHED_ARCHES="${OMARCHY_ARCHES:-x86_64}"
+```
+
+That list drives the whole scheduled pipeline. `check-versions` compares
+PKGBUILDs against each architecture's channel databases and writes one queue
+file per channel and architecture (`.sync-needed-<channel>-<arch>`);
+`auto-release <channel>` works through the queues one architecture at a
+time, each with its own backoff (`.build-failed-<channel>-<arch>`), so a
+failing build on one architecture never holds up the other; and the release
+train advances channels with `--arch all`: it takes one host-wide lock and
+verifies every architecture's source database before moving any of them. The
+first entry is the reference architecture the release train observes channels
+through. Rerunning the same advance after a failed remote sync completes it
+safely.
+
+Adding an architecture to the scheduled pipeline is therefore one checked-in
+change to that list: the next `check-versions` tick queues everything the new
+architecture lacks, and the next `auto-release` tick starts building it. CI
+does not read this list: it builds the architectures in `CI_ARCHES`, both by
+default. For a one-off run, override it directly:
+
+```bash
+OMARCHY_ARCHES=x86_64 bin/check-versions
+OMARCHY_ARCHES=aarch64 bin/check-versions
+OMARCHY_ARCHES="x86_64 aarch64" bin/check-versions
+```
+
+The builder image bootstraps
+`omarchy-keyring` from the x86_64 tree for every architecture, so the first
+build of a new architecture does not depend on a repository that only it can
+create.
+
+## Release in one command
+
+> Abandoned. Kept as reference for the tooling; don't follow it to publish.
+
+The release command is smart and **incremental** - it only builds packages that have changed or are missing. You generally don't need to specify a package manually unless you are debugging a specific failure.
+
+When a package fails, a completed build run still signs and publishes the packages
+that succeeded. Failed packages and their blocked dependents remain queued with
+failure backoff; retries compare against the updated repository and skip the
+published versions. Only artifacts recorded by fully completed package builds
+are eligible for a partial release. An interrupted build, a failed publication
+step, or an incomplete pair using deferred runtime dependencies still stops the
+release. Reports distinguish partial publication from complete success.
+
+```bash
+# Build changed/new packages, sign, promote, clean, update, and sync
+bin/repo release
+
+# Stable Mirror
+bin/repo release --mirror stable
+
+# ARM64
+bin/repo release --arch aarch64
+
+# Build one package (still skipped when its version is already published)
+bin/repo release --package omarchy-nvim
+
+# Show what would build without signing/promoting/syncing
+bin/repo release --dry-run
+```
+
+### Step-by-Step
+
+```bash
+bin/repo build                          # Build (unsigned)
+bin/repo sign                           # Sign packages
+bin/repo promote                        # Copy to production
+bin/repo clean                          # Remove old versions
+bin/repo update                         # Update database
+bin/repo sync                           # Sync to remote
+```
+
+## Building Heavy Packages Locally
+
+> Abandoned. Kept as reference for the tooling; don't follow it to publish.
+
+Large packages build faster on a local machine than on the server. Build them
+here, then hand the artifacts to the repository host, which signs and publishes
+them:
+
+```bash
+bin/repo deploy --package nvidia-580xx-utils   # Build here, publish from the host
+```
+
+`deploy` is `build` followed by `push`. The two steps are also available
+separately when a build needs inspecting before it ships:
+
+```bash
+bin/build --package nvidia-580xx-utils         # Build on the fast machine
+bin/repo push --package nvidia-580xx-utils     # Upload + publish on the host
+```
+
+`push` uploads to the host's `build-output/`, verifies checksums, and runs
+`bin/upload-prebuilt` there. Do not publish from a local checkout instead: a
+local machine holds neither the complete repository nor a signing key.
+
+**Name the package.** `build` plans against the local repository database, or
+against the public channel's when there is none. `deploy` refuses to run
+unscoped when the local database is missing. Unscoped builds belong on
+the repository host, where `bin/repo release` does the same job against a real
+database.
+
+Every other `bin/repo` command — `sign`, `promote`, `update`, `clean`,
+`advance`, `remove`, `sync`, `release` — works on the published tree. Run them
+from anywhere: with a repository host configured `bin/repo` forwards them over
+ssh to run there (see [Build trigger and the build host](#build-trigger-and-the-build-host)),
+and `--local` forces execution on the current machine. `bin/repo build`
+forwards too; call `bin/build` directly, or pass `--local`, to build on this
+machine. `push` and `deploy` always run locally.
+
+## Commands
+
+> Abandoned. Kept as reference for the tooling; don't follow it to publish.
+
+### Global Flags
+
+These flags can be used with all commands:
+
+- `--mirror <edge|rc|stable>`: Selects the channel (default: `edge`).
+- `--local`: Run on this machine instead of forwarding to the repository host.
+- `--arch <x86_64|aarch64>`: Selects the target architecture (default: `x86_64`).
+
+### Build
+
+```bash
+bin/repo build                                   # All packages (x86_64, edge)
+bin/repo build --arch aarch64                    # ARM64
+bin/repo build --mirror rc                       # Release-candidate channel
+bin/repo build --mirror stable                   # Stable channel
+bin/repo build --package yay cursor-bin          # Specific packages
+bin/repo build --dry-run                         # Show what would build
+```
+
+**Output**: Unsigned `.pkg.tar.zst` in `build-output/`. Only builds packages whose version differs from what the repository holds.
+
+Use `--dry-run` to show the build plan without running `makepkg`.
+
+### Sign
+
+```bash
+bin/repo sign
+```
+
+Reads the GPG key and passphrase from the environment and signs all packages in `build-output/`. Supports `--arch` and `--mirror`.
+
+### Promote
+
+```bash
+bin/repo promote                    # Copy to production
+bin/repo promote --arch aarch64     # ARM64
+bin/repo promote --dry-run          # Preview
+```
+
+Copies signed packages from `build-output/` → `pkgs.omarchy.org/`.
+
+### Clean
+
+```bash
+bin/repo clean                      # Keep 2 versions
+bin/repo clean --keep 3             # Keep 3 versions
+bin/repo clean --dry-run            # Preview
+```
+
+Removes old package versions from the file system. **Does not update the database.**
+
+### Update
+
+```bash
+bin/repo update                     # Update database
+```
+
+Updates the repository database (adding the newest version of each package). Run this after `promote` or `clean`.
+
+### Sync Repository
+
+```bash
+bin/repo sync                           # Sync current arch/mirror
+bin/repo sync --mirror stable           # Sync stable
+bin/repo sync --arch aarch64            # Sync ARM64
+bin/repo sync --skip-prod-check         # No confirmation
+```
+
+Syncs package repositories to the remote server using rclone based on the configured mirror and architecture.
+
+**Uploads are additive.** A local tree is not authoritative about what belongs on
+the remote — `pkgs.omarchy.org/` is gitignored, and packages built on another
+machine exist only there — so sync never deletes by default. To take a package
+out of the channels, use the `unpublish.yml` workflow.
+
+For the same reason sync refuses to publish a repository database built from a
+tree holding fewer packages than the remote database already lists. The database
+is what pacman resolves against, so a partial one hides every package it does not
+know about even though the files are still on the mirror. Use `bin/repo push` to
+publish packages built on another machine.
+
+### Deploy
+
+```bash
+bin/repo deploy --package nvidia-580xx-utils   # Build locally, publish from the host
+bin/repo deploy --host root@example.com        # Point at a specific repo host
+bin/repo deploy --dry-run                      # Show the plan, change nothing
+```
+
+Runs `build` then `push` in one command. The repository host is resolved before
+the build starts, so a missing `--host` fails immediately rather than after a long
+compile.
+
+### Push to the Repository Host
+
+```bash
+bin/repo push                                  # Push everything in build-output
+bin/repo push --package nvidia-580xx-utils     # Push one package
+bin/repo push --mirror stable --arch aarch64   # Pick mirror and architecture
+bin/repo push --host root@example.com          # Override the repo host
+bin/repo push --dry-run                        # Show the plan, transfer nothing
+```
+
+Uploads packages from `build-output/` to the repository host and publishes them there
+with `bin/upload-prebuilt` (sign → promote → update → sync). Use it when a package
+is quicker to build on a local machine than on the server.
+
+Publishing happens on the host rather than locally for two reasons: the host
+has a GPG signing key (CI has its own copy in the `publish` environment), and
+it holds the repository tree that its database and sync are built from. Local
+machines therefore need no secrets.
+
+The host comes from `--host`, `$OMARCHY_REPO_HOST`, then `.repo-host`. The
+setting is named for the repository rather than for building, which happens
+wherever you like. The same setting tells `bin/omarchy-pkgs release` which host
+to poke after a release push.
+
+`--package` means the same thing as it does to `build`: a pkgbase, whose every
+output ships together. Pushing `nvidia-580xx-utils` carries `nvidia-580xx-dkms`
+and `opencl-nvidia-580xx` with it, because that is what the build produced. An
+output's own name still selects just that one, for publishing a single package
+on purpose. Omit `--package` to push everything built.
+
+Publishing signs and promotes everything staged on the host, not just what this
+push uploaded, so `push` stops when it finds packages already staged there —
+usually leftovers from a failed run. Remove them on the host, or pass
+`--include-staged` to publish them too.
+
+### Other host commands
+
+```bash
+bin/repo advance --from rc --to stable            # Ship the tested rc channel to stable
+bin/repo advance --from edge --to rc              # Open a train: carry edge forward into rc
+bin/repo advance --from edge --to rc --package x  # Deliberate single-package advance
+bin/repo advance --from rc --to stable --dry-run  # Preview without changing files
+bin/repo bootstrap-rc                             # One-time initial rc seed from stable
+bin/repo timers                      # Timer schedule, last runs, queues, backoff, lock
+bin/repo list                        # List package metadata
+bin/repo deploy                      # Build locally, then publish from the host
+bin/repo push                        # Upload local builds to the host and publish
+bin/repo remove <package>            # Remove package (host workflow; CI uses unpublish.yml)
+bin/clean-docker                     # Clear Docker images/cache (forces fresh rebuild)
+```
+
+## Build trigger and the build host
+
+> Abandoned. Kept as reference for the tooling; don't follow it to publish.
+
+Release commands run from anywhere. `bin/repo` is a **remote control**: with a
+repository host configured, every command that operates on the published tree
+(`release`, `build`, `sign`, `promote`, `update`, `clean`, `advance`,
+`bootstrap-rc`, `remove`, `sync`, `migrate`) executes ON the host over ssh —
+the exact same code, run where the tree lives, so ssh'ing in and running the
+same commands by hand behaves identically. Pass `--local` to force execution
+on the current machine. `list`, `push`, `deploy`, and `setup` never forward
+(`push`/`deploy` exist precisely to move local builds *to* the host).
+
+Without a configured host, commands run locally — which on the build host
+itself (no `.repo-host` there) is exactly right, and elsewhere the exact
+commands to run are printed by the orchestrator, with the 5-minute
+auto-release timer as the backstop.
+
+The host setting is any destination `ssh` accepts, resolved in this order:
+
+1. `--host <dest>`, for `push`, `deploy` and `bin/omarchy-release`
+2. `OMARCHY_REPO_HOST` environment variable
+3. the git-ignored `.repo-host` file (one line; `#` comments allowed)
+
+The server layout lives under `/root`, so the value is `root@<ip>`,
+`root@<hostname>`, or — nicest — a `Host` alias from `~/.ssh/config` that
+carries the user, key, and port:
+
+```
+# .repo-host
+root@pkgs.example.com
+```
+
+All connections are plain ssh; nothing else is used to reach the host.
+
+**How "this machine is the build host" is detected — and its one caveat.**
+The marker is the published database living in this checkout
+(`pkgs.omarchy.org/<channel>/<arch>/omarchy.db*`), the same convention the
+rest of `bin/` uses. A workstation that once ran a full local
+`bin/repo release` carries that marker too and would infer it is the host.
+An explicitly configured destination always outranks the inference — `--host`,
+`OMARCHY_REPO_HOST`, and `.repo-host` are checked first, and only when none is
+set does local detection apply. So if a machine ever misidentifies itself,
+writing the real host into `.repo-host` is the fix.
+
+## Directory Structure
+
+> Abandoned. Kept as reference for the tooling; don't follow it to publish.
+
+```
+omarchy-pkgs/
+├── pkgbuilds/                  # Source PKGBUILDs
+│   └── package-name/
+│       ├── PKGBUILD
+│       └── .omarchy/
+│           ├── package.json    # Source/sync/release metadata
+│           └── upstream.sh     # Optional custom vendor release feed hook
+├── build/
+├── build-output/               # Unsigned packages (temporary)
+│   ├── edge/                   # (rc/ and stable/ alongside, each x86_64 + aarch64)
+│   ├── rc/
+│   └── stable/
+├── pkgs.omarchy.org/           # Signed packages (production)
+│   ├── .release.lock           # Host-wide lock: one channel mutation at a time
+│   ├── edge/                   # Each channel: x86_64/ and aarch64/
+│   ├── rc/
+│   └── stable/
+└── bin/                        # CLI tools (on host)
+```
+
+## Architecture-Specific Notes
+
+> Abandoned. Kept as reference for the tooling; don't follow it to publish.
+
+### x86_64
+- Native builds (fast)
+- Mirrors: mirror.omarchy.org, rackspace, pkgbuild.com
+
+### aarch64
+- Built on the repository host like x86_64; under QEMU when the host is x86_64
+- On an ARM host, package builds and the signing/database utility containers
+  run natively; only an explicitly requested x86_64 package build is emulated
+- Uses Arch Linux ARM repositories through the same HTTPS mirror for every
+  channel (Arch Linux ARM publishes no dated snapshots to pin a channel's base)
+- Additional repos: `[alarm]`, `[aur]`
+- Same workflow, just add `--arch aarch64`; the scheduled pipeline runs it
+  automatically once `aarch64` is in `PUBLISHED_ARCHES`
+- Packages whose `arch=()` lacks `aarch64` are skipped, not failed
+
+### Building for Both Architectures
+
+```bash
+# Build x86_64
+bin/repo release --package myapp
+
+# Build aarch64
+bin/repo release --arch aarch64 --package myapp
+
+# Sync both
+bin/repo sync
+bin/repo sync --arch aarch64
+```
+
+## Version Management
+
+> Abandoned. Kept as reference for the tooling; don't follow it to publish.
+
+Packages are only rebuilt if:
+- PKGBUILD version differs from the repository version
+- Package doesn't exist in production
+
+A package that has to be rebuilt because something underneath it changed is handled by turning that into a version change: `bin/sync-rebuilds` bumps pkgrel when a dependency named in `rebuild_on` moves.
+
+## Scheduled releases on the host
+
+> Abandoned. Kept as reference for the tooling; don't follow it to publish.
+
+Four systemd units in `systemd/` drive unattended releases from the host.
+
+All four units run **every 5 minutes**, staggered by a minute each, so a push
+reaches the mirror in minutes rather than hours:
+
+1. **check-versions** (`*:0/5`): Pulls latest from git, compares PKGBUILD versions to published versions for every published architecture, creates one state file per channel and architecture if builds are needed
+2. **auto-release-edge** (`*:1/5`): For each published architecture with a state file, builds all edge packages that need updates
+3. **auto-release-rc** (`*:2/5`): Builds fast-ring packages for rc, from the main checkout like the other two — natively in the rc image, not copied from another channel. The pinned release pair is built separately by `omarchy-release rc` in the `rc` branch worktree
+4. **auto-release-stable** (`*:3/5`): If a state file exists, builds `release_ring=fast` packages for stable
+
+That cadence is only safe because of three guards:
+
+- **No overlap.** Every channel-mutating run takes a host-wide lock
+  (`pkgs.omarchy.org/.release.lock`). Scheduled runs take it
+  **non-blocking**: if a build is already going, the tick exits immediately
+  instead of queuing. Waiting would stack one stalled process per tick behind
+  a long build and stampede when it finished. Manual commands still wait, as
+  an operator expects. `check-versions` takes it too — its `git pull` would
+  otherwise swap PKGBUILDs out from under a running build.
+- **Backoff on failure.** A failed release records the attempt in
+  `.build-failed-<channel>-<arch>` and backs off exponentially — 10m, 20m, 40m, up to
+  a 6h ceiling — instead of rebuilding the same broken tree every 5 minutes.
+  **Any new commit clears the backoff immediately**, since a push is the most
+  likely fix. Clear it by hand with
+  `rm /root/.state/.build-failed-<channel>-<arch>`.
+- **Quiet when idle.** With nothing queued a tick exits without output, so the
+  journal shows the runs that mattered rather than 288 no-ops a day.
+
+`bin/repo timers` reports all of this: schedules, last results, what is
+queued, what is failing and when it will retry, and whether the lock is held.
+
+## Build reports
+
+> Abandoned. Kept as reference for the tooling; don't follow it to publish.
+
+Every release run reports to Basecamp Campfire — not just failures, so a push
+can be followed all the way to the mirror without watching the host:
+
+| Event | Message |
+|---|---|
+| 🔨 Started | channel, arch, host, the commit being built, and which packages are queued |
+| ✅ Published | the packages and versions that went out, duration, and the channel URL |
+| 📦 Promoted | what `advance` moved between channels (including the rc bootstrap) |
+| 📦 Nothing to publish | a queued run built nothing — see below |
+| 🔴 Failed | which step failed, the commit, and the last 25 log lines |
+
+Reports are tied to release *runs*, not timer ticks: a tick with nothing
+queued exits silently, so a quiet day is a quiet chat. That is what makes the
+"nothing to publish" report meaningful rather than routine — a release only
+runs when the version check queued work, so building nothing means the check
+and the builder disagree about what is out of date. It names the packages that
+were queued but not built, which is where to start looking.
+
+By default everything posts to `BASECAMP_CHATBOT_URL`, the same chat the
+sync workflows use — one variable, nothing extra to configure.
+
+If release traffic starts drowning that chat, give it its own: create a second
+Basecamp chat, add a chatbot integration to it, and export its lines URL
+alongside the existing one in `/root/.omarchy/build-credentials`:
+
+```bash
+export OMARCHY_RELEASE_CHATBOT_URL="https://3.basecamp.com/<account>/integrations/<key>/buckets/<project>/chats/<chat>/lines"
+```
+
+Release reports then go there while the sync workflows keep posting to
+`BASECAMP_CHATBOT_URL`. With neither set, reports are silently skipped.
+`bin/setup` reports which of the three cases applies.
+
+Check on all of it with `bin/repo timers` — schedule, each unit's last run and
+whether it succeeded, what is queued, whether a release is running right now,
+and any failed units. Like the other host commands it forwards over ssh, so
+the build box's state is one command away from any machine:
+
+```bash
+bin/repo timers           # runs on the repository host when one is configured
+bin/repo timers --local   # inspect this machine instead
+```
+
+State files are stored in `/root/.state/`:
+- `.sync-needed-<channel>-<arch>` — the packages queued for that channel and
+  architecture, one per line; the release run reads them to name what it is
+  building
+- `.build-failed-<channel>-<arch>` — consecutive failure count, timestamp, and
+  the commit it failed on (drives the backoff; removing it forces a retry)
+
+Legacy files without the architecture suffix are consumed once as x86_64
+state, so upgrading the host does not lose an in-flight build.
+
+## Schedule (America/New_York)
+
+> Abandoned. Kept as reference for the tooling; don't follow it to publish.
+
+| Minute of every hour | Action |
+|------|--------|
+| :00, :05, :10, … | check-versions (git pull + creates state files) |
+| :01, :06, :11, … | auto-release-edge |
+| :02, :07, :12, … | auto-release-rc |
+| :03, :08, :13, … | auto-release-stable |
+
+Each release unit is a no-op when its channel has nothing queued, another run
+holds the lock, or the channel is in failure backoff.
+
+## Installation
+
+> Abandoned. Kept as reference for the tooling; don't follow it to publish.
+
+```bash
+ssh root@<host> 'cd /root/omarchy-pkgs && bin/setup --skip-timers'
+```
+
+`bin/setup` installs the dependencies, ensures Docker is running and creates
+the state directory. Without `--skip-timers` it also installs and enables the
+release timers, which must stay off while CI publishes. It works on
+Debian/Ubuntu and on Arch, and is idempotent, so run it again whenever a
+dependency is added.
+
+The host does not need to be Arch: makepkg, repo-add and package signing all
+run inside containers, so it needs only Docker, rclone, bsdtar, jq, git and
+rsync. Docker is left alone when it already works, rather than replacing a
+working installation from Docker's own repository with the distribution's.
+
+```bash
+bin/repo setup --check         # Report what is missing, change nothing
+bin/repo setup --skip-timers   # Prepare the host without the release timers
+```
+
+Signing credentials (`/root/.omarchy/build-credentials`) and the rclone remote
+hold secrets, so setup reports on them rather than creating them.
+
+## Management
+
+> Abandoned. Kept as reference for the tooling; don't follow it to publish.
+
+```bash
+# Everything at a glance: schedules, last runs, queues, backoff, lock
+bin/repo timers                     # forwards to the host when one is configured
+
+# Manual trigger (edge, rc, stable)
+systemctl start omarchy-check-versions.service
+systemctl start omarchy-auto-release-edge.service
+
+# View logs
+journalctl -u omarchy-auto-release-edge.service -n 50
+
+# Clear a channel stuck in failure backoff (a new commit also clears it)
+rm /root/.state/.build-failed-edge-x86_64
+
+# Release lock left behind by a killed run (bin/repo timers shows if it is live)
+rm /root/omarchy-pkgs/pkgs.omarchy.org/.release.lock
+```
+
+With the timers enabled, `check-versions` pulls the main checkout on its
+5-minute tick. With them disabled, nothing does: `bin/repo` pulls before a
+command it forwards, and a command run on the host itself needs a `git pull`
+first. The checkout must be on `master`.

docs/upstream-sources.md

@@ -73,13 +73,21 @@ because its published history counted every commit and the number must never
 go down.
 
 `min_release_age` holds a branch tip until its commit timestamp is old enough.
-A fresh tip leaves the existing pin alone; the watch never walks backward to
+A fresh tip falls back to the newest commit on the branch's first-parent
-an older commit. This uses Git's committer date, not the time a commit was
+history that has cleared the window, so a busy branch still advances; it never
-pushed. `BYPASS_MIN_RELEASE_AGE=1` bypasses the hold.
+selects a commit from a merged side branch. This uses Git's committer date, not
+the time a commit was pushed, measured from when the run cloned the branch so
+packages pinned from it agree. `BYPASS_MIN_RELEASE_AGE=1` bypasses the hold.
 
 Packages marked `"auto_merge": true` ride the unattended lane
-(`track-branches.yml`) instead of the reviewed sync PR: their bump PR is opened
+(`track-branches.yml`), checked hourly instead of every 6 hours. Every lane
-and auto-merged as soon as the build checks pass. `bin/sync-upstream --lane
+opens its PRs through `package-prs.yml` and auto-merges them as soon as the
+build checks pass. Each package gets its own
+PR on `auto/track-branches-<package>`, and packages that pin the same branch
+share one, so a package whose build fails holds back only itself. The lane works with every
+provider, not only branch watches, so it also carries release feeds trusted to
+ship without review: the browsers, large vendors' apps, Omacom's own projects,
+and vendor binaries that hold fresh releases with `min_release_age`. `bin/sync-upstream --lane
 reviewed|auto-merge|all` selects a lane; the scheduled workflows each pass their
 own. Packages that pin the same branch move in lockstep: if one of them fails
 to update, the run restores the others and reports the group as failed. A
@@ -151,7 +159,6 @@ in `origin` and has no effect on release selection.
 | `1password-beta` | debian | [https://downloads.1password.com/linux/debian/amd64/dists/beta/main/binary-amd64/Packages](https://downloads.1password.com/linux/debian/amd64/dists/beta/main/binary-amd64/Packages) |
 | `1password-cli` | json | [https://app-updates.agilebits.com/check/1/0/CLI2/en/0](https://app-updates.agilebits.com/check/1/0/CLI2/en/0) |
 | `aether` | github | [omacom/aether](https://github.com/omacom/aether) |
-| `asusctl` | git_tags | [https://github.com/OpenGamingCollective/asusctl.git](https://github.com/OpenGamingCollective/asusctl.git) |
 | `basecamp-cli` | github | [basecamp/basecamp-cli](https://github.com/basecamp/basecamp-cli) |
 | `bun-bin` | github | [oven-sh/bun](https://github.com/oven-sh/bun) |
 | `claude-code` | regex | [https://downloads.claude.ai/claude-code-releases/latest](https://downloads.claude.ai/claude-code-releases/latest) |
@@ -162,21 +169,6 @@ in `origin` and has no effect on release selection.
 | `dbxcli-bin` | github | [dropbox/dbxcli](https://github.com/dropbox/dbxcli) |
 | `dropbox` | redirect | [https://www.dropbox.com/download?plat=lnx.x86_64](https://www.dropbox.com/download?plat=lnx.x86_64) |
 | `dropbox-cli` | regex | [https://linux.dropbox.com/packages/](https://linux.dropbox.com/packages/) |
-| `elephant` | github | [abenz1267/elephant](https://github.com/abenz1267/elephant) |
-| `elephant-all` | github | [abenz1267/elephant](https://github.com/abenz1267/elephant) |
-| `elephant-archlinuxpkgs` | github | [abenz1267/elephant](https://github.com/abenz1267/elephant) |
-| `elephant-bluetooth` | github | [abenz1267/elephant](https://github.com/abenz1267/elephant) |
-| `elephant-calc` | github | [abenz1267/elephant](https://github.com/abenz1267/elephant) |
-| `elephant-clipboard` | github | [abenz1267/elephant](https://github.com/abenz1267/elephant) |
-| `elephant-desktopapplications` | github | [abenz1267/elephant](https://github.com/abenz1267/elephant) |
-| `elephant-files` | github | [abenz1267/elephant](https://github.com/abenz1267/elephant) |
-| `elephant-menus` | github | [abenz1267/elephant](https://github.com/abenz1267/elephant) |
-| `elephant-providerlist` | github | [abenz1267/elephant](https://github.com/abenz1267/elephant) |
-| `elephant-runner` | github | [abenz1267/elephant](https://github.com/abenz1267/elephant) |
-| `elephant-symbols` | github | [abenz1267/elephant](https://github.com/abenz1267/elephant) |
-| `elephant-todo` | github | [abenz1267/elephant](https://github.com/abenz1267/elephant) |
-| `elephant-unicode` | github | [abenz1267/elephant](https://github.com/abenz1267/elephant) |
-| `elephant-websearch` | github | [abenz1267/elephant](https://github.com/abenz1267/elephant) |
 | `heroic-games-launcher-bin` | github | [Heroic-Games-Launcher/HeroicGamesLauncher](https://github.com/Heroic-Games-Launcher/HeroicGamesLauncher) |
 | `hyprshade` | pypi | [hyprshade](https://pypi.org/project/hyprshade/) |
 | `lib32-nvidia-580xx-utils` | regex | [https://download.nvidia.com/XFree86/Linux-x86_64/](https://download.nvidia.com/XFree86/Linux-x86_64/) |
@@ -213,7 +205,6 @@ in `origin` and has no effect on release selection.
 | `vi` | regex | [https://sources.archlinux.org/other/vi/](https://sources.archlinux.org/other/vi/) |
 | `visual-studio-code-bin` | json | [https://update.code.visualstudio.com/api/update/linux-deb-x64/stable/latest](https://update.code.visualstudio.com/api/update/linux-deb-x64/stable/latest) |
 | `walker` | github | [abenz1267/walker](https://github.com/abenz1267/walker) |
-| `xdg-terminal-exec` | git_tags | [https://gitlab.freedesktop.org/Vladimir-csp/xdg-terminal-exec.git](https://gitlab.freedesktop.org/Vladimir-csp/xdg-terminal-exec.git) |
 | `xpadneo-dkms` | github | [atar-axis/xpadneo](https://github.com/atar-axis/xpadneo) |
 | `yaru-icon-theme` | git_tags | [https://github.com/ubuntu/yaru.git](https://github.com/ubuntu/yaru.git) |
 | `yay` | github | [Jguer/yay](https://github.com/Jguer/yay) |
@@ -221,12 +212,10 @@ in `origin` and has no effect on release selection.
 
 ## Existing manual holds
 
-`grok-bot`, `libfprint-git`, `libretro-cap32-git`, `libretro-database-git`, `libretro-fbneo-git`, `libretro-uae-git`, `libretro-vice-git`, `quickshell-git`, `supergfxctl`.
+`libfprint-git`, `libretro-cap32-git`, `libretro-database-git`, `libretro-fbneo-git`, `libretro-uae-git`, `libretro-vice-git`, `quickshell-git`, `supergfxctl`.
 
 These packages were already excluded from automatic AUR updates. The migration preserves that policy.
 
-`linux-firmware-cirrus` is a deliberate hold: a self-retiring shim that ships Arch's linux-firmware-cirrus 20260910-2 payload to stable while stable's Arch snapshot is on 20260810-2 (Dell XPS 13 DX13260 / 1028:0e54 speaker firmware). It is versioned 20260810-3 so the genuine Arch package supersedes it as soon as the snapshot advances; bumping it to the Arch version would defeat that. Delete the recipe once stable's snapshot carries linux-firmware >= 20260910.
-
 `m1n1-aurora` and `uboot-asahi` are deliberate holds: Apple Silicon boot code, pinned by hand like `linux-aurora`, and bumped only after a cold boot on the qualification Macs. `m1n1-aurora` pins an aurora-silicon/m1n1 commit plus a local patch. `uboot-asahi` follows asahi-alarm's recipe and patch set (asahi-alarm/PKGBUILDs), which a tag watch on AsahiLinux/u-boot cannot carry.
 
 `cua-driver-bin` is a deliberate hold: Omarchy bumps it by hand, so a Cua release ships only when a maintainer has verified it. It keeps its `.omarchy/upstream.sh` hook and `min_release_age`, so lifting the hold means removing `"sync": false`. `cua-hyprland-plugin` declares no upstream source, so no automation updates it either.
@@ -239,3 +228,183 @@ These packages were already excluded from automatic AUR updates. The migration p
 - RustDesk reads hbb_common from the release gitlink; its existing build-time dependency/toolchain checks remain in force.
 - Spotify uses HTTPS and retains its signed Release/Packages verification.
 - Source and build compatibility still need review when upstream code changes. Direct watches remove AUR recipe churn, not the need to maintain packaging.
+
+## How the sync PRs build
+
+`sync-upstream.yml`, `sync-rebuilds.yml` and `track-branches.yml` each run their
+sync once, split the changed recipes into one PR per package with
+`.github/scripts/package-pr-groups.sh`, and hand them to `package-prs.yml`. That
+pushes each PR with the PAT in `PKGS_BOT_TOKEN`, so its builds start without an
+approval hold, and arms auto-merge. A push to an `auto/sync-*` or
+`auto/track-branches-*` branch does not cancel the PR's build in flight: the new
+build waits, then reuses every artifact the finished one uploaded.
+
+A red PR stays open for a maintainer and holds back only its own package. A
+later run updates it if upstream moves again, and closes it once it conflicts
+with `master`. A run started by hand with `packages` updates the same
+per-package PRs a scheduled run would.
+
+## Declarative providers and hooks
+
+The older provider form, still in use beside `upstream.watch`. Give a new
+package an `upstream.watch`; `helpers/upstream-watch.py check` validates that
+form only.
+
+```bash
+bin/sync-upstream                       # Update every package with an upstream hook
+bin/sync-upstream openai-codex-desktop  # Update specific packages
+```
+
+A package declares where its releases come from either as data or, for an
+unusual feed, a small hook.
+
+A vendor shipping tagged GitHub releases is pure data, declared as `upstream`
+in `.omarchy/package.json` with no code at all:
+
+```json
+"upstream": {
+  "github": "jdx/mise",
+  "checksums": "SHASUMS256.txt",
+  "assets": {
+    "x86_64": "mise-{tag}-linux-x64.tar.xz",
+    "aarch64": "mise-{tag}-linux-arm64.tar.xz"
+  }
+}
+```
+
+`checksums` names the manifest asset the vendor publishes. A vendor publishing
+none sets `"digests": true` instead, and the checksums come from the SHA-256
+digest GitHub's release API reports for every asset — see
+`pkgbuilds/schist-bin/.omarchy/package.json`. Either way the artifacts
+themselves are never downloaded.
+
+An architecture may map to an ordered array when its PKGBUILD downloads more
+than one release asset. Small versioned files outside the release assets can be
+listed under `sources` and are downloaded and hashed when a new version appears:
+
+```json
+"upstream": {
+  "github": "owner/project",
+  "digests": true,
+  "assets": {
+    "x86_64": ["tool-{pkgver}-x86_64", "tool-{pkgver}-x86_64.asc"],
+    "aarch64": ["tool-{pkgver}-aarch64", "tool-{pkgver}-aarch64.asc"]
+  },
+  "sources": {
+    "any": ["https://raw.githubusercontent.com/owner/project/{tag}/LICENSE"]
+  }
+}
+```
+
+Asset and source keys must be disjoint because each key maps to one PKGBUILD
+checksum array (`any` means the unsuffixed `sha256sums`).
+
+Repositories whose historical releases use incompatible tag schemes may set
+`"latest_only": true`. The provider then considers only the newest stable
+GitHub release, while retaining all validation for that release. A quarantine
+will wait for that release to age instead of falling back to an older one.
+
+`{tag}` and `{pkgver}` interpolate into asset names; a leading `v` on the tag is
+stripped for `pkgver`; drafts and prereleases are ignored. Only the 100 most
+recent releases are considered. The provider fails closed on anything it cannot
+read — an unusable tag, timestamp, or checksum stops the sync rather than being
+skipped.
+
+Projects that publish version tags but no checksum manifest can declare the
+tag repository, the exact tag shape, and every source that should be hashed:
+
+```json
+"upstream": {
+  "git_tags": "https://github.com/owner/project.git",
+  "tag_pattern": "v{pkgver}",
+  "sources": {
+    "any": ["https://github.com/owner/project/archive/refs/tags/{tag}.tar.gz"]
+  }
+}
+```
+
+The newest matching tag is selected with pacman's `vercmp`; unrelated tags are
+ignored. `tag_pattern` must contain exactly one `{pkgver}`. Source templates may
+use `{tag}` and `{pkgver}`. Each expanded URL must be HTTPS and is downloaded
+only when the discovered version is newer. A checked-in patch or other local
+source can be included as `file:patch-name.patch`; it is hashed from the package
+directory. Keys such as `any`, `x86_64`, and `aarch64` select the corresponding
+`sha256sums` array.
+
+npm packages use the same source mapping, with `{npm_tarball}` available for
+the tarball named by the selected dist-tag:
+
+```json
+"upstream": {
+  "npm": "@scope/package",
+  "dist_tag": "latest",
+  "sources": {
+    "any": ["{npm_tarball}", "https://example.com/v{pkgver}/CHANGELOG.md"]
+  }
+}
+```
+
+`dist_tag` defaults to `latest`. The registry's publication timestamp is
+carried into the provider result, so `min_release_age` works for npm packages.
+
+A vendor with a plain-text Debian `Packages` index can use it to discover the
+newest exact package version, then hash immutable source URLs:
+
+```json
+"upstream": {
+  "debian": "https://example.com/debian/dists/stable/main/binary-amd64/Packages",
+  "package": "example-app",
+  "sources": {
+    "x86_64": ["https://example.com/tool-{pkgver}-x64.tar.gz"],
+    "aarch64": ["https://example.com/tool-{pkgver}-arm64.tar.gz"]
+  }
+}
+```
+
+This deliberately accepts only Debian versions that are already valid Arch
+`pkgver` values. Feeds needing epoch, revision, or filename translation retain
+a hook. Exactly one of `github`, `git_tags`, `npm`, or `debian` may appear in a
+declaration.
+
+A timestamped provider may also declare `"min_release_age": "24h"`
+(`s`/`m`/`h`/`d` suffix or bare seconds) to quarantine fresh releases until
+maintainers have had time to pull a bad or compromised one. GitHub Releases and
+npm provide publication times; raw git tags and Debian Packages indexes do not,
+so combining either with this policy fails closed. The newest release that has
+cleared the window ships, so a fast release cadence cannot starve updates. The
+window is enforced
+centrally: whatever reports the release must prove its age via `published_at`,
+or the sync fails. A maintainer deliberately shipping inside the window runs
+`BYPASS_MIN_RELEASE_AGE=1 bin/sync-upstream <package>` locally and merges the
+result through a normal PR; scheduled automation never sets the bypass.
+
+A vendor whose feed fits no convention (a Debian package index, a bare
+version.txt) instead provides `.omarchy/upstream.sh`, a hook that reports the
+newest upstream release as JSON on stdout — declaring both an `upstream` block
+and a hook is an error:
+
+```json
+{
+  "pkgver": "1.2.3",
+  "sha256sums": { "x86_64": ["<sha256>"], "aarch64": ["<sha256>"] }
+}
+```
+
+Architecture keys become `sha256sums_<arch>` in the PKGBUILD; the key `any` means
+the unsuffixed `sha256sums` array, and only the arrays a hook names are touched.
+An empty object (`{}`) reports no update, which is how a hook waits out a release
+that has landed for one architecture but not yet the other.
+
+When the reported version is newer than the checked-in one, `bin/sync-upstream`
+rewrites `pkgver` and those checksum arrays and resets `pkgrel` to 1. A version
+that is equal or older leaves the package alone, so a vendor rolling a release
+back cannot walk the repository backwards.
+
+Hooks should read checksums from whatever manifest the vendor publishes rather
+than downloading the artifacts — see `pkgbuilds/openai-codex-desktop/.omarchy/upstream.sh`,
+which reads OpenAI's Debian package index and never fetches the 750 MB of debs
+it describes. Hooks honoring `min_release_age` receive the window as
+`MIN_RELEASE_AGE_SECONDS` and report `published_at` alongside `pkgver`.
+
+`bin/sync-upstream self-test` runs offline fixture tests over the release
+selection, quarantine backstop, duration parsing, and manifest validation.

helpers/package-metadata.sh

@@ -333,7 +333,8 @@ packages_for_upstream_sync() {
 # "auto_merge": true rides the unattended lane instead: its bump PR is opened
 # and auto-merged by the branch tracker as soon as CI is green, which is how a
 # package that follows a moving branch (omarchy-dev, omasnap-git) gets rebuilt
-# without anyone clicking. The lanes are disjoint so a branch tip can never
+# without anyone clicking, and how trusted release feeds (browsers, large
+# vendors, Omacom's own projects) ship without waiting for review. The lanes are disjoint so a branch tip can never
 # hold up a reviewed vendor release, or the other way round.
 package_auto_merge() {
   local pkgdir="$1" metadata

helpers/upstream-watch.py

@@ -186,9 +186,9 @@ def matches(watch, text, extra=None, full=False):
             yield candidate(watch, {**(extra or {}), **match.groupdict()})
 
 
-def git_branch_tip(url, branch, tag_pattern, cache):
+def git_branch_tip(url, branch, tag_pattern, cache, min_age=0):
-    """Describe the current tip of an upstream branch:
+    """Describe the newest commit on an upstream branch that has cleared
-    commit, total count, date, and with a tag_pattern
+    min_age: commit, total count, date, and with a tag_pattern
     the newest release tag reachable from it plus the distance from that tag,
     so a branch build can be versioned <tag>.r<n>.g<sha>, above the release it
     follows and below the next one, the way a pkgver() function would.
@@ -196,20 +196,33 @@ def git_branch_tip(url, branch, tag_pattern, cache):
     One blobless single-branch clone per (url, branch) per run, shared by
     every package that tracks it, so two recipes pinned from one clone always
     see the same commit. The clone is read with git only; nothing in it runs.
-    select_release applies the age hold to this tip, without walking back
+    A tip younger than min_age falls back along first-parent history, the
-    into history (which could select a commit from a merged side branch).
+    commits that were themselves the branch tip, never into a merged side
+    branch. Holding the whole branch instead stalled a busy branch for as
+    long as it kept getting commits. Age is measured from when the clone was
+    made, so siblings synced seconds apart cannot straddle the window.
     """
     https(url)
     key = hashlib.sha256(f"{url}#{branch}".encode()).hexdigest()
     work = Path(cache) / f"{key}.branch.git"
+    cloned_at = work.with_name(f"{key}.branch.time")
     if not work.exists():
         scratch = work.with_name(f"{work.name}.{os.getpid()}.tmp")
+        started = dt.datetime.now(dt.timezone.utc).isoformat()
         subprocess.run(["git", "clone", "--quiet", "--bare", "--filter=blob:none", "--single-branch", "--branch", branch, url, str(scratch)], check=True)
+        cloned_at.write_text(started)
         scratch.replace(work)
     git = ["git", "-C", str(work)]
     commit = run([*git, "rev-parse", "HEAD"], text=True).strip()
     if not re.fullmatch(r"[0-9a-f]{40}", commit):
         raise ValueError("branch tip is not a commit")
+    if min_age:
+        now = dt.datetime.fromisoformat(cloned_at.read_text().strip())
+        for line in run([*git, "log", "--first-parent", "--format=%H %cI", commit], text=True).splitlines():
+            sha, committed = line.split()
+            if (now - dt.datetime.fromisoformat(committed)).total_seconds() >= min_age:
+                commit = sha
+                break
     count = run([*git, "rev-list", "--count", commit], text=True).strip()
     date = run([*git, "show", "-s", "--format=%cs", commit], text=True).strip().replace("-", "")
     timestamp = run([*git, "show", "-s", "--format=%cI", commit], text=True).strip()
@@ -233,7 +246,7 @@ def git_branch_tip(url, branch, tag_pattern, cache):
     return values
 
 
-def discover(watch, fetch):
+def discover(watch, fetch, min_age=0):
     provider = validate(watch)
     feed = watch[provider]
     results = []
@@ -260,7 +273,7 @@ def discover(watch, fetch):
         for tag, commit in tags.items():
             results.extend(matches(watch, tag, {"tag": tag, "commit": commit}, full=True))
     elif provider == "git_branch":
-        tip = git_branch_tip(feed, watch["branch"], watch.get("tag_pattern"), fetch.cache)
+        tip = git_branch_tip(feed, watch["branch"], watch.get("tag_pattern"), fetch.cache, min_age)
         results.append(candidate(watch, tip))
     elif provider == "npm":
         data = fetch.json("https://registry.npmjs.org/" + quote(feed, safe=""))
@@ -544,7 +557,7 @@ def sync(package, fetch, min_age=0, check=False):
     original = path.read_text()
     before = read_recipe(path)
     bypass = os.environ.get("BYPASS_MIN_RELEASE_AGE") == "1"
-    release = select_release(discover(watch, fetch), min_age, bypass=bypass)
+    release = select_release(discover(watch, fetch, 0 if bypass else min_age), min_age, bypass=bypass)
     if release is None:
         return {"status": "skipped", "reason": "minimum release age"}
     current = scalar(before, "pkgver")

pkgbuilds/1password-beta/PKGBUILD

@@ -1,6 +1,6 @@
 pkgname=1password-beta
 
-_tarver=8.12.40-27.BETA
+_tarver=8.12.42-32.BETA
 case "${CARCH}" in
     x86_64)
         _archdir="x64"
@@ -9,7 +9,7 @@ case "${CARCH}" in
         _archdir="arm64"
         ;;
 esac
-pkgver=8.12.40_27.BETA
+pkgver=8.12.42_32.BETA
 pkgrel=1
 conflicts=('1password' '1password-beta-bin')
 pkgdesc="Password manager and secure wallet"
@@ -22,8 +22,8 @@ source=()
 sha256sums=()
 source_x86_64=(https://downloads.1password.com/linux/tar/beta/x86_64/1password-${_tarver}.x64.tar.gz{,.sig})
 source_aarch64=(https://downloads.1password.com/linux/tar/beta/aarch64/1password-${_tarver}.arm64.tar.gz{,.sig})
-sha256sums_x86_64=('1327d102255b5c347e6c5e19b1a6581986446e06848015b93b5d7b10b9bc3f52' '2a19fba2b81ade500d9707a20829930d4fca972254fdc653ffa27cee57638098')
+sha256sums_x86_64=('55fe8dbc80e65337e657c926948dff356b09c3d0860f3b381f1df5af2b99741a' '62494cae0f90d553cade1eeda82cec4d5b26e4719f2233085ce47a70cc80da63')
-sha256sums_aarch64=('54b14cae2a676480f3f2df7b85e42bf389d1f84207b0a4ad1e32382071625146' '3a55dc9cdee5729e4bdf6830e04d9813c11546b328003800a837df83f79e33f9')
+sha256sums_aarch64=('53a63a857e9219da410839915216c4f9cc017cb17bbff9095caf01365e28c5d8' 'd910aedf72c4ff31745b0bbfc12d03c03b177df85f73a381a35227439320ad5c')
 validpgpkeys=('3FEF9748469ADBE15DA7CA80AC2D62742012EA22')
 
 package() {

pkgbuilds/1password-cli/.omarchy/package.json

@@ -1,5 +1,6 @@
 {
   "source": "local",
+  "auto_merge": true,
   "release_ring": "fast",
   "upstream": {
     "watch": {

pkgbuilds/1password-cli/PKGBUILD

@@ -3,7 +3,7 @@
 
 pkgname=1password-cli
 pkgver=2.40.0
-pkgrel=1
+pkgrel=2
 pkgdesc="1Password command line tool"
 arch=('x86_64' 'i686' 'arm' 'armv6h' 'aarch64')
 url="https://app-updates.agilebits.com/product_history/CLI2"

pkgbuilds/1password/.omarchy/package.json

@@ -1,5 +1,6 @@
 {
   "source": "local",
+  "auto_merge": true,
   "release_ring": "fast",
   "upstream": {
     "debian": "https://downloads.1password.com/linux/debian/amd64/dists/stable/main/binary-amd64/Packages",

pkgbuilds/1password/PKGBUILD

@@ -1,6 +1,6 @@
 pkgname=1password
 pkgver=8.12.40
-pkgrel=1
+pkgrel=2
 conflicts=('1password-beta' '1password-beta-bin')
 pkgdesc="Password manager and secure wallet"
 arch=('x86_64' 'aarch64')

pkgbuilds/aether/.omarchy/package.json

@@ -1,5 +1,6 @@
 {
   "source": "local",
+  "auto_merge": true,
   "release_ring": "fast",
   "upstream": {
     "watch": {

pkgbuilds/aether/PKGBUILD

@@ -1,7 +1,7 @@
 # Maintainer: Bjarne Øverli <bjarne@oever.li>
 pkgname=aether
 pkgver=4.32.0
-pkgrel=1
+pkgrel=2
 pkgdesc='Desktop theming application - extract colors from wallpapers and apply cohesive themes'
 arch=('x86_64' 'aarch64')
 url='https://github.com/omacom/aether'

pkgbuilds/asusctl/.nvchecker.toml

@@ -1,3 +0,0 @@
-[asusctl]
-source = "git"
-git = "https://github.com/OpenGamingCollective/asusctl.git"

pkgbuilds/asusctl/.omarchy/package.json

@@ -1,13 +0,0 @@
-{
-  "source": "local",
-  "upstream": {
-    "watch": {
-      "git_tags": "https://github.com/OpenGamingCollective/asusctl.git",
-      "pattern": "(?P<version>[0-9]+(?:\\.[0-9]+)*)"
-    }
-  },
-  "origin": {
-    "aur": "asusctl",
-    "commit": "b0ec6ca495eb331a684db91b0fe12085a868b632"
-  }
-}

pkgbuilds/asusctl/LICENSE

@@ -1,12 +0,0 @@
-Copyright Arch Linux Contributors
-
-Permission to use, copy, modify, and/or distribute this software for
-any purpose with or without fee is hereby granted.
-
-THE SOFTWARE IS PROVIDED “AS IS” AND THE AUTHOR DISCLAIMS ALL
-WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
-OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE
-FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY
-DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
-AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
-OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

pkgbuilds/asusctl/LICENSES/0BSD.txt

@@ -1 +0,0 @@
-../LICENSE

pkgbuilds/asusctl/PKGBUILD

@@ -1,59 +0,0 @@
-# Maintainer: Mahdi Sarikhani <mahdisarikhani@outlook.com>
-# Contributor: Fabian Bornschein <fabiscafe@archlinux.org>
-# Contributor: Static_Rocket
-
-pkgbase=asusctl
-pkgname=(asusctl rog-control-center)
-pkgver=6.5.0
-pkgrel=1
-pkgdesc="Daemon and tools to control your ASUS ROG laptop"
-arch=('x86_64')
-url="https://asus-linux.org"
-license=('MPL-2.0')
-makedepends=('cargo' 'fontconfig')
-source=("${pkgbase}-${pkgver}.tar.gz::https://github.com/OpenGamingCollective/asusctl/archive/${pkgver}.tar.gz")
-b2sums=('4179e08a60f9480b62e41d84faade1f46407140a213ca4d60c8699837a2486bda8e66b4ca43fa06149667d02e3d060c3efd792348f9a93a675f762d6ea2d05f8')
-
-prepare() {
-    cd "${pkgbase}-${pkgver}"
-    export RUSTUP_TOOLCHAIN=stable
-    cargo fetch --locked --target host-tuple
-}
-
-build() {
-    cd "${pkgbase}-${pkgver}"
-    export RUSTUP_TOOLCHAIN=stable
-    export CARGO_TARGET_DIR=target
-    make build
-}
-
-package_asusctl() {
-    pkgdesc="An utility for Linux to control many aspects of various ASUS laptops"
-    depends=('glibc' 'libgcc' 'libusb' 'systemd-libs')
-    optdepends=(
-        'acpi_call: fan control'
-        'asusctltray: tray profile switcher'
-        'rog-control-center: graphical user interface for asusctl'
-        'supergfxctl: hybrid GPU control'
-    )
-    install=asusctl.install
-
-    cd "${pkgbase}-${pkgver}"
-    make DESTDIR="${pkgdir}" \
-        install-asusctl \
-        install-asusd \
-        install-asusd_user \
-        install-asus-shutdown \
-        install-data-asusd \
-        install-data-asusd_user
-}
-
-package_rog-control-center() {
-    pkgdesc="Graphical user interface for asusctl"
-    depends=('asusctl' 'fontconfig' 'glibc' 'hicolor-icon-theme' 'libgcc' 'systemd-libs')
-
-    cd "${pkgbase}-${pkgver}"
-    make DESTDIR="${pkgdir}" \
-        install-rog_gui \
-        install-data-rog_gui
-}

pkgbuilds/asusctl/REUSE.toml

@@ -1,22 +0,0 @@
-version = 1
-
-[[annotations]]
-path = [
-    "PKGBUILD",
-    "README.md",
-    "keys/**",
-    ".SRCINFO",
-    ".nvchecker.toml",
-    "*.install",
-    "*.sysusers",
-    "*.tmpfiles",
-    "*.logrotate",
-    "*.pam",
-    "*.service",
-    "*.socket",
-    "*.timer",
-    "*.desktop",
-    "*.hook",
-]
-SPDX-FileCopyrightText = "Arch Linux contributors"
-SPDX-License-Identifier = "0BSD"

pkgbuilds/asusctl/asusctl.install

@@ -1,18 +0,0 @@
-post_install() {
-    printf ":: asusd provides a service that is activated by an udev rule on\n"
-    printf ":: startup. Please reboot the system or run\n"
-    printf ":: # systemctl start asusd.service\n"
-    printf ":: to make it work.\n"
-    printf ":: See https://github.com/OpenGamingCollective/asusctl#kernel-requirements\n"
-    printf ":: for latest required kernel patches/versions\n"
-}
-
-post_upgrade() {
-    if systemctl is-active asusd.service --quiet; then
-        printf ":: asusd service will be restarted…\n"
-        systemctl daemon-reload
-        systemctl restart asusd.service
-    fi
-    printf ":: See https://github.com/OpenGamingCollective/asusctl#kernel-requirements\n"
-    printf ":: for latest required kernel patches/versions\n"
-}

pkgbuilds/basecamp-cli/.omarchy/package.json

@@ -1,5 +1,6 @@
 {
   "source": "local",
+  "auto_merge": true,
   "release_ring": "fast",
   "upstream": {
     "watch": {

pkgbuilds/basecamp-cli/PKGBUILD

@@ -1,6 +1,6 @@
 # Maintainer: Basecamp <support@basecamp.com>
 pkgname=basecamp-cli
-pkgver=0.12.0
+pkgver=0.13.0
 pkgrel=1
 pkgdesc="CLI for Basecamp project management"
 arch=('x86_64' 'aarch64')
@@ -15,8 +15,8 @@ optdepends=(
 )
 source_x86_64=("https://github.com/basecamp/basecamp-cli/releases/download/v${pkgver}/basecamp_${pkgver}_linux_amd64.tar.gz")
 source_aarch64=("https://github.com/basecamp/basecamp-cli/releases/download/v${pkgver}/basecamp_${pkgver}_linux_arm64.tar.gz")
-sha256sums_x86_64=('25d61c38de5660e97855661a2bf7329264912fcd46e2b3fb893fbc70bb467b5c')
+sha256sums_x86_64=('8b33a93018c165f82ac7050d83cad8cde509f9cb7cfbccbc48fb9d98c0649931')
-sha256sums_aarch64=('1f692d2a8cc733ef95232eeb107414e32f1dd3228a0dde6c9039538661e0f2ca')
+sha256sums_aarch64=('bef69d622d66685899b4f955b255951bb588cf1aac54f990b6bd818ae551104c')
 
 package() {
   install -Dm755 "basecamp" "${pkgdir}/usr/bin/basecamp"

pkgbuilds/brave-bin/.omarchy/package.json

@@ -1,5 +1,6 @@
 {
   "source": "local",
+  "auto_merge": true,
   "release_ring": "fast",
   "upstream": {
     "watch": {

pkgbuilds/brave-bin/PKGBUILD

@@ -10,7 +10,7 @@
 # Contributor: Giusy Digital <kurmikon at libero dot it>
 
 pkgname=brave-bin
-pkgver=1.96.61
+pkgver=1.97.56
 pkgrel=1
 epoch=1
 pkgdesc='Web browser that blocks ads and trackers by default (binary release)'
@@ -35,8 +35,8 @@ source_aarch64=(${pkgname}-${pkgver}-aarch64.zip::https://github.com/brave/brave
 noextract=(${pkgname}-${pkgver}-x86_64.zip ${pkgname}-${pkgver}-aarch64.zip)
 sha256sums=('75a87dd17b42fcc6f27adfd16c82bed1c08e9251b07d2012f8d49f7412fa1d00'
             'c07276b69c7304981525ecb022f92daf7ae125a4fb05ac3442157b50826e257a')
-sha256sums_x86_64=('c68cf179603470e8001a949294fe98b593f0749ca95f42687d855081b1c394a4')
+sha256sums_x86_64=('8acac76eae35942e30cc63e05adc772f632ad87be8a5ffb3d8a6e280380584ec')
-sha256sums_aarch64=('33a1513379505642e4df0dda36a1dd78f735ee351631cffd4a4ac90b1cec0cd5')
+sha256sums_aarch64=('f18823bfe8bf626a7412a2cc142ba851f991665ca31af8d750f80dbb8371f984')
 
 prepare() {
 	mkdir -p brave

pkgbuilds/brave-origin-bin/.omarchy/package.json

@@ -1,5 +1,6 @@
 {
   "source": "local",
+  "auto_merge": true,
   "release_ring": "fast",
   "upstream": {
     "watch": {

pkgbuilds/brave-origin-bin/PKGBUILD

@@ -1,7 +1,7 @@
 # Maintainer: brave <aur-release@brave.com>
 
 pkgname=brave-origin-bin
-pkgver=1.96.61
+pkgver=1.97.56
 pkgrel=1
 epoch=1
 pkgdesc='The minimalist browser from the makers of Brave (binary release).'
@@ -22,8 +22,8 @@ source_aarch64=("${pkgname}-${pkgver}-aarch64.zip::https://github.com/brave/brav
 noextract=("${pkgname}-${pkgver}-x86_64.zip" "${pkgname}-${pkgver}-aarch64.zip")
 sha256sums=('5ff70ee473f35c2fc7642c422c8abe20aaac0d7cc30a3292744eb9fbeafba1bd'
             'c70bc71c696b6764247070375ae111bd76c8bad9c7bda4d46e03975b95571a8a')
-sha256sums_x86_64=('06e4c48b71c65a33bdb94b6909aab505237b5939adf8985b332cb14557792816')
+sha256sums_x86_64=('4710187525d4153d47c1d0366a69829f351b445f568ed091bf62215de25ddf34')
-sha256sums_aarch64=('df07224b25284b67b5c7d0e8859d16f3d2533abcf588c81437df59e9fd4f4c62')
+sha256sums_aarch64=('66789d7cd7d423f761d713edc9959ebff86b1493b1718c15346f627b02f6ef74')
 
 prepare() {
 	mkdir -p brave

pkgbuilds/bun-bin/.omarchy/package.json

@@ -1,5 +1,6 @@
 {
   "source": "local",
+  "auto_merge": true,
   "release_ring": "fast",
   "upstream": {
     "watch": {

pkgbuilds/bun-bin/PKGBUILD

@@ -3,7 +3,7 @@
 # Contributor: 37h4n (aarch64 support added by Ethan Reece <aur at ethanreece dot com>)
 # Contributor: sh!zeeg (shizeeque@gmail.com) support for non-avx2 CPUs, shell completions.
 pkgname=bun-bin
-pkgver=1.4.2
+pkgver=1.4.3
 pkgrel=1
 pkgdesc="All-in-one JavaScript runtime built for speed, with bundler, transpiler, test runner, and package manager. Includes bunx, shell completions and support for baseline CPUs"
 arch=('x86_64' 'aarch64')
@@ -12,8 +12,8 @@ license=('MIT')
 provides=('bun')
 conflicts=('bun')
 options=('!debug')
-sha256sums_x86_64=('36368faef7527875d5ffa52e53cd48021741f2a83eb6208a8dd64068d422a913' 'c678040f14fe0440eb839d37cbd0ce4c051a32da72806ac97de6a6aab6bf728f' '9b296bcc20090b5ea079dc1bca15913a32246121169bcf54cbdb7384d6f5b32b')
+sha256sums_x86_64=('3e730528d89775f03f87f05c06787c4df4099d0a37f3f252e7b829cb23816e18' '1fc2edac843102909e3a1be1d8d9802cc6071cf074e67e88231f4ffe0f8b397b' '9b296bcc20090b5ea079dc1bca15913a32246121169bcf54cbdb7384d6f5b32b')
-sha256sums_aarch64=('54328bbc2d9c8e0c9f892c544d66c57a83b84139e34909e5ee81758f1ac8fda7' '9b296bcc20090b5ea079dc1bca15913a32246121169bcf54cbdb7384d6f5b32b')
+sha256sums_aarch64=('efa9813da5ed72423bf847f916e8d2c47c0d776add972354026a75e10da9aa21' '9b296bcc20090b5ea079dc1bca15913a32246121169bcf54cbdb7384d6f5b32b')
 source_x86_64=(
 "bun-x64.zip::https://github.com/oven-sh/bun/releases/download/bun-v${pkgver}/bun-linux-x64.zip"
 "bun-x64-baseline.zip::https://github.com/oven-sh/bun/releases/download/bun-v${pkgver}/bun-linux-x64-baseline.zip"

pkgbuilds/buzz/.omarchy/package.json

@@ -0,0 +1,10 @@
+{
+  "source": "local",
+  "release_ring": "fast",
+  "upstream": {
+    "watch": {
+      "github": "block/buzz",
+      "pattern": "desktop-v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
+    }
+  }
+}

pkgbuilds/buzz/PKGBUILD

@@ -0,0 +1,92 @@
+pkgname=buzz
+pkgver=0.5.28
+pkgrel=1
+pkgdesc='Workspace where humans and AI agents build together, on a Nostr relay you own'
+arch=('x86_64' 'aarch64')
+url='https://github.com/block/buzz'
+license=('Apache-2.0')
+
+depends=(
+  'alsa-lib'
+  'cairo'
+  'gcc-libs'
+  'gdk-pixbuf2'
+  'glib2'
+  'glibc'
+  'gst-plugins-good'
+  'gtk3'
+  'hicolor-icon-theme'
+  'libayatana-appindicator'
+  'libsoup3'
+  'opus'
+  'webkit2gtk-4.1'
+)
+makedepends=('cargo' 'cmake' 'nodejs' 'pnpm' 'pkgconf')
+conflicts=('buzz-appimage' 'buzz-bin' 'buzz-desktop-git')
+# Arch's GCC LTO objects cannot be consumed when crates compile bundled C
+# libraries (secp256k1-sys among them).
+options=('!lto')
+
+_srcdir="$pkgname-desktop-v$pkgver"
+source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/desktop-v$pkgver.tar.gz"
+        'buzz.desktop')
+sha256sums=('4ba8c250d6ebb075ba60e6c4d217b77ea605b183161715b77629bd8660b81a43'
+            '3c152420e67c64f5046cc0e10a9d948e1c7d3efa512582ad279f073b0900526a')
+
+# The sidecars the desktop app spawns from its own directory, from upstream's
+# scripts/bundle-sidecars.sh.
+_sidecars=(buzz-acp buzz-agent buzz-backend-kubernetes buzz-dev-mcp git-credential-nostr buzz)
+
+prepare() {
+  cd "$_srcdir"
+
+  export npm_config_store_dir="$srcdir/pnpm-store"
+  pnpm install --frozen-lockfile
+
+  # The sidecars build in the root workspace; the app has its own lockfile.
+  cargo fetch --locked --target "$CARCH-unknown-linux-gnu"
+  cargo fetch --locked --target "$CARCH-unknown-linux-gnu" \
+    --manifest-path desktop/src-tauri/Cargo.toml
+}
+
+build() {
+  cd "$_srcdir"
+
+  export npm_config_store_dir="$srcdir/pnpm-store"
+  # audiopus_sys's vendored opus fallback declares an old CMake minimum.
+  export CMAKE_POLICY_VERSION_MINIMUM=3.5
+  # sha2-asm assembles ARMv8 SHA instructions, which Arch Linux ARM's
+  # -march=armv8-a leaves out. sha2 still checks for them at runtime.
+  [[ $CARCH == aarch64 ]] && CFLAGS=${CFLAGS/-march=armv8-a/-march=armv8-a+crypto}
+
+  cargo build --frozen --release -p buzz-acp -p buzz-agent -p buzz-backend-kubernetes \
+    -p buzz-dev-mcp -p git-credential-nostr -p buzz-cli
+  ./scripts/bundle-sidecars.sh
+
+  # Upstream's Linux release build, without its bundles. Leaving
+  # BUZZ_UPDATER_PUBLIC_KEY and BUZZ_UPDATER_ENDPOINT unset compiles the
+  # self-updater out: pacman owns updates.
+  cd desktop
+  pnpm tauri build --ci --no-bundle --features mesh-llm -- --frozen
+}
+
+package() {
+  cd "$_srcdir"
+
+  install -Dm755 desktop/src-tauri/target/release/buzz-desktop "$pkgdir/usr/bin/buzz-desktop"
+  local bin
+  for bin in "${_sidecars[@]}"; do
+    install -Dm755 "target/release/$bin" "$pkgdir/usr/bin/$bin"
+  done
+
+  install -Dm644 "$srcdir/buzz.desktop" "$pkgdir/usr/share/applications/buzz-desktop.desktop"
+  local icons=desktop/src-tauri/icons size
+  for size in 32 64 128; do
+    install -Dm644 "$icons/${size}x$size.png" \
+      "$pkgdir/usr/share/icons/hicolor/${size}x$size/apps/buzz-desktop.png"
+  done
+  install -Dm644 "$icons/128x128@2x.png" "$pkgdir/usr/share/icons/hicolor/256x256/apps/buzz-desktop.png"
+  install -Dm644 "$icons/icon.png" "$pkgdir/usr/share/icons/hicolor/512x512/apps/buzz-desktop.png"
+
+  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+}

pkgbuilds/buzz/buzz.desktop

@@ -0,0 +1,10 @@
+[Desktop Entry]
+Type=Application
+Name=Buzz
+Comment=Workspace where humans and AI agents build together
+Exec=buzz-desktop %u
+Icon=buzz-desktop
+Terminal=false
+StartupWMClass=buzz-desktop
+Categories=Network;InstantMessaging;Chat;
+MimeType=x-scheme-handler/buzz;

pkgbuilds/claude-code/.omarchy/package.json

@@ -1,5 +1,6 @@
 {
   "source": "local",
+  "auto_merge": true,
   "release_ring": "fast",
   "upstream": {
     "watch": {

pkgbuilds/claude-code/PKGBUILD

@@ -4,7 +4,7 @@
 # Automation repository: https://github.com/fabifont/claude-code-aur
 
 pkgname=claude-code
-pkgver=2.1.291
+pkgver=2.1.296
 pkgrel=1
 pkgdesc="An agentic coding tool that lives in your terminal"
 arch=('x86_64' 'aarch64')
@@ -29,8 +29,8 @@ source_x86_64=("claude-${pkgver}-x86_64::https://downloads.claude.ai/claude-code
 source_aarch64=("claude-${pkgver}-aarch64::https://downloads.claude.ai/claude-code-releases/${pkgver}/linux-arm64/claude")
 
 sha256sums=('SKIP')
-sha256sums_x86_64=('078fad28d0297c9a25d306b635b2d8816c6839347520f29eb54ffea5d56142fb')
+sha256sums_x86_64=('24972e3bc859fab2b46ed4c1e51f7d6130f06d3bd550811a114640de3370d0de')
-sha256sums_aarch64=('c18473a04cc4f077435d5d9081f09ebea46e699eb2825cea64741c4bccb87647')
+sha256sums_aarch64=('f1f6e96e0d8342b9dbf41d7e88255397a6a52ce3d8736ad6a4c6b59c9b62fefa')
 
 package() {
 	install -Dm755 "${srcdir}/claude-${pkgver}-${CARCH}" "${pkgdir}/opt/claude-code/bin/claude"

pkgbuilds/claude-desktop/.omarchy/package.json

@@ -1,5 +1,6 @@
 {
   "source": "local",
+  "auto_merge": true,
   "release_ring": "fast",
   "upstream": {
     "debian": "https://downloads.claude.ai/claude-desktop/apt/stable/dists/stable/main/binary-amd64/Packages",

pkgbuilds/claude-desktop/PKGBUILD

@@ -6,7 +6,7 @@
 # repository's package index.
 
 pkgname=claude-desktop
-pkgver=2.19675.1
+pkgver=2.31226.1
 pkgrel=1
 pkgdesc="Official Claude desktop app with Claude Code"
 arch=('x86_64' 'aarch64')
@@ -63,8 +63,8 @@ source_x86_64=("${_deb_x86_64}::${_pool}/${_deb_x86_64}")
 source_aarch64=("${_deb_aarch64}::${_pool}/${_deb_aarch64}")
 noextract=("${_deb_x86_64}" "${_deb_aarch64}")
 sha256sums=('edfdbc63b65891ef7c481b07086c7e630fc102c042b6ed65331a52fcaf72b14a')
-sha256sums_x86_64=('9ba127eeccf270f6e60d35f5c5333654053bf0540c88fc82a009d01711b106fc')
+sha256sums_x86_64=('5a9bebdfcb1df6ce38767b373f3a7fabf77156a2ddd8a3f5d04961da5bde305e')
-sha256sums_aarch64=('681d122ae97d0eb302f0e6d92c7f232847064bb01746458dc50a2c095a40ed12')
+sha256sums_aarch64=('d2f57a38ffc73cfda660f8772a5f8bada05e6d74399948a268c6f5d53593ee8f')
 
 package() {
   cd "${srcdir}"

pkgbuilds/cliamp/.omarchy/package.json

@@ -1,5 +1,6 @@
 {
   "source": "local",
+  "auto_merge": true,
   "upstream": {
     "watch": {
       "github": "bjarneo/cliamp",

pkgbuilds/cliamp/PKGBUILD

@@ -1,7 +1,7 @@
 # Maintainer: bjarneo <https://github.com/bjarneo>
 pkgname=cliamp
 pkgver=2.3.0
-pkgrel=1
+pkgrel=2
 pkgdesc='A retro terminal music player inspired by Winamp 2.x'
 arch=('x86_64' 'aarch64')
 url='https://github.com/bjarneo/cliamp'

pkgbuilds/crush-bin/PKGBUILD

@@ -3,7 +3,7 @@
 # Maintainer: caarlos0 <carlos@charm.sh>
 
 pkgname='crush-bin'
-pkgver=0.97.1
+pkgver=0.98.1
 pkgrel=1
 pkgdesc='A powerful terminal-based AI assistant for developers, providing intelligent coding assistance directly in your terminal.'
 url='https://charm.sh/crush'
@@ -13,16 +13,16 @@ provides=('crush')
 conflicts=('crush')
 
 source_aarch64=("${pkgname}_${pkgver}_aarch64.tar.gz::https://github.com/charmbracelet/crush/releases/download/v${pkgver}/crush_${pkgver}_Linux_arm64.tar.gz")
-sha256sums_aarch64=('16c9477a178d69e02a51bf4babe6174e62051314b2cd7f36b1ec5fea47e25a88')
+sha256sums_aarch64=('098e875c1d9501822d08ef14ab094f24cfc87396385af5402994bf741a673b99')
 
 source_armv7h=("${pkgname}_${pkgver}_armv7h.tar.gz::https://github.com/charmbracelet/crush/releases/download/v${pkgver}/crush_${pkgver}_Linux_armv7.tar.gz")
-sha256sums_armv7h=('1999746feb3778aa65554df726a04161e98f38f00dc7d565617d88ba0ebc7e33')
+sha256sums_armv7h=('ba4361b5b2bfe28d7c0063cb25a570c4472d4fe0c10b125af12813b3ab27e25b')
 
 source_i686=("${pkgname}_${pkgver}_i686.tar.gz::https://github.com/charmbracelet/crush/releases/download/v${pkgver}/crush_${pkgver}_Linux_i386.tar.gz")
-sha256sums_i686=('a46de190551e8c45f27f36c26247e5a8ff01d082e66e61cb39a8bce77b9fbad0')
+sha256sums_i686=('6d972d44e177130c27a76c4316a8a40ac6a4357dcd2f79b7904a0b31801a0fce')
 
 source_x86_64=("${pkgname}_${pkgver}_x86_64.tar.gz::https://github.com/charmbracelet/crush/releases/download/v${pkgver}/crush_${pkgver}_Linux_x86_64.tar.gz")
-sha256sums_x86_64=('1b7cbe0600a3797538a74dc00dd8c4bac54ac4b8f4455ba5ff2312b29c7bd598')
+sha256sums_x86_64=('d85d913effef350f0152f594a70bd9749ad455bf15af77bb0d2b731036079885')
 
 package() {
   case "$CARCH" in

pkgbuilds/cua-driver-bin/PKGBUILD

@@ -19,10 +19,8 @@
 # binary to point at pm.sh, a stand-in that declines and names pacman instead.
 
 pkgname=cua-driver-bin
-# Held at 0.28.2: 0.28.3 and newer break screenshots. Bump by hand once a
+pkgver=0.33.4
-# fixed release is verified.
+pkgrel=1
-pkgver=0.28.2
-pkgrel=3
 pkgdesc="Computer-use driver for native GUI apps: accessibility-tree snapshots and input injection"
 arch=('x86_64' 'aarch64')
 url="https://github.com/trycua/cua"
@@ -49,8 +47,8 @@ source_x86_64=("https://github.com/trycua/cua/releases/download/cua-driver-rs-v$
 source_aarch64=("https://github.com/trycua/cua/releases/download/cua-driver-rs-v${pkgver}/cua-driver-rs-${pkgver}-linux-arm64.tar.gz")
 sha256sums=('c0779290c1d4783169aa3dbfb55feb505e563ef8a004bbf55298ceffcfbda8d9'
             'c76e251c3ed424200eac52bec35ba534336307fabd83a175ab0b47e2084ab0d8')
-sha256sums_x86_64=('8f3e5b669e2bcd98d0eecc64f40640aac77f358b6332a06abc6ee79991620f7d')
+sha256sums_x86_64=('a4759cc41c00691a345f08abfc28ece79aef41447d27a463ddd8662939fa3378')
-sha256sums_aarch64=('cadd7e6b757c3ce50f2b5f6e273c154ea48450fb5fcaff744209b382915eddf5')
+sha256sums_aarch64=('63a1e858a1a407c44ceb407ad133909b8cddedd713aea3b56d7ccb6db784eb48')
 
 case "${CARCH}" in
   x86_64) _platform="linux-x86_64" ;;
@@ -72,8 +70,8 @@ prepare() {
     return 1
   fi
 
-  # In 0.28.1 the URL appears in the updater, the printed reinstall command,
+  # Through 0.33.4 the URL appears in the updater, the printed reinstall
-  # and two embedded copies of Skills/cua-driver/README.md. Rewrite all four
+  # command, and two embedded copies of Skills/cua-driver/README.md. Rewrite all four
   # so the embedded instructions also defer to pacman. Any other count means
   # the release layout changed and needs review before packaging.
   local expected=4 found
@@ -113,4 +111,5 @@ package() {
   ln -s ../lib/cua-driver/cua-driver "${pkgdir}/usr/bin/cua-driver"
 
   install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
+  install -Dm644 THIRD_PARTY_NOTICES.md "${pkgdir}/usr/share/licenses/${pkgname}/THIRD_PARTY_NOTICES.md"
 }

pkgbuilds/cua-hyprland-plugin/README.md

@@ -1,6 +1,6 @@
 # Optional Cua Hyprland plugin
 
-This package targets **Omarchy x86_64**, with Inkscape `1.4.4-6` and two independent background-input lanes. Release `0.32.0-3` is an edge candidate built from the plugin source published with Driver `0.32.0`, paired with `cua-driver-bin` `0.28.2`. That source carries the independent agent keymaps and compatible Num Lock handling that releases `0.26.1-5` through `0.28.2-2` applied as an Omarchy patch; this release applies a smaller one, `downstream.patch`, so foreground typing keeps working with modifier and Compose remaps (see *Keyboard behavior*) and so that, with its guard active, restarting fcitx5 does not crash Hyprland (see *Input-method popups*). The upstream native qualification below covers older, unpatched source. Cua's native qualification is recorded in [the kit's qualification record](https://github.com/trycua/cua/releases/download/cua-hyprland-kit-v1.1.0-omarchy-stable-20260910/QUALIFICATION.md) and [Cua #3698](https://github.com/trycua/cua/pull/3698). Omabot replay and Omarchy's merge decision are recorded in [omarchy-pkgs #346](https://github.com/omacom/omarchy-pkgs/pull/346). Scheduling the recipe does not expand the qualified stable target.
+This package targets **Omarchy x86_64**, with Inkscape `1.4.4-6` and two independent background-input lanes. Release `0.32.0-3` is an edge candidate built from the plugin source published with Driver `0.32.0`, paired with `cua-driver-bin` `0.33.4`; the plugin sources are unchanged from 0.32.0 through 0.33.4. That source carries the independent agent keymaps and compatible Num Lock handling that releases `0.26.1-5` through `0.28.2-2` applied as an Omarchy patch; this release applies a smaller one, `downstream.patch`, so foreground typing keeps working with modifier and Compose remaps (see *Keyboard behavior*) and so that, with its guard active, restarting fcitx5 does not crash Hyprland (see *Input-method popups*). The upstream native qualification below covers older, unpatched source. Cua's native qualification is recorded in [the kit's qualification record](https://github.com/trycua/cua/releases/download/cua-hyprland-kit-v1.1.0-omarchy-stable-20260910/QUALIFICATION.md) and [Cua #3698](https://github.com/trycua/cua/pull/3698). Omabot replay and Omarchy's merge decision are recorded in [omarchy-pkgs #346](https://github.com/omacom/omarchy-pkgs/pull/346). Scheduling the recipe does not expand the qualified stable target.
 
 The plugin is optional. Cua Driver works independently, and installation does not load the plugin or enable input. The package follows the normal edge-to-RC-to-stable promotion path instead of the fast release ring. Its PKGBUILD limits builds to x86_64. The upstream qualification covers the original stable profile; the updated Aquamarine profile needs its own Omabot validation before promotion.
 
@@ -8,7 +8,7 @@ The plugin is optional. Cua Driver works independently, and installation does no
 
 The package uses the [Driver 0.32.0 plugin source](https://github.com/trycua/cua/releases/tag/cua-driver-rs-v0.32.0). Against the Driver 0.26.1 source the profile kit was qualified with, it adds the keyboard behaviour below ([Cua #3970](https://github.com/trycua/cua/pull/3970), adapted from [#473](https://github.com/omacom/omarchy-pkgs/pull/473)) and gives agent keyboards the user seat's key repeat rate instead of zero ([Cua #4358](https://github.com/trycua/cua/pull/4358)), which crashed single-seat clients such as imv that bound an agent seat ([Cua #4257](https://github.com/trycua/cua/issues/4257)). The input protocol header is unchanged.
 
-The qualified upstream Driver pairing is `cua-driver-bin 0.27.0-1`, with input protocol v3. Driver 0.27.0 contains the bounded stale-geometry retry validated with the upstream module. This package pairs with `cua-driver-bin 0.28.2`, which speaks the same input protocol v3 to this source; Driver finds the plugin only through its versioned input socket, not through the plugin's provenance. Discovery protocol v2 is separate. `cua-driver-bin` stays at 0.28.2 because Driver 0.28.3 through 0.32.0 refuse desktop capture on Hyprland with more than one output or with one output away from the origin ([Cua #4161](https://github.com/trycua/cua/issues/4161)), where 0.28.2 captures. This pairing is a changed pairing and requires affected replay before promotion.
+The qualified upstream Driver pairing is `cua-driver-bin 0.27.0-1`, with input protocol v3. Driver 0.27.0 contains the bounded stale-geometry retry validated with the upstream module. This package pairs with `cua-driver-bin 0.33.4`, which speaks the same input protocol v3 to this source; Driver finds the plugin only through its versioned input socket, not through the plugin's provenance. Discovery protocol v2 is separate. Driver 0.28.3 through 0.33.3 refuse desktop capture on Hyprland with more than one output or with one output away from the origin ([Cua #4161](https://github.com/trycua/cua/issues/4161)); 0.33.4 captures there again ([Cua #4305](https://github.com/trycua/cua/pull/4305)). This pairing is a changed pairing and requires affected replay before promotion.
 
 Profile `omarchy-hyprland-0562r4-remaps`, kit tooling `1.1.0`, and package release `3` pin:
 
@@ -19,7 +19,7 @@ Profile `omarchy-hyprland-0562r4-remaps`, kit tooling `1.1.0`, and package relea
 This profile derives from Cua's `omarchy-stable-20260910` profile. Arch's Hyprland `0.56.2-4` is a rebuild of the same 0.56.2 release against vulkan-sdk 1.4.363 and glslang, built with the same GCC `16.2.1 20260810` and linked to the same `libstdc++`. Its executable (SHA-256 `55da553be71222566ee73b973d2f56dbb9939044d8f22f81aa54b66c83f2f6d1`) and two of its 497 headers differ from `-3`: `src/version.h` now names the Aquamarine `0.15.1` and hyprutils `0.14.2` it was built against, and `protocols/hyprland-input-capture-v1.hpp` gains a destroy handler. The header inventory is re-measured the way `profile_verify.py` measures it, giving `1fdefe6ac027a159d04a5dfee4928ec7ebd15544a9a25b5f66d2f5a46fcf364a`; that method reproduces the kit's `-2`/`-3` values exactly.
 The checked-in `PROFILE.json` changes only the profile name, package release, source release, exact Hyprland, Aquamarine and glibc package versions, and the re-measured compositor executable and header hashes. Compiler and libstdc++ runtime identities remain Cua's; the separately recorded patch changes the build source. Cua publishes the profile tooling only in the 0.26.1 kit, and the Driver 0.32.0 source manifest has exactly the fields that kit's `profile_verify.py` checks. The download wrapper verifies the original kit and the Driver 0.32.0 source archive before substituting that archive and its manifest into the kit, deriving the updated profile and provenance, and rendering the recipe from the kit's own `PROFILE-PKGBUILD.in`. It then verifies every derived member against its recorded digest, so the result is the kit Cua's `profile_verify.py` accepts as complete for this profile.
 
-The native qualification below was recorded with package `0.26.1-2` and Hyprland `-2`. The 0.32.0 source and its Omarchy patch, the Aquamarine and glibc updates, and the Driver 0.28.2 pairing need their own application and Driver replay before promotion. Hyprland `0.56.2-4`, Aquamarine `0.15.1-1` and glibc `2.44+r50+g1848099f063e-1` must all reach a destination channel before this artifact can be installed there; publication still follows edge → RC → stable.
+The native qualification below was recorded with package `0.26.1-2` and Hyprland `-2`. The 0.32.0 source and its Omarchy patch, the Aquamarine and glibc updates, and the Driver 0.33.4 pairing need their own application and Driver replay before promotion. Hyprland `0.56.2-4`, Aquamarine `0.15.1-1` and glibc `2.44+r50+g1848099f063e-1` must all reach a destination channel before this artifact can be installed there; publication still follows edge → RC → stable.
 
 The generated `PKGBUILD` identifies the immutable kit download, outer checksum,
 and member checksums. The kit records the full source and tooling revisions,

pkgbuilds/cursor-bin/.omarchy/package.json

@@ -1,5 +1,6 @@
 {
   "source": "local",
+  "auto_merge": true,
   "release_ring": "fast",
   "upstream": {
     "watch": {

pkgbuilds/cursor-bin/PKGBUILD

@@ -1,7 +1,7 @@
 # Maintainer: Gunther Schulz <dev@guntherschulz.de>
 
 pkgname=cursor-bin
-pkgver=3.23.23
+pkgver=3.24.12
 pkgrel=1
 pkgdesc='AI-first coding environment'
 arch=('x86_64' 'aarch64')
@@ -18,13 +18,13 @@ depends_aarch64=(
   libxkbcommon libxrandr mesa nspr nss pango systemd-libs which
 )
 options=(!strip !debug) # Don't break ext of VSCode
-_commit=2dac2428994fe34f12658d9ecad1541b98db2c04
+_commit=37b865941ccb31e2fc90c685157534efca87f964
 source_x86_64=("https://downloads.cursor.com/production/${_commit}/linux/x64/deb/amd64/deb/cursor_${pkgver}_amd64.deb"
 "https://gitlab.archlinux.org/archlinux/packaging/packages/code/-/raw/main/code."{sh,mjs}
 rg.sh)
-sha512sums_x86_64=('acdf6f2677cd817c41fe91181075f8fa2cbf6fe21211c937a750769f1b036911a05c2e48c3f5186cc5e3d71a1b56aac8e6fbfead84a3c86902c39b77f8776328' '937299c6cb6be2f8d25f7dbc95cf77423875c5f8353b8bd6cd7cc8e5603cbf8405b14dbf8bd615db2e3b36ed680fc8e1909410815f7f8587b7267a699e00ab37' '793f9ff6306e3992ac89802d98110cba288ea1181a901467333293b7d76182ef9792c2a39ff49d9347a18a174b1f42bc58862091dff583f4146c2704eea28033' 'e79fe7659f59d1ae02fc68816399bfd31587315df6cdb6ccf1d0ca76f7cdc692c2a42b30591c0091147bd97ef14b1c7745dc26bd7cb3ea6bba45698e5044fa2a')
+sha512sums_x86_64=('336dc2b642cbb6d16a65bbd79cd4241e53c0d1fd3d9189850d7a922d1afcc9c37908d8a1e24d8c06429a12b375e7629a06e5f168c51e7be12e0b57430f6f1b86' '937299c6cb6be2f8d25f7dbc95cf77423875c5f8353b8bd6cd7cc8e5603cbf8405b14dbf8bd615db2e3b36ed680fc8e1909410815f7f8587b7267a699e00ab37' '793f9ff6306e3992ac89802d98110cba288ea1181a901467333293b7d76182ef9792c2a39ff49d9347a18a174b1f42bc58862091dff583f4146c2704eea28033' 'e79fe7659f59d1ae02fc68816399bfd31587315df6cdb6ccf1d0ca76f7cdc692c2a42b30591c0091147bd97ef14b1c7745dc26bd7cb3ea6bba45698e5044fa2a')
 source_aarch64=("https://downloads.cursor.com/production/${_commit}/linux/arm64/deb/arm64/deb/cursor_${pkgver}_arm64.deb")
-sha512sums_aarch64=('28ae4e335d48a8c9aa189645e75e26a2384462c8d2c910a7a1340442259eda55beb065210f049f895eeb809c4cdc331823e0c6b539a79bab209a94594777d5c0')
+sha512sums_aarch64=('fd2fc67f4cbec2e35a43046019ecddf14c025ae06398a1652369839a58fbd0edd565cf433525734c8a114b0bb4b5a3a6c9cfce0cc71739f4f803cbf984275876')
 noextract=(cursor_${pkgver}_amd64.deb cursor_${pkgver}_arm64.deb) # avoid double tarball
 _app=usr/share/cursor/resources/app
 package() {

pkgbuilds/cursor-cli/.omarchy/package.json

@@ -1,5 +1,6 @@
 {
   "source": "local",
+  "auto_merge": true,
   "release_ring": "fast",
   "upstream": {
     "watch": {

pkgbuilds/cursor-cli/PKGBUILD

@@ -8,7 +8,7 @@ pkgver=2026.10.01.1.e373342
 # Derive the upstream version (YYYY.MM.DD-<hash>) from that pkgver.
 _upstream_ver="${pkgver%.*}"
 _upstream_ver="${_upstream_ver%.*}-${pkgver##*.}"
-pkgrel=1
+pkgrel=2
 # epoch=1: bumped when switching from the original `20250808.0.<sha>` scheme
 # to the current `YYYY.MM.DD.<n>.<hash>` scheme (2025-08-09). Never decrease.
 epoch=1

pkgbuilds/disktree-bin/.omarchy/package.json

@@ -1,5 +1,6 @@
 {
   "source": "local",
+  "auto_merge": true,
   "min_release_age": "24h",
   "upstream": {
     "github": "tobi/disktree",

pkgbuilds/disktree-bin/PKGBUILD

@@ -3,7 +3,7 @@
 pkgname=disktree-bin
 _name=disktree
 pkgver=0.11.0
-pkgrel=1
+pkgrel=2
 pkgdesc="Disk space treemap for Omarchy: see what fills a disk by kind, mark what should go, and remove it"
 arch=('x86_64' 'aarch64')
 url="https://github.com/tobi/disktree"

pkgbuilds/dropbox-cli/PKGBUILD

@@ -7,7 +7,7 @@
 
 pkgname=dropbox-cli
 pkgver=2026.09.28
-pkgrel=2
+pkgrel=3
 pkgdesc="Command line interface for Dropbox"
 arch=("any")
 url="https://www.dropbox.com"

pkgbuilds/dropbox/.omarchy/package.json

@@ -1,5 +1,6 @@
 {
   "source": "local",
+  "auto_merge": true,
   "release_ring": "fast",
   "upstream": {
     "watch": {

pkgbuilds/elephant-all/.omarchy/package.json

@@ -1,13 +0,0 @@
-{
-  "source": "local",
-  "upstream": {
-    "watch": {
-      "github": "abenz1267/elephant",
-      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
-    }
-  },
-  "origin": {
-    "aur": "elephant-all",
-    "commit": "5614a0a61616643e448fb7c68d58237715ce2739"
-  }
-}

pkgbuilds/elephant-all/PKGBUILD

@@ -1,47 +0,0 @@
-# Maintainer: Andrej Benz <hello[at]benz[dot]dev>
-
-pkgname=elephant-all
-pkgver=2.22.1
-pkgrel=1
-pkgdesc='elephant + all official elephant providers'
-url='https://github.com/abenz1267/elephant'
-arch=('x86_64' 'aarch64')
-license=('GPL')
-depends=('libqalculate' 'wl-clipboard' 'imagemagick' 'fd' 'wtype' 'jq' 'sqlite3')
-makedepends=('go')
-conflicts=('elephant' 'elephant-playerctl' 'elephant-wireplumber' 'elephant-bitwarden' 'elephant-dnfpackages' 'elephant-1password' 'elephant-bookmarks' 'elephant-nirisessions' 'elephant-niriactions' 'elephant-archlinuxpkgs' 'elephant-bluetooth' 'elephant-calc' 'elephant-clipboard' 'elephant-desktopapplications' 'elephant-files' 'elephant-menus' 'elephant-providerlist' 'elephant-runner' 'elephant-snippets' 'elephant-symbols' 'elephant-todo' 'elephant-unicode' 'elephant-websearch' 'elephant-windows')
-provides=('elephant' 'elephant-playerctl' 'elephant-wireplumber' 'elephant-nirisessions' 'elephant-niriactions' 'elephant-archlinuxpkgs' 'elephant-bluetooth' 'elephant-calc' 'elephant-clipboard' 'elephant-desktopapplications' 'elephant-files' 'elephant-menus' 'elephant-providerlist' 'elephant-runner' 'elephant-snippets' 'elephant-symbols' 'elephant-todo' 'elephant-unicode' 'elephant-websearch' 'elephant-windows')
-source=("${url}/archive/refs/tags/v${pkgver}.tar.gz")
-sha256sums=('3d1d0d4c55ae531fa3f06406b96504b5165a0d7b53523d1f8351d9d93e457f44')
-
-build() {
-    # Build main elephant binary
-    cd elephant-${pkgver}/cmd/elephant
-    go build -ldflags="-s -w" -buildvcs=false -x -o elephant -trimpath
-
-    # Build all provider plugins
-    cd ../../internal/providers
-
-    # Build each provider
-    for provider in playerctl wireplumber archlinuxpkgs bitwarden dnfpackages 1password bookmarks bluetooth nirisessions niriactions calc clipboard desktopapplications files menus providerlist runner snippets symbols todo unicode websearch windows; do
-        cd $provider
-        go build -ldflags="-s -w" -buildvcs=false -buildmode=plugin -trimpath
-        cd ..
-    done
-}
-
-package() {
-    # Install main elephant binary
-    cd elephant-${pkgver}/cmd/elephant
-    install -Dm 755 elephant -t "${pkgdir}/usr/bin"
-
-    # Install all provider plugins
-    cd ../../internal/providers
-    for provider in playerctl wireplumber archlinuxpkgs bitwarden dnfpackages bookmarks 1password nirisessions niriactions bluetooth calc clipboard desktopapplications files menus providerlist runner snippets symbols todo unicode websearch windows; do
-        install -Dm 755 $provider/$provider.so -t "${pkgdir}/usr/lib/elephant"
-    done
-
-    # Install license
-    cd ../../
-    install -Dm 644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
-}

pkgbuilds/elephant-archlinuxpkgs/.omarchy/package.json

@@ -1,13 +0,0 @@
-{
-  "source": "local",
-  "upstream": {
-    "watch": {
-      "github": "abenz1267/elephant",
-      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
-    }
-  },
-  "origin": {
-    "aur": "elephant-archlinuxpkgs",
-    "commit": "659b81f1aa74a13fd2ebec222e19da2046d8e977"
-  }
-}

pkgbuilds/elephant-archlinuxpkgs/PKGBUILD

@@ -1,27 +0,0 @@
-# Maintainer: Andrej Benz <hello[at]benz[dot]dev>
-
-pkgname=elephant-archlinuxpkgs
-pkgver=2.22.1
-pkgrel=1
-pkgdesc='archlinuxpkgs provider for elephant'
-url='https://github.com/abenz1267/elephant'
-arch=('x86_64' 'aarch64')
-license=('GPL')
-makedepends=('go')
-conflicts=('elephant-archlinuxpkgs')
-provides=('elephant-archlinuxpkgs')
-source=("${url}/archive/refs/tags/v${pkgver}.tar.gz")
-sha256sums=('3d1d0d4c55ae531fa3f06406b96504b5165a0d7b53523d1f8351d9d93e457f44')
-
-build() {
-    cd elephant-${pkgver}/internal/providers/archlinuxpkgs
-    go build -ldflags="-s -w" -buildvcs=false -buildmode=plugin -trimpath
-}
-
-package() {
-    cd elephant-${pkgver}/internal/providers/archlinuxpkgs
-    install -Dm 755 archlinuxpkgs.so -t "${pkgdir}/usr/lib/elephant"
-
-    cd ../../../
-    install -Dm 644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
-}

pkgbuilds/elephant-bluetooth/.omarchy/package.json

@@ -1,13 +0,0 @@
-{
-  "source": "local",
-  "upstream": {
-    "watch": {
-      "github": "abenz1267/elephant",
-      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
-    }
-  },
-  "origin": {
-    "aur": "elephant-bluetooth",
-    "commit": "42d9dd5424884c51b8fe6bf7692caf0a31007f05"
-  }
-}

pkgbuilds/elephant-bluetooth/PKGBUILD

@@ -1,27 +0,0 @@
-# Maintainer: Andrej Benz <hello[at]benz[dot]dev>
-
-pkgname=elephant-bluetooth
-pkgver=2.22.1
-pkgrel=1
-pkgdesc='bluetooth provider for elephant'
-url='https://github.com/abenz1267/elephant'
-arch=('x86_64' 'aarch64')
-license=('GPL')
-makedepends=('go')
-conflicts=('elephant-bluetooth')
-provides=('elephant-bluetooth')
-source=("${url}/archive/refs/tags/v${pkgver}.tar.gz")
-sha256sums=('3d1d0d4c55ae531fa3f06406b96504b5165a0d7b53523d1f8351d9d93e457f44')
-
-build() {
-    cd elephant-${pkgver}/internal/providers/bluetooth
-    go build -ldflags="-s -w" -buildvcs=false -buildmode=plugin -trimpath
-}
-
-package() {
-    cd elephant-${pkgver}/internal/providers/bluetooth
-    install -Dm 755 bluetooth.so -t "${pkgdir}/usr/lib/elephant"
-
-    cd ../../../
-    install -Dm 644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
-}

pkgbuilds/elephant-calc/.omarchy/package.json

@@ -1,13 +0,0 @@
-{
-  "source": "local",
-  "upstream": {
-    "watch": {
-      "github": "abenz1267/elephant",
-      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
-    }
-  },
-  "origin": {
-    "aur": "elephant-calc",
-    "commit": "84aba9e90bbd65af45f83168cd6c7bce6ec4322e"
-  }
-}

pkgbuilds/elephant-calc/PKGBUILD

@@ -1,28 +0,0 @@
-# Maintainer: Andrej Benz <hello[at]benz[dot]dev>
-
-pkgname=elephant-calc
-pkgver=2.22.1
-pkgrel=1
-pkgdesc='calc provider for elephant'
-url='https://github.com/abenz1267/elephant'
-arch=('x86_64' 'aarch64')
-license=('GPL')
-depends=('libqalculate')
-makedepends=('go')
-conflicts=('elephant-calc')
-provides=('elephant-calc')
-source=("${url}/archive/refs/tags/v${pkgver}.tar.gz")
-sha256sums=('3d1d0d4c55ae531fa3f06406b96504b5165a0d7b53523d1f8351d9d93e457f44')
-
-build() {
-    cd elephant-${pkgver}/internal/providers/calc
-    go build -ldflags="-s -w" -buildvcs=false -buildmode=plugin -trimpath
-}
-
-package() {
-    cd elephant-${pkgver}/internal/providers/calc
-    install -Dm 755 calc.so -t "${pkgdir}/usr/lib/elephant"
-
-    cd ../../../
-    install -Dm 644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
-}

pkgbuilds/elephant-clipboard/.omarchy/package.json

@@ -1,13 +0,0 @@
-{
-  "source": "local",
-  "upstream": {
-    "watch": {
-      "github": "abenz1267/elephant",
-      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
-    }
-  },
-  "origin": {
-    "aur": "elephant-clipboard",
-    "commit": "3176f9de1445e7115009383f9cdac116729fc7be"
-  }
-}

pkgbuilds/elephant-clipboard/PKGBUILD

@@ -1,28 +0,0 @@
-# Maintainer: Andrej Benz <hello[at]benz[dot]dev>
-
-pkgname=elephant-clipboard
-pkgver=2.22.1
-pkgrel=1
-pkgdesc='clipboard provider for elephant'
-url='https://github.com/abenz1267/elephant'
-arch=('x86_64' 'aarch64')
-license=('GPL')
-depends=('wl-clipboard' 'imagemagick')
-makedepends=('go')
-conflicts=('elephant-clipboard')
-provides=('elephant-clipboard')
-source=("${url}/archive/refs/tags/v${pkgver}.tar.gz")
-sha256sums=('3d1d0d4c55ae531fa3f06406b96504b5165a0d7b53523d1f8351d9d93e457f44')
-
-build() {
-    cd elephant-${pkgver}/internal/providers/clipboard
-    go build -ldflags="-s -w" -buildvcs=false -buildmode=plugin -trimpath
-}
-
-package() {
-    cd elephant-${pkgver}/internal/providers/clipboard
-    install -Dm 755 clipboard.so -t "${pkgdir}/usr/lib/elephant"
-
-    cd ../../../
-    install -Dm 644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
-}

pkgbuilds/elephant-desktopapplications/.omarchy/package.json

@@ -1,13 +0,0 @@
-{
-  "source": "local",
-  "upstream": {
-    "watch": {
-      "github": "abenz1267/elephant",
-      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
-    }
-  },
-  "origin": {
-    "aur": "elephant-desktopapplications",
-    "commit": "c30e33db5fef912dec9aa157773b10ffab1e0307"
-  }
-}

pkgbuilds/elephant-desktopapplications/PKGBUILD

@@ -1,27 +0,0 @@
-# Maintainer: Andrej Benz <hello[at]benz[dot]dev>
-
-pkgname=elephant-desktopapplications
-pkgver=2.22.1
-pkgrel=1
-pkgdesc='desktopapplications provider for elephant'
-url='https://github.com/abenz1267/elephant'
-arch=('x86_64' 'aarch64')
-license=('GPL')
-makedepends=('go')
-conflicts=('elephant-desktopapplications')
-provides=('elephant-desktopapplications')
-source=("${url}/archive/refs/tags/v${pkgver}.tar.gz")
-sha256sums=('3d1d0d4c55ae531fa3f06406b96504b5165a0d7b53523d1f8351d9d93e457f44')
-
-build() {
-    cd elephant-${pkgver}/internal/providers/desktopapplications
-    go build -ldflags="-s -w" -buildvcs=false -buildmode=plugin -trimpath
-}
-
-package() {
-    cd elephant-${pkgver}/internal/providers/desktopapplications
-    install -Dm 755 desktopapplications.so -t "${pkgdir}/usr/lib/elephant"
-
-    cd ../../../
-    install -Dm 644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
-}

pkgbuilds/elephant-files/.omarchy/package.json

@@ -1,13 +0,0 @@
-{
-  "source": "local",
-  "upstream": {
-    "watch": {
-      "github": "abenz1267/elephant",
-      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
-    }
-  },
-  "origin": {
-    "aur": "elephant-files",
-    "commit": "2d16502b7a905e7d7a03e0026c5519c3b3c4abf2"
-  }
-}

pkgbuilds/elephant-files/PKGBUILD

@@ -1,28 +0,0 @@
-# Maintainer: Andrej Benz <hello[at]benz[dot]dev>
-
-pkgname=elephant-files
-pkgver=2.22.1
-pkgrel=1
-pkgdesc='files provider for elephant'
-url='https://github.com/abenz1267/elephant'
-arch=('x86_64' 'aarch64')
-license=('GPL')
-depends=('fd')
-makedepends=('go')
-conflicts=('elephant-files')
-provides=('elephant-files')
-source=("${url}/archive/refs/tags/v${pkgver}.tar.gz")
-sha256sums=('3d1d0d4c55ae531fa3f06406b96504b5165a0d7b53523d1f8351d9d93e457f44')
-
-build() {
-    cd elephant-${pkgver}/internal/providers/files
-    go build -ldflags="-s -w" -buildvcs=false -buildmode=plugin -trimpath
-}
-
-package() {
-    cd elephant-${pkgver}/internal/providers/files
-    install -Dm 755 files.so -t "${pkgdir}/usr/lib/elephant"
-
-    cd ../../../
-    install -Dm 644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
-}

pkgbuilds/elephant-menus/.omarchy/package.json

@@ -1,13 +0,0 @@
-{
-  "source": "local",
-  "upstream": {
-    "watch": {
-      "github": "abenz1267/elephant",
-      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
-    }
-  },
-  "origin": {
-    "aur": "elephant-menus",
-    "commit": "5ab583fee6ba3e387d49ffe4e409bb84bc60ea24"
-  }
-}

pkgbuilds/elephant-menus/PKGBUILD

@@ -1,27 +0,0 @@
-# Maintainer: Andrej Benz <hello[at]benz[dot]dev>
-
-pkgname=elephant-menus
-pkgver=2.22.1
-pkgrel=1
-pkgdesc='menus provider for elephant'
-url='https://github.com/abenz1267/elephant'
-arch=('x86_64' 'aarch64')
-license=('GPL')
-makedepends=('go')
-conflicts=('elephant-menus')
-provides=('elephant-menus')
-source=("${url}/archive/refs/tags/v${pkgver}.tar.gz")
-sha256sums=('3d1d0d4c55ae531fa3f06406b96504b5165a0d7b53523d1f8351d9d93e457f44')
-
-build() {
-    cd elephant-${pkgver}/internal/providers/menus
-    go build -ldflags="-s -w" -buildvcs=false -buildmode=plugin -trimpath
-}
-
-package() {
-    cd elephant-${pkgver}/internal/providers/menus
-    install -Dm 755 menus.so -t "${pkgdir}/usr/lib/elephant"
-
-    cd ../../../
-    install -Dm 644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
-}

pkgbuilds/elephant-providerlist/.omarchy/package.json

@@ -1,13 +0,0 @@
-{
-  "source": "local",
-  "upstream": {
-    "watch": {
-      "github": "abenz1267/elephant",
-      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
-    }
-  },
-  "origin": {
-    "aur": "elephant-providerlist",
-    "commit": "1d756a138e926a81b9d33265f0197b8661168845"
-  }
-}

pkgbuilds/elephant-providerlist/PKGBUILD

@@ -1,27 +0,0 @@
-# Maintainer: Andrej Benz <hello[at]benz[dot]dev>
-
-pkgname=elephant-providerlist
-pkgver=2.22.1
-pkgrel=1
-pkgdesc='providerlist provider for elephant'
-url='https://github.com/abenz1267/elephant'
-arch=('x86_64' 'aarch64')
-license=('GPL')
-makedepends=('go')
-conflicts=('elephant-providerlist')
-provides=('elephant-providerlist')
-source=("${url}/archive/refs/tags/v${pkgver}.tar.gz")
-sha256sums=('3d1d0d4c55ae531fa3f06406b96504b5165a0d7b53523d1f8351d9d93e457f44')
-
-build() {
-    cd elephant-${pkgver}/internal/providers/providerlist
-    go build -ldflags="-s -w" -buildvcs=false -buildmode=plugin -trimpath
-}
-
-package() {
-    cd elephant-${pkgver}/internal/providers/providerlist
-    install -Dm 755 providerlist.so -t "${pkgdir}/usr/lib/elephant"
-
-    cd ../../../
-    install -Dm 644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
-}

pkgbuilds/elephant-runner/.omarchy/package.json

@@ -1,13 +0,0 @@
-{
-  "source": "local",
-  "upstream": {
-    "watch": {
-      "github": "abenz1267/elephant",
-      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
-    }
-  },
-  "origin": {
-    "aur": "elephant-runner",
-    "commit": "e47641530d912199372204cf8780ef37f99f0b37"
-  }
-}

pkgbuilds/elephant-runner/PKGBUILD

@@ -1,27 +0,0 @@
-# Maintainer: Andrej Benz <hello[at]benz[dot]dev>
-
-pkgname=elephant-runner
-pkgver=2.22.1
-pkgrel=1
-pkgdesc='runner provider for elephant'
-url='https://github.com/abenz1267/elephant'
-arch=('x86_64' 'aarch64')
-license=('GPL')
-makedepends=('go')
-conflicts=('elephant-runner')
-provides=('elephant-runner')
-source=("${url}/archive/refs/tags/v${pkgver}.tar.gz")
-sha256sums=('3d1d0d4c55ae531fa3f06406b96504b5165a0d7b53523d1f8351d9d93e457f44')
-
-build() {
-    cd elephant-${pkgver}/internal/providers/runner
-    go build -ldflags="-s -w" -buildvcs=false -buildmode=plugin -trimpath
-}
-
-package() {
-    cd elephant-${pkgver}/internal/providers/runner
-    install -Dm 755 runner.so -t "${pkgdir}/usr/lib/elephant"
-
-    cd ../../../
-    install -Dm 644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
-}

pkgbuilds/elephant-symbols/.omarchy/package.json

@@ -1,13 +0,0 @@
-{
-  "source": "local",
-  "upstream": {
-    "watch": {
-      "github": "abenz1267/elephant",
-      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
-    }
-  },
-  "origin": {
-    "aur": "elephant-symbols",
-    "commit": "32263e8b71390ab38b8aa1fd82fc2595b41a5157"
-  }
-}

pkgbuilds/elephant-symbols/PKGBUILD

@@ -1,27 +0,0 @@
-# Maintainer: Andrej Benz <hello[at]benz[dot]dev>
-
-pkgname=elephant-symbols
-pkgver=2.22.1
-pkgrel=1
-pkgdesc='symbols provider for elephant'
-url='https://github.com/abenz1267/elephant'
-arch=('x86_64' 'aarch64')
-license=('GPL')
-makedepends=('go')
-conflicts=('elephant-symbols')
-provides=('elephant-symbols')
-source=("${url}/archive/refs/tags/v${pkgver}.tar.gz")
-sha256sums=('3d1d0d4c55ae531fa3f06406b96504b5165a0d7b53523d1f8351d9d93e457f44')
-
-build() {
-    cd elephant-${pkgver}/internal/providers/symbols
-    go build -ldflags="-s -w" -buildvcs=false -buildmode=plugin -trimpath
-}
-
-package() {
-    cd elephant-${pkgver}/internal/providers/symbols
-    install -Dm 755 symbols.so -t "${pkgdir}/usr/lib/elephant"
-
-    cd ../../../
-    install -Dm 644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
-}

pkgbuilds/elephant-todo/.omarchy/package.json

@@ -1,13 +0,0 @@
-{
-  "source": "local",
-  "upstream": {
-    "watch": {
-      "github": "abenz1267/elephant",
-      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
-    }
-  },
-  "origin": {
-    "aur": "elephant-todo",
-    "commit": "447978df5ea3afd1e10959d7973c0b35367724c3"
-  }
-}

pkgbuilds/elephant-todo/PKGBUILD

@@ -1,27 +0,0 @@
-# Maintainer: Andrej Benz <hello[at]benz[dot]dev>
-
-pkgname=elephant-todo
-pkgver=2.22.1
-pkgrel=1
-pkgdesc='todo provider for elephant'
-url='https://github.com/abenz1267/elephant'
-arch=('x86_64' 'aarch64')
-license=('GPL')
-makedepends=('go')
-conflicts=('elephant-todo')
-provides=('elephant-todo')
-source=("${url}/archive/refs/tags/v${pkgver}.tar.gz")
-sha256sums=('3d1d0d4c55ae531fa3f06406b96504b5165a0d7b53523d1f8351d9d93e457f44')
-
-build() {
-    cd elephant-${pkgver}/internal/providers/todo
-    go build -ldflags="-s -w" -buildvcs=false -buildmode=plugin -trimpath
-}
-
-package() {
-    cd elephant-${pkgver}/internal/providers/todo
-    install -Dm 755 todo.so -t "${pkgdir}/usr/lib/elephant"
-
-    cd ../../../
-    install -Dm 644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
-}

pkgbuilds/elephant-unicode/.omarchy/package.json

@@ -1,13 +0,0 @@
-{
-  "source": "local",
-  "upstream": {
-    "watch": {
-      "github": "abenz1267/elephant",
-      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
-    }
-  },
-  "origin": {
-    "aur": "elephant-unicode",
-    "commit": "23222b0d304a234c74f630c5b9176d58c6c6e0b3"
-  }
-}

pkgbuilds/elephant-unicode/PKGBUILD

@@ -1,27 +0,0 @@
-# Maintainer: Andrej Benz <hello[at]benz[dot]dev>
-
-pkgname=elephant-unicode
-pkgver=2.22.1
-pkgrel=1
-pkgdesc='unicode provider for elephant'
-url='https://github.com/abenz1267/elephant'
-arch=('x86_64' 'aarch64')
-license=('GPL')
-makedepends=('go')
-conflicts=('elephant-unicode')
-provides=('elephant-unicode')
-source=("${url}/archive/refs/tags/v${pkgver}.tar.gz")
-sha256sums=('3d1d0d4c55ae531fa3f06406b96504b5165a0d7b53523d1f8351d9d93e457f44')
-
-build() {
-    cd elephant-${pkgver}/internal/providers/unicode
-    go build -ldflags="-s -w" -buildvcs=false -buildmode=plugin -trimpath
-}
-
-package() {
-    cd elephant-${pkgver}/internal/providers/unicode
-    install -Dm 755 unicode.so -t "${pkgdir}/usr/lib/elephant"
-
-    cd ../../../
-    install -Dm 644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
-}

pkgbuilds/elephant-websearch/.omarchy/package.json

@@ -1,13 +0,0 @@
-{
-  "source": "local",
-  "upstream": {
-    "watch": {
-      "github": "abenz1267/elephant",
-      "pattern": "v(?P<version>[0-9]+(?:\\.[0-9]+)*)"
-    }
-  },
-  "origin": {
-    "aur": "elephant-websearch",
-    "commit": "6b5da831da33e3533593823826a8ffb1a008a299"
-  }
-}