Automatically approve orphan removal during updates (#14428)

test/shell.d/update-orphan-test.sh

@@ -23,7 +23,7 @@ SH
 }
 
 run_orphan_checker() {
-  HOME="$test_home" PATH="$stub_bin:$PATH" "$ROOT/bin/omarchy-update-orphan-pkgs"
+  HOME="$test_home" PATH="$stub_bin:$ROOT/bin:$PATH" "$ROOT/bin/omarchy-update-orphan-pkgs" "$@"
 }
 
 write_stub pacman 'if [[ $1 == "-Qtdq" ]]; then printf "old-lib\nunused-tool\n"; exit 0; fi; exit 1'
@@ -35,7 +35,29 @@ grep -q '^  old-lib$' "$test_tmp/noninteractive.out" || fail "orphan checker lis
 grep -q 'Re-run omarchy-update-orphan-pkgs in a terminal' "$test_tmp/noninteractive.out" || fail "orphan checker does not remove packages non-interactively"
 pass "orphan checker only reports orphans non-interactively"
 
+export REMOVAL_LOG="$test_tmp/removal.log"
+write_stub pacman 'case $1 in
+  -Qtdq|-Qq) printf "old-lib\nunused-tool\n" ;;
+  -Rns) printf "%s\n" "$@" >"$REMOVAL_LOG" ;;
+  *) exit 1 ;;
+esac'
+write_stub sudo '"$@"'
+run_orphan_checker -y >"$test_tmp/approved.out" 2>"$test_tmp/approved.err"
+diff <(printf '%s\n' -Rns --noconfirm old-lib unused-tool) "$REMOVAL_LOG" ||
+  fail "approved cleanup removes the orphan packages without pacman confirmation"
+pass "approved cleanup removes orphans without Omarchy or pacman confirmation"
+
+write_stub sudo 'exit 42'
+if run_orphan_checker -y >"$test_tmp/failure.out" 2>"$test_tmp/failure.err"; then
+  fail "approved cleanup reports removal failures"
+fi
+pass "approved cleanup reports removal failures"
+
+rm -f "$REMOVAL_LOG"
 write_stub pacman 'if [[ $1 == "-Qtdq" ]]; then exit 0; fi; exit 1'
-run_orphan_checker >"$test_tmp/none.out" 2>"$test_tmp/none.err"
-[[ ! -s $test_tmp/none.out ]] || fail "orphan checker stays quiet when no orphans exist"
+for mode in "" -y; do
+  run_orphan_checker $mode >"$test_tmp/none.out" 2>"$test_tmp/none.err"
+  [[ ! -s $test_tmp/none.out ]] || fail "orphan checker stays quiet when no orphans exist"
+done
+[[ ! -e $REMOVAL_LOG ]] || fail "orphan checker does not remove packages when no orphans exist"
 pass "orphan checker stays quiet without orphans"

test/shell.d/update-sequence-test.sh

@@ -35,6 +35,9 @@ for step in "${steps[@]}"; do
   cat >"$stub_bin/$step" <<'STUB'
 #!/bin/bash
 printf '%s unattended=%s\n' "${0##*/}" "${OMARCHY_UPDATE_UNATTENDED:-}" >>"$STEP_LOG"
+if [[ ${0##*/} == "omarchy-update-orphan-pkgs" ]]; then
+  printf '%s\n' "$@" >"$STEP_LOG.orphan-args"
+fi
 [[ ${FAILING_STEP:-} != "${0##*/}" ]] || exit 1
 STUB
   chmod +x "$stub_bin/$step"
@@ -84,6 +87,8 @@ run_update -y || fail "an update where everything works reports a failure"
 diff <(expected_steps) <(steps_run) >"$test_tmp/order" ||
   fail "an update where everything works does not run every step in order" "$(cat "$test_tmp/order")"
 pass "an update where every step works runs all of them, in order"
+[[ $(cat "$test_tmp/steps.orphan-args") == "-y" ]] || fail "an unattended update approves orphan removal"
+pass "an unattended update approves orphan removal"
 
 grep -q '^omarchy-update-system-pkgs unattended=1$' "$test_tmp/steps" ||
   fail "-y does not mark the update unattended"
@@ -93,6 +98,8 @@ diff <(expected_steps confirmed) <(steps_run) >"$test_tmp/order" ||
 grep -q '^omarchy-update-system-pkgs unattended=$' "$test_tmp/steps" ||
   fail "an update a person confirmed is treated as unattended"
 pass "-y is what marks an update unattended, not the update itself"
+[[ $(cat "$test_tmp/steps.orphan-args") == "-y" ]] || fail "a confirmed update approves orphan removal"
+pass "a confirmed update approves orphan removal"
 
 # Migrations ship with the packages the upgrade installs and are written against
 # them. Running them against what is still on disk is the failure this ordering