[noctuum]

A PKGBUILD in prepare runs as the user that owns the scripts, .status/ and handoff/ of every package. It could plant scripts/update-readme.sh, which the Hand over step ran to decide work, and so skip verify and publish with a green run, mark another package up_to_date, or forge a check_failed issue.

• A new check job runs the strategies with the read-only token, runs no PKGBUILD, decides prepare and work, and uploads .status/ as the checked artifact.
• prepare runs only for a new version and takes the statuses from checked. Its Hand over step runs nothing from the workspace. Root prefixes its output, so no line from a PKGBUILD reaches the runner as a workflow command.
• publish runs when check found work, also without prepare, and not after a failure of prepare or verify. check-all.sh --publish keeps the statuses from checked and publishes only the packages check found outdated. For the others it takes only an update_failed text from handoff/status, or records update_failed: prepare handed over no update. It counts _error_count itself.
• check-all.sh --verify treats exit code 3 as a failure: base comes from the prepare run, so a wrong base looked like a moved AUR repo.

A PKGBUILD can still make the other packages that update in the same run fail, and each failure now opens an issue.

bats tests/ --recursive: 382 pass, actionlint is clean. tests/workflows.bats runs the Decide and Prepare updates steps.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!