slosh.git/contrib/release, branch docs-new

arch: a self-hosted pacman repository, since the AUR is shut

2026-08-29T13:48:25Z

AUR signups are closed while the AUR deals with supply chain attacks, so the package is published from our own roof -- which is the better offer anyway: a pacman repository serves built packages where the AUR hands every user a rebuild. contrib/aur/ becomes contrib/arch/ (the .SRCINFO goes; it is AUR metadata, regenerated in a minute when signups reopen), and contrib/arch-repo builds the package and maintains the slosh.db / slosh.files indexes in dist/arch//, which rsyncs to /opt/slosh/arch/ on the box. The README and the front page carry the [slosh] stanza; SigLevel is spelled out because the packages are not signed yet and pacman defaults to demanding it.

aur: a PKGBUILD, building offline from the cgit snapshot

2026-08-28T14:54:56Z

contrib/aur/ is the upstream copy of the AUR package; the AUR repo gets these files verbatim on a release, and contrib/release now says so in its checklist. The source is the cgit snapshot of the tag, which carries the vendored libghostty-vt -- and every zig dependency in its build.zig.zon is lazy and unused by the VT-only build (verified against a cold ZIG_GLOBAL_CACHE_DIR), so the build fetches nothing and is clean in an offline chroot. prepare() writes pkgver into VERSION because the v0.1.1 snapshot predates the release script that keeps the floor bumped; for later tags the line writes what is already there.

release: one command to bump, commit and tag

2026-08-28T13:44:01Z

contrib/release X.Y.Z moves ./VERSION, commits and cuts the annotated tag together, so the floor and the tag cannot disagree by construction. It refuses a dirty tree, a detached HEAD, a malformed or non-increasing version, and an existing tag; notes passed as the second argument land in the tag message. It prints the push and `make release` commands instead of running them, because publishing should be deliberate. contrib/release --check verifies the invariant (VERSION equals the newest tag) on its own: `make release` runs it before building anything, and the new pre-push hook runs the same comparison against the commit a v* tag points at, so a tag made by hand is caught before it escapes the machine.