packaging: republish python-pywal to [breadway]

python-pywal was dropped from Arch's [extra] repo (AUR-only now), so
`pacstrap` can no longer resolve it and every ISO build fails with
"target not found: python-pywal". The `wal` binary is load-bearing —
bread-theme shells out to it to extract the colour palette from the
user's wallpaper.

Republish it the same way as calamares / bibata / powerlevel10k /
yay-bin:

- `packaging/python-pywal/PKGBUILD` — in-house copy of the AUR PKGBUILD
  (Morten Linderud's), modernised to `python -m build` / `installer`
  instead of the removed `setup.py install`, sha256-only sources like
  the sibling PKGBUILDs. Test-built locally: 28 unit tests pass, package
  ships `/usr/bin/wal`.
- `.forgejo/workflows/python-pywal.yml` — builds + PUTs to the Forgejo
  Arch registry on a push to `packaging/python-pywal/**`.
- `signed-repo.yml` gains it as a `workflow_run` trigger;
  `ci-publish-signed-repo.sh` gains it in `PACKAGES` so the signed
  dl.breadway.dev/arch db picks it up.
- packages.x86_64 keeps the `python-pywal` line (now sourced from
  [breadway]) with a note.

Ordering: `python-pywal.yml` must publish to the registry once before
`signed-repo.yml` runs, or the collect step errors "registry db missing
packages: python-pywal".

.forgejo/workflows/python-pywal.yml

@@ -0,0 +1,39 @@
+name: Build and publish python-pywal
+
+# python-pywal was dropped from Arch's [extra] repo (AUR-only now), but the ISO
+# needs the `wal` binary (bread-theme extracts the wallpaper palette with it).
+# BOS keeps an in-house PKGBUILD and publishes to the [breadway] repo — same
+# pattern as calamares / bibata / powerlevel10k / yay-bin.
+on:
+  push:
+    paths:
+      - 'packaging/python-pywal/**'
+  workflow_dispatch:
+
+jobs:
+  python-pywal:
+    runs-on: [self-hosted, hestia]
+    container:
+      image: archlinux:latest
+    steps:
+      - name: Build and publish
+        env:
+          PUBLISH_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -euo pipefail
+          pacman -Syu --noconfirm base-devel git \
+            python python-build python-installer python-wheel python-setuptools imagemagick
+          useradd -m builder
+          git config --global --add safe.directory '*'
+          # Clone the ref that triggered this run (not the default branch) —
+          # same as the other packaging workflows.
+          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
+            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" /home/builder/src
+          chown -R builder:builder /home/builder/src
+          su builder -c "cd /home/builder/src/packaging/python-pywal && makepkg -f --noconfirm"
+          PKG=$(find /home/builder/src/packaging/python-pywal -name '*.pkg.tar.zst' | head -1)
+          curl -fsS -X PUT \
+            -H "Authorization: token ${PUBLISH_TOKEN}" \
+            -H "Content-Type: application/octet-stream" \
+            --data-binary "@${PKG}" \
+            "https://git.breadway.dev/api/packages/Breadway/arch/os"

.forgejo/workflows/signed-repo.yml

@@ -21,6 +21,7 @@ on:
       - Build and publish bibata-cursor-theme
       - Build and publish powerlevel10k
       - Build and publish yay-bin
+      - Build and publish python-pywal
     types: [completed]
 
 concurrency:

docs/signed-repo.md

@@ -47,7 +47,7 @@ On disk: `/srv/breadway-dl/arch/x86_64/` (nginx already serves
 
 The job collects the current ISO `[breadway]` set from the Forgejo Arch
 registry (breadlock + calamares, zen-browser-bin, bibata-cursor-theme-bin,
-zsh-theme-powerlevel10k, yay-bin). Leftover bakery-channel pacman packages
+zsh-theme-powerlevel10k, yay-bin, python-pywal). Leftover bakery-channel pacman packages
 still sitting in that registry are **not** copied. Optional
 `BREADWAY_PKG_DIR` on the runner overrides individual files.
 
@@ -87,7 +87,7 @@ curl -fsS -X POST \
 ```
 
 It also runs after the in-repo AUR republish workflows complete
-(`calamares` / `bibata` / `powerlevel10k` / `yay-bin`). breadlock lives in
+(`calamares` / `bibata` / `powerlevel10k` / `yay-bin` / `python-pywal`). breadlock lives in
 another repo; that job can fire this one with `repository_dispatch` event
 `publish-signed-repo` (or dispatch from the UI after a breadlock tag).
 

iso/packages.x86_64

@@ -225,6 +225,8 @@ slurp
 wl-clipboard
 playerctl
 # Wallpaper daemon + pywal (drives the bread* colour palette from the wallpaper).
+# python-pywal was dropped from Arch [extra] (AUR-only now) — republished to
+# [breadway], see packaging/python-pywal.
 awww
 python-pywal
 # Boot splash (BOS logo + spinner instead of kernel text).

packaging/arch/README.md

@@ -3,7 +3,7 @@ Arch packaging
 
 This directory only holds `PKGBUILD`s for third-party AUR packages BOS
 republishes to the `[breadway]` pacman repo (`calamares`, `bibata`,
-`powerlevel10k`, `yay-bin`) — not the user's own code. See each
+`powerlevel10k`, `yay-bin`, `python-pywal`) — not the user's own code. See each
 subdirectory's `.forgejo/workflows/<name>.yml` (in this repo) for how each
 one publishes on a push to `packaging/<name>/**`.
 

packaging/python-pywal/PKGBUILD

@@ -0,0 +1,44 @@
+# BOS in-house rebuild of python-pywal.
+#
+# python-pywal was dropped from Arch's [extra] repo (it is now AUR-only), but
+# BOS needs the `wal` binary: bread-theme shells out to it to extract a colour
+# palette from the user's wallpaper. Republished to [breadway] so the ISO can
+# pull it via pacman, same pattern as calamares / bibata / powerlevel10k /
+# yay-bin. Source of truth: https://aur.archlinux.org/packages/python-pywal
+#
+# Maintainer: Breadway <plasticbread849@gmail.com>
+# Upstream maintainer: Morten Linderud <foxboron@archlinux.org>
+# Contributor: Sean Haugh <seanphaugh@gmail.com>
+
+pkgname=python-pywal
+pkgver=3.3.0
+pkgrel=11
+pkgdesc="Generate and change colorschemes on the fly"
+arch=('any')
+url="https://github.com/dylanaraps/pywal/"
+license=('MIT')
+depends=('python' 'imagemagick')
+makedepends=('python-build' 'python-installer' 'python-wheel' 'python-setuptools')
+optdepends=('feh: set wallpaper'
+            'nitrogen: set wallpaper')
+# BOS PKGBUILDs verify sources by sha256 only (no source PGP), matching
+# calamares / powerlevel10k here.
+source=("$pkgname-$pkgver.tar.gz::https://github.com/dylanaraps/pywal/archive/${pkgver}.tar.gz")
+sha256sums=('fe8fc1c29d1cad1a1a8580293dcfe32e1fac259f9dbfd5c8877439fa5948d189')
+
+build() {
+  cd "pywal-${pkgver}"
+  # setup.py-only project: python-build injects the setuptools backend.
+  python -m build --wheel --no-isolation
+}
+
+check() {
+  cd "pywal-${pkgver}"
+  python -m unittest discover -vs tests
+}
+
+package() {
+  cd "pywal-${pkgver}"
+  python -m installer --destdir="$pkgdir" dist/*.whl
+  install -Dm644 LICENSE.md "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+}

scripts/ci-publish-signed-repo.sh

@@ -22,6 +22,7 @@ PACKAGES=(
   bibata-cursor-theme-bin
   zsh-theme-powerlevel10k
   yay-bin
+  python-pywal
 )
 
 ARCH="${BREADWAY_ARCH:-x86_64}"