Ship OmaSheets as a native Arch package

.github/workflows/ci.yml

@@ -384,6 +384,40 @@ jobs:
           path: ${{ runner.temp }}/omasheets-qt-grid/
           if-no-files-found: warn
 
+  arch-package:
+    name: Arch package install, upgrade and removal
+    needs: native-package
+    runs-on: ubuntu-latest
+    container:
+      image: archlinux:base-devel
+    steps:
+      - run: pacman -Syu --noconfirm --needed git python gtk3 libreoffice-fresh bubblewrap qt6-base qt6-declarative qt6-wayland desktop-file-utils shared-mime-info xorg-server-xvfb ttf-dejavu
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: omasheets-native-linux-x86_64
+          path: dist-native
+      - name: Package the verified binaries without rebuilding
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          bash packaging/arch/build.sh dist-native/omasheets-native-0.0.2-linux-x86_64.tar.gz /tmp/arch-package
+          useradd -m builder
+          chown -R builder:builder /tmp/arch-package
+          runuser -u builder -- bash -c 'cd /tmp/arch-package && makepkg --noconfirm && makepkg --printsrcinfo > .SRCINFO'
+          cd /tmp/arch-package
+          sha256sum *.pkg.tar.zst > SHA256SUMS
+          tar -czf omasheets-aur-recipe.tar.gz PKGBUILD .SRCINFO
+      - name: Verify package lifecycle as a desktop user
+        run: bash packaging/arch/check.sh /tmp/arch-package
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: omasheets-arch-linux-x86_64
+          path: |
+            /tmp/arch-package/*.pkg.tar.zst
+            /tmp/arch-package/SHA256SUMS
+            /tmp/arch-package/*.tar.gz
+            /tmp/arch-package/*.sha256
+
   native-package:
     name: Build native release bundle
     runs-on: ubuntu-latest

.github/workflows/development.yml

@@ -42,6 +42,11 @@ jobs:
           sha256sum --check "${archives[0]}.sha256"
           tar -xOf "${archives[0]}" manifest.json > manifest.json
           test "$(jq -r .source.commit manifest.json)" = "$BUILD_SHA"
+      - name: Download the tested Arch package and AUR recipe
+        run: |
+          gh run download "$BUILD_RUN" --name omasheets-arch-linux-x86_64 --dir arch
+          cd arch
+          sha256sum --check SHA256SUMS
       - name: Publish an immutable development prerelease
         run: |
           tag="dev-$BUILD_SHA"
@@ -60,25 +65,28 @@ jobs:
 
           ## Install OmaSheets
 
-          Download **OmaSheets-Setup-linux-x86_64.tar.gz** below, extract it, and open **omasheets-setup**. The installer handles downloads and offers system dependency setup. Then choose **Open OmaSheets** and **Try an example**.
+          Download **omasheets-bin-*.pkg.tar.zst** below. Install with \`sudo pacman -U ./omasheets-bin-*.pkg.tar.zst\` after a normal system update. Pacman installs dependencies and registers the desktop app. Launch **OmaSheets**, then choose **Try an example**.
+
+          Updates from downloaded packages use the same Pacman command with a newer package; removal uses \`sudo pacman -Rns omasheets-bin\`. AUR publication is separate: the attached **omasheets-aur-recipe.tar.gz** contains the pinned PKGBUILD and .SRCINFO for a maintainer. This release does not itself list the app in the AUR.
 
-          Future updates: **Help → Updates** inside the app. No terminal command, GitHub login or compiler is needed. For Omarchy on Linux x86_64; see INSTALL.md for details.
+          Existing home-directory installs: close OmaSheets, install the package, then run \`/usr/bin/omasheets migrate-user-install\` once. See INSTALL.md for migration and package-channel details.
           EOF
             gh release create "$tag" --target "$BUILD_SHA" --draft --prerelease \
               --title "Development build ${BUILD_SHA:0:12}" --notes-file notes.md
           fi
           gh release upload "$tag" bundle/*.tar.gz bundle/*.tar.gz.sha256 --clobber
+          gh release upload "$tag" arch/*.pkg.tar.zst arch/SHA256SUMS arch/*.tar.gz arch/*.sha256 --clobber
           gh release edit "$tag" --draft=false
 
   install-public:
-    name: Verify public desktop install
+    name: Verify public Pacman install
     needs: publish
     runs-on: ubuntu-latest
     container:
       image: archlinux:base
     steps:
       - name: Install runtime dependencies only
-        run: pacman -Syu --noconfirm --needed git curl jq python gtk3 libreoffice-fresh bubblewrap qt6-base qt6-declarative qt6-wayland xorg-server-xvfb
+        run: pacman -Syu --noconfirm --needed git curl jq xorg-server-xvfb ttf-dejavu
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.workflow_run.head_sha }}
@@ -88,12 +96,18 @@ jobs:
           BUILD_SHA: ${{ github.event.workflow_run.head_sha }}
         run: |
           unset GH_TOKEN GITHUB_TOKEN
-          curl -fsSL "https://github.com/tcballard/OmaSheets/releases/download/dev-$BUILD_SHA/OmaSheets-Setup-linux-x86_64.tar.gz" -o setup.tar.gz
-          tar -xzf setup.tar.gz
-          xvfb-run -a timeout 300 ./OmaSheets-Setup/omasheets-setup --install-test
-          "$HOME/.local/bin/omasheets" update
-          "$HOME/.local/bin/omasheets" doctor --json > doctor.json
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          version="0.0.2.r$(git show -s --format=%ct HEAD).g${BUILD_SHA:0:12}"
+          package="omasheets-bin-$version-1-x86_64.pkg.tar.zst"
+          url="https://github.com/tcballard/OmaSheets/releases/download/dev-$BUILD_SHA"
+          curl -fsSL "$url/$package" -o "$package"
+          curl -fsSL "$url/SHA256SUMS" -o SHA256SUMS
+          sha256sum --check SHA256SUMS
+          pacman -U --noconfirm "./$package"
+          useradd -m desktop
+          install -d -m 700 -o desktop -g desktop /tmp/omasheets-public-runtime
+          runuser -u desktop -- /usr/bin/omasheets doctor --json > doctor.json
           jq -e '.ready == true' doctor.json
-          jq -e ' .source.commit == env.BUILD_SHA ' "$HOME/.local/share/omasheets/app/provenance.json"
-          test -x "$HOME/.local/share/omasheets/app/bin/omasheets-update"
-          xvfb-run -a timeout 20 "$HOME/.local/share/omasheets/app/bin/omasheets-setup" --capture installed-setup.png
+          jq -e '.source.commit == env.BUILD_SHA' /usr/lib/omasheets/provenance.json
+          runuser -u desktop -- env XDG_RUNTIME_DIR=/tmp/omasheets-public-runtime OMASHEETS_UI_CAPTURE=/tmp/omasheets-public-runtime/welcome.png xvfb-run -a timeout 30 bash packaging/arch/capture.sh
+          test -s /tmp/omasheets-public-runtime/welcome.png

INSTALL.md

@@ -1,17 +1,60 @@
 # Install OmaSheets on Omarchy
 
-## Install from your desktop
+## Install the Arch package
 
 1. [Open the downloads page](https://github.com/tcballard/OmaSheets/releases).
-2. In the newest development build, download **OmaSheets-Setup-linux-x86_64.tar.gz**.
-3. Extract the archive and open **omasheets-setup** inside it. If your file manager asks, choose **Execute**.
-4. Choose **Install / update OmaSheets**. Setup shows progress and asks for system authentication if required packages are missing. This uses Arch's normal full system update to avoid a partial upgrade.
-5. Choose **Open OmaSheets**. The app is also available in the application launcher.
+2. Download **omasheets-bin-…-x86_64.pkg.tar.zst** from the newest development build.
+3. Update your system through Omarchy, then install the downloaded file:
 
-Setup requires Omarchy on Linux x86_64, its standard GTK 3 runtime, and an
-internet connection. It installs the app in your home directory. System
-package installation uses Polkit; cancelling authentication leaves the app
-installation unstarted. Failed downloads can be retried from the same window.
+   ```bash
+   sudo pacman -U ~/Downloads/omasheets-bin-*.pkg.tar.zst
+   ```
+
+   Keep only the package you intend to install in that wildcard, or use its exact filename.
+4. Open **OmaSheets** from your app launcher. Choose **Try an example** to learn the basics.
+
+Pacman installs the dependencies and owns the application, desktop entry and
+file-type registration. No compiler, source checkout, plugin or custom Setup
+app is required. Workbooks and preferences remain in your home directory.
+The package does not change your preferred application for existing Excel files.
+
+### Updates and removal
+
+For downloaded packages, download a newer build and repeat `pacman -U`.
+A standalone downloaded package does **not** gain automatic repository updates.
+Remove it through **Omarchy → Remove → Package**, or:
+
+```bash
+sudo pacman -Rns omasheets-bin
+```
+
+Removing the package leaves your workbooks and preferences intact.
+**Help → Updates** explains the installed package's update options.
+
+### Install through Omarchy's AUR menu
+
+This requires publishing `omasheets-bin` to the AUR first. Until that is done,
+it will not appear in **Install → AUR**, and `yay -S omasheets-bin` is not an
+available installation instruction. Each release includes a pinned
+**omasheets-aur-recipe.tar.gz** ready for an AUR maintainer to publish.
+After publication, the AUR menu can install it and Omarchy's normal AUR updates
+can update it. [Maintainer instructions](packaging/arch/README.md).
+
+### Move your existing installation to Pacman
+
+Close OmaSheets and stop its optional user service if you enabled one. Install
+the package above, then run this **once as your normal user**:
+
+```bash
+/usr/bin/omasheets migrate-user-install
+```
+
+This uses the old installer's ownership records to remove its app, launchers,
+desktop overrides and automatically installed Codex plugin. It preserves
+workbooks and unrelated configuration, and reports modified files instead of
+deleting them. Run `hash -r` afterwards if your shell cached the old launcher.
+The standalone package includes MCP through `omasheets mcp serve`; agent
+configuration is optional and is not written by Pacman as root.
 
 ### Your first workbook
 
@@ -26,15 +69,15 @@ Excel and OpenDocument files have a separate opener on the welcome screen.
 Importing an Excel file creates a native copy and shows a report of features
 that could not be preserved.
 
-### Update from the app
+### Older home-directory installations
 
-Choose **Help → Updates**, confirm closing the current window, and use Setup.
+For the older custom installation only: choose **Help → Updates**, confirm closing the current window, and use Setup.
 Close other OmaSheets windows before installing. Setup downloads and verifies
 the latest passing development build, preserves workbooks, and offers to
 reopen the app afterwards. If you enabled the optional systemd service,
 stop it before updating; a running service is reported instead of replaced.
 
-## Optional terminal installation
+## Legacy home-directory installer
 
 Close any OmaSheets windows, then install or update the development build:
 

README.md

@@ -18,7 +18,7 @@ what cannot be preserved; it does not promise full Excel fidelity.
 from the app launcher or run `omasheets`. Create a workbook with **Ctrl+N**,
 open one with **Ctrl+O**, and press **F1** for the keyboard guide. Native edits
 save when you finish each cell; the File menu offers import and export.
-[Download the desktop installer](https://github.com/tcballard/OmaSheets/releases) and choose **Try an example** for a guided first workbook.
+[Install the Arch package](INSTALL.md) and choose **Try an example** for a guided first workbook.
 Published development builds need no GitHub login or local compiler; the
 published v0.0.2 release remains the older compatibility baseline.
 

bin/omasheets-install

@@ -2,6 +2,11 @@
 # Install the newest public development build; production releases retain their signed installer.
 set -euo pipefail
 
+if command -v pacman >/dev/null && pacman -Q omasheets-bin >/dev/null 2>&1; then
+  echo 'OmaSheets is managed by Pacman. Use Omarchy Update for AUR installs, or pacman -U with a newer downloaded package.' >&2
+  exit 1
+fi
+
 for tool in curl jq git sha256sum; do
   command -v "$tool" >/dev/null || { echo "Missing $tool. Install it and run this command again." >&2; exit 1; }
 done

bin/omasheets-plugin

@@ -3,6 +3,13 @@ set -euo pipefail
 
 plugin_root=$(cd -- "$(dirname -- "$0")/.." && pwd -P)
 launcher="${HOME}/.local/bin/omasheets"
+if [[ -f /usr/lib/omasheets/package-manager ]]; then
+  launcher=/usr/bin/omasheets
+  case "${1:-}" in
+    install | doctor) exec "$launcher" doctor ;;
+    uninstall) exec "$launcher" uninstall ;;
+  esac
+fi
 
 case "${1:-}" in
 install)

packaging/arch/PKGBUILD.in

@@ -0,0 +1,18 @@
+# Maintainer: Tom Ballard
+pkgname=omasheets-bin
+pkgver=@VERSION@
+pkgrel=1
+pkgdesc='Native spreadsheets for Omarchy with reviewable agent changes (development preview)'
+arch=('x86_64')
+url='https://github.com/tcballard/OmaSheets'
+license=('MIT')
+depends=('python' 'gtk3' 'libreoffice-fresh' 'bubblewrap' 'qt6-base' 'qt6-declarative' 'qt6-wayland' 'desktop-file-utils' 'shared-mime-info')
+provides=('omasheets')
+conflicts=('omasheets')
+options=('!strip' '!debug')
+source=("omasheets-runtime-${pkgver}-x86_64.tar.gz::https://github.com/tcballard/OmaSheets/releases/download/dev-@COMMIT@/omasheets-runtime-${pkgver}-x86_64.tar.gz")
+sha256sums=('@CHECKSUM@')
+
+package() {
+  cp -a usr "$pkgdir/"
+}

packaging/arch/README.md

@@ -0,0 +1,42 @@
+# Arch distribution
+
+CI reuses the verified native bundle to create a runtime tarball, then runs
+`makepkg` as an unprivileged user. The resulting `omasheets-bin` package owns
+`/usr/lib/omasheets`, two commands in `/usr/bin`, desktop/MIME entries and the
+license. Standard Arch hooks refresh the desktop and MIME databases. There
+are no root install scripts and no writes to a user's home directory.
+
+The package omits the custom Setup/updater. Python modules live in a private
+directory so a system Python minor-version upgrade does not strand them in an
+old site-packages directory. Native binaries keep their verified provenance.
+
+CI tests migration from the old install, Pacman installation, desktop checks,
+an ordinary user's doctor and native window, the full service workflow,
+upgrade to a higher pkgrel, removal and preservation of user files. Main CI
+must pass before publication; another job downloads and installs the public
+package without GitHub credentials.
+
+## AUR publication
+
+Publishing a GitHub release does not publish to the AUR. An AUR account and
+its registered SSH key are required. No AUR credentials are stored here.
+
+1. Download `omasheets-aur-recipe.tar.gz` from the intended passing release.
+2. Inspect the extracted `PKGBUILD` and `.SRCINFO`. They pin the immutable
+   release URL, version and SHA-256 of the runtime archive; no `SKIP` checksums
+   or downloads of a moving `main` branch are used.
+3. In the maintainer's `ssh://aur@aur.archlinux.org/omasheets-bin.git` checkout,
+   copy those two files, commit and push. Do not push the binaries to the AUR.
+4. Verify the public AUR entry before advertising `yay -S omasheets-bin` or
+   Omarchy's **Install → AUR** route. Publish a new recipe for each intended
+   update so AUR helpers see the newer version.
+
+Development package versions use the source commit timestamp plus its short
+SHA (`0.0.2.r<TIMESTAMP>.g<SHA>`). A later `0.1.0` sorts above these previews.
+This channel remains a development preview and does not bypass the separate
+signed production release gates. AUR source checksums verify downloaded bytes;
+they are not a maintainer signature on a production release.
+
+References: [Omarchy AUR picker](https://github.com/basecamp/omarchy/blob/master/bin/omarchy-pkg-aur-install),
+[Arch package guidelines](https://wiki.archlinux.org/title/Arch_package_guidelines),
+[AUR submission](https://wiki.archlinux.org/title/AUR_submission_guidelines).

packaging/arch/build.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+# Prepare a verified system payload and an AUR recipe. Run makepkg as a user.
+set -euo pipefail
+root=$(git rev-parse --show-toplevel)
+archive=$(realpath "$1")
+output=$(realpath -m "$2")
+mkdir -p "$output"
+stage=$(mktemp -d)
+trap 'rm -rf "$stage"' EXIT
+commit=$(git rev-parse HEAD)
+version="0.0.2.r$(git show -s --format=%ct HEAD).g${commit:0:12}"
+export SOURCE_DATE_EPOCH
+SOURCE_DATE_EPOCH=$(git show -s --format=%ct HEAD)
+
+# Reuse the existing allowlist, checksum and executable provenance verifier.
+PYTHONPATH="$root/src" python - "$root" "$archive" "$stage" <<'PY'
+import json
+import shutil
+import sys
+from pathlib import Path
+from omasheets import __version__
+from omasheets.installation import source_identity, _launcher
+from omasheets.integration import DESKTOP_ENTRY, DESKTOP_ID, MIME_PACKAGE
+from omasheets.native_bundle import install_native_bundle
+
+root, archive, stage = map(Path, sys.argv[1:])
+app = stage / 'usr/lib/omasheets'
+identity = source_identity(root)
+manifest = install_native_bundle(archive, app, version=__version__, source=identity)
+# Package updates belong to Pacman. Never ship the home-directory setup here.
+(app / 'bin/omasheets-setup').unlink()
+shutil.copytree(root / 'src/omasheets', app / 'lib/omasheets',
+                ignore=shutil.ignore_patterns('__pycache__', '*.pyc'))
+(app / 'package-manager').write_text('pacman\n')
+(app / 'provenance.json').write_text(json.dumps({'source': identity, 'native_bundle': manifest}) + '\n')
+bin_dir = stage / 'usr/bin'
+bin_dir.mkdir(parents=True)
+(bin_dir / 'omasheets').write_bytes(_launcher(Path('/usr/lib/omasheets')))
+(bin_dir / 'omasheets').chmod(0o755)
+(bin_dir / 'omasheets-service').symlink_to('../lib/omasheets/bin/omasheets-service')
+desktop = stage / 'usr/share/applications' / DESKTOP_ID
+desktop.parent.mkdir(parents=True)
+desktop.write_text(DESKTOP_ENTRY.replace('Exec=omasheets ', 'Exec=/usr/bin/omasheets '))
+mime = stage / 'usr/share/mime/packages/io.github.tcballard.OmaSheets.xml'
+mime.parent.mkdir(parents=True)
+mime.write_bytes(MIME_PACKAGE)
+license = stage / 'usr/share/licenses/omasheets-bin/LICENSE'
+license.parent.mkdir(parents=True)
+shutil.copyfile(root / 'LICENSE', license)
+PY
+payload="omasheets-runtime-$version-x86_64.tar.gz"
+tar --sort=name --mtime="@$SOURCE_DATE_EPOCH" --owner=0 --group=0 --numeric-owner \
+  -C "$stage" -czf "$output/$payload" usr
+checksum=$(sha256sum "$output/$payload" | cut -d' ' -f1)
+sed -e "s/@VERSION@/$version/g" -e "s/@COMMIT@/$commit/g" -e "s/@CHECKSUM@/$checksum/g" \
+  "$root/packaging/arch/PKGBUILD.in" > "$output/PKGBUILD"
+(cd "$output" && sha256sum "$payload" > "$payload.sha256")
+printf 'Prepared %s and PKGBUILD in %s\n' "$payload" "$output"

packaging/arch/capture.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+# The desktop launcher returns immediately; keep Xvfb alive for its child.
+set -euo pipefail
+/usr/bin/omasheets
+for _ in {1..200}; do
+  if [[ -s $OMASHEETS_UI_CAPTURE && ! -S $XDG_RUNTIME_DIR/omasheets/native.sock ]]; then
+    exit 0
+  fi
+  sleep 0.1
+done
+echo 'The installed window did not render and shut down within 20 seconds.' >&2
+exit 1