7 Commits

Author SHA1 Message Date
8aaf7cae5b fix: audit MEDIUM fixes — merge fallback, service hardening, CI token
- moonarch-waybar: on merge failure, remove the stale output so waybar
  falls back to the system config (previously it kept running with stale
  merged data despite the error notification claiming otherwise).
- moonarch-doctor: hoist INSTALLED assignment above both OFFICIAL and AUR
  blocks so the script survives set -u when only aur.txt is present.
- zshrc parse_git_branch: gate on git rev-parse and replace three grep
  subshells with bash pattern matching, cutting prompt latency from
  ~5 subprocesses per render to 2 (status + symbolic-ref).
- moonarch-batsaver.service: validate the threshold is an integer 1-100
  before writing to sysfs, add NoNewPrivileges and protection directives
  instead of relying on kernel validation alone.
- ci/act-runner/Dockerfile: drop the broad "pacman -Sy *" sudoers entry
  (only -S --needed is required by makepkg), and pin run.sh to
  act_runner:0.3.1 so it cannot drift ahead of the pinned binary.
- .gitea/workflows/update-pkgver.yaml: push via credential.helper=store
  with a chmod 600 temp file instead of `git -c http.extraHeader=...`,
  so the token no longer shows up in /proc/PID/cmdline.
2026-04-24 13:15:52 +02:00
ee85b87d3a fix: signal waybar after wlsunset starts to update nightlight icon
Waybar starts before wlsunset (due to ExecStartPre sleep) and only
checks the service status once. ExecStartPost sends SIGRTMIN+11 so
waybar refreshes the nightlight module after wlsunset is ready.
2026-04-16 10:36:05 +02:00
0433f08f08 feat: manage wlsunset via systemd user service
All checks were successful
Update PKGBUILD version / update-pkgver (push) Successful in 4s
Move nightlight from niri spawn-at-startup to a systemd user service
with After=kanshi.service to ensure all outputs are configured before
wlsunset starts. Toggle now uses enable/disable --now for persistent
state across reboots.
2026-04-14 17:42:24 +02:00
b8753bf84f fix: remove docker from defaults, fix cliphist-image ordering cycle
Docker is a dev dependency, not a desktop environment default. Remove
from package list, archinstall config, services and README.

Fix systemd ordering cycle that prevented cliphist-image from starting:
cliphist-text had After=graphical-session.target which combined with
PartOf= and cliphist-image's After=cliphist-text created a cycle.
2026-04-10 08:18:55 +02:00
ac2b210a1f fix: audit remediation — security, quality and performance fixes
All checks were successful
Update PKGBUILD version / update-pkgver (push) Successful in 3s
- CI Dockerfile: verify act_runner SHA256, restrict sudoers to safe
  pacman arguments (S-C1, S-C2)
- cliphist: split into cliphist-text + cliphist-image services with
  Type=simple for proper PID tracking and restart (Q-C3)
- batsaver-toggle: validate sysfs input as numeric, check state file
  write (Q-C2, S-W2)
- udev battery rule: add ACTION=="add" filter to avoid firing on
  every battery event (Q-W3)
- cpugov: replace eval with direct expansion, switch waybar module
  to signal-based updates, send SIGRTMIN+10 after toggle (Q-W1,
  S-W1, P-W4)
- Remove docker group auto-assignment from install scripts (S-I1)
2026-04-08 11:45:56 +02:00
579a948449 feat: add battery conservation mode with Waybar toggle
All checks were successful
Update PKGBUILD version / update-pkgver (push) Successful in 2s
Laptops with charge_control_end_threshold support get a click-to-toggle
on the battery module (80% ↔ 100%). A ♥ icon appears when conservation
is active, hidden when inactive. State persists across reboots via
systemd oneshot service. udev rule grants wheel group write access
so no sudo is needed for toggling.
2026-04-08 09:55:46 +02:00
80c395fc14 feat: add cliphist service, move user services to /etc/systemd/user/
All checks were successful
Update PKGBUILD version / update-pkgver (push) Successful in 2s
- Add cliphist.service that wipes clipboard history on session start
  (crash-safe: cleans up at next boot, not at shutdown)
- Move kanshi, walker, nautilus services from ~/.config/systemd/user/
  to /etc/systemd/user/ (system-level defaults, consistent with
  moonarch's config philosophy)
- Remove cliphist spawn-sh-at-startup from niri config (managed by
  systemd service now)
- Add cliphist to USER_SERVICES in post-install.sh and transform.sh

Closes #1
2026-04-07 11:27:49 +02:00