fix: fail safely when AUR synchronization fails

autoupdate.sh

@@ -9,7 +9,6 @@
 #     NO_GIT_PUSH=1  do everything except push (dry run)
 #     FORCE_REBUILD=1  bump pkgrel even with no detected change
 #     FORCE_REFRESH=1  re-download remote sources even without a version change
-#     AUR_FORCE=1    force-push over diverged AUR history
 #
 # This is a RECONCILER, not a version-bump script. A new upstream release is
 # only one of the things that can make a package diverge from the AUR; a manual
@@ -93,7 +92,11 @@ update_one() {
   # A failure in here exits non-zero and is NOT mistaken for "no new version".
   local oldver newver
   oldver="$(pkgbuild_get pkgver)"
-  newver="$("$LATEST_VERSION_CMD" .)"
+  # Checked explicitly rather than leaning on `set -e`, so the failure is
+  # attributed to the lookup instead of surfacing several steps later as an
+  # unrelated .SRCINFO complaint.
+  newver="$("$LATEST_VERSION_CMD" .)" || die "upstream version lookup failed for ${pkg}"
+  validate_version "$newver" "upstream version for ${pkg}"
   info "upstream ${newver}, local ${oldver:-<empty>}"
 
   local version_changed=0
@@ -267,8 +270,28 @@ extract_appimage_assets() {
   rm -rf "$(readlink -f "${tmp}/squashfs-root" 2>/dev/null || true)" "$tmp"
 }
 
+# One package per process, deliberately.
+#
+# The obvious `( update_one "$pkg" ) || { rc=1; ... }` is broken: putting a
+# subshell in an && / || list disables `set -e` for its ENTIRE body, not just
+# for the subshell as a unit. update_one then sails past a failed sync-aur.sh
+# straight into `git push origin`, which is precisely the "origin ahead of the
+# AUR" state this whole tool exists to avoid -- and it happened in production.
+#
+#   inner() { echo start; false; echo "REACHED CODE AFTER FAILURE"; }
+#   ( inner ) || echo caught     # prints REACHED CODE AFTER FAILURE
+#   ( inner )                    # correctly aborts
+#
+# Re-exec'ing gives each package a fresh shell whose `set -e` is intact; the
+# parent's AND-OR context cannot reach across a process boundary. The CI matrix
+# already passes exactly one package, so the loop only affects local runs.
+if [ -n "${AUTOUPDATE_SINGLE:-}" ]; then
+  update_one "$1"
+  exit 0
+fi
+
 rc=0
 for pkg in "$@"; do
-  ( update_one "$pkg" ) || { rc=1; warn "${pkg} FAILED"; }
+  AUTOUPDATE_SINGLE=1 "$0" "$pkg" || { rc=1; warn "${pkg} FAILED"; }
 done
 exit "$rc"