ci: take the package list from the UPDATE_PACKAGES variable instead of the matrix

README.md

@@ -18,7 +18,7 @@ three take the same path, and the AUR reconcile runs on every pass.
 | `sync-aur.sh` | reconciles the repo against the AUR |
 | `common.sh` | logging, guards, PKGBUILD parsing and array splicing |
 | `test.sh` | hermetic test suite |
-| `.gitea/workflows/update.yaml` | nightly matrix job |
+| `.gitea/workflows/update.yaml` | nightly job: `plan` reads `UPDATE_PACKAGES`, `update` runs one matrix entry per package |
 
 Nothing here is package-specific. Everything that differs between packages
 lives in a `.autoupdate` manifest committed to the package repo itself.
@@ -40,6 +40,42 @@ icon="reflex.png"
 It rides along to the AUR on push, as `README.md` and `LICENSE` already do.
 Harmless: the AUR reads only `PKGBUILD` and `.SRCINFO`.
 
+## Package list
+
+The nightly job updates the packages named in the Gitea Actions variable
+`UPDATE_PACKAGES`; nothing in this repo lists them. Set it on the `aur` org
+(Settings -> Actions -> Variables), which is the recommended place; a variable
+of the same name on `aur/.autoupdate` itself overrides the org one.
+
+One package per line. A leading `- ` is optional, so YAML-list lines and bare
+names both work and can be mixed; blank lines and `#` comments (whole-line or
+trailing) are ignored, and duplicates are dropped. A name must match
+`^[A-Za-z0-9][A-Za-z0-9._+-]*$`, otherwise the run fails naming it. The
+current value:
+
+```
+- nethlink-appimage
+- open-video-downloader-appimage
+- open-video-downloader-bin
+- pman-helper
+- reflex-appimage
+- tsparams
+```
+
+Add `- skeptical-updater` once `source/skeptical-updater` has its first tag.
+Until then its version lookup finds no tag, which is a failed lookup (see
+[Exit codes](#exit-codes)) and would turn that matrix job red every night.
+
+The workflow's `plan` job turns the variable into the `update` matrix, one job
+per package. A manual run's `package` input (Actions -> Update AUR Packages ->
+Run workflow) overrides the variable and runs that one package only, listed or
+not. An unset or empty variable fails the run on purpose: an empty matrix
+would pass and look exactly like a night with nothing to update.
+
+This needs Gitea 28.0 or newer, the first release that expands a matrix from
+another job's outputs. Older servers expand it before `plan` has run, start a
+single `update` job with an empty package name, and that job fails.
+
 ## What a run does
 
 1. Clone the package repo, read its manifest.
@@ -116,8 +152,8 @@ immediately instead of taking a silently wrong branch further in.
 ## Container image
 
 `dockerfile` builds the environment the nightly job runs in, published to the
-Gitea registry as `git.bjphoster.com/aur/autoupdate:latest`. Without it, all six
-matrix jobs would run a full `pacman` transaction every night.
+Gitea registry as `git.bjphoster.com/aur/autoupdate:latest`. Without it, every
+matrix job would run a full `pacman` transaction every night.
 
 `.gitea/workflows/build-image.yaml` rebuilds and overwrites `:latest` monthly
 (Arch is rolling, so a month-old image is a month behind), on any push touching