home-server/roles/init/files/bin/etc_stop_upstream

#!/usr/bin/env bash
# The home-server project produces a multi-purpose setup using Ansible.
# Copyright © 2018–2023 Y. Gablin, under the GPL-3.0-or-later license.
# Full licensing information in the LICENSE file, or gnu.org/licences/gpl-3.0.txt if the file is missing.

. "$(dirname "$0")/.etc_checkroot.inc"
cd /etc

# where are we in the history tree?
ancestor=$(git merge-base run master)
curhead=$(git rev-parse HEAD)

# restore the “master”-state of “run”-files that were needed in order to update “master”
for f in pacman.conf pacman.d/mirrorlist ssh/sshd_config; do
  if git ls-tree --name-only -r $ancestor | grep -qxF "$f"; then
    git checkout $ancestor -- "$f"
  else
    rm -f "$f"
  fi
done

# automatically accept new versions of files that were seen as changed because of the above hack
find . -name '*.pacnew' -exec bash -c 'mv -f "$0" "${0%.pacnew}"' {} \;

# enforce local policy in case etckeeper was updated
local_policy='etckeeper/post-install.d/00-local-policy'
for d in list-installed.d post-install.d pre-install.d; do
  chmod a-x etckeeper/$d/[0-9][0-9]*
done
[ -x "$local_policy" ] || { \
  cat >"$local_policy" <<-"END"
#!/bin/sh
pacman -Q >/etc/etckeeper/packages.list
END
  chmod 755 "$local_policy"
}

# commit the changes
amend=
if etckeeper unclean; then
  git add -A
  if [ "$ancestor" != "$curhead" ]; then
    amend=--amend
  fi
  git commit -m "upstream $(date -Iseconds)${1:+: $1}" $amend
fi

# switch to branch “run” and merge “master”
git checkout run
git merge master -Xtheirs -m "merge $(date -Iseconds)${1:+: $1}"

# if no errors occurred, restore the uncommited changed that were stashed
status=$?
if [ $status -eq 0 ]; then
  stash=$(git stash list | grep -F etc_local_unclean | cut -d: -f1)
  if [ -n "$stash" ]; then
    git stash pop --index "$stash"
    status=$?
  fi
fi

# restore empty directories and file modes
etckeeper init
systemctl daemon-reload
exit $status