Release version 0.7.5

In GitHub's Fedora-based CI containers the directory /nix may already exist
(e.g. from the base image or a previous build layer) and is often owned by
root:root. In this situation the Nix single-user installer aborts with:

    "directory /nix exists, but is not writable by you"

This caused the container build to fail during `init-nix.sh`, leaving no
working `nix` binary on PATH. As a result, the runtime wrapper
(pkmgr-wrapper.sh) reported:

    "[pkgmgr-wrapper] ERROR: 'nix' binary not found on PATH."

Local runs did not show the issue because a previous installation had already
created /nix with correct ownership.

This commit makes container-mode Nix initialization fully idempotent:

  • If /nix does not exist → create it with owner nix:nixbld (existing logic).
  • If /nix exists but has wrong owner/group → forcibly chown -R nix:nixbld.
  • A warning is emitted if /nix remains non-writable after correction.

This guarantees that the Nix installer always has writable access to /nix
and prevents the installer from aborting in CI. As a result, `pkgmgr --help`
works again inside Fedora CI containers.

https://chatgpt.com/share/69384149-9dc8-800f-8148-55817ece8e21

.github/workflows/test-container.yml

@@ -1,4 +1,4 @@
-name: Test Distribution Containers
+name: Test OS Containers
 
 on:
   push:

.github/workflows/test-e2e.yml

@@ -1,4 +1,4 @@
-name: Test package-manager (e2e)
+name: Test End-To-End
 
 on:
   push:

.github/workflows/test-integration.yml

@@ -1,4 +1,4 @@
-name: Test package-manager (integration)
+name: Test Code Integration
 
 on:
   push:
@@ -21,9 +21,5 @@ jobs:
       - name: Show Docker version
         run: docker version
 
-      # Build Arch test image (same as used in test-unit and test-e2e)
-      - name: Build test images
-        run: make build
-
       - name: Run integration tests via make (Arch container)
-        run: make test-integration
+        run: make test-integration DISTROS="arch"

.github/workflows/test-unit.yml

@@ -1,4 +1,4 @@
-name: Test package-manager (unit)
+name: Test Units
 
 on:
   push:
@@ -22,4 +22,4 @@ jobs:
         run: docker version
 
       - name: Run unit tests via make (Arch container)
-        run: make test-unit
+        run: make test-unit DISTROS="arch"

CHANGELOG.md

@@ -1,3 +1,18 @@
+## [0.7.5] - 2025-12-09
+
+* Fixed wrong directory permissions for nix
+
+
+## [0.7.4] - 2025-12-09
+
+* Fixed missing build in test workflow -> Tests pass now
+
+
+## [0.7.3] - 2025-12-09
+
+* Fixed bug: Ignored packages are now ignored
+
+
 ## [0.7.2] - 2025-12-09
 
 * Implemented Changelog Support for Fedora and Debian

Makefile

@@ -46,16 +46,16 @@ build:
 # Test targets (delegated to scripts/test)
 # ------------------------------------------------------------
 
-test-unit:
+test-unit: build-missing
 	@bash scripts/test/test-unit.sh
 
-test-integration:
+test-integration: build-missing
 	@bash scripts/test/test-integration.sh
 
-test-e2e:
+test-e2e: build-missing
 	@bash scripts/test/test-e2e.sh
 
-test-container:
+test-container: build-missing
 	@bash scripts/test/test-container.sh
 
 # ------------------------------------------------------------
@@ -65,7 +65,7 @@ build-missing:
 	@bash scripts/build/build-image-missing.sh
 
 # Combined test target for local + CI (unit + e2e + integration)
-test: build-missing test-container test-unit test-e2e test-integration
+test: test-container test-unit test-e2e test-integration
 
 # ------------------------------------------------------------
 # System install (native packages, calls scripts/installation/run-package.sh)

PKGBUILD

@@ -1,7 +1,7 @@
 # Maintainer: Kevin Veen-Birkenbach <info@veen.world>
 
 pkgname=package-manager
-pkgver=0.7.2
+pkgver=0.7.5
 pkgrel=1
 pkgdesc="Local-flake wrapper for Kevin's package-manager (Nix-based)."
 arch=('any')

debian/changelog

@@ -1,3 +1,21 @@
+package-manager (0.7.5-1) unstable; urgency=medium
+
+  * Fixed wrong directory permissions for nix
+
+ -- Kevin Veen-Birkenbach <kevin@veen.world>  Tue, 09 Dec 2025 16:45:42 +0100
+
+package-manager (0.7.4-1) unstable; urgency=medium
+
+  * Fixed missing build in test workflow -> Tests pass now
+
+ -- Kevin Veen-Birkenbach <kevin@veen.world>  Tue, 09 Dec 2025 16:22:00 +0100
+
+package-manager (0.7.3-1) unstable; urgency=medium
+
+  * Fixed bug: Ignored packages are now ignored
+
+ -- Kevin Veen-Birkenbach <kevin@veen.world>  Tue, 09 Dec 2025 16:08:31 +0100
+
 package-manager (0.7.2-1) unstable; urgency=medium
 
   * Implemented Changelog Support for Fedora and Debian

flake.nix

@@ -31,7 +31,7 @@
         rec {
           pkgmgr = pyPkgs.buildPythonApplication {
             pname   = "package-manager";
-            version = "0.7.2";
+            version = "0.7.5";
 
             # Use the git repo as source
             src = ./.;

package-manager.spec

@@ -1,5 +1,5 @@
 Name:           package-manager
-Version:        0.7.2
+Version:        0.7.5
 Release:        1%{?dist}
 Summary:        Wrapper that runs Kevin's package-manager via Nix flake
 
@@ -77,6 +77,15 @@ echo ">>> package-manager removed. Nix itself was not removed."
 /usr/lib/package-manager/
 
 %changelog
+* Tue Dec 09 2025 Kevin Veen-Birkenbach <kevin@veen.world> - 0.7.5-1
+- Fixed wrong directory permissions for nix
+
+* Tue Dec 09 2025 Kevin Veen-Birkenbach <kevin@veen.world> - 0.7.4-1
+- Fixed missing build in test workflow -> Tests pass now
+
+* Tue Dec 09 2025 Kevin Veen-Birkenbach <kevin@veen.world> - 0.7.3-1
+- Fixed bug: Ignored packages are now ignored
+
 * Tue Dec 09 2025 Kevin Veen-Birkenbach <kevin@veen.world> - 0.7.2-1
 - Implemented Changelog Support for Fedora and Debian
 

pkgmgr/core/repository/selected.py

@@ -8,6 +8,7 @@ import re
 from typing import Any, Dict, List, Sequence
 
 from pkgmgr.core.repository.resolve import resolve_repos
+from pkgmgr.core.repository.ignored import filter_ignored
 
 Repository = Dict[str, Any]
 
@@ -88,7 +89,7 @@ def _apply_filters(
             if not _match_pattern(ident_str, string_pattern):
                 continue
 
-        # Category filter: nur echte Kategorien, KEINE Tags
+        # Category filter: only real categories, NOT tags
         if category_patterns:
             cats: List[str] = []
             cats.extend(map(str, repo.get("category_files", [])))
@@ -106,7 +107,7 @@ def _apply_filters(
             if not ok:
                 continue
 
-        # Tag filter: ausschließlich YAML-Tags
+        # Tag filter: YAML tags only
         if tag_patterns:
             tags: List[str] = list(map(str, repo.get("tags", [])))
             if not tags:
@@ -124,16 +125,38 @@ def _apply_filters(
 
     return filtered
 
+
+def _maybe_filter_ignored(args, repos: List[Repository]) -> List[Repository]:
+    """
+    Apply ignore filtering unless the caller explicitly opted to include ignored
+    repositories (via args.include_ignored).
+
+    Note: this helper is used only for *implicit* selections (all / filters /
+    by-directory). For *explicit* identifiers we do NOT filter ignored repos,
+    so the user can still target them directly if desired.
+    """
+    include_ignored: bool = bool(getattr(args, "include_ignored", False))
+    if include_ignored:
+        return repos
+    return filter_ignored(repos)
+
+
 def get_selected_repos(args, all_repositories: List[Repository]) -> List[Repository]:
     """
     Compute the list of repositories selected by CLI arguments.
 
     Modes:
       - If identifiers are given: select via resolve_repos() from all_repositories.
-      - Else if any of --category/--string/--tag is used: start from all_repositories
-        and apply filters.
-      - Else if --all is set: select all_repositories.
-      - Else: try to select the repository of the current working directory.
+        Ignored repositories are *not* filtered here, so explicit identifiers
+        always win.
+      - Else if any of --category/--string/--tag is used: start from
+        all_repositories, apply filters and then drop ignored repos.
+      - Else if --all is set: select all_repositories and then drop ignored repos.
+      - Else: try to select the repository of the current working directory
+        and then drop it if it is ignored.
+
+    The ignore filter can be bypassed by setting args.include_ignored = True
+    (e.g. via a CLI flag --include-ignored).
     """
     identifiers: List[str] = getattr(args, "identifiers", []) or []
     use_all: bool = bool(getattr(args, "all", False))
@@ -143,18 +166,25 @@ def get_selected_repos(args, all_repositories: List[Repository]) -> List[Reposit
 
     has_filters = bool(category_patterns or string_pattern or tag_patterns)
 
-    # 1) Explicit identifiers win
+    # 1) Explicit identifiers win and bypass ignore filtering
     if identifiers:
         base = resolve_repos(identifiers, all_repositories)
         return _apply_filters(base, string_pattern, category_patterns, tag_patterns)
 
     # 2) Filter-only mode: start from all repositories
     if has_filters:
-        return _apply_filters(list(all_repositories), string_pattern, category_patterns, tag_patterns)
+        base = _apply_filters(
+            list(all_repositories),
+            string_pattern,
+            category_patterns,
+            tag_patterns,
+        )
+        return _maybe_filter_ignored(args, base)
 
     # 3) --all (no filters): all repos
     if use_all:
-        return list(all_repositories)
+        base = list(all_repositories)
+        return _maybe_filter_ignored(args, base)
 
     # 4) Fallback: try to select repository of current working directory
     cwd = os.path.abspath(os.getcwd())
@@ -164,7 +194,7 @@ def get_selected_repos(args, all_repositories: List[Repository]) -> List[Reposit
         if os.path.abspath(str(repo.get("directory", ""))) == cwd
     ]
     if by_dir:
-        return by_dir
+        return _maybe_filter_ignored(args, by_dir)
 
     # No specific match -> empty list
     return []

pyproject.toml

@@ -7,7 +7,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "package-manager"
-version = "0.7.2"
+version = "0.7.5"
 description = "Kevin's package-manager tool (pkgmgr)"
 readme = "README.md"
 requires-python = ">=3.11"

scripts/init-nix.sh

@@ -97,11 +97,32 @@ if [[ "${IN_CONTAINER}" -eq 1 && "${EUID:-0}" -eq 0 ]]; then
     useradd -m -r -g nixbld -s /usr/bin/bash nix
   fi
 
-  # Create /nix directory and hand it to nix user (prevents installer sudo prompt)
+  # Ensure /nix exists and is writable by the "nix" user.
+  #
+  # In some base images (or previous runs), /nix may already exist and be
+  # owned by root. In that case the Nix single-user installer will abort with:
+  #
+  #   "directory /nix exists, but is not writable by you"
+  #
+  # To keep container runs idempotent and robust, we always enforce
+  # ownership nix:nixbld here.
   if [[ ! -d /nix ]]; then
     echo "[init-nix] Creating /nix with owner nix:nixbld..."
     mkdir -m 0755 /nix
     chown nix:nixbld /nix
+  else
+    current_owner="$(stat -c '%U' /nix 2>/dev/null || echo '?')"
+    current_group="$(stat -c '%G' /nix 2>/dev/null || echo '?')"
+    if [[ "${current_owner}" != "nix" || "${current_group}" != "nixbld" ]]; then
+      echo "[init-nix] /nix already exists with owner ${current_owner}:${current_group} – fixing to nix:nixbld..."
+      chown -R nix:nixbld /nix
+    else
+      echo "[init-nix] /nix already exists with correct owner nix:nixbld."
+    fi
+
+    if [[ ! -w /nix ]]; then
+      echo "[init-nix] WARNING: /nix is still not writable after chown; Nix installer may fail."
+    fi
   fi
 
   # Run Nix single-user installer as "nix"

tests/unit/pkgmgr/core/repository/test_ignored.py

@@ -0,0 +1,29 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+import unittest
+
+from pkgmgr.core.repository.ignored import filter_ignored
+
+
+class TestFilterIgnored(unittest.TestCase):
+    def test_filter_ignored_removes_repos_with_ignore_true(self) -> None:
+        repos = [
+            {"provider": "github.com", "account": "user", "repository": "a", "ignore": True},
+            {"provider": "github.com", "account": "user", "repository": "b", "ignore": False},
+            {"provider": "github.com", "account": "user", "repository": "c"},
+        ]
+
+        result = filter_ignored(repos)
+
+        identifiers = {(r["provider"], r["account"], r["repository"]) for r in result}
+        self.assertNotIn(("github.com", "user", "a"), identifiers)
+        self.assertIn(("github.com", "user", "b"), identifiers)
+        self.assertIn(("github.com", "user", "c"), identifiers)
+
+    def test_filter_ignored_empty_list_returns_empty_list(self) -> None:
+        self.assertEqual(filter_ignored([]), [])
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/unit/pkgmgr/core/repository/test_selected.py

@@ -0,0 +1,180 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+
+import os
+import unittest
+from types import SimpleNamespace
+from unittest.mock import patch
+
+from pkgmgr.core.repository.selected import get_selected_repos
+
+
+def _repo(
+    provider: str,
+    account: str,
+    repository: str,
+    ignore: bool | None = None,
+    directory: str | None = None,
+):
+    repo = {
+        "provider": provider,
+        "account": account,
+        "repository": repository,
+    }
+    if ignore is not None:
+        repo["ignore"] = ignore
+    if directory is not None:
+        repo["directory"] = directory
+    return repo
+
+
+class TestGetSelectedRepos(unittest.TestCase):
+    def setUp(self) -> None:
+        self.repo_ignored = _repo(
+            "github.com",
+            "user",
+            "ignored-repo",
+            ignore=True,
+            directory="/repos/github.com/user/ignored-repo",
+        )
+        self.repo_visible = _repo(
+            "github.com",
+            "user",
+            "visible-repo",
+            ignore=False,
+            directory="/repos/github.com/user/visible-repo",
+        )
+        self.all_repos = [self.repo_ignored, self.repo_visible]
+
+    # ------------------------------------------------------------------
+    # 1) Explizite Identifier – ignorierte Repos dürfen ausgewählt werden
+    # ------------------------------------------------------------------
+    def test_identifiers_bypass_ignore_filter(self) -> None:
+        args = SimpleNamespace(
+            identifiers=["ignored-repo"],  # matches by repository name
+            all=False,
+            category=[],
+            string="",
+            tag=[],
+            include_ignored=False,  # should be ignored for explicit identifiers
+        )
+
+        selected = get_selected_repos(args, self.all_repos)
+
+        self.assertEqual(len(selected), 1)
+        self.assertIs(selected[0], self.repo_ignored)
+
+    # ------------------------------------------------------------------
+    # 2) Filter-only Modus – ignorierte Repos werden rausgefiltert
+    # ------------------------------------------------------------------
+    def test_filter_mode_excludes_ignored_by_default(self) -> None:
+        # string-Filter, der beide Repos matchen würde
+        args = SimpleNamespace(
+            identifiers=[],
+            all=False,
+            category=[],
+            string="repo",  # substring in beiden Namen
+            tag=[],
+            include_ignored=False,
+        )
+
+        selected = get_selected_repos(args, self.all_repos)
+
+        self.assertEqual(len(selected), 1)
+        self.assertIs(selected[0], self.repo_visible)
+
+    def test_filter_mode_can_include_ignored_when_flag_set(self) -> None:
+        args = SimpleNamespace(
+            identifiers=[],
+            all=False,
+            category=[],
+            string="repo",
+            tag=[],
+            include_ignored=True,
+        )
+
+        selected = get_selected_repos(args, self.all_repos)
+
+        # Beide Repos sollten erscheinen, weil include_ignored=True
+        self.assertEqual({r["repository"] for r in selected}, {"ignored-repo", "visible-repo"})
+
+    # ------------------------------------------------------------------
+    # 3) --all Modus – ignorierte Repos werden per Default entfernt
+    # ------------------------------------------------------------------
+    def test_all_mode_excludes_ignored_by_default(self) -> None:
+        args = SimpleNamespace(
+            identifiers=[],
+            all=True,
+            category=[],
+            string="",
+            tag=[],
+            include_ignored=False,
+        )
+
+        selected = get_selected_repos(args, self.all_repos)
+
+        self.assertEqual(len(selected), 1)
+        self.assertIs(selected[0], self.repo_visible)
+
+    def test_all_mode_can_include_ignored_when_flag_set(self) -> None:
+        args = SimpleNamespace(
+            identifiers=[],
+            all=True,
+            category=[],
+            string="",
+            tag=[],
+            include_ignored=True,
+        )
+
+        selected = get_selected_repos(args, self.all_repos)
+
+        self.assertEqual(len(selected), 2)
+        self.assertCountEqual(
+            [r["repository"] for r in selected],
+            ["ignored-repo", "visible-repo"],
+        )
+
+    # ------------------------------------------------------------------
+    # 4) CWD-Modus – Repo anhand des aktuellen Verzeichnisses auswählen
+    # ------------------------------------------------------------------
+    def test_cwd_selection_excludes_ignored_by_default(self) -> None:
+        # Wir lassen CWD auf das Verzeichnis des ignorierten Repos zeigen.
+        cwd = os.path.abspath(self.repo_ignored["directory"])
+
+        args = SimpleNamespace(
+            identifiers=[],
+            all=False,
+            category=[],
+            string="",
+            tag=[],
+            include_ignored=False,
+        )
+
+        with patch("os.getcwd", return_value=cwd):
+            selected = get_selected_repos(args, self.all_repos)
+
+        # Da das einzige Repo für dieses Verzeichnis ignoriert ist,
+        # sollte die Auswahl leer sein.
+        self.assertEqual(selected, [])
+
+    def test_cwd_selection_can_include_ignored_when_flag_set(self) -> None:
+        cwd = os.path.abspath(self.repo_ignored["directory"])
+
+        args = SimpleNamespace(
+            identifiers=[],
+            all=False,
+            category=[],
+            string="",
+            tag=[],
+            include_ignored=True,
+        )
+
+        with patch("os.getcwd", return_value=cwd):
+            selected = get_selected_repos(args, self.all_repos)
+
+        self.assertEqual(len(selected), 1)
+        self.assertIs(selected[0], self.repo_ignored)
+
+
+if __name__ == "__main__":
+    unittest.main()