docs: document release confirmation step

Add set -euo pipefail, root checks, safer orphan cleanup, and a help
message to fullupgrade. Refresh the README and project notes to match
the current scripts and release process.

.continue/rules/project.md

@@ -0,0 +1,82 @@
+# Project Status — fullupgrade
+
+Last updated: 2026-04-27
+
+## Project goal
+This repository contains two Bash scripts for system administration and Git release management:
+- `fullupgrade`: Arch Linux maintenance script
+- `makerelease.sh`: Git release automation script
+
+The project is intentionally minimal and centered on these two scripts.
+
+## Current structure
+- `fullupgrade`: system update and cleanup
+- `makerelease.sh`: release workflow from `dev` to `main`
+- `README.md`: English documentation with usage, warnings, and examples
+- `LICENSE`: GPLv3
+
+## Current analysis
+
+### 1) `fullupgrade`
+Current behavior:
+- updates `archlinux-keyring`
+- runs `pacman -Syu --noconfirm`
+- removes orphaned packages only when any are found
+- cleans the pacman cache
+
+Notes:
+- the script already uses `set -euo pipefail`
+- it checks for root privileges before running package operations
+- it can have a significant system impact
+
+Recommendations:
+- keep documenting the system impact clearly
+
+### 2) `makerelease.sh`
+Current behavior:
+- supports explicit versions like `1.2.3`
+- supports version increments with `+0.0.1`, `+0.1`, and `+1`
+- supports `--dry-run` to print the computed release version
+- checks that the current branch is `dev`
+- verifies the working tree is clean
+- checks that the target tag does not already exist
+- displays the computed release tag before proceeding
+- asks for confirmation before any Git action
+- checks out `main`
+- merges `dev` into `main`
+- pushes the branch
+- creates an annotated tag
+- pushes tags
+- attempts to return to the original branch on exit
+
+Notes:
+- the script uses `set -euo pipefail`
+- the release tag message is automatically generated as `Release <version>`
+- the script no longer requires a separate release message argument
+- the current increment logic assumes simple dotted numeric tags
+- normal releases now require an interactive confirmation after the tag is displayed
+
+Recommendations:
+- consider validating the version format more strictly if release rules grow
+- keep the dry-run behavior documented and aligned with the script
+
+### 3) `README.md`
+Current status:
+- the README documents both scripts in English
+- it includes release increments, dry-run usage, and the confirmation step for `makerelease.sh`
+
+Recommendations:
+- keep it aligned with the actual script behavior
+- add more examples only if they improve clarity
+
+## Project tracking rules
+This file should be updated whenever:
+- script behavior changes
+- documentation changes materially
+- new constraints or design decisions are introduced
+- release workflow rules evolve
+
+## Maintenance notes
+- Always keep the README, the scripts, and this file consistent.
+- If a script changes, update this note immediately (./continue/rules/project.md).
+- If a new usage rule appears, document it here.

README.md

@@ -1,2 +1,98 @@
 # fullupgrade
 
+Minimal Bash tools for Arch Linux maintenance and Git release automation.
+
+## Overview
+
+This repository contains two small Bash scripts:
+
+- `fullupgrade`: updates an Arch Linux system and performs cleanup
+- `makerelease.sh`: automates a Git release from `dev` to `main`
+
+The project is intentionally small and focused on a simple, opinionated workflow.
+
+## Requirements
+
+- Bash
+- `pacman` for `fullupgrade`
+- `git` for `makerelease.sh`
+- root privileges for `fullupgrade`
+- a local Git repository with `dev` and `main` branches for `makerelease.sh`
+
+## `fullupgrade`
+
+`fullupgrade` performs the following steps:
+
+1. updates `archlinux-keyring`
+2. runs a full system synchronization with `pacman -Syu --noconfirm`
+3. removes orphaned packages if any are found
+4. cleans the pacman cache with `pacman -Sc --noconfirm`
+
+### Usage
+
+```bash
+sudo ./fullupgrade
+```
+
+### Notes
+
+- The script must be run as `root`.
+- It does not ask for confirmation.
+- It can remove packages and clean the package cache, so review the output carefully.
+
+## `makerelease.sh`
+
+`makerelease.sh` automates a Git release workflow:
+
+1. checks that the current branch is `dev` for real releases
+2. verifies the working tree is clean
+3. optionally computes a new version from an increment shortcut
+4. displays the chosen release tag
+5. asks for confirmation before any Git action
+6. switches to `main`
+7. merges `dev` into `main`
+8. pushes `main`
+9. creates an annotated tag
+10. pushes tags
+11. switches back to the original branch on exit
+
+### Usage
+
+```bash
+./makerelease.sh VERSION
+./makerelease.sh +0.0.1
+./makerelease.sh +0.1
+./makerelease.sh +1
+./makerelease.sh --dry-run VERSION
+./makerelease.sh --dry-run +0.0.1
+./makerelease.sh --dry-run +0.1
+./makerelease.sh --dry-run +1
+```
+
+### Examples
+
+```bash
+./makerelease.sh 1.2.0
+./makerelease.sh --dry-run +0.0.1
+```
+
+### Notes
+
+- Run the script from a clean, local Git repository.
+- Make sure the `dev` branch contains the changes you want to release.
+- `VERSION` is used directly as the tag name.
+- If `VERSION` starts with `+`, it is treated as an increment based on the latest existing tag.
+- `--dry-run` can be used from any branch and only prints the computed tag.
+- In normal mode, the computed tag is shown and a confirmation is required before Git actions run.
+- The script may fail if Git state is unexpected or if a tag already exists.
+- The tag message is automatically generated as `Release <version>`.
+
+## Status
+
+This repository is intentionally minimal.
+- `fullupgrade` is hardened with `set -euo pipefail`.
+- `makerelease.sh` now includes clean-tree checks, duplicate tag protection, increment shortcuts, dry-run support from any branch, and a trap to return to the original branch on exit.
+
+## License
+
+GPLv3

fullupgrade

@@ -1,6 +1,61 @@
 #!/bin/bash
+set -euo pipefail
 
-pacman -Sy --noconfirm archlinux-keyring
-pacman -Syu --noconfirm
-pacman -Rns $(pacman -Qqtd) --noconfirm
-pacman -Sc --noconfirm
+show_help() {
+	cat <<'EOF'
+Usage: fullupgrade
+
+Updates Arch Linux and performs cleanup:
+  - updates archlinux-keyring
+  - performs a full system synchronization
+  - removes orphaned packages
+  - cleans the pacman cache
+
+Warning: this script modifies the system and runs without confirmation.
+EOF
+}
+
+
+require_root() {
+	if [ "${EUID:-$(id -u)}" -ne 0 ]; then
+		echo "Error: this script must be run as root." >&2
+		exit 1
+	fi
+}
+
+cleanup_orphans() {
+	local orphans=()
+
+	mapfile -t orphans < <(pacman -Qqtd)
+
+	if [ "${#orphans[@]}" -gt 0 ]; then
+		pacman -Rns --noconfirm "${orphans[@]}"
+	else
+		echo "No orphaned packages to remove."
+	fi
+}
+
+main() {
+	if [ "${1:-}" = "-h" ] || [ "${1:-}" = "--help" ]; then
+		show_help
+		exit 0
+	fi
+
+	require_root
+
+	echo "Updating archlinux-keyring..."
+	pacman -Sy --noconfirm archlinux-keyring
+
+	echo "Performing full system update..."
+	pacman -Syu --noconfirm
+
+	echo "Searching for orphaned packages..."
+	cleanup_orphans
+
+	echo "Cleaning pacman cache..."
+	pacman -Sc --noconfirm
+
+	echo "Update completed successfully."
+}
+
+main "$@"

makerelease.sh

@@ -1,32 +1,135 @@
 #!/bin/bash
 
-declare -r VERSION=${1}
-declare -r MESSAGE=${2}
+set -euo pipefail
+
 declare -r TAGBRANCH=main
 declare CURRENTBRANCH=""
+declare ORIGBRANCH=""
+declare -r ARG1="${1:-}"
+declare -r ARG2="${2:-}"
+declare is_dry_run=false
+declare release_input=""
 
 showHelp() {
-	echo makerelease version
+	cat <<'EOF'
+Usage:
+  makerelease.sh VERSION
+  makerelease.sh +0.0.1
+  makerelease.sh +0.1
+  makerelease.sh +1
+  makerelease.sh --dry-run VERSION
+  makerelease.sh --dry-run +0.0.1
+  makerelease.sh --dry-run +0.1
+  makerelease.sh --dry-run +1
+
+Creates an annotated Git tag from the current dev branch.
+
+If VERSION starts with +, it is treated as an increment:
+- +0.0.1 increments patch
+- +0.1 increments minor
+- +1 increments major
+
+Use --dry-run to show the computed release version without running Git actions.
+
+Requirements:
+- run from a clean Git working tree
+- current branch must be dev for real releases
+- main branch must exist locally
+EOF
 }
 
-if [ "${VERSION}" == "" ]; then
+cleanup() {
+	if [ -n "${ORIGBRANCH}" ] && [ "${CURRENTBRANCH}" != "${ORIGBRANCH}" ]; then
+		git checkout "${ORIGBRANCH}" >/dev/null 2>&1 || true
+	fi
+}
+
+trap cleanup EXIT
+
+if [ "${ARG1}" = "--dry-run" ] || [ "${ARG1}" = "-n" ]; then
+	is_dry_run=true
+	release_input="${ARG2:-}"
+else
+	release_input="${ARG1}"
+fi
+
+if [ -z "${release_input}" ]; then
 	showHelp
 	echo ""
 	echo "no version provided!"
 	exit 1
 fi
 
-CURRENTBRANCH=$(git rev-parse --abbrev-ref HEAD)
+if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+	echo "You are not inside a Git repository!"
+	exit 1
+fi
 
-if [ ! "${CURRENTBRANCH}" == "dev" ]; then
+if [ -n "$(git status --porcelain)" ]; then
+	echo "Working tree is not clean!"
+	echo "Commit or stash your changes before creating a release."
+	exit 1
+fi
+
+CURRENTBRANCH=$(git rev-parse --abbrev-ref HEAD)
+ORIGBRANCH="${CURRENTBRANCH}"
+
+if [ "${is_dry_run}" = false ] && [ "${CURRENTBRANCH}" != "dev" ]; then
 	echo "You are not in dev branch!"
 	echo "Use dev branch to make a release!"
 	exit 1
 fi
 
+release_tag="${release_input}"
+if [ "${release_input}" != "${release_input#+}" ]; then
+	current_tag="$(git describe --tags --abbrev=0 2>/dev/null || true)"
+	if [ -z "${current_tag}" ]; then
+		echo "No existing tag found to increment from!"
+		exit 1
+	fi
+	case "${release_input}" in
+		+1)
+			release_tag="$(printf '%s' "${current_tag}" | awk -F. 'BEGIN{OFS="."} { $1+=1; $2=0; $3=0; print }')"
+			;;
+			+0.1)
+			release_tag="$(printf '%s' "${current_tag}" | awk -F. 'BEGIN{OFS="."} { $2+=1; $3=0; print }')"
+			;;
+			+0.0.1)
+			release_tag="$(printf '%s' "${current_tag}" | awk -F. 'BEGIN{OFS="."} { $3+=1; print }')"
+			;;
+		*)
+			echo "Unsupported increment syntax: ${release_input}"
+			exit 1
+			;;
+	esac
+fi
+
+if git rev-parse -q --verify "refs/tags/${release_tag}" >/dev/null; then
+	echo "Tag ${release_tag} already exists!"
+	exit 1
+fi
+
+if [ "${is_dry_run}" = true ]; then
+	echo "Dry run: computed release tag ${release_tag}"
+	exit 0
+fi
+
+echo "Release tag selected: ${release_tag}"
+read -r -p "Proceed with release? [y/N] " confirm
+case "${confirm}" in
+	y|Y)
+		;;
+	*)
+		echo "Release cancelled."
+		exit 1
+		;;
+esac
+
 git checkout "${TAGBRANCH}"
-git merge "${CURRENTBRANCH}"
+CURRENTBRANCH="${TAGBRANCH}"
+git merge "${ORIGBRANCH}"
 git push
-git tag -a "${VERSION}" -m "${MESSAGE}"
+git tag -a "${release_tag}" -m "Release ${release_tag}"
 git push --tags
-git checkout "${CURRENTBRANCH}"
+
+echo "Created release tag ${release_tag}"