fix(ci): Make the package conflict check actually detect conflicts

The step ran `pacman -Sp`, which skips conflict checking entirely: it
happily prints URLs for eternalterminal + eternalterminal-client and
exits 0. It also skipped every localrepo package, so the conflict fixed
in f06bfd1 could never have been caught here.

Now the check resolves against a throwaway config that adds [local-aur]
(localrepo/), with a fresh dbpath/root so runner-installed packages
don't mask or fake conflicts, and runs a real `pacman -S`. Conflicts and
broken deps fail in "prepare", before any download; XferCommand is set
to /usr/bin/false after the sync so a clean list stops at the download
instead of fetching the whole ISO. Package availability comes from one
`-Slq` instead of ~400 `-Si` calls.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/tests.yaml

@@ -309,34 +309,63 @@ jobs:
           echo "  Checking for conflicting packages in packages.x86_64"
           echo "═══════════════════════════════════════════════════════════════"
 
-          # Sync databases first so pacman knows what exists
+          # Resolve against the repos mkarchiso sees, including [local-aur]
-          sudo pacman -Sy --noconfirm
+          # (localrepo/), so conflicts between pre-built AUR packages and
+          # anything else are caught here instead of in the ISO build.
+          # A fresh dbpath = empty local db, like pacstrap's target root:
+          # packages installed on the runner can neither mask a conflict
+          # nor cause a false one.
+          CONF=$(mktemp)
+          DB=$(mktemp -d)
+          ROOT=$(mktemp -d)
+          cp /etc/pacman.conf "$CONF"
+          printf '\n[local-aur]\nSigLevel = Optional TrustAll\nServer = file://%s/localrepo\n' \
+            "$PWD" >> "$CONF"
+          mkdir -p "$DB/sync"
+          cp -p /var/lib/pacman/sync/*.db "$DB/sync/"
+          pac() { pacman --config "$CONF" --dbpath "$DB" "$@"; }
+          pac -Sy --noconfirm
+          # From here on never download (set after -Sy, which needs to fetch
+          # the file:// local-aur db): the check only needs a prepared
+          # transaction
+          sed -i '/^\[options\]/a XferCommand = /usr/bin/false %u' "$CONF"
 
-          # Collect only packages that exist in the official repositories
+          # Packages built at ISO build time (build-end4-deps.sh) can't be
+          # resolved yet; everything else must be
+          mapfile -t AVAIL < <(pac -Slq | sort -u)
           PKGS=()
           while IFS= read -r pkg; do
             [[ -z "$pkg" || "$pkg" =~ ^# ]] && continue
-
+            if printf '%s\n' "${AVAIL[@]}" | grep -qxF -- "$pkg"; then
-            # Check if the package exists in official repos
-            if pacman -Si "$pkg" >/dev/null 2>&1; then
               PKGS+=("$pkg")
             else
-              echo "⚠️ Skipping AUR/missing package: $pkg"
+              echo "⚠️ Skipping unresolvable package: $pkg"
             fi
           done < packages.x86_64
 
-          # Run conflict check only if we have official packages to test
+          # `pacman -Sp` skips conflict checks entirely, so run a real -S
+          # into an empty root. Conflicts and broken deps fail in "prepare",
+          # before any download; a clean list gets as far as the download,
+          # which the XferCommand above makes fail on purpose.
           if [ ${#PKGS[@]} -eq 0 ]; then
-            echo "✅ No official packages to check."
+            echo "✅ No resolvable packages to check."
-          elif CONFLICTS=$(pacman -Sp --needed "${PKGS[@]}" 2>&1); then
-            echo "✅ No package conflicts detected among official packages"
           else
-            echo "------- Pacman Output -------"
+            OUT=$(pac -S --noconfirm --root "$ROOT" --cachedir "$ROOT" "${PKGS[@]}" 2>&1)
-            echo "$CONFLICTS"
+            if grep -q 'failed to prepare transaction' <<< "$OUT"; then
-            echo "-----------------------------"
+              echo "------- Pacman Output -------"
-            echo ""
+              grep -vE '^(http|file|ftp)' <<< "$OUT" | tail -40
-            echo "═══════════════════════════════════════════════════════════════"
+              echo "-----------------------------"
-            echo "  ❌ Conflicting packages found — fix packages.x86_64"
+              echo ""
-            echo "═══════════════════════════════════════════════════════════════"
+              echo "═══════════════════════════════════════════════════════════════"
-            exit 1
+              echo "  ❌ Conflicting/unresolvable packages — fix packages.x86_64"
+              echo "═══════════════════════════════════════════════════════════════"
+              exit 1
+            elif ! grep -q 'Proceed with installation' <<< "$OUT"; then
+              echo "------- Pacman Output -------"
+              tail -40 <<< "$OUT"
+              echo "-----------------------------"
+              echo "❌ pacman stopped before the conflict check completed"
+              exit 1
+            fi
+            echo "✅ No package conflicts detected (repos + local-aur)"
           fi