Keep the configured threshold in the pending file

A threshold argument is a one-off override for the notification, so status bars
keep using THRESHOLD from the config.

PKGBUILD

@@ -3,7 +3,7 @@
 # Maintainer: Daniele Fucini <dfucini [at] gmail [dot] com>
 
 pkgname=update-notify
-pkgver=3.6
+pkgver=3.8
 pkgrel=1
 pkgdesc='Notify when updates are available'
 arch=('any')
@@ -14,10 +14,11 @@ depends=('pacman-contrib'
 makedepends=('git')
 optdepends=('aurutils: to check AUR packages in the local repo for updates'
             'fwupd: to check for firmware updates'
-            'git-monitor: to check git repos for updates')
+            'git-monitor: to check git repos for updates'
+            'trustsight: to vet AUR updates before building them')
 source=("git+$url?signed#tag=$pkgver")
 validpgpkeys=('7E12BC1FF3B6EDB2CD8053EB981A2B2A3BBF5514')
-sha256sums=('3efd5deadb6619b0fbc46d0559716feb117d095ce1068a02da53c3e14e88af68')
+sha256sums=('947b6b33a9dd8fe69e87252d8a3591e99123d334f0e7660dcf13177ea8ba7746')
 
 package()
 {
@@ -25,6 +26,9 @@ package()
     install -Dm755 "$pkgname" "$pkgdir"/usr/bin/"$pkgname"
     install -Dm644 "$pkgname".service "$pkgdir"/usr/lib/systemd/user/"$pkgname".service
     install -Dm644 "$pkgname".timer "$pkgdir"/usr/lib/systemd/user/"$pkgname".timer
+    install -Dm644 "$pkgname".path "$pkgdir"/usr/lib/systemd/user/"$pkgname".path
+    install -Dm755 "$pkgname"-refresh "$pkgdir"/usr/lib/"$pkgname"/refresh
+    install -Dm644 "$pkgname".hook "$pkgdir"/usr/share/libalpm/hooks/"$pkgname".hook
     install -Dm644 README.md "$pkgdir"/usr/share/doc/"$pkgname"/README.md
     install -Dm644 config.example "$pkgdir"/usr/share/doc/"$pkgname"/config.example
 }

README.md

@@ -10,7 +10,7 @@ update-notify runs on a systemd user timer and checks:
 
 It sends one notification, and only when its content changes since the last one:
 
-- Update counts are shown once the total number of updates reaches a threshold (default 30). Reminders for `git-monitor` and pending firmware updates (`fwupdmgr`) are added when those tools are installed.
+- Update counts are shown once the total number of updates reaches a threshold (default 30). Reminders for `git-monitor` and pending firmware updates (`fwupdmgr`) are added when those tools are installed, and one to run `trustsight` before building pending AUR updates.
 - Kernel rebuild reminders are always shown, even below the threshold.
 
 ## Requirements
@@ -23,6 +23,7 @@ Optional:
 - `aurutils`: check AUR packages in the local repository
 - `fwupd`: check for firmware updates
 - `git-monitor`: remind to check git packages
+- `trustsight`: remind to vet AUR updates before building them
 
 ## Installation
 
@@ -70,7 +71,7 @@ systemctl --user enable --now update-notify.path
 update-notify [threshold]
 ```
 
-`threshold` is the minimum number of updates (repo + AUR) before update counts are shown. It overrides the `THRESHOLD` setting below.
+`threshold` is the minimum number of updates (repo + AUR) before update counts are shown. It overrides the `THRESHOLD` setting below for that run's notification only; the pending file keeps the configured value.
 
 ## Configuration
 
@@ -96,7 +97,7 @@ The content of the last notification is stored in `$XDG_STATE_HOME/update-notify
 Each run also writes the pending updates to `$XDG_STATE_HOME/update-notify/pending`, whether or not the threshold is reached, for status bars such as xmobar to read:
 
 ```
-threshold 30
+threshold <THRESHOLD from the config, not the argument>
 repo <pkg> <newver>
 aur <pkg> <newver>
 kernel <custom-pkg> <stock-ver>

update-notify

@@ -19,10 +19,15 @@ if [[ -r $config_file ]]; then
     # shellcheck source=/dev/null
     source "$config_file"
 fi
+config_threshold=$THRESHOLD  # written to the pending file, so a one-off argument doesn't change status bars
 THRESHOLD=${1:-$THRESHOLD}
 
-[[ $THRESHOLD =~ ^[0-9]+$ ]] || { echo "Threshold must be a number" >&2; exit 1; }
+for t in "$config_threshold" "$THRESHOLD"; do
-THRESHOLD=$((10#$THRESHOLD))  # force base 10, so e.g. "08" isn't read as octal
+    [[ $t =~ ^[0-9]+$ ]] || { echo "Threshold must be a number" >&2; exit 1; }
+done
+# force base 10, so e.g. "08" isn't read as octal
+config_threshold=$((10#$config_threshold))
+THRESHOLD=$((10#$THRESHOLD))
 mkdir -p "$state_dir"
 
 # notify-send from cron/systemd needs the session bus address
@@ -130,7 +135,7 @@ done
 # Pending list for status bars, one "<source> <pkg> <newver>" per line
 # ---------------------------------------------------------------------------
 {
-    printf 'threshold %s\n' "$THRESHOLD"
+    printf 'threshold %s\n' "$config_threshold"
     for item in "${arch_list[@]}"; do
         read -r pkg _ _ new <<< "$item"
         printf 'repo %s %s\n' "$pkg" "$new"
@@ -175,6 +180,11 @@ if (( over_threshold )); then
         fi
     fi
 
+    # Vet AUR changes before building them
+    if (( aur_updates )) && command -v trustsight >/dev/null 2>&1; then
+        parts+=("Before aur sync: trustsight review --repo $AUR_REPO")
+    fi
+
     if (( ${#reminders[@]} )); then
         printf -v list '%s, ' "${reminders[@]}"
         parts+=("Also check: ${list%, }")