pacman -Syu: Sync and Upgrade Arch Safely

By Kaveh Alemi·Latchkey

pacman -Syu refreshes the package database and upgrades every installed package in one step, the supported way to update Arch.

Arch is rolling-release, so mixing an old system with new packages (a partial upgrade) is unsupported. -Syu keeps the system consistent.

What it does

pacman -Syu syncs the package database (-y) and then upgrades all packages to the newest version (-u). Doing both together avoids partial upgrades, where a freshly synced database is used to install a package against an un-upgraded system.

Common usage

pacman -Syu --noconfirm
# refresh keyring before a big upgrade in a stale image
pacman -Sy --noconfirm archlinux-keyring && pacman -Su --noconfirm

Options

In CI

Never run pacman -Sy <pkg> to install a single package on a stale image; that is a partial upgrade and can pull in a library newer than the rest of the system. Use pacman -Syu to update fully, or pacman -S with a recently synced but not upgraded system only for short-lived containers.

Common errors in CI

"error: failed to commit transaction (invalid or corrupted package)" during upgrade usually means an outdated keyring; update archlinux-keyring first. "warning: <pkg>: local (X) is newer than core (Y)" indicates the mirror is behind. "unable to lock database" means a stale /var/lib/pacman/db.lck; delete it. A partial upgrade often surfaces later as a missing shared library.

Using this in CI

A runner shell is not a login shell. It does not read your dotfiles, it usually has no TTY, and by default it does not stop on the first error, so a failing command in the middle of a multi-line run block can leave the job green.

# make the shell behave the way you assume it does
- name: Build
  shell: bash
  run: |
    set -euo pipefail    # exit on error, undefined vars, and pipeline failures
    ./do-the-thing | tee out.log

Frequently asked questions

Related guides

References

• GitHub Actions documentation