{
  writeShellScript,
  lib,
  coreutils,
  findutils,
  gnugrep,
  curl,
  jq,
  git,
  nix,
  nix-prefetch-git,
  moreutils,
  yq,
  # Config
  tarballPrefix,
  tarballSuffix,
  releasePrefix,
  releaseSuffix,
  owner,
  repo,
  # New: which variant to update (defaults to version.json's defaultVariant)
  variant ? null,
}:
let
  path = lib.makeBinPath [
    coreutils
    curl
    findutils
    gnugrep
    jq
    moreutils
    git
    nix-prefetch-git
    nix
    yq
  ];
in
writeShellScript "update-${repo}" ''
  set -euo pipefail
  PATH=${path}

  repoRoot="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
  versionFile="$repoRoot/packages/proton-cachyos/version.json"

  # Determine variant to update (prefer CLI arg, else defaultVariant in file)
  variantEff="${variant:-}"
  if [ -z "$variantEff" ]; then
    variantEff="$(jq -r '.defaultVariant // empty' "$versionFile")"
  fi
  if [ -z "$variantEff" ]; then
    variantEff="cachyos"
  fi

  # Read current values from the unified version.json
  localBase="$(jq -r --arg v "$variantEff" '.variants[$v].variables.base' "$versionFile")"
  localRelease="$(jq -r --arg v "$variantEff" '.variants[$v].variables.release' "$versionFile")"
  localHash="$(jq -r --arg v "$variantEff" '.variants[$v].sources.proton.hash' "$versionFile")"

  # Discover latest release tag
  latestVer="$(
    curl -fsSL "https://github.com/${owner}/${repo}/releases.atom" \
      | xq -r '.feed.entry[].link."@href"' \
      | grep -Po "(?<=/)${releasePrefix}[^/]+${releaseSuffix}$" \
      | head -n 1
  )"

  if [ "${releasePrefix}''${localBase}-''${localRelease}${releaseSuffix}" = "$latestVer" ]; then
    echo "No update needed for variant '$variantEff' (${localBase}.${localRelease})."
    exit 0
  fi

  latestBase="$(echo "$latestVer" | grep -Po "(?<=^${releasePrefix})[^-]+")"
  latestRelease="$(echo "$latestVer" | grep -Po "(?<=-)[^-]+(?=${releaseSuffix}$)")"
  artifactUrl="https://github.com/${owner}/${repo}/releases/download/''${latestVer}/${tarballPrefix}''${latestVer}${tarballSuffix}"

  latestSha256="$(nix-prefetch-url --type sha256 "$artifactUrl")"
  latestHash="$(nix-hash --to-sri --type sha256 "$latestSha256")"

  # Update the selected variant in version.json
  tmp="$(mktemp)"
  jq \
    --arg v "$variantEff" \
    --arg latestBase "$latestBase" \
    --arg latestRelease "$latestRelease" \
    --arg latestHash "$latestHash" \
    '
      .variants[$v].variables.base = $latestBase
      | .variants[$v].variables.release = $latestRelease
      | .variants[$v].sources.proton.hash = $latestHash
    ' "$versionFile" > "$tmp"
  mv "$tmp" "$versionFile"

  git -C "$repoRoot" add "packages/proton-cachyos/version.json"
  git -C "$repoRoot" commit -m "${repo}(${variantEff}): ''${localBase}.''${localRelease} -> ''${latestBase}.''${latestRelease}"
''