azy5030
f08859eaea
CI / build (push) Successful in 6m25s
The daily Bump job emerged a full Go/pkgdev toolchain (and synced ::gentoo,
~5-26 min) on every run before bump-version.sh checked whether anything was
actually out of date — which, on the common no-op day, it isn't. Add a cheap
first step that compares the newest upstream release (releases.rss) against the
newest committed ebuild (Gitea contents API) using only base-image wget, and
gate the sync/install/bump steps on its `needed` output. The gate only
short-circuits when confident both versions parsed and current >= upstream;
on any doubt it falls through to the full run, where bump-version.sh remains
the source of truth.
Also fix the binpkg signature-verification disable in both workflows: the
`sed 's/^verify-signature = true/.../'` matched nothing in the stage3 binhost
config, so every emerge flooded the log with GPG failures ("unknown key",
missing pubring.kbx, "Try running getuto"). Delete any verify-signature line
and append `verify-signature = false` so the knob is actually set.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS
60 lines
2.7 KiB
YAML
60 lines
2.7 KiB
YAML
name: CI
|
|
on: [push]
|
|
|
|
jobs:
|
|
build:
|
|
# The label only schedules the job on the (Docker-backend) runner; the steps
|
|
# actually run inside the Gentoo container declared below.
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: gentoo/stage3:amd64-openrc
|
|
steps:
|
|
# Bootstrap a portage tree (emerge-webrsync ships its own downloader).
|
|
- name: Sync ::gentoo
|
|
run: emerge-webrsync
|
|
|
|
# pkgcore (pkgcheck) only reads /etc/portage/repos.conf, and the binhost
|
|
# needs the Gentoo release keys we don't ship — disable binpkg signature
|
|
# verification (ephemeral CI container) so prebuilt deps like dev-lang/go
|
|
# can be pulled instead of compiled.
|
|
- name: Configure portage
|
|
run: |
|
|
mkdir -p /etc/portage/repos.conf
|
|
printf '[DEFAULT]\nmain-repo = gentoo\n\n[gentoo]\nlocation = /var/db/repos/gentoo\n' \
|
|
> /etc/portage/repos.conf/gentoo.conf
|
|
sed -i '/^verify-signature/d' /etc/portage/binrepos.conf/gentoo.conf
|
|
printf '\nverify-signature = false\n' >> /etc/portage/binrepos.conf/gentoo.conf
|
|
emerge -q --getbinpkg net-misc/curl dev-util/pkgcheck
|
|
|
|
# Place this overlay at /var/db/repos/azy5030. actions/checkout is avoided
|
|
# (SHA-256 Gitea repos break it); curl + tar fetches the source archive.
|
|
- name: Check out overlay
|
|
env:
|
|
TOKEN: ${{ github.token }}
|
|
run: |
|
|
host=${GITHUB_SERVER_URL#http://}; host=${host#https://}
|
|
url="http://x-access-token:${TOKEN}@${host}/${GITHUB_REPOSITORY}/archive/${GITHUB_REF_NAME}.tar.gz"
|
|
curl -fsSL "$url" -o repo.tar.gz
|
|
mkdir -p /var/db/repos/azy5030
|
|
tar xzf repo.tar.gz -C /var/db/repos/azy5030 --strip-components=1
|
|
printf '[azy5030]\nlocation = /var/db/repos/azy5030\nmasters = gentoo\nauto-sync = false\n' \
|
|
> /etc/portage/repos.conf/azy5030.conf
|
|
mkdir -p /etc/portage/package.accept_keywords
|
|
echo 'dev-util/gitea-runner ~amd64' > /etc/portage/package.accept_keywords/gitea-runner
|
|
|
|
- name: QA scan
|
|
run: pkgcheck scan --repo /var/db/repos/azy5030 dev-util/gitea-runner
|
|
|
|
# Full source build: portage fetches the upstream source tarball and the
|
|
# vendor tarball (release asset), verifies them against the committed
|
|
# Manifest, then compiles offline from the vendored modules.
|
|
- name: Emerge gitea-runner
|
|
run: emerge -v --getbinpkg dev-util/gitea-runner
|
|
|
|
- name: Verify binary
|
|
run: |
|
|
ver=$(find /var/db/repos/azy5030/dev-util/gitea-runner -name 'gitea-runner-*.ebuild' \
|
|
| sed -E 's#.*/gitea-runner-(.*)\.ebuild#\1#' | sort -V | tail -1)
|
|
gitea-runner --version
|
|
gitea-runner --version | grep -q "v${ver}"
|