azy5030
98ed1c32ce
Run 110's lint job failed at checkout ("couldn't find remote ref <sha>")
because GIT_DEFAULT_HASH: sha256 — copied from the SHA-256 homeserver repo —
made git init create a SHA-256 repo that can't resolve this repo's SHA-1
commits. This overlay is a plain SHA-1 repo, so checkout needs no hash override.
- lint job: drop the bogus GIT_DEFAULT_HASH: sha256 override.
- build job: replace the curl+tar checkout with actions/checkout into
$GITHUB_WORKSPACE, registered with portage via repos.conf; pull dev-vcs/git
in Configure portage (stage3 has no git, which checkout shells out to) and
drop net-misc/curl (only the old checkout used it). QA scan / verify steps
now reference $GITHUB_WORKSPACE.
- CLAUDE.md: correct the SHA-256 claim and rewrite the CI section for the
two-job lint-gate + actions/checkout setup.
just lint passes; ci.yaml passes actionlint.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS
93 lines
3.8 KiB
YAML
93 lines
3.8 KiB
YAML
name: CI
|
|
on: [push]
|
|
|
|
jobs:
|
|
# Lint gate: runs on the plain Docker-backend runner (not the Gentoo
|
|
# container) and must pass before the build job starts. Mirrors the lint job
|
|
# in the homeserver repo; `just lint` runs markdownlint/shellcheck/yamllint/
|
|
# actionlint over the repo.
|
|
lint:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
# setup-just fetches its binary from GitHub; on a Gitea runner the default
|
|
# github-token is the *Gitea* token (GitHub rejects it 401), so pass none
|
|
# and use GitHub's unauthenticated API.
|
|
- uses: extractions/setup-just@v4
|
|
with:
|
|
github-token: ""
|
|
|
|
- uses: taiki-e/install-action@v2
|
|
env:
|
|
GITHUB_TOKEN: ""
|
|
with:
|
|
tool: shellcheck
|
|
|
|
- name: Install markdownlint-cli
|
|
run: npm install -g markdownlint-cli
|
|
|
|
# actionlint has no maintained setup-action and uv ships via astral.sh;
|
|
# both installers hit their own release assets (no GitHub token needed).
|
|
- name: Install yamllint + actionlint tooling
|
|
run: |
|
|
curl -LsSf https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh
|
|
bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) latest /usr/local/bin
|
|
|
|
- name: Run linters
|
|
run: just lint
|
|
|
|
build:
|
|
needs: lint
|
|
# The label only schedules the job on the (Docker-backend) runner; the steps
|
|
# actually run inside the Gentoo container declared below.
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: gentoo/stage3:amd64-openrc
|
|
steps:
|
|
# Bootstrap a portage tree (emerge-webrsync ships its own downloader).
|
|
- name: Sync ::gentoo
|
|
run: emerge-webrsync
|
|
|
|
# pkgcore (pkgcheck) only reads /etc/portage/repos.conf, and the binhost
|
|
# needs the Gentoo release keys we don't ship — disable binpkg signature
|
|
# verification (ephemeral CI container) so prebuilt deps like dev-lang/go
|
|
# can be pulled instead of compiled. dev-vcs/git is pulled here too because
|
|
# actions/checkout (next step) shells out to git, and stage3 has none.
|
|
- name: Configure portage
|
|
run: |
|
|
mkdir -p /etc/portage/repos.conf
|
|
printf '[DEFAULT]\nmain-repo = gentoo\n\n[gentoo]\nlocation = /var/db/repos/gentoo\n' \
|
|
> /etc/portage/repos.conf/gentoo.conf
|
|
sed -i '/^verify-signature/d' /etc/portage/binrepos.conf/gentoo.conf
|
|
printf '\nverify-signature = false\n' >> /etc/portage/binrepos.conf/gentoo.conf
|
|
emerge -q --getbinpkg dev-vcs/git dev-util/pkgcheck
|
|
|
|
# Check out the overlay into the workspace (plain SHA-1 repo, so no
|
|
# GIT_DEFAULT_HASH override), then register that path with portage.
|
|
- name: Check out overlay
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Register overlay with portage
|
|
run: |
|
|
printf '[azy5030]\nlocation = %s\nmasters = gentoo\nauto-sync = false\n' "$GITHUB_WORKSPACE" \
|
|
> /etc/portage/repos.conf/azy5030.conf
|
|
mkdir -p /etc/portage/package.accept_keywords
|
|
echo 'dev-util/gitea-runner ~amd64' > /etc/portage/package.accept_keywords/gitea-runner
|
|
|
|
- name: QA scan
|
|
run: pkgcheck scan --repo "$GITHUB_WORKSPACE" dev-util/gitea-runner
|
|
|
|
# Full source build: portage fetches the upstream source tarball and the
|
|
# vendor tarball (release asset), verifies them against the committed
|
|
# Manifest, then compiles offline from the vendored modules.
|
|
- name: Emerge gitea-runner
|
|
run: emerge -v --getbinpkg dev-util/gitea-runner
|
|
|
|
- name: Verify binary
|
|
run: |
|
|
ver=$(find "$GITHUB_WORKSPACE/dev-util/gitea-runner" -name 'gitea-runner-*.ebuild' \
|
|
| sed -E 's#.*/gitea-runner-(.*)\.ebuild#\1#' | sort -V | tail -1)
|
|
gitea-runner --version
|
|
gitea-runner --version | grep -q "v${ver}"
|