dev-util/gitea-runner: new package at 1.0.4

Initial azy5030 overlay: scaffolding (eselect repository), the
dev-util/gitea-runner ebuild (go-module, vendored), CI build validation,
and a daily upstream-bump workflow.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitea/workflows/bump.yaml

@@ -0,0 +1,33 @@
+name: Bump
+on:
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch: {}
+
+jobs:
+  bump:
+    runs-on: ubuntu-latest
+    container:
+      image: gentoo/stage3:amd64-openrc
+    steps:
+      - name: Sync ::gentoo
+        run: emerge-webrsync
+
+      - name: Configure portage + install tooling
+        run: |
+          printf '[DEFAULT]\nmain-repo = gentoo\n\n[gentoo]\nlocation = /var/db/repos/gentoo\n' \
+            > /etc/portage/repos.conf/gentoo.conf
+          sed -i 's/^verify-signature = true/verify-signature = false/' \
+            /etc/portage/binrepos.conf/gentoo.conf
+          emerge -q --getbinpkg \
+            dev-vcs/git net-misc/curl app-arch/xz-utils app-misc/jq \
+            dev-lang/go dev-util/pkgdev
+
+      - name: Check for new release and open PR
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          host=${GITHUB_SERVER_URL#http://}; host=${host#https://}
+          curl -fsSL "http://x-access-token:${GITEA_TOKEN}@${host}/${GITHUB_REPOSITORY}/raw/branch/master/scripts/bump-version.sh" \
+            -o /tmp/bump-version.sh
+          bash /tmp/bump-version.sh

.gitea/workflows/ci.yaml

@@ -0,0 +1,58 @@
+name: CI
+on: [push]
+
+jobs:
+  build:
+    # The label only schedules the job on the (Docker-backend) runner; the steps
+    # actually run inside the Gentoo container declared below.
+    runs-on: ubuntu-latest
+    container:
+      image: gentoo/stage3:amd64-openrc
+    steps:
+      # Bootstrap a portage tree (emerge-webrsync ships its own downloader).
+      - name: Sync ::gentoo
+        run: emerge-webrsync
+
+      # pkgcore (pkgcheck) only reads /etc/portage/repos.conf, and the binhost
+      # needs the Gentoo release keys we don't ship — disable binpkg signature
+      # verification (ephemeral CI container) so prebuilt deps like dev-lang/go
+      # can be pulled instead of compiled.
+      - name: Configure portage
+        run: |
+          printf '[DEFAULT]\nmain-repo = gentoo\n\n[gentoo]\nlocation = /var/db/repos/gentoo\n' \
+            > /etc/portage/repos.conf/gentoo.conf
+          sed -i 's/^verify-signature = true/verify-signature = false/' \
+            /etc/portage/binrepos.conf/gentoo.conf
+          emerge -q --getbinpkg net-misc/curl dev-util/pkgcheck
+
+      # Place this overlay at /var/db/repos/azy5030. actions/checkout is avoided
+      # (SHA-256 Gitea repos break it); curl + tar fetches the source archive.
+      - name: Check out overlay
+        env:
+          TOKEN: ${{ github.token }}
+        run: |
+          host=${GITHUB_SERVER_URL#http://}; host=${host#https://}
+          url="http://x-access-token:${TOKEN}@${host}/${GITHUB_REPOSITORY}/archive/${GITHUB_REF_NAME}.tar.gz"
+          curl -fsSL "$url" -o repo.tar.gz
+          mkdir -p /var/db/repos/azy5030
+          tar xzf repo.tar.gz -C /var/db/repos/azy5030 --strip-components=1
+          printf '[azy5030]\nlocation = /var/db/repos/azy5030\nmasters = gentoo\nauto-sync = false\n' \
+            > /etc/portage/repos.conf/azy5030.conf
+          mkdir -p /etc/portage/package.accept_keywords
+          echo 'dev-util/gitea-runner ~amd64' > /etc/portage/package.accept_keywords/gitea-runner
+
+      - name: QA scan
+        run: pkgcheck scan --repo /var/db/repos/azy5030 dev-util/gitea-runner
+
+      # Full source build: portage fetches the upstream source tarball and the
+      # vendor tarball (release asset), verifies them against the committed
+      # Manifest, then compiles offline from the vendored modules.
+      - name: Emerge gitea-runner
+        run: emerge -v --getbinpkg dev-util/gitea-runner
+
+      - name: Verify binary
+        run: |
+          ver=$(find /var/db/repos/azy5030/dev-util/gitea-runner -name 'gitea-runner-*.ebuild' \
+            | sed -E 's#.*/gitea-runner-(.*)\.ebuild#\1#' | sort -V | tail -1)
+          gitea-runner --version
+          gitea-runner --version | grep -q "v${ver}"

.gitignore

@@ -0,0 +1,2 @@
+# Portage regenerates metadata cache on sync; don't track it (avoids staleness).
+/metadata/md5-cache/

.yamllint.yaml

@@ -0,0 +1,13 @@
+# yamllint config for the homeserver repo.
+# Relaxed to match the repo's existing YAML style (configs + docker-compose +
+# Gitea Actions workflows), mirroring the line-length leniency in .markdownlint.json.
+extends: default
+
+rules:
+  # Many service/compose configs have long values (URLs, labels); don't enforce width.
+  line-length: disable
+  # Config and compose files don't use explicit "---" document starts.
+  document-start: disable
+  # Allow workflow keys like `on:` (parsed as boolean) without quoting.
+  truthy:
+    check-keys: false

README.md

@@ -0,0 +1,28 @@
+# azy5030 overlay
+
+A personal [Gentoo ebuild repository](https://wiki.gentoo.org/wiki/Ebuild_repository)
+(overlay) for packages not in the main ::gentoo tree.
+
+## Packages
+
+| Package | Description |
+| --- | --- |
+| `dev-util/gitea-runner` | [Gitea Actions runner](https://gitea.com/gitea/runner) (formerly `act_runner`), built from upstream source with a vendored Go module tree. |
+
+## Using the overlay
+
+```sh
+eselect repository add azy5030 git https://git.azy.dev/azy5030/azy5030-overlay.git
+emaint sync -r azy5030
+echo 'dev-util/gitea-runner ~amd64' >> /etc/portage/package.accept_keywords/gitea-runner
+emerge dev-util/gitea-runner
+```
+
+## Maintenance
+
+- `.gitea/workflows/ci.yaml` builds each package in a `gentoo/stage3` container on
+  every push and asserts the resulting binary runs.
+- `.gitea/workflows/bump.yaml` runs `scripts/bump-version.sh` daily: it checks the
+  upstream releases feed and, when a newer version exists, regenerates + uploads the
+  vendor tarball, bumps the ebuild, and opens a pull request. Requires a `GITEA_TOKEN`
+  repository secret (scopes: repository read/write, write release).

dev-util/gitea-runner/Manifest

@@ -0,0 +1,2 @@
+DIST gitea-runner-1.0.4-vendor.tar.xz 3007156 BLAKE2B b9b7b03f607298a390b513bdc6824a2eba58bf7c1ed2e9e09556b309cb62669f1e5fc8fef6f62ce7a74f3a23573280158cb32d3b412394101f81cf8f19cdf64b SHA512 5309ef21c054a07b37a5ea1f5dd47cd6c424375a29f437ef743cb5719e8160e0c22a017175dad0b612291f444508b8dbe8e5fefabc9aac946c1217910aae6dd6
+DIST gitea-runner-1.0.4.tar.gz 326258 BLAKE2B 1908718d033b658238f735baed3323b53c85c5b5a471b8a7e543a1d7ef3898c1220a7fa27ff8e4224ae9f24960a6532699d9de770dc6ed7b5649dc0c5d624058 SHA512 5f7bdc31ce9b2c34dbac161f2a29a1be33a16a8118d9d1d58aef05de621ba542360afdb2af6fa4042d8cb7ab3421e9d1cd0f3c5102ddf85fc08a089ebb28a496

dev-util/gitea-runner/gitea-runner-1.0.4.ebuild

@@ -0,0 +1,37 @@
+# Copyright 2026 Ali Zein Yousuf
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+DESCRIPTION="Gitea Actions runner (formerly act_runner)"
+HOMEPAGE="https://gitea.com/gitea/runner"
+SRC_URI="
+	https://gitea.com/gitea/runner/archive/v${PV}.tar.gz -> ${P}.tar.gz
+	https://git.azy.dev/azy5030/azy5030-overlay/releases/download/${PN}-${PV}-vendor/${P}-vendor.tar.xz
+"
+S="${WORKDIR}/runner"
+
+# Upstream is MIT; the remaining licenses cover the vendored Go modules that
+# are statically linked into the binary.
+LICENSE="MIT Apache-2.0 BSD BSD-2 ISC MPL-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+
+BDEPEND=">=dev-lang/go-1.26.0"
+# The runner shells out to the docker client for the Docker backend.
+RDEPEND="app-containers/docker-cli"
+
+src_compile() {
+	local ldflags=(
+		-s -w
+		-X "gitea.com/gitea/runner/internal/pkg/ver.version=v${PV}"
+	)
+	ego build -ldflags="${ldflags[*]}" -o gitea-runner .
+}
+
+src_install() {
+	dobin gitea-runner
+	einstalldocs
+}

dev-util/gitea-runner/metadata.xml

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE pkgmetadata SYSTEM "https://www.gentoo.org/dtd/metadata.dtd">
+<pkgmetadata>
+	<maintainer type="person">
+		<email>azy5030@gmail.com</email>
+		<name>Ali Zein Yousuf</name>
+	</maintainer>
+	<longdescription lang="en">
+		Gitea Actions runner (formerly act_runner): executes Gitea Actions
+		workflows using a Docker or host backend. Packaged from upstream
+		source (https://gitea.com/gitea/runner) with a vendored Go module tree.
+	</longdescription>
+</pkgmetadata>

metadata/layout.conf

@@ -0,0 +1,3 @@
+masters = gentoo
+thin-manifests = true
+sign-manifests = false

profiles/categories

@@ -0,0 +1 @@
+dev-util

profiles/eapi

@@ -0,0 +1 @@
+8

profiles/repo_name

@@ -0,0 +1 @@
+azy5030

scripts/bump-version.sh

@@ -0,0 +1,127 @@
+#!/usr/bin/env bash
+# Check upstream gitea/runner releases and, if a newer version exists than the
+# newest gitea-runner ebuild, generate + upload a vendor tarball, bump the
+# ebuild, regenerate the Manifest, and open a pull request.
+#
+# Expects a Gentoo environment with: go, pkgdev, git, curl, xz, jq.
+# Required env: GITEA_TOKEN, GITHUB_SERVER_URL, GITHUB_REPOSITORY.
+# Optional env: GITHUB_API_URL (defaults to ${GITHUB_SERVER_URL}/api/v1).
+set -euo pipefail
+
+PN="gitea-runner"
+UPSTREAM_RSS="https://gitea.com/gitea/runner/releases.rss"
+UPSTREAM_ARCHIVE="https://gitea.com/gitea/runner/archive"
+UPSTREAM_GOMOD="https://gitea.com/gitea/runner/raw/tag"
+
+: "${GITEA_TOKEN:?GITEA_TOKEN is required}"
+: "${GITHUB_SERVER_URL:?GITHUB_SERVER_URL is required}"
+: "${GITHUB_REPOSITORY:?GITHUB_REPOSITORY is required}"
+API="${GITHUB_API_URL:-${GITHUB_SERVER_URL}/api/v1}"
+
+host=${GITHUB_SERVER_URL#http://}; host=${host#https://}
+api() { curl -fsSL -H "Authorization: token ${GITEA_TOKEN}" "$@"; }
+
+# --- determine versions ------------------------------------------------------
+latest=$(curl -fsSL "$UPSTREAM_RSS" \
+  | grep -oE '<title>v[0-9]+\.[0-9]+\.[0-9]+</title>' \
+  | head -1 | sed -E 's#</?title>##g; s/^v//')
+[ -n "$latest" ] || { echo "could not parse upstream version"; exit 1; }
+
+WORK=$(mktemp -d)
+git clone "https://x-access-token:${GITEA_TOKEN}@${host}/${GITHUB_REPOSITORY}.git" "$WORK"
+cd "$WORK"
+pkgdir="dev-util/${PN}"
+
+current=$(find "$pkgdir" -name "${PN}-*.ebuild" \
+  | sed -E "s#.*/${PN}-(.*)\.ebuild#\1#" | sort -V | tail -1)
+echo "upstream=${latest} current=${current}"
+
+newest=$(printf '%s\n%s\n' "$current" "$latest" | sort -V | tail -1)
+if [ "$newest" = "$current" ] && [ "$latest" != "$current" ]; then
+  echo "current ($current) is newer than upstream ($latest); nothing to do"; exit 0
+fi
+[ "$latest" != "$current" ] || { echo "already at latest ($current)"; exit 0; }
+
+branch="bump/${PN}-${latest}"
+if api "${API}/repos/${GITHUB_REPOSITORY}/branches/${branch}" >/dev/null 2>&1; then
+  echo "branch ${branch} already exists; nothing to do"; exit 0
+fi
+
+echo "bumping ${PN}: ${current} -> ${latest}"
+
+# --- generate + upload the vendor tarball ------------------------------------
+dist=$(mktemp -d)
+curl -fsSL "${UPSTREAM_ARCHIVE}/v${latest}.tar.gz" -o "${dist}/${PN}-${latest}.tar.gz"
+tar xzf "${dist}/${PN}-${latest}.tar.gz" -C "$dist"
+( cd "${dist}/runner" && go mod vendor )
+XZ_OPT=-9 tar --sort=name --mtime='UTC 1970-01-01' --owner=0 --group=0 --numeric-owner \
+  --create --auto-compress --file "${dist}/${PN}-${latest}-vendor.tar.xz" \
+  -C "$dist" runner/vendor
+
+vendor_tag="${PN}-${latest}-vendor"
+rel_id=$(api "${API}/repos/${GITHUB_REPOSITORY}/releases/tags/${vendor_tag}" 2>/dev/null \
+  | jq -r '.id // empty' || true)
+if [ -z "$rel_id" ]; then
+  rel_id=$(api -X POST -H 'Content-Type: application/json' \
+    "${API}/repos/${GITHUB_REPOSITORY}/releases" \
+    -d "{\"tag_name\":\"${vendor_tag}\",\"target_commitish\":\"master\",\"name\":\"${vendor_tag}\",\"body\":\"Vendored Go modules for ${PN} ${latest}.\"}" \
+    | jq -r '.id')
+fi
+api -X POST -H 'Content-Type: multipart/form-data' \
+  -F "attachment=@${dist}/${PN}-${latest}-vendor.tar.xz" \
+  "${API}/repos/${GITHUB_REPOSITORY}/releases/${rel_id}/assets?name=${PN}-${latest}-vendor.tar.xz" \
+  >/dev/null
+
+# --- bump the ebuild ---------------------------------------------------------
+git config user.name "gitea-actions"
+git config user.email "actions@azy.dev"
+git checkout -b "$branch"
+git mv "${pkgdir}/${PN}-${current}.ebuild" "${pkgdir}/${PN}-${latest}.ebuild"
+
+# Track the upstream go.mod's required Go version in BDEPEND.
+goreq=$(curl -fsSL "${UPSTREAM_GOMOD}/v${latest}/go.mod" \
+  | grep -oE '^go [0-9]+\.[0-9]+(\.[0-9]+)?' | awk '{print $2}')
+[ -n "$goreq" ] && sed -i -E \
+  "s#^BDEPEND=\">=dev-lang/go-[0-9.]+\"#BDEPEND=\">=dev-lang/go-${goreq}\"#" \
+  "${pkgdir}/${PN}-${latest}.ebuild"
+
+# Regenerate the Manifest (pkgdev fetches distfiles into DISTDIR first).
+mkdir -p /var/cache/distfiles
+cp "${dist}/${PN}-${latest}.tar.gz" /var/cache/distfiles/
+cp "${dist}/${PN}-${latest}-vendor.tar.xz" /var/cache/distfiles/
+printf '[DEFAULT]\nmain-repo = gentoo\n\n[gentoo]\nlocation = /var/db/repos/gentoo\n' \
+  > /etc/portage/repos.conf/gentoo.conf
+printf '[azy5030]\nlocation = %s\nmasters = gentoo\nauto-sync = false\n' "$WORK" \
+  > /etc/portage/repos.conf/azy5030.conf
+( cd "${pkgdir}" && pkgdev manifest )
+
+# --- validate, commit, push, open PR ----------------------------------------
+pkgcheck scan --repo "$WORK" "${pkgdir}" || true
+mkdir -p /etc/portage/package.accept_keywords
+echo 'dev-util/gitea-runner ~amd64' > /etc/portage/package.accept_keywords/gitea-runner
+emerge -v --getbinpkg "=dev-util/${PN}-${latest}"
+gitea-runner --version | grep -q "v${latest}"
+
+git add -A
+git commit -m "dev-util/${PN}: bump to ${latest}"
+git push origin "$branch"
+
+body=$(cat <<EOF
+Automated bump of \`dev-util/${PN}\` from ${current} to ${latest}.
+
+- Upstream release: https://gitea.com/gitea/runner/releases/tag/v${latest}
+- Vendor tarball: ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/releases/tag/${vendor_tag}
+
+Review checklist:
+- [ ] LICENSE still covers all vendored module licenses (\`go-licenses report ./...\`)
+- [ ] BDEPEND Go version matches upstream go.mod (set to >=${goreq:-unchanged})
+- [ ] version ldflags path \`internal/pkg/ver.version\` unchanged upstream
+
+CI build + \`gitea-runner --version\` passed in this workflow.
+EOF
+)
+api -X POST -H 'Content-Type: application/json' \
+  "${API}/repos/${GITHUB_REPOSITORY}/pulls" \
+  -d "$(jq -n --arg h "$branch" --arg t "dev-util/${PN}: bump to ${latest}" --arg b "$body" \
+    '{head:$h, base:"master", title:$t, body:$b}')" \
+  | jq -r '"opened PR #\(.number): \(.html_url)"'