From f08859eaea7994b94c574c2d743b2ff85d43d04b Mon Sep 17 00:00:00 2001 From: Ali Zein Yousuf Date: Fri, 19 Jun 2026 20:18:21 -0500 Subject: [PATCH] ci(bump): gate toolchain install behind a cheap version check; fix binpkg verify MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The daily Bump job emerged a full Go/pkgdev toolchain (and synced ::gentoo, ~5-26 min) on every run before bump-version.sh checked whether anything was actually out of date — which, on the common no-op day, it isn't. Add a cheap first step that compares the newest upstream release (releases.rss) against the newest committed ebuild (Gitea contents API) using only base-image wget, and gate the sync/install/bump steps on its `needed` output. The gate only short-circuits when confident both versions parsed and current >= upstream; on any doubt it falls through to the full run, where bump-version.sh remains the source of truth. Also fix the binpkg signature-verification disable in both workflows: the `sed 's/^verify-signature = true/.../'` matched nothing in the stage3 binhost config, so every emerge flooded the log with GPG failures ("unknown key", missing pubring.kbx, "Try running getuto"). Delete any verify-signature line and append `verify-signature = false` so the knob is actually set. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS --- .gitea/workflows/bump.yaml | 36 ++++++++++++++++++++++++++++++++++-- .gitea/workflows/ci.yaml | 4 ++-- 2 files changed, 36 insertions(+), 4 deletions(-) diff --git a/.gitea/workflows/bump.yaml b/.gitea/workflows/bump.yaml index d0a41ab..6288c08 100644 --- a/.gitea/workflows/bump.yaml +++ b/.gitea/workflows/bump.yaml @@ -10,21 +10,53 @@ jobs: container: image: gentoo/stage3:amd64-openrc steps: + # Cheap gate: compare the newest upstream release against the newest + # committed ebuild using only base-image tools (wget). The expensive + # toolchain install + bump below is skipped on the common no-op day, so a + # daily run that has nothing to do finishes in seconds instead of minutes. + # bump-version.sh re-checks this itself and remains the source of truth. + - name: Check whether a bump is needed + id: check + env: + BUMP_TOKEN: ${{ secrets.BUMP_TOKEN }} + run: | + latest=$(wget -qO- https://gitea.com/gitea/runner/releases.rss \ + | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+' \ + | head -1 | sed -E 's###g; s/^v//') + current=$(wget -qO- --header="Authorization: token ${BUMP_TOKEN}" \ + "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/contents/dev-util/gitea-runner" \ + | grep -oE '"name": *"gitea-runner-[0-9.]+\.ebuild"' \ + | sed -E 's#.*gitea-runner-([0-9.]+)\.ebuild.*#\1#' | sort -V | tail -1) + echo "upstream=${latest} current=${current}" + # Only short-circuit when we are CONFIDENT there is nothing to do + # (both versions parsed and current is >= upstream). On any doubt + # fall through to the full run and let bump-version.sh decide. + if [ -n "$latest" ] && [ -n "$current" ] \ + && [ "$(printf '%s\n%s\n' "$current" "$latest" | sort -V | tail -1)" = "$current" ]; then + echo "needed=false" >> "$GITHUB_OUTPUT" + echo "nothing to do (upstream ${latest}, have ${current})" + else + echo "needed=true" >> "$GITHUB_OUTPUT" + fi + - name: Sync ::gentoo + if: steps.check.outputs.needed == 'true' run: emerge-webrsync - name: Configure portage + install tooling + if: steps.check.outputs.needed == 'true' run: | mkdir -p /etc/portage/repos.conf printf '[DEFAULT]\nmain-repo = gentoo\n\n[gentoo]\nlocation = /var/db/repos/gentoo\n' \ > /etc/portage/repos.conf/gentoo.conf - sed -i 's/^verify-signature = true/verify-signature = false/' \ - /etc/portage/binrepos.conf/gentoo.conf + sed -i '/^verify-signature/d' /etc/portage/binrepos.conf/gentoo.conf + printf '\nverify-signature = false\n' >> /etc/portage/binrepos.conf/gentoo.conf emerge -q --getbinpkg \ dev-vcs/git net-misc/curl app-arch/xz-utils app-misc/jq \ dev-lang/go dev-util/pkgdev - name: Check for new release and open PR + if: steps.check.outputs.needed == 'true' env: BUMP_TOKEN: ${{ secrets.BUMP_TOKEN }} run: | diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index ee20c79..9cdf777 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -22,8 +22,8 @@ jobs: mkdir -p /etc/portage/repos.conf printf '[DEFAULT]\nmain-repo = gentoo\n\n[gentoo]\nlocation = /var/db/repos/gentoo\n' \ > /etc/portage/repos.conf/gentoo.conf - sed -i 's/^verify-signature = true/verify-signature = false/' \ - /etc/portage/binrepos.conf/gentoo.conf + sed -i '/^verify-signature/d' /etc/portage/binrepos.conf/gentoo.conf + printf '\nverify-signature = false\n' >> /etc/portage/binrepos.conf/gentoo.conf emerge -q --getbinpkg net-misc/curl dev-util/pkgcheck # Place this overlay at /var/db/repos/azy5030. actions/checkout is avoided