ci(bump): gate toolchain install behind a cheap version check; fix binpkg verify

The daily Bump job emerged a full Go/pkgdev toolchain (and synced ::gentoo,
~5-26 min) on every run before bump-version.sh checked whether anything was
actually out of date — which, on the common no-op day, it isn't. Add a cheap
first step that compares the newest upstream release (releases.rss) against the
newest committed ebuild (Gitea contents API) using only base-image wget, and
gate the sync/install/bump steps on its `needed` output. The gate only
short-circuits when confident both versions parsed and current >= upstream;
on any doubt it falls through to the full run, where bump-version.sh remains
the source of truth.

Also fix the binpkg signature-verification disable in both workflows: the
`sed 's/^verify-signature = true/.../'` matched nothing in the stage3 binhost
config, so every emerge flooded the log with GPG failures ("unknown key",
missing pubring.kbx, "Try running getuto"). Delete any verify-signature line
and append `verify-signature = false` so the knob is actually set.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS

.gitea/workflows/bump.yaml

@@ -10,21 +10,53 @@ jobs:
     container:
       image: gentoo/stage3:amd64-openrc
     steps:
+      # Cheap gate: compare the newest upstream release against the newest
+      # committed ebuild using only base-image tools (wget). The expensive
+      # toolchain install + bump below is skipped on the common no-op day, so a
+      # daily run that has nothing to do finishes in seconds instead of minutes.
+      # bump-version.sh re-checks this itself and remains the source of truth.
+      - name: Check whether a bump is needed
+        id: check
+        env:
+          BUMP_TOKEN: ${{ secrets.BUMP_TOKEN }}
+        run: |
+          latest=$(wget -qO- https://gitea.com/gitea/runner/releases.rss \
+            | grep -oE '<title>v[0-9]+\.[0-9]+\.[0-9]+</title>' \
+            | head -1 | sed -E 's#</?title>##g; s/^v//')
+          current=$(wget -qO- --header="Authorization: token ${BUMP_TOKEN}" \
+            "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/contents/dev-util/gitea-runner" \
+            | grep -oE '"name": *"gitea-runner-[0-9.]+\.ebuild"' \
+            | sed -E 's#.*gitea-runner-([0-9.]+)\.ebuild.*#\1#' | sort -V | tail -1)
+          echo "upstream=${latest} current=${current}"
+          # Only short-circuit when we are CONFIDENT there is nothing to do
+          # (both versions parsed and current is >= upstream). On any doubt
+          # fall through to the full run and let bump-version.sh decide.
+          if [ -n "$latest" ] && [ -n "$current" ] \
+             && [ "$(printf '%s\n%s\n' "$current" "$latest" | sort -V | tail -1)" = "$current" ]; then
+            echo "needed=false" >> "$GITHUB_OUTPUT"
+            echo "nothing to do (upstream ${latest}, have ${current})"
+          else
+            echo "needed=true" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Sync ::gentoo
+        if: steps.check.outputs.needed == 'true'
         run: emerge-webrsync
 
       - name: Configure portage + install tooling
+        if: steps.check.outputs.needed == 'true'
         run: |
           mkdir -p /etc/portage/repos.conf
           printf '[DEFAULT]\nmain-repo = gentoo\n\n[gentoo]\nlocation = /var/db/repos/gentoo\n' \
             > /etc/portage/repos.conf/gentoo.conf
-          sed -i 's/^verify-signature = true/verify-signature = false/' \
-            /etc/portage/binrepos.conf/gentoo.conf
+          sed -i '/^verify-signature/d' /etc/portage/binrepos.conf/gentoo.conf
+          printf '\nverify-signature = false\n' >> /etc/portage/binrepos.conf/gentoo.conf
           emerge -q --getbinpkg \
             dev-vcs/git net-misc/curl app-arch/xz-utils app-misc/jq \
             dev-lang/go dev-util/pkgdev
 
       - name: Check for new release and open PR
+        if: steps.check.outputs.needed == 'true'
         env:
           BUMP_TOKEN: ${{ secrets.BUMP_TOKEN }}
         run: |

.gitea/workflows/ci.yaml

@@ -22,8 +22,8 @@ jobs:
           mkdir -p /etc/portage/repos.conf
           printf '[DEFAULT]\nmain-repo = gentoo\n\n[gentoo]\nlocation = /var/db/repos/gentoo\n' \
             > /etc/portage/repos.conf/gentoo.conf
-          sed -i 's/^verify-signature = true/verify-signature = false/' \
-            /etc/portage/binrepos.conf/gentoo.conf
+          sed -i '/^verify-signature/d' /etc/portage/binrepos.conf/gentoo.conf
+          printf '\nverify-signature = false\n' >> /etc/portage/binrepos.conf/gentoo.conf
           emerge -q --getbinpkg net-misc/curl dev-util/pkgcheck
 
       # Place this overlay at /var/db/repos/azy5030. actions/checkout is avoided