actions/checkout can't run in the build job: the Gitea runner executes JS
actions via `docker exec node …` inside the job container, and gentoo/stage3
ships no node, so checkout died with `exec: "node": ... not found` (exit 127)
in run 111. Revert the build job to the node-free curl+tar checkout (restore
net-misc/curl, /var/db/repos/azy5030 paths) and document why.
The lint job keeps actions/checkout — it has no container: and runs in the
runner's default node-capable image, where plain checkout works on this SHA-1
repo (confirmed green in run 111's lint job).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS
Run 110's lint job failed at checkout ("couldn't find remote ref <sha>")
because GIT_DEFAULT_HASH: sha256 — copied from the SHA-256 homeserver repo —
made git init create a SHA-256 repo that can't resolve this repo's SHA-1
commits. This overlay is a plain SHA-1 repo, so checkout needs no hash override.
- lint job: drop the bogus GIT_DEFAULT_HASH: sha256 override.
- build job: replace the curl+tar checkout with actions/checkout into
$GITHUB_WORKSPACE, registered with portage via repos.conf; pull dev-vcs/git
in Configure portage (stage3 has no git, which checkout shells out to) and
drop net-misc/curl (only the old checkout used it). QA scan / verify steps
now reference $GITHUB_WORKSPACE.
- CLAUDE.md: correct the SHA-256 claim and rewrite the CI section for the
two-job lint-gate + actions/checkout setup.
just lint passes; ci.yaml passes actionlint.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS
Mirror the homeserver repo's lint setup. Add a `Justfile` with
lint-md/lint-sh/lint-yaml/lint-actions recipes (and a `lint` aggregate +
fix recipes), an `.github`-style `.markdownlint.json`, and a `lint` job in
ci.yaml that runs `just lint` on the plain runner and gates the Gentoo
`build` job via `needs: lint`.
The overlay has no custom runner labels (workflows use ubuntu-latest), so
lint-actions calls actionlint without a -config-file, and no
.github/actionlint.yaml is needed. Also add the blank line before a list in
CLAUDE.md that markdownlint (MD032) flagged, and make the .markdownlint.json
referenced by .yamllint.yaml's comment actually exist.
All linters pass locally.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS
The daily Bump job emerged a full Go/pkgdev toolchain (and synced ::gentoo,
~5-26 min) on every run before bump-version.sh checked whether anything was
actually out of date — which, on the common no-op day, it isn't. Add a cheap
first step that compares the newest upstream release (releases.rss) against the
newest committed ebuild (Gitea contents API) using only base-image wget, and
gate the sync/install/bump steps on its `needed` output. The gate only
short-circuits when confident both versions parsed and current >= upstream;
on any doubt it falls through to the full run, where bump-version.sh remains
the source of truth.
Also fix the binpkg signature-verification disable in both workflows: the
`sed 's/^verify-signature = true/.../'` matched nothing in the stage3 binhost
config, so every emerge flooded the log with GPG failures ("unknown key",
missing pubring.kbx, "Try running getuto"). Delete any verify-signature line
and append `verify-signature = false` so the knob is actually set.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS
Same login-redirect issue as the source archive: gitea.com/gitea/runner/raw/tag/v*/go.mod now 303s to /user/login, so curl -fsSL saves the login HTML, grep finds no 'go N.N' line, and pipefail aborts the bump.
Switching to /api/v1/repos/gitea/runner/raw/go.mod?ref=v* — anonymous, returns the raw go.mod.
gitea.com now redirects unauthenticated requests for /<owner>/<repo>/archive/v*.tar.gz to /user/login, breaking emerge's source fetch (wget saves the login HTML, distfile size verify fails).
The /api/v1/repos/<owner>/<repo>/archive/v*.tar.gz endpoint still serves anonymously and returns byte-identical contents, so the Manifest is unchanged.
Updated both the live 1.0.4 ebuild SRC_URI and the bump-version.sh template so regenerated ebuilds (and the bump script's own vendor-tarball fetch) use the working URL.
The Gitea runner's GITHUB_SERVER_URL is the internal http endpoint
(http://172.17.0.1:3000); hard-coding https:// in the clone URL caused a TLS
error. Derive the scheme from GITHUB_SERVER_URL, and use the public host for
the PR-body vendor link.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Gitea reserves the GITEA_ prefix for secret names, so the workflow secret
can't be GITEA_TOKEN. Rename it (and the env var the script reads) to
BUMP_TOKEN.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
A fresh gentoo/stage3 container has no /etc/portage/repos.conf directory, so
writing gentoo.conf failed. mkdir -p it first in both workflows and the bump
script.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Initial azy5030 overlay: scaffolding (eselect repository), the
dev-util/gitea-runner ebuild (go-module, vendored), CI build validation,
and a daily upstream-bump workflow.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
azy5030
