## Why
The daily **Bump** job (`runs/107` and every other scheduled run) does ~5–26 min
of work on every run before it ever checks whether a bump is needed — and on the
common no-op day it isn't. Timeline of a no-op run:
`docker pull stage3` → `emerge-webrsync` → **`emerge … dev-lang/go dev-util/pkgdev` (29 pkgs)** → `bump-version.sh` finds `already at latest` and exits in **1 second**.
`go`/`pkgdev`/`xz`/`jq` are only needed when a bump actually happens. Recent
no-op scheduled runs took 5m, 26m, 9m, 5m, 10m — all to do nothing.
Separately, the log on every emerge was flooded with binpkg GPG failures
(`unknown key`, `pubring.kbx: No such file`, `Try running getuto`). The
`sed 's/^verify-signature = true/.../'` matched nothing in the stage3 binhost
config, so the intended "disable binpkg signature verification" never took
effect (it worked anyway only because the failures are non-fatal).
## What
- **`bump.yaml`**: add a cheap `Check whether a bump is needed` step that compares
the newest upstream release (`releases.rss`) against the newest committed ebuild
(Gitea contents API) using only base-image `wget`, and gate `Sync ::gentoo`,
the toolchain install, and the bump step on its `needed` output. The gate only
short-circuits when **confident** (both versions parsed and current ≥ upstream);
on any doubt — failed fetch, unparseable version — it falls through to the full
run, where `bump-version.sh` remains the source of truth and re-checks.
- **`bump.yaml` + `ci.yaml`**: replace the no-op `sed` with `sed -i '/^verify-signature/d'`
+ append `verify-signature = false`, so the knob is actually set regardless of
the stage3 default contents.
## Notes / limits
- The job `container:` still pulls `gentoo/stage3` before the gate runs, so the
~3.5 min image pull on no-op days is unchanged; this saves the larger
webrsync + 29-package emerge. A follow-up could split the gate into a separate
container-less job to skip the pull too, but that depends on what the runner
maps `runs-on: ubuntu-latest` to, so it's left out here.
- Validated: `yamllint -c .yamllint.yaml` clean on both files; version-comparison
logic and the contents-API JSON parsing unit-tested locally (equal / upstream-newer /
current-ahead / parse-failure cases).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Reviewed-on: #4
Co-authored-by: Ali Zein Yousuf <azy5030@gmail.com>
Co-committed-by: Ali Zein Yousuf <azy5030@gmail.com>
Same login-redirect issue as the source archive: gitea.com/gitea/runner/raw/tag/v*/go.mod now 303s to /user/login, so curl -fsSL saves the login HTML, grep finds no 'go N.N' line, and pipefail aborts the bump.
Switching to /api/v1/repos/gitea/runner/raw/go.mod?ref=v* — anonymous, returns the raw go.mod.
gitea.com now redirects unauthenticated requests for /<owner>/<repo>/archive/v*.tar.gz to /user/login, breaking emerge's source fetch (wget saves the login HTML, distfile size verify fails).
The /api/v1/repos/<owner>/<repo>/archive/v*.tar.gz endpoint still serves anonymously and returns byte-identical contents, so the Manifest is unchanged.
Updated both the live 1.0.4 ebuild SRC_URI and the bump-version.sh template so regenerated ebuilds (and the bump script's own vendor-tarball fetch) use the working URL.
The Gitea runner's GITHUB_SERVER_URL is the internal http endpoint
(http://172.17.0.1:3000); hard-coding https:// in the clone URL caused a TLS
error. Derive the scheme from GITHUB_SERVER_URL, and use the public host for
the PR-body vendor link.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Gitea reserves the GITEA_ prefix for secret names, so the workflow secret
can't be GITEA_TOKEN. Rename it (and the env var the script reads) to
BUMP_TOKEN.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
A fresh gentoo/stage3 container has no /etc/portage/repos.conf directory, so
writing gentoo.conf failed. mkdir -p it first in both workflows and the bump
script.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Initial azy5030 overlay: scaffolding (eselect repository), the
dev-util/gitea-runner ebuild (go-module, vendored), CI build validation,
and a daily upstream-bump workflow.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
gitea-actions
azy5030