Mirror the homeserver repo's lint setup. Add a `Justfile` with
lint-md/lint-sh/lint-yaml/lint-actions recipes (and a `lint` aggregate +
fix recipes), an `.github`-style `.markdownlint.json`, and a `lint` job in
ci.yaml that runs `just lint` on the plain runner and gates the Gentoo
`build` job via `needs: lint`.
The overlay has no custom runner labels (workflows use ubuntu-latest), so
lint-actions calls actionlint without a -config-file, and no
.github/actionlint.yaml is needed. Also add the blank line before a list in
CLAUDE.md that markdownlint (MD032) flagged, and make the .markdownlint.json
referenced by .yamllint.yaml's comment actually exist.
All linters pass locally.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS
The daily Bump job emerged a full Go/pkgdev toolchain (and synced ::gentoo,
~5-26 min) on every run before bump-version.sh checked whether anything was
actually out of date — which, on the common no-op day, it isn't. Add a cheap
first step that compares the newest upstream release (releases.rss) against the
newest committed ebuild (Gitea contents API) using only base-image wget, and
gate the sync/install/bump steps on its `needed` output. The gate only
short-circuits when confident both versions parsed and current >= upstream;
on any doubt it falls through to the full run, where bump-version.sh remains
the source of truth.
Also fix the binpkg signature-verification disable in both workflows: the
`sed 's/^verify-signature = true/.../'` matched nothing in the stage3 binhost
config, so every emerge flooded the log with GPG failures ("unknown key",
missing pubring.kbx, "Try running getuto"). Delete any verify-signature line
and append `verify-signature = false` so the knob is actually set.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS
Same login-redirect issue as the source archive: gitea.com/gitea/runner/raw/tag/v*/go.mod now 303s to /user/login, so curl -fsSL saves the login HTML, grep finds no 'go N.N' line, and pipefail aborts the bump.
Switching to /api/v1/repos/gitea/runner/raw/go.mod?ref=v* — anonymous, returns the raw go.mod.
gitea.com now redirects unauthenticated requests for /<owner>/<repo>/archive/v*.tar.gz to /user/login, breaking emerge's source fetch (wget saves the login HTML, distfile size verify fails).
The /api/v1/repos/<owner>/<repo>/archive/v*.tar.gz endpoint still serves anonymously and returns byte-identical contents, so the Manifest is unchanged.
Updated both the live 1.0.4 ebuild SRC_URI and the bump-version.sh template so regenerated ebuilds (and the bump script's own vendor-tarball fetch) use the working URL.
The Gitea runner's GITHUB_SERVER_URL is the internal http endpoint
(http://172.17.0.1:3000); hard-coding https:// in the clone URL caused a TLS
error. Derive the scheme from GITHUB_SERVER_URL, and use the public host for
the PR-body vendor link.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Gitea reserves the GITEA_ prefix for secret names, so the workflow secret
can't be GITEA_TOKEN. Rename it (and the env var the script reads) to
BUMP_TOKEN.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
A fresh gentoo/stage3 container has no /etc/portage/repos.conf directory, so
writing gentoo.conf failed. mkdir -p it first in both workflows and the bump
script.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Initial azy5030 overlay: scaffolding (eselect repository), the
dev-util/gitea-runner ebuild (go-module, vendored), CI build validation,
and a daily upstream-bump workflow.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
azy5030
