The daily Bump job emerged a full Go/pkgdev toolchain (and synced ::gentoo,
~5-26 min) on every run before bump-version.sh checked whether anything was
actually out of date — which, on the common no-op day, it isn't. Add a cheap
first step that compares the newest upstream release (releases.rss) against the
newest committed ebuild (Gitea contents API) using only base-image wget, and
gate the sync/install/bump steps on its `needed` output. The gate only
short-circuits when confident both versions parsed and current >= upstream;
on any doubt it falls through to the full run, where bump-version.sh remains
the source of truth.
Also fix the binpkg signature-verification disable in both workflows: the
`sed 's/^verify-signature = true/.../'` matched nothing in the stage3 binhost
config, so every emerge flooded the log with GPG failures ("unknown key",
missing pubring.kbx, "Try running getuto"). Delete any verify-signature line
and append `verify-signature = false` so the knob is actually set.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS
Gitea reserves the GITEA_ prefix for secret names, so the workflow secret
can't be GITEA_TOKEN. Rename it (and the env var the script reads) to
BUMP_TOKEN.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
A fresh gentoo/stage3 container has no /etc/portage/repos.conf directory, so
writing gentoo.conf failed. mkdir -p it first in both workflows and the bump
script.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Initial azy5030 overlay: scaffolding (eselect repository), the
dev-util/gitea-runner ebuild (go-module, vendored), CI build validation,
and a daily upstream-bump workflow.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
azy5030