dev-util/gitea-runner: bump to 3.5.0

- ci.yaml: filter the push trigger to branches. An unfiltered `push` also
  fired for every tag ref, including the vendor-release tags the bump script
  creates via the API.
- bump-version.sh: remove the pkgcheck/emerge/--version validation before
  push. The branch push triggers CI, which runs the same checks and, unlike
  the script's local copy, fetches the real release asset. The PR body now
  asks for green CI instead of claiming the build passed in the bump job.
- vendor-tags.yaml: new workflow on pushes to master touching dev-util/**.
  The vendor release is created before the bump commit exists (and PRs are
  squash-merged), so its tag pointed at an arbitrary master commit. This
  force-updates each vendor tag whose ebuild is in the tree to the master
  commit that added that ebuild. Tags are only ever updated, never deleted,
  since deleting a release's tag deletes the release and its assets.
- CLAUDE.md: document both changes.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.gitea/workflows/bump.yaml

@@ -2,7 +2,14 @@ name: Bump
 on:
   schedule:
     - cron: '0 5 * * *'
-  workflow_dispatch: {}
+  workflow_dispatch:
+    inputs:
+      version:
+        description: >-
+          Upstream gitea/runner version to bump to (e.g. 3.4.0, no leading
+          "v"). Leave empty to use the latest upstream release.
+        required: false
+        type: string
 
 jobs:
   bump:
@@ -10,23 +17,69 @@ jobs:
     container:
       image: gentoo/stage3:amd64-openrc
     steps:
+      # Cheap gate: compare the newest upstream release against the newest
+      # committed ebuild using only base-image tools (wget). The expensive
+      # toolchain install + bump below is skipped on the common no-op day, so a
+      # daily run that has nothing to do finishes in seconds instead of minutes.
+      # bump-version.sh re-checks this itself and remains the source of truth.
+      - name: Check whether a bump is needed
+        id: check
+        env:
+          BUMP_TOKEN: ${{ secrets.BUMP_TOKEN }}
+          BUMP_VERSION: ${{ inputs.version }}
+        run: |
+          # An explicitly requested version always runs the full bump.
+          if [ -n "${BUMP_VERSION}" ]; then
+            echo "needed=true" >> "$GITHUB_OUTPUT"
+            echo "explicit version requested: ${BUMP_VERSION}"
+            exit 0
+          fi
+          latest=$(wget -qO- https://gitea.com/gitea/runner/releases.rss \
+            | grep -oE '<title>v[0-9]+\.[0-9]+\.[0-9]+</title>' \
+            | head -1 | sed -E 's#</?title>##g; s/^v//')
+          current=$(wget -qO- --header="Authorization: token ${BUMP_TOKEN}" \
+            "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/contents/dev-util/gitea-runner" \
+            | grep -oE '"name": *"gitea-runner-[0-9.]+\.ebuild"' \
+            | sed -E 's#.*gitea-runner-([0-9.]+)\.ebuild.*#\1#' | sort -V | tail -1)
+          echo "upstream=${latest} current=${current}"
+          # Only short-circuit when we are CONFIDENT there is nothing to do
+          # (both versions parsed and current is >= upstream). On any doubt
+          # fall through to the full run and let bump-version.sh decide.
+          if [ -n "$latest" ] && [ -n "$current" ] \
+             && [ "$(printf '%s\n%s\n' "$current" "$latest" | sort -V | tail -1)" = "$current" ]; then
+            echo "needed=false" >> "$GITHUB_OUTPUT"
+            echo "nothing to do (upstream ${latest}, have ${current})"
+          else
+            echo "needed=true" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Sync ::gentoo
+        if: steps.check.outputs.needed == 'true'
         run: emerge-webrsync
 
       - name: Configure portage + install tooling
+        if: steps.check.outputs.needed == 'true'
         run: |
           mkdir -p /etc/portage/repos.conf
           printf '[DEFAULT]\nmain-repo = gentoo\n\n[gentoo]\nlocation = /var/db/repos/gentoo\n' \
             > /etc/portage/repos.conf/gentoo.conf
-          sed -i 's/^verify-signature = true/verify-signature = false/' \
-            /etc/portage/binrepos.conf/gentoo.conf
+          sed -i '/^verify-signature/d' /etc/portage/binrepos.conf/gentoo.conf
+          printf '\nverify-signature = false\n' >> /etc/portage/binrepos.conf/gentoo.conf
+          # Upstream's go.mod can require a Go that Gentoo only has under
+          # ~amd64 (GOTOOLCHAIN=local forbids auto-download), so accept the
+          # testing-keyworded dev-lang/go. It is built from source when no
+          # stable binpkg satisfies the requirement.
+          mkdir -p /etc/portage/package.accept_keywords
+          echo 'dev-lang/go ~amd64' > /etc/portage/package.accept_keywords/go
           emerge -q --getbinpkg \
             dev-vcs/git net-misc/curl app-arch/xz-utils app-misc/jq \
             dev-lang/go dev-util/pkgdev
 
       - name: Check for new release and open PR
+        if: steps.check.outputs.needed == 'true'
         env:
           BUMP_TOKEN: ${{ secrets.BUMP_TOKEN }}
+          BUMP_VERSION: ${{ inputs.version }}
         run: |
           host=${GITHUB_SERVER_URL#http://}; host=${host#https://}
           curl -fsSL "http://x-access-token:${BUMP_TOKEN}@${host}/${GITHUB_REPOSITORY}/raw/branch/master/scripts/bump-version.sh" \

.gitea/workflows/ci.yaml

@@ -1,8 +1,49 @@
 name: CI
-on: [push]
+# Restrict to branch pushes: an unfiltered `push` also fires for tag refs,
+# including the vendor-release tags the bump script creates via the API.
+on:
+  push:
+    branches:
+      - '**'
 
 jobs:
+  # Lint gate: runs on the plain Docker-backend runner (not the Gentoo
+  # container) and must pass before the build job starts. Mirrors the lint job
+  # in the homeserver repo; `just lint` runs markdownlint/shellcheck/yamllint/
+  # actionlint over the repo.
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # setup-just fetches its binary from GitHub; on a Gitea runner the default
+      # github-token is the *Gitea* token (GitHub rejects it 401), so pass none
+      # and use GitHub's unauthenticated API.
+      - uses: extractions/setup-just@v4
+        with:
+          github-token: ""
+
+      - uses: taiki-e/install-action@v2
+        env:
+          GITHUB_TOKEN: ""
+        with:
+          tool: shellcheck
+
+      - name: Install markdownlint-cli
+        run: npm install -g markdownlint-cli
+
+      # actionlint has no maintained setup-action and uv ships via astral.sh;
+      # both installers hit their own release assets (no GitHub token needed).
+      - name: Install yamllint + actionlint tooling
+        run: |
+          curl -LsSf https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh
+          bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) latest /usr/local/bin
+
+      - name: Run linters
+        run: just lint
+
   build:
+    needs: lint
     # The label only schedules the job on the (Docker-backend) runner; the steps
     # actually run inside the Gentoo container declared below.
     runs-on: ubuntu-latest
@@ -22,12 +63,16 @@ jobs:
           mkdir -p /etc/portage/repos.conf
           printf '[DEFAULT]\nmain-repo = gentoo\n\n[gentoo]\nlocation = /var/db/repos/gentoo\n' \
             > /etc/portage/repos.conf/gentoo.conf
-          sed -i 's/^verify-signature = true/verify-signature = false/' \
-            /etc/portage/binrepos.conf/gentoo.conf
+          sed -i '/^verify-signature/d' /etc/portage/binrepos.conf/gentoo.conf
+          printf '\nverify-signature = false\n' >> /etc/portage/binrepos.conf/gentoo.conf
           emerge -q --getbinpkg net-misc/curl dev-util/pkgcheck
 
-      # Place this overlay at /var/db/repos/azy5030. actions/checkout is avoided
-      # (SHA-256 Gitea repos break it); curl + tar fetches the source archive.
+      # Place this overlay at /var/db/repos/azy5030 via curl + tar. actions/checkout
+      # can't run here: this job uses the gentoo/stage3 container, and the Gitea
+      # runner executes JS actions with `node` *inside* that container
+      # (`docker exec node …`) — stage3 ships no node, so checkout fails with
+      # exit 127. (The lint job uses actions/checkout fine: it has no container:
+      # and runs in the runner's default node-capable image.)
       - name: Check out overlay
         env:
           TOKEN: ${{ github.token }}
@@ -41,6 +86,11 @@ jobs:
             > /etc/portage/repos.conf/azy5030.conf
           mkdir -p /etc/portage/package.accept_keywords
           echo 'dev-util/gitea-runner ~amd64' > /etc/portage/package.accept_keywords/gitea-runner
+          # Upstream tracks new Go releases faster than Gentoo stabilises them
+          # (the ebuild's BDEPEND follows upstream go.mod), so accept the
+          # testing-keyworded dev-lang/go. No stable binpkg exists for it, so
+          # this compiles Go from source when a newer one is required.
+          echo 'dev-lang/go ~amd64' > /etc/portage/package.accept_keywords/go
 
       - name: QA scan
         run: pkgcheck scan --repo /var/db/repos/azy5030 dev-util/gitea-runner

.gitea/workflows/vendor-tags.yaml

@@ -0,0 +1,43 @@
+name: Vendor tags
+# The bump script creates the `${PN}-${ver}-vendor` release (which hosts the
+# vendor tarball) *before* the bump commit exists, so its tag can only point at
+# whatever master was at the time. The PR is then squash/rebase-merged, so the
+# branch commit never lands on master either. This job re-points each vendor
+# tag at the master commit that introduced that version's ebuild. It is
+# idempotent: a tag already on the right commit is left alone.
+#
+# Only ever force-*update* a tag here. Deleting a release's tag makes Gitea
+# delete the release and its assets, which would break the ebuild's SRC_URI.
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - 'dev-util/**'
+
+jobs:
+  repoint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Point vendor tags at their bump commits
+        run: |
+          set -euo pipefail
+          git fetch --tags --force origin
+          for ebuild in dev-util/gitea-runner/gitea-runner-*.ebuild; do
+            ver=${ebuild##*/gitea-runner-}; ver=${ver%.ebuild}
+            tag="gitea-runner-${ver}-vendor"
+            if ! cur=$(git rev-parse --verify -q "refs/tags/${tag}^{commit}"); then
+              echo "${tag}: no such tag, skipping"; continue
+            fi
+            # git mv shows up as an addition of the new path (no --follow).
+            target=$(git log --diff-filter=A --format=%H -1 -- "$ebuild")
+            if [ "$cur" = "$target" ]; then
+              echo "${tag}: already at ${target}"; continue
+            fi
+            echo "${tag}: ${cur} -> ${target}"
+            git push --force origin "${target}:refs/tags/${tag}"
+          done

.markdownlint.json

@@ -0,0 +1,9 @@
+{
+  "MD013": false,
+  "MD024": {
+    "siblings_only": true
+  },
+  "MD060": {
+    "style": "compact"
+  }
+}

CLAUDE.md

@@ -0,0 +1,97 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## What this is
+
+A personal **Gentoo ebuild repository (overlay)**, repo name `azy5030`, EAPI 8,
+`masters = gentoo`, thin + unsigned Manifests (`metadata/layout.conf`). It packages
+software not in the main `::gentoo` tree. Currently one package:
+`dev-util/gitea-runner`. Hosted on a self-hosted Gitea at `git.azy.dev`. (This repo
+is a standard SHA-1 repo; the sibling `homeserver` repo is SHA-256, so workflow
+snippets copied from it may carry a `GIT_DEFAULT_HASH: sha256` checkout override
+that this repo must *not* use.)
+
+## The vendored-build model (the core design)
+
+`dev-util/gitea-runner` is a `go-module` ebuild built **offline** from upstream
+`gitea/runner` source. Gentoo's build sandbox has no network, so Go modules cannot be
+fetched at build time. Instead they are vendored ahead of time:
+
+1. The upstream source archive is `SRC_URI`'d from gitea.com's `/api/v1/.../archive`
+   endpoint (a plain `git clone`/`go get` is never used).
+2. A **vendor tarball** (`${P}-vendor.tar.xz`, the result of `go mod vendor`, packed
+   deterministically) is uploaded as a **release asset on this repo** and is the second
+   `SRC_URI`. `S="${WORKDIR}/runner"`.
+3. `dev-util/gitea-runner/Manifest` pins BLAKE2B/SHA512 of both tarballs. `emerge`
+   verifies against the Manifest, then compiles offline from `vendor/`.
+
+Consequences when editing the ebuild:
+
+- `LICENSE` must cover **every vendored module's** license, not just upstream's MIT.
+  The bump PR checklist suggests `go-licenses report ./...` to confirm.
+- `BDEPEND` Go version tracks upstream's `go.mod` `go` directive.
+- The version string is injected via ldflags into
+  `gitea.com/gitea/runner/internal/pkg/ver.version`; CI asserts `gitea-runner --version`
+  echoes `v${PV}`. If upstream moves that symbol path, the build "succeeds" but reports
+  the wrong version.
+
+## Bumping to a new upstream version
+
+This is **automated** by `scripts/bump-version.sh` (run daily by `bump.yaml`, or
+`workflow_dispatch`). To do it manually you must reproduce its steps, because a version
+bump is never just renaming the ebuild — the vendor tarball must be regenerated and
+re-uploaded as a release asset, or the build will fail Manifest verification. The script:
+
+1. Reads the latest `vX.Y.Z` from upstream `releases.rss`; compares to the newest
+   committed ebuild. Exits early if up to date or if a `bump/gitea-runner-<ver>` branch
+   already exists.
+2. Downloads the source archive, runs `go mod vendor`, packs a reproducible
+   `*-vendor.tar.xz` (`--sort=name --mtime='UTC 1970-01-01' --owner=0 --group=0`).
+3. Creates/reuses a release tagged `${PN}-${ver}-vendor` and uploads the tarball asset.
+4. `git mv`s the ebuild to the new version, rewrites `BDEPEND`'s Go version from
+   upstream `go.mod`, and regenerates the Manifest with `pkgdev manifest` (after copying
+   both distfiles into `/var/cache/distfiles` and wiring a temporary `repos.conf`).
+5. Commits, pushes the branch, opens a PR against `master`. The script does **not**
+   emerge or pkgcheck the result itself: the branch push triggers CI, which does both
+   (and fetches the real release asset, which the script's local copy never would).
+
+Requires a `BUMP_TOKEN` repo secret (scopes: repository read/write, write release) plus
+a Gentoo env with `go pkgdev git curl xz jq`.
+
+## CI (`.gitea/workflows/ci.yaml`)
+
+Runs on every push, two jobs. A **`lint`** job runs on the plain Docker-backend runner
+(no container), checks out with `actions/checkout`, installs the linters, and runs
+`just lint` (markdownlint/shellcheck/yamllint/actionlint). The **`build`** job has
+`needs: lint` (lint is a gate) and runs inside a `gentoo/stage3:amd64-openrc` container:
+`emerge-webrsync` to sync `::gentoo` → configure portage (disables binpkg signature
+verification so prebuilt deps like `dev-lang/go` are pulled, not compiled) → **check out
+via `curl + tar`, not `actions/checkout`** into `/var/db/repos/azy5030` → `pkgcheck scan`
+→ `emerge` → assert `gitea-runner --version` matches the ebuild version.
+
+The build job can't use `actions/checkout` (even though the lint job does): the Gitea
+runner executes JS actions by `docker exec node …` *inside* the job container, and
+`gentoo/stage3` ships no node, so any JS action fails with exit 127. The lint job has no
+`container:`, so it runs in the runner's default node-capable image and checkout works.
+
+## Vendor-tag repointing (`.gitea/workflows/vendor-tags.yaml`)
+
+The bump script creates the `${PN}-${ver}-vendor` release before the bump commit
+exists, so its tag points at whatever `master` was at the time (and squash/rebase
+merges mean the branch commit never lands on `master` anyway). On every push to
+`master` touching `dev-util/**`, this workflow force-updates each vendor tag whose
+ebuild is still in the tree to the `master` commit that added that ebuild. It only
+ever *updates* tags: deleting a release's tag makes Gitea delete the release and its
+assets, breaking the ebuild's `SRC_URI`. Tag pushes don't re-trigger CI because
+`ci.yaml` is filtered to branch pushes.
+
+## Conventions / gotchas
+
+- **YAML** is linted by `.yamllint.yaml` (relaxed: line-length and document-start
+  disabled; `truthy.check-keys: false` so `on:` is allowed unquoted).
+- `metadata/md5-cache/` is **gitignored** — portage regenerates it on sync, so never
+  commit it (a stale `gitea-runner-1.0.4` file may linger on disk untracked).
+- The bump script and CI deliberately preserve the scheme of `GITHUB_SERVER_URL`: on the
+  self-hosted runner it is an internal `http://` endpoint. Don't hardcode `https`.
+- New packages must be added to `profiles/categories` (currently just `dev-util`).

Justfile

@@ -0,0 +1,70 @@
+# azy5030 overlay management commands
+
+# Install dev tooling (linters) used by the lint recipes and CI
+setup-dev:
+    brew install just markdownlint-cli shellcheck actionlint uv
+
+# Lint Markdown: all repo files, or only the .md files in a passed list
+lint-md files="":
+    #!/usr/bin/env bash
+    set -euo pipefail
+    if [ -z "{{files}}" ]; then
+        markdownlint --ignore node_modules '**/*.md'
+    else
+        targets=$(printf '%s\n' {{files}} | grep -E '\.md$' || true)
+        if [ -n "$targets" ]; then markdownlint --ignore node_modules $targets; fi
+    fi
+
+# Lint shell scripts: all repo files, or only the .sh files in a passed list
+lint-sh files="":
+    #!/usr/bin/env bash
+    set -euo pipefail
+    if [ -z "{{files}}" ]; then
+        targets=$(find . -name '*.sh' -not -path './node_modules/*')
+    else
+        targets=$(printf '%s\n' {{files}} | grep -E '\.sh$' || true)
+    fi
+    if [ -n "$targets" ]; then shellcheck $targets; fi
+
+# Lint YAML: all repo files, or only the .yaml/.yml in a passed list (via uv)
+lint-yaml files="":
+    #!/usr/bin/env bash
+    set -euo pipefail
+    if [ -z "{{files}}" ]; then
+        targets=$(find . \( -name '*.yaml' -o -name '*.yml' \) -not -path './node_modules/*')
+    else
+        targets=$(printf '%s\n' {{files}} | grep -E '\.ya?ml$' || true)
+    fi
+    if [ -n "$targets" ]; then uvx yamllint $targets; fi
+
+# Lint Gitea Actions workflows: all, or only the workflow files in a passed list
+lint-actions files="":
+    #!/usr/bin/env bash
+    set -euo pipefail
+    if [ -z "{{files}}" ]; then
+        targets=$(find .gitea/workflows \( -name '*.yaml' -o -name '*.yml' \) 2>/dev/null || true)
+    else
+        targets=$(printf '%s\n' {{files}} | grep -E '^\.gitea/workflows/.*\.ya?ml$' || true)
+    fi
+    # actionlint also runs shellcheck on each `run:` block. No custom runner
+    # labels here (workflows use ubuntu-latest), so no -config-file is needed.
+    if [ -n "$targets" ]; then actionlint $targets; fi
+
+# Autofix all Markdown files
+fix-md:
+    markdownlint --fix --ignore node_modules '**/*.md'
+
+# Apply shellcheck's auto-fixable suggestions to all shell scripts
+fix-sh:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    targets=$(find . -name '*.sh' -not -path './node_modules/*')
+    # shellcheck's diff carries ./ path segments that `git apply` rejects; strip them.
+    diff=$(shellcheck -f diff $targets 2>/dev/null | sed 's|/\./|/|g' || true)
+    if [ -n "$diff" ]; then printf '%s\n' "$diff" | git apply; fi
+
+# Lint everything (all repo files, or only a passed list of files)
+lint files="": (lint-md files) (lint-sh files) (lint-yaml files) (lint-actions files)
+
+# Autofix everything
+fix: fix-md fix-sh

dev-util/gitea-runner/Manifest

@@ -1,2 +1,2 @@
-DIST gitea-runner-1.0.7-vendor.tar.xz 3018704 BLAKE2B 39b861b1b454a22f23c80bacd551127d0812b71a336c79032fa01f8df834eca23e030479da76fc12358af955f7cb56bcc541b99df1fd7880a62fbf35b8859d4c SHA512 0f21ba48db4bbb9fc0738543a7123e884e93ab5b423b6ff99dfa913d6df6cf0db4d96bff2e32b82beee9fef8e81cfdef849d58050fe8d9a2abddb55af7da8a38
-DIST gitea-runner-1.0.7.tar.gz 340157 BLAKE2B 7dc0fb3026e02c14052d4983f265adf787d9f3f01d856e81a4297a3163a1d2efe19f5ae6b9132fe4520ca551c84e7749ea33c7eeff87806870b0a9b60c54719f SHA512 8f0c69bb0e416efca1b63ae37cad0f740a5093bc569711b9327cd11a69f40d1037e59dc547ad3a88e8d6be7fa669a3acf58ac775237932f2872c492a7812cf96
+DIST gitea-runner-3.5.0-vendor.tar.xz 3263236 BLAKE2B 747cf45afebd2b1c3c5b44d2f9335e2b787db0fd5fbc14195346ba84250dfec69dd34e64221a015db3973cd7cbc796c58d704e00efd7cd8aba3628e896794244 SHA512 d881dafa3dd09d9d20e138e19a38c8bc82fe2eef90885db7a9a8fe1eac531470a55ac61be870e37b9b1b9807b71f1ce765d0c6b4b373d0c94032ff322fd6ac20
+DIST gitea-runner-3.5.0.tar.gz 516558 BLAKE2B 262e7e6383f99c61f6e3bdf6b72e8916ae1ea916f789b2b8a3db36e332bc4a2ed3f3c662d052fe9eb9ab802ae634938c360c7d5d82afd63f38580d344c786ef7 SHA512 0b2697ad8b481125cce52fbdd2cb38c4cb6a13df016646d332a6676573e38bc2e4beee711ed629f392ce6d1b8a19e6006d1009024bfa2866aabfe8dc2258b5c2

dev-util/gitea-runner/gitea-runner-3.5.0.ebuild

@@ -19,7 +19,7 @@ LICENSE="MIT Apache-2.0 BSD BSD-2 ISC MPL-2.0"
 SLOT="0"
 KEYWORDS="~amd64"
 
-BDEPEND=">=dev-lang/go-1.26.0"
+BDEPEND=">=dev-lang/go-1.27"
 # The runner shells out to the docker client for the Docker backend.
 RDEPEND="app-containers/docker-cli"
 

scripts/bump-version.sh

@@ -6,12 +6,17 @@
 # Expects a Gentoo environment with: go, pkgdev, git, curl, xz, jq.
 # Required env: BUMP_TOKEN, GITHUB_SERVER_URL, GITHUB_REPOSITORY.
 # Optional env: GITHUB_API_URL (defaults to ${GITHUB_SERVER_URL}/api/v1).
+#               BUMP_VERSION   target a specific upstream version (X.Y.Z, no
+#                              leading "v") instead of the latest release. An
+#                              explicit target may be older than the current
+#                              ebuild (useful to back out of a broken release).
 set -euo pipefail
 
 PN="gitea-runner"
 UPSTREAM_RSS="https://gitea.com/gitea/runner/releases.rss"
 UPSTREAM_ARCHIVE="https://gitea.com/api/v1/repos/gitea/runner/archive"
-UPSTREAM_GOMOD="https://gitea.com/gitea/runner/raw/tag"
+UPSTREAM_GOMOD="https://gitea.com/api/v1/repos/gitea/runner/raw/go.mod"
+UPSTREAM_TAGS="https://gitea.com/api/v1/repos/gitea/runner/tags"
 
 : "${BUMP_TOKEN:?BUMP_TOKEN is required}"
 : "${GITHUB_SERVER_URL:?GITHUB_SERVER_URL is required}"
@@ -25,10 +30,22 @@ host="${GITHUB_SERVER_URL#*://}"
 api() { curl -fsSL -H "Authorization: token ${BUMP_TOKEN}" "$@"; }
 
 # --- determine versions ------------------------------------------------------
-latest=$(curl -fsSL "$UPSTREAM_RSS" \
+if [ -n "${BUMP_VERSION:-}" ]; then
+  latest="${BUMP_VERSION#v}"
+  echo "$latest" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$' \
+    || { echo "BUMP_VERSION must look like X.Y.Z (got '${BUMP_VERSION}')"; exit 1; }
+  # Fail fast if the tag doesn't exist upstream, before cloning anything.
+  # (The raw endpoint silently falls back to the default branch for an
+  # unknown ref, so ask the tags API, which 404s.)
+  curl -fsSL "${UPSTREAM_TAGS}/v${latest}" -o /dev/null \
+    || { echo "upstream tag v${latest} not found"; exit 1; }
+  echo "targeting explicit version ${latest}"
+else
+  latest=$(curl -fsSL "$UPSTREAM_RSS" \
     | grep -oE '<title>v[0-9]+\.[0-9]+\.[0-9]+</title>' \
     | head -1 | sed -E 's#</?title>##g; s/^v//')
-[ -n "$latest" ] || { echo "could not parse upstream version"; exit 1; }
+  [ -n "$latest" ] || { echo "could not parse upstream version"; exit 1; }
+fi
 
 WORK=$(mktemp -d)
 git clone "${scheme}://x-access-token:${BUMP_TOKEN}@${host}/${GITHUB_REPOSITORY}.git" "$WORK"
@@ -39,11 +56,15 @@ current=$(find "$pkgdir" -name "${PN}-*.ebuild" \
   | sed -E "s#.*/${PN}-(.*)\.ebuild#\1#" | sort -V | tail -1)
 echo "upstream=${latest} current=${current}"
 
+[ "$latest" != "$current" ] || { echo "already at ${latest}"; exit 0; }
 newest=$(printf '%s\n%s\n' "$current" "$latest" | sort -V | tail -1)
-if [ "$newest" = "$current" ] && [ "$latest" != "$current" ]; then
+if [ "$newest" = "$current" ]; then
+  if [ -n "${BUMP_VERSION:-}" ]; then
+    echo "warning: explicit target ${latest} is older than current ${current}; downgrading"
+  else
     echo "current ($current) is newer than upstream ($latest); nothing to do"; exit 0
+  fi
 fi
-[ "$latest" != "$current" ] || { echo "already at latest ($current)"; exit 0; }
 
 branch="bump/${PN}-${latest}"
 if api "${API}/repos/${GITHUB_REPOSITORY}/branches/${branch}" >/dev/null 2>&1; then
@@ -82,7 +103,7 @@ git checkout -b "$branch"
 git mv "${pkgdir}/${PN}-${current}.ebuild" "${pkgdir}/${PN}-${latest}.ebuild"
 
 # Track the upstream go.mod's required Go version in BDEPEND.
-goreq=$(curl -fsSL "${UPSTREAM_GOMOD}/v${latest}/go.mod" \
+goreq=$(curl -fsSL "${UPSTREAM_GOMOD}?ref=v${latest}" \
   | grep -oE '^go [0-9]+\.[0-9]+(\.[0-9]+)?' | awk '{print $2}')
 [ -n "$goreq" ] && sed -i -E \
   "s#^BDEPEND=\">=dev-lang/go-[0-9.]+\"#BDEPEND=\">=dev-lang/go-${goreq}\"#" \
@@ -99,13 +120,10 @@ printf '[azy5030]\nlocation = %s\nmasters = gentoo\nauto-sync = false\n' "$WORK"
   > /etc/portage/repos.conf/azy5030.conf
 ( cd "${pkgdir}" && pkgdev manifest )
 
-# --- validate, commit, push, open PR ----------------------------------------
-pkgcheck scan --repo "$WORK" "${pkgdir}" || true
-mkdir -p /etc/portage/package.accept_keywords
-echo 'dev-util/gitea-runner ~amd64' > /etc/portage/package.accept_keywords/gitea-runner
-emerge -v --getbinpkg "=dev-util/${PN}-${latest}"
-gitea-runner --version | grep -q "v${latest}"
-
+# --- commit, push, open PR ---------------------------------------------------
+# No emerge/pkgcheck here: pushing the branch triggers CI, which runs pkgcheck,
+# builds the package from the Manifest (fetching the real release asset) and
+# asserts `gitea-runner --version`. A broken release shows up as a red PR.
 git add -A
 git commit -m "dev-util/${PN}: bump to ${latest}"
 git push origin "$branch"
@@ -120,8 +138,7 @@ Review checklist:
 - [ ] LICENSE still covers all vendored module licenses (\`go-licenses report ./...\`)
 - [ ] BDEPEND Go version matches upstream go.mod (set to >=${goreq:-unchanged})
 - [ ] version ldflags path \`internal/pkg/ver.version\` unchanged upstream
-
-CI build + \`gitea-runner --version\` passed in this workflow.
+- [ ] CI (pkgcheck + emerge + \`gitea-runner --version\`) is green on this PR
 EOF
 )
 api -X POST -H 'Content-Type: application/json' \