Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 gitea-actions
|
da66e2efb1 |
@@ -2,14 +2,7 @@ name: Bump
|
||||
on:
|
||||
schedule:
|
||||
- cron: '0 5 * * *'
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
version:
|
||||
description: >-
|
||||
Upstream gitea/runner version to bump to (e.g. 3.4.0, no leading
|
||||
"v"). Leave empty to use the latest upstream release.
|
||||
required: false
|
||||
type: string
|
||||
workflow_dispatch: {}
|
||||
|
||||
jobs:
|
||||
bump:
|
||||
@@ -26,14 +19,7 @@ jobs:
|
||||
id: check
|
||||
env:
|
||||
BUMP_TOKEN: ${{ secrets.BUMP_TOKEN }}
|
||||
BUMP_VERSION: ${{ inputs.version }}
|
||||
run: |
|
||||
# An explicitly requested version always runs the full bump.
|
||||
if [ -n "${BUMP_VERSION}" ]; then
|
||||
echo "needed=true" >> "$GITHUB_OUTPUT"
|
||||
echo "explicit version requested: ${BUMP_VERSION}"
|
||||
exit 0
|
||||
fi
|
||||
latest=$(wget -qO- https://gitea.com/gitea/runner/releases.rss \
|
||||
| grep -oE '<title>v[0-9]+\.[0-9]+\.[0-9]+</title>' \
|
||||
| head -1 | sed -E 's#</?title>##g; s/^v//')
|
||||
@@ -65,12 +51,6 @@ jobs:
|
||||
> /etc/portage/repos.conf/gentoo.conf
|
||||
sed -i '/^verify-signature/d' /etc/portage/binrepos.conf/gentoo.conf
|
||||
printf '\nverify-signature = false\n' >> /etc/portage/binrepos.conf/gentoo.conf
|
||||
# Upstream's go.mod can require a Go that Gentoo only has under
|
||||
# ~amd64 (GOTOOLCHAIN=local forbids auto-download), so accept the
|
||||
# testing-keyworded dev-lang/go. It is built from source when no
|
||||
# stable binpkg satisfies the requirement.
|
||||
mkdir -p /etc/portage/package.accept_keywords
|
||||
echo 'dev-lang/go ~amd64' > /etc/portage/package.accept_keywords/go
|
||||
emerge -q --getbinpkg \
|
||||
dev-vcs/git net-misc/curl app-arch/xz-utils app-misc/jq \
|
||||
dev-lang/go dev-util/pkgdev
|
||||
@@ -79,7 +59,6 @@ jobs:
|
||||
if: steps.check.outputs.needed == 'true'
|
||||
env:
|
||||
BUMP_TOKEN: ${{ secrets.BUMP_TOKEN }}
|
||||
BUMP_VERSION: ${{ inputs.version }}
|
||||
run: |
|
||||
host=${GITHUB_SERVER_URL#http://}; host=${host#https://}
|
||||
curl -fsSL "http://x-access-token:${BUMP_TOKEN}@${host}/${GITHUB_REPOSITORY}/raw/branch/master/scripts/bump-version.sh" \
|
||||
|
||||
@@ -1,10 +1,5 @@
|
||||
name: CI
|
||||
# Restrict to branch pushes: an unfiltered `push` also fires for tag refs,
|
||||
# including the vendor-release tags the bump script creates via the API.
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- '**'
|
||||
on: [push]
|
||||
|
||||
jobs:
|
||||
# Lint gate: runs on the plain Docker-backend runner (not the Gentoo
|
||||
@@ -86,11 +81,6 @@ jobs:
|
||||
> /etc/portage/repos.conf/azy5030.conf
|
||||
mkdir -p /etc/portage/package.accept_keywords
|
||||
echo 'dev-util/gitea-runner ~amd64' > /etc/portage/package.accept_keywords/gitea-runner
|
||||
# Upstream tracks new Go releases faster than Gentoo stabilises them
|
||||
# (the ebuild's BDEPEND follows upstream go.mod), so accept the
|
||||
# testing-keyworded dev-lang/go. No stable binpkg exists for it, so
|
||||
# this compiles Go from source when a newer one is required.
|
||||
echo 'dev-lang/go ~amd64' > /etc/portage/package.accept_keywords/go
|
||||
|
||||
- name: QA scan
|
||||
run: pkgcheck scan --repo /var/db/repos/azy5030 dev-util/gitea-runner
|
||||
|
||||
@@ -1,43 +0,0 @@
|
||||
name: Vendor tags
|
||||
# The bump script creates the `${PN}-${ver}-vendor` release (which hosts the
|
||||
# vendor tarball) *before* the bump commit exists, so its tag can only point at
|
||||
# whatever master was at the time. The PR is then squash/rebase-merged, so the
|
||||
# branch commit never lands on master either. This job re-points each vendor
|
||||
# tag at the master commit that introduced that version's ebuild. It is
|
||||
# idempotent: a tag already on the right commit is left alone.
|
||||
#
|
||||
# Only ever force-*update* a tag here. Deleting a release's tag makes Gitea
|
||||
# delete the release and its assets, which would break the ebuild's SRC_URI.
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
paths:
|
||||
- 'dev-util/**'
|
||||
|
||||
jobs:
|
||||
repoint:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Point vendor tags at their bump commits
|
||||
run: |
|
||||
set -euo pipefail
|
||||
git fetch --tags --force origin
|
||||
for ebuild in dev-util/gitea-runner/gitea-runner-*.ebuild; do
|
||||
ver=${ebuild##*/gitea-runner-}; ver=${ver%.ebuild}
|
||||
tag="gitea-runner-${ver}-vendor"
|
||||
if ! cur=$(git rev-parse --verify -q "refs/tags/${tag}^{commit}"); then
|
||||
echo "${tag}: no such tag, skipping"; continue
|
||||
fi
|
||||
# git mv shows up as an addition of the new path (no --follow).
|
||||
target=$(git log --diff-filter=A --format=%H -1 -- "$ebuild")
|
||||
if [ "$cur" = "$target" ]; then
|
||||
echo "${tag}: already at ${target}"; continue
|
||||
fi
|
||||
echo "${tag}: ${cur} -> ${target}"
|
||||
git push --force origin "${target}:refs/tags/${tag}"
|
||||
done
|
||||
@@ -52,9 +52,8 @@ re-uploaded as a release asset, or the build will fail Manifest verification. Th
|
||||
4. `git mv`s the ebuild to the new version, rewrites `BDEPEND`'s Go version from
|
||||
upstream `go.mod`, and regenerates the Manifest with `pkgdev manifest` (after copying
|
||||
both distfiles into `/var/cache/distfiles` and wiring a temporary `repos.conf`).
|
||||
5. Commits, pushes the branch, opens a PR against `master`. The script does **not**
|
||||
emerge or pkgcheck the result itself: the branch push triggers CI, which does both
|
||||
(and fetches the real release asset, which the script's local copy never would).
|
||||
5. Validates: `pkgcheck scan`, then `emerge` + `gitea-runner --version | grep v${ver}`.
|
||||
6. Commits, pushes the branch, opens a PR against `master`.
|
||||
|
||||
Requires a `BUMP_TOKEN` repo secret (scopes: repository read/write, write release) plus
|
||||
a Gentoo env with `go pkgdev git curl xz jq`.
|
||||
@@ -75,17 +74,6 @@ runner executes JS actions by `docker exec node …` *inside* the job container,
|
||||
`gentoo/stage3` ships no node, so any JS action fails with exit 127. The lint job has no
|
||||
`container:`, so it runs in the runner's default node-capable image and checkout works.
|
||||
|
||||
## Vendor-tag repointing (`.gitea/workflows/vendor-tags.yaml`)
|
||||
|
||||
The bump script creates the `${PN}-${ver}-vendor` release before the bump commit
|
||||
exists, so its tag points at whatever `master` was at the time (and squash/rebase
|
||||
merges mean the branch commit never lands on `master` anyway). On every push to
|
||||
`master` touching `dev-util/**`, this workflow force-updates each vendor tag whose
|
||||
ebuild is still in the tree to the `master` commit that added that ebuild. It only
|
||||
ever *updates* tags: deleting a release's tag makes Gitea delete the release and its
|
||||
assets, breaking the ebuild's `SRC_URI`. Tag pushes don't re-trigger CI because
|
||||
`ci.yaml` is filtered to branch pushes.
|
||||
|
||||
## Conventions / gotchas
|
||||
|
||||
- **YAML** is linted by `.yamllint.yaml` (relaxed: line-length and document-start
|
||||
|
||||
@@ -1,2 +1,2 @@
|
||||
DIST gitea-runner-4.0.0-vendor.tar.xz 3532664 BLAKE2B 3d19a84f54a4889de8828ffea484712a3504ecab1bf1d721843e0f5c37cb624cdfd24ba0cfdd8c13f903a5e28fdecbf0e1535264d880d53e0ecb05591ae228d0 SHA512 a2dcc3602794a39115607e03f603d26c9d38961877f3b3a04fc1397a5866d0b151668eda7c94d9dd432275138454cac19818d0b6cb15f5468720ea5d512b1ab0
|
||||
DIST gitea-runner-4.0.0.tar.gz 537632 BLAKE2B dfe799fd92bc6341ce7006283aa404834bdbdd5f0ce687f0afe4a91e5d8495dad503a45c350bc75845d62a09a56ceef1777d6957e0cc764ad956327bc9948660 SHA512 500974e4a8b11aa23d8bd4616345a4a6e9b40939e3907c31c7707e12865471b9a0dbef5ec15278a5bf5c2f7eea272e41314907a8af793e90070f20ac2c5e27bb
|
||||
DIST gitea-runner-3.0.1-vendor.tar.xz 3210020 BLAKE2B cb2ed2937b9eff439978be0edb77d74c7c5cf8876719372b867ccf728e656f09b9036f00bbd92d5b416b7bc5da6a1e3783584bb007696516acaaa6bba8b918d6 SHA512 8c281985195c48408ee2a5d91ae6ecbd9a3da9d02df253c810fc96fa3437a7604c6c70b5fd793bd62d587214eb3c82fdf0d38d3c8f71761aec3099b029f4d6aa
|
||||
DIST gitea-runner-3.0.1.tar.gz 472208 BLAKE2B 74a3d070e44b0fc6a38479fb2e342cdd1769dd774d4512fa661d44a86e84f3a58886b3db97a72379a8bf9cd6d2db60241a296c609a91aae50f1b231db63968a4 SHA512 d254c9fef038952d715c31594744a482cfd25c23deed3591436ddd383dc1693987bed6963e16790576e4df1ab27c4f8fd80c2bab1b9c169dc34427c15e907d12
|
||||
|
||||
+1
-1
@@ -19,7 +19,7 @@ LICENSE="MIT Apache-2.0 BSD BSD-2 ISC MPL-2.0"
|
||||
SLOT="0"
|
||||
KEYWORDS="~amd64"
|
||||
|
||||
BDEPEND=">=dev-lang/go-1.27"
|
||||
BDEPEND=">=dev-lang/go-1.26.0"
|
||||
# The runner shells out to the docker client for the Docker backend.
|
||||
RDEPEND="app-containers/docker-cli"
|
||||
|
||||
+11
-28
@@ -6,17 +6,12 @@
|
||||
# Expects a Gentoo environment with: go, pkgdev, git, curl, xz, jq.
|
||||
# Required env: BUMP_TOKEN, GITHUB_SERVER_URL, GITHUB_REPOSITORY.
|
||||
# Optional env: GITHUB_API_URL (defaults to ${GITHUB_SERVER_URL}/api/v1).
|
||||
# BUMP_VERSION target a specific upstream version (X.Y.Z, no
|
||||
# leading "v") instead of the latest release. An
|
||||
# explicit target may be older than the current
|
||||
# ebuild (useful to back out of a broken release).
|
||||
set -euo pipefail
|
||||
|
||||
PN="gitea-runner"
|
||||
UPSTREAM_RSS="https://gitea.com/gitea/runner/releases.rss"
|
||||
UPSTREAM_ARCHIVE="https://gitea.com/api/v1/repos/gitea/runner/archive"
|
||||
UPSTREAM_GOMOD="https://gitea.com/api/v1/repos/gitea/runner/raw/go.mod"
|
||||
UPSTREAM_TAGS="https://gitea.com/api/v1/repos/gitea/runner/tags"
|
||||
|
||||
: "${BUMP_TOKEN:?BUMP_TOKEN is required}"
|
||||
: "${GITHUB_SERVER_URL:?GITHUB_SERVER_URL is required}"
|
||||
@@ -30,22 +25,10 @@ host="${GITHUB_SERVER_URL#*://}"
|
||||
api() { curl -fsSL -H "Authorization: token ${BUMP_TOKEN}" "$@"; }
|
||||
|
||||
# --- determine versions ------------------------------------------------------
|
||||
if [ -n "${BUMP_VERSION:-}" ]; then
|
||||
latest="${BUMP_VERSION#v}"
|
||||
echo "$latest" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$' \
|
||||
|| { echo "BUMP_VERSION must look like X.Y.Z (got '${BUMP_VERSION}')"; exit 1; }
|
||||
# Fail fast if the tag doesn't exist upstream, before cloning anything.
|
||||
# (The raw endpoint silently falls back to the default branch for an
|
||||
# unknown ref, so ask the tags API, which 404s.)
|
||||
curl -fsSL "${UPSTREAM_TAGS}/v${latest}" -o /dev/null \
|
||||
|| { echo "upstream tag v${latest} not found"; exit 1; }
|
||||
echo "targeting explicit version ${latest}"
|
||||
else
|
||||
latest=$(curl -fsSL "$UPSTREAM_RSS" \
|
||||
| grep -oE '<title>v[0-9]+\.[0-9]+\.[0-9]+</title>' \
|
||||
| head -1 | sed -E 's#</?title>##g; s/^v//')
|
||||
[ -n "$latest" ] || { echo "could not parse upstream version"; exit 1; }
|
||||
fi
|
||||
|
||||
WORK=$(mktemp -d)
|
||||
git clone "${scheme}://x-access-token:${BUMP_TOKEN}@${host}/${GITHUB_REPOSITORY}.git" "$WORK"
|
||||
@@ -56,15 +39,11 @@ current=$(find "$pkgdir" -name "${PN}-*.ebuild" \
|
||||
| sed -E "s#.*/${PN}-(.*)\.ebuild#\1#" | sort -V | tail -1)
|
||||
echo "upstream=${latest} current=${current}"
|
||||
|
||||
[ "$latest" != "$current" ] || { echo "already at ${latest}"; exit 0; }
|
||||
newest=$(printf '%s\n%s\n' "$current" "$latest" | sort -V | tail -1)
|
||||
if [ "$newest" = "$current" ]; then
|
||||
if [ -n "${BUMP_VERSION:-}" ]; then
|
||||
echo "warning: explicit target ${latest} is older than current ${current}; downgrading"
|
||||
else
|
||||
if [ "$newest" = "$current" ] && [ "$latest" != "$current" ]; then
|
||||
echo "current ($current) is newer than upstream ($latest); nothing to do"; exit 0
|
||||
fi
|
||||
fi
|
||||
[ "$latest" != "$current" ] || { echo "already at latest ($current)"; exit 0; }
|
||||
|
||||
branch="bump/${PN}-${latest}"
|
||||
if api "${API}/repos/${GITHUB_REPOSITORY}/branches/${branch}" >/dev/null 2>&1; then
|
||||
@@ -120,10 +99,13 @@ printf '[azy5030]\nlocation = %s\nmasters = gentoo\nauto-sync = false\n' "$WORK"
|
||||
> /etc/portage/repos.conf/azy5030.conf
|
||||
( cd "${pkgdir}" && pkgdev manifest )
|
||||
|
||||
# --- commit, push, open PR ---------------------------------------------------
|
||||
# No emerge/pkgcheck here: pushing the branch triggers CI, which runs pkgcheck,
|
||||
# builds the package from the Manifest (fetching the real release asset) and
|
||||
# asserts `gitea-runner --version`. A broken release shows up as a red PR.
|
||||
# --- validate, commit, push, open PR ----------------------------------------
|
||||
pkgcheck scan --repo "$WORK" "${pkgdir}" || true
|
||||
mkdir -p /etc/portage/package.accept_keywords
|
||||
echo 'dev-util/gitea-runner ~amd64' > /etc/portage/package.accept_keywords/gitea-runner
|
||||
emerge -v --getbinpkg "=dev-util/${PN}-${latest}"
|
||||
gitea-runner --version | grep -q "v${latest}"
|
||||
|
||||
git add -A
|
||||
git commit -m "dev-util/${PN}: bump to ${latest}"
|
||||
git push origin "$branch"
|
||||
@@ -138,7 +120,8 @@ Review checklist:
|
||||
- [ ] LICENSE still covers all vendored module licenses (\`go-licenses report ./...\`)
|
||||
- [ ] BDEPEND Go version matches upstream go.mod (set to >=${goreq:-unchanged})
|
||||
- [ ] version ldflags path \`internal/pkg/ver.version\` unchanged upstream
|
||||
- [ ] CI (pkgcheck + emerge + \`gitea-runner --version\`) is green on this PR
|
||||
|
||||
CI build + \`gitea-runner --version\` passed in this workflow.
|
||||
EOF
|
||||
)
|
||||
api -X POST -H 'Content-Type: application/json' \
|
||||
|
||||
Reference in New Issue
Block a user