fix(gitea-runner): fetch source via /api/v1 archive endpoint

gitea.com now redirects unauthenticated /gitea/runner/archive/v*.tar.gz to /user/login. The /api/v1/repos/gitea/runner/archive/v*.tar.gz endpoint still serves anonymously and returns byte-identical contents, so the Manifest is unchanged.

.gitea/workflows/bump.yaml

@@ -2,14 +2,7 @@ name: Bump
 on:
   schedule:
     - cron: '0 5 * * *'
-  workflow_dispatch:
-    inputs:
-      version:
-        description: >-
-          Upstream gitea/runner version to bump to (e.g. 3.4.0, no leading
-          "v"). Leave empty to use the latest upstream release.
-        required: false
-        type: string
+  workflow_dispatch: {}
 
 jobs:
   bump:
@@ -17,69 +10,23 @@ jobs:
     container:
       image: gentoo/stage3:amd64-openrc
     steps:
-      # Cheap gate: compare the newest upstream release against the newest
-      # committed ebuild using only base-image tools (wget). The expensive
-      # toolchain install + bump below is skipped on the common no-op day, so a
-      # daily run that has nothing to do finishes in seconds instead of minutes.
-      # bump-version.sh re-checks this itself and remains the source of truth.
-      - name: Check whether a bump is needed
-        id: check
-        env:
-          BUMP_TOKEN: ${{ secrets.BUMP_TOKEN }}
-          BUMP_VERSION: ${{ inputs.version }}
-        run: |
-          # An explicitly requested version always runs the full bump.
-          if [ -n "${BUMP_VERSION}" ]; then
-            echo "needed=true" >> "$GITHUB_OUTPUT"
-            echo "explicit version requested: ${BUMP_VERSION}"
-            exit 0
-          fi
-          latest=$(wget -qO- https://gitea.com/gitea/runner/releases.rss \
-            | grep -oE '<title>v[0-9]+\.[0-9]+\.[0-9]+</title>' \
-            | head -1 | sed -E 's#</?title>##g; s/^v//')
-          current=$(wget -qO- --header="Authorization: token ${BUMP_TOKEN}" \
-            "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/contents/dev-util/gitea-runner" \
-            | grep -oE '"name": *"gitea-runner-[0-9.]+\.ebuild"' \
-            | sed -E 's#.*gitea-runner-([0-9.]+)\.ebuild.*#\1#' | sort -V | tail -1)
-          echo "upstream=${latest} current=${current}"
-          # Only short-circuit when we are CONFIDENT there is nothing to do
-          # (both versions parsed and current is >= upstream). On any doubt
-          # fall through to the full run and let bump-version.sh decide.
-          if [ -n "$latest" ] && [ -n "$current" ] \
-             && [ "$(printf '%s\n%s\n' "$current" "$latest" | sort -V | tail -1)" = "$current" ]; then
-            echo "needed=false" >> "$GITHUB_OUTPUT"
-            echo "nothing to do (upstream ${latest}, have ${current})"
-          else
-            echo "needed=true" >> "$GITHUB_OUTPUT"
-          fi
-
       - name: Sync ::gentoo
-        if: steps.check.outputs.needed == 'true'
         run: emerge-webrsync
 
       - name: Configure portage + install tooling
-        if: steps.check.outputs.needed == 'true'
         run: |
           mkdir -p /etc/portage/repos.conf
           printf '[DEFAULT]\nmain-repo = gentoo\n\n[gentoo]\nlocation = /var/db/repos/gentoo\n' \
             > /etc/portage/repos.conf/gentoo.conf
-          sed -i '/^verify-signature/d' /etc/portage/binrepos.conf/gentoo.conf
-          printf '\nverify-signature = false\n' >> /etc/portage/binrepos.conf/gentoo.conf
-          # Upstream's go.mod can require a Go that Gentoo only has under
-          # ~amd64 (GOTOOLCHAIN=local forbids auto-download), so accept the
-          # testing-keyworded dev-lang/go. It is built from source when no
-          # stable binpkg satisfies the requirement.
-          mkdir -p /etc/portage/package.accept_keywords
-          echo 'dev-lang/go ~amd64' > /etc/portage/package.accept_keywords/go
+          sed -i 's/^verify-signature = true/verify-signature = false/' \
+            /etc/portage/binrepos.conf/gentoo.conf
           emerge -q --getbinpkg \
             dev-vcs/git net-misc/curl app-arch/xz-utils app-misc/jq \
             dev-lang/go dev-util/pkgdev
 
       - name: Check for new release and open PR
-        if: steps.check.outputs.needed == 'true'
         env:
           BUMP_TOKEN: ${{ secrets.BUMP_TOKEN }}
-          BUMP_VERSION: ${{ inputs.version }}
         run: |
           host=${GITHUB_SERVER_URL#http://}; host=${host#https://}
           curl -fsSL "http://x-access-token:${BUMP_TOKEN}@${host}/${GITHUB_REPOSITORY}/raw/branch/master/scripts/bump-version.sh" \

.gitea/workflows/ci.yaml

@@ -1,49 +1,8 @@
 name: CI
-# Restrict to branch pushes: an unfiltered `push` also fires for tag refs,
-# including the vendor-release tags the bump script creates via the API.
-on:
-  push:
-    branches:
-      - '**'
+on: [push]
 
 jobs:
-  # Lint gate: runs on the plain Docker-backend runner (not the Gentoo
-  # container) and must pass before the build job starts. Mirrors the lint job
-  # in the homeserver repo; `just lint` runs markdownlint/shellcheck/yamllint/
-  # actionlint over the repo.
-  lint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      # setup-just fetches its binary from GitHub; on a Gitea runner the default
-      # github-token is the *Gitea* token (GitHub rejects it 401), so pass none
-      # and use GitHub's unauthenticated API.
-      - uses: extractions/setup-just@v4
-        with:
-          github-token: ""
-
-      - uses: taiki-e/install-action@v2
-        env:
-          GITHUB_TOKEN: ""
-        with:
-          tool: shellcheck
-
-      - name: Install markdownlint-cli
-        run: npm install -g markdownlint-cli
-
-      # actionlint has no maintained setup-action and uv ships via astral.sh;
-      # both installers hit their own release assets (no GitHub token needed).
-      - name: Install yamllint + actionlint tooling
-        run: |
-          curl -LsSf https://astral.sh/uv/install.sh | env UV_INSTALL_DIR=/usr/local/bin sh
-          bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash) latest /usr/local/bin
-
-      - name: Run linters
-        run: just lint
-
   build:
-    needs: lint
     # The label only schedules the job on the (Docker-backend) runner; the steps
     # actually run inside the Gentoo container declared below.
     runs-on: ubuntu-latest
@@ -63,16 +22,12 @@ jobs:
           mkdir -p /etc/portage/repos.conf
           printf '[DEFAULT]\nmain-repo = gentoo\n\n[gentoo]\nlocation = /var/db/repos/gentoo\n' \
             > /etc/portage/repos.conf/gentoo.conf
-          sed -i '/^verify-signature/d' /etc/portage/binrepos.conf/gentoo.conf
-          printf '\nverify-signature = false\n' >> /etc/portage/binrepos.conf/gentoo.conf
+          sed -i 's/^verify-signature = true/verify-signature = false/' \
+            /etc/portage/binrepos.conf/gentoo.conf
           emerge -q --getbinpkg net-misc/curl dev-util/pkgcheck
 
-      # Place this overlay at /var/db/repos/azy5030 via curl + tar. actions/checkout
-      # can't run here: this job uses the gentoo/stage3 container, and the Gitea
-      # runner executes JS actions with `node` *inside* that container
-      # (`docker exec node …`) — stage3 ships no node, so checkout fails with
-      # exit 127. (The lint job uses actions/checkout fine: it has no container:
-      # and runs in the runner's default node-capable image.)
+      # Place this overlay at /var/db/repos/azy5030. actions/checkout is avoided
+      # (SHA-256 Gitea repos break it); curl + tar fetches the source archive.
       - name: Check out overlay
         env:
           TOKEN: ${{ github.token }}
@@ -86,11 +41,6 @@ jobs:
             > /etc/portage/repos.conf/azy5030.conf
           mkdir -p /etc/portage/package.accept_keywords
           echo 'dev-util/gitea-runner ~amd64' > /etc/portage/package.accept_keywords/gitea-runner
-          # Upstream tracks new Go releases faster than Gentoo stabilises them
-          # (the ebuild's BDEPEND follows upstream go.mod), so accept the
-          # testing-keyworded dev-lang/go. No stable binpkg exists for it, so
-          # this compiles Go from source when a newer one is required.
-          echo 'dev-lang/go ~amd64' > /etc/portage/package.accept_keywords/go
 
       - name: QA scan
         run: pkgcheck scan --repo /var/db/repos/azy5030 dev-util/gitea-runner

.gitea/workflows/vendor-tags.yaml

@@ -1,43 +0,0 @@
-name: Vendor tags
-# The bump script creates the `${PN}-${ver}-vendor` release (which hosts the
-# vendor tarball) *before* the bump commit exists, so its tag can only point at
-# whatever master was at the time. The PR is then squash/rebase-merged, so the
-# branch commit never lands on master either. This job re-points each vendor
-# tag at the master commit that introduced that version's ebuild. It is
-# idempotent: a tag already on the right commit is left alone.
-#
-# Only ever force-*update* a tag here. Deleting a release's tag makes Gitea
-# delete the release and its assets, which would break the ebuild's SRC_URI.
-on:
-  push:
-    branches:
-      - master
-    paths:
-      - 'dev-util/**'
-
-jobs:
-  repoint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Point vendor tags at their bump commits
-        run: |
-          set -euo pipefail
-          git fetch --tags --force origin
-          for ebuild in dev-util/gitea-runner/gitea-runner-*.ebuild; do
-            ver=${ebuild##*/gitea-runner-}; ver=${ver%.ebuild}
-            tag="gitea-runner-${ver}-vendor"
-            if ! cur=$(git rev-parse --verify -q "refs/tags/${tag}^{commit}"); then
-              echo "${tag}: no such tag, skipping"; continue
-            fi
-            # git mv shows up as an addition of the new path (no --follow).
-            target=$(git log --diff-filter=A --format=%H -1 -- "$ebuild")
-            if [ "$cur" = "$target" ]; then
-              echo "${tag}: already at ${target}"; continue
-            fi
-            echo "${tag}: ${cur} -> ${target}"
-            git push --force origin "${target}:refs/tags/${tag}"
-          done

.markdownlint.json

@@ -1,9 +0,0 @@
-{
-  "MD013": false,
-  "MD024": {
-    "siblings_only": true
-  },
-  "MD060": {
-    "style": "compact"
-  }
-}

CLAUDE.md

@@ -1,97 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## What this is
-
-A personal **Gentoo ebuild repository (overlay)**, repo name `azy5030`, EAPI 8,
-`masters = gentoo`, thin + unsigned Manifests (`metadata/layout.conf`). It packages
-software not in the main `::gentoo` tree. Currently one package:
-`dev-util/gitea-runner`. Hosted on a self-hosted Gitea at `git.azy.dev`. (This repo
-is a standard SHA-1 repo; the sibling `homeserver` repo is SHA-256, so workflow
-snippets copied from it may carry a `GIT_DEFAULT_HASH: sha256` checkout override
-that this repo must *not* use.)
-
-## The vendored-build model (the core design)
-
-`dev-util/gitea-runner` is a `go-module` ebuild built **offline** from upstream
-`gitea/runner` source. Gentoo's build sandbox has no network, so Go modules cannot be
-fetched at build time. Instead they are vendored ahead of time:
-
-1. The upstream source archive is `SRC_URI`'d from gitea.com's `/api/v1/.../archive`
-   endpoint (a plain `git clone`/`go get` is never used).
-2. A **vendor tarball** (`${P}-vendor.tar.xz`, the result of `go mod vendor`, packed
-   deterministically) is uploaded as a **release asset on this repo** and is the second
-   `SRC_URI`. `S="${WORKDIR}/runner"`.
-3. `dev-util/gitea-runner/Manifest` pins BLAKE2B/SHA512 of both tarballs. `emerge`
-   verifies against the Manifest, then compiles offline from `vendor/`.
-
-Consequences when editing the ebuild:
-
-- `LICENSE` must cover **every vendored module's** license, not just upstream's MIT.
-  The bump PR checklist suggests `go-licenses report ./...` to confirm.
-- `BDEPEND` Go version tracks upstream's `go.mod` `go` directive.
-- The version string is injected via ldflags into
-  `gitea.com/gitea/runner/internal/pkg/ver.version`; CI asserts `gitea-runner --version`
-  echoes `v${PV}`. If upstream moves that symbol path, the build "succeeds" but reports
-  the wrong version.
-
-## Bumping to a new upstream version
-
-This is **automated** by `scripts/bump-version.sh` (run daily by `bump.yaml`, or
-`workflow_dispatch`). To do it manually you must reproduce its steps, because a version
-bump is never just renaming the ebuild — the vendor tarball must be regenerated and
-re-uploaded as a release asset, or the build will fail Manifest verification. The script:
-
-1. Reads the latest `vX.Y.Z` from upstream `releases.rss`; compares to the newest
-   committed ebuild. Exits early if up to date or if a `bump/gitea-runner-<ver>` branch
-   already exists.
-2. Downloads the source archive, runs `go mod vendor`, packs a reproducible
-   `*-vendor.tar.xz` (`--sort=name --mtime='UTC 1970-01-01' --owner=0 --group=0`).
-3. Creates/reuses a release tagged `${PN}-${ver}-vendor` and uploads the tarball asset.
-4. `git mv`s the ebuild to the new version, rewrites `BDEPEND`'s Go version from
-   upstream `go.mod`, and regenerates the Manifest with `pkgdev manifest` (after copying
-   both distfiles into `/var/cache/distfiles` and wiring a temporary `repos.conf`).
-5. Commits, pushes the branch, opens a PR against `master`. The script does **not**
-   emerge or pkgcheck the result itself: the branch push triggers CI, which does both
-   (and fetches the real release asset, which the script's local copy never would).
-
-Requires a `BUMP_TOKEN` repo secret (scopes: repository read/write, write release) plus
-a Gentoo env with `go pkgdev git curl xz jq`.
-
-## CI (`.gitea/workflows/ci.yaml`)
-
-Runs on every push, two jobs. A **`lint`** job runs on the plain Docker-backend runner
-(no container), checks out with `actions/checkout`, installs the linters, and runs
-`just lint` (markdownlint/shellcheck/yamllint/actionlint). The **`build`** job has
-`needs: lint` (lint is a gate) and runs inside a `gentoo/stage3:amd64-openrc` container:
-`emerge-webrsync` to sync `::gentoo` → configure portage (disables binpkg signature
-verification so prebuilt deps like `dev-lang/go` are pulled, not compiled) → **check out
-via `curl + tar`, not `actions/checkout`** into `/var/db/repos/azy5030` → `pkgcheck scan`
-→ `emerge` → assert `gitea-runner --version` matches the ebuild version.
-
-The build job can't use `actions/checkout` (even though the lint job does): the Gitea
-runner executes JS actions by `docker exec node …` *inside* the job container, and
-`gentoo/stage3` ships no node, so any JS action fails with exit 127. The lint job has no
-`container:`, so it runs in the runner's default node-capable image and checkout works.
-
-## Vendor-tag repointing (`.gitea/workflows/vendor-tags.yaml`)
-
-The bump script creates the `${PN}-${ver}-vendor` release before the bump commit
-exists, so its tag points at whatever `master` was at the time (and squash/rebase
-merges mean the branch commit never lands on `master` anyway). On every push to
-`master` touching `dev-util/**`, this workflow force-updates each vendor tag whose
-ebuild is still in the tree to the `master` commit that added that ebuild. It only
-ever *updates* tags: deleting a release's tag makes Gitea delete the release and its
-assets, breaking the ebuild's `SRC_URI`. Tag pushes don't re-trigger CI because
-`ci.yaml` is filtered to branch pushes.
-
-## Conventions / gotchas
-
-- **YAML** is linted by `.yamllint.yaml` (relaxed: line-length and document-start
-  disabled; `truthy.check-keys: false` so `on:` is allowed unquoted).
-- `metadata/md5-cache/` is **gitignored** — portage regenerates it on sync, so never
-  commit it (a stale `gitea-runner-1.0.4` file may linger on disk untracked).
-- The bump script and CI deliberately preserve the scheme of `GITHUB_SERVER_URL`: on the
-  self-hosted runner it is an internal `http://` endpoint. Don't hardcode `https`.
-- New packages must be added to `profiles/categories` (currently just `dev-util`).

Justfile

@@ -1,70 +0,0 @@
-# azy5030 overlay management commands
-
-# Install dev tooling (linters) used by the lint recipes and CI
-setup-dev:
-    brew install just markdownlint-cli shellcheck actionlint uv
-
-# Lint Markdown: all repo files, or only the .md files in a passed list
-lint-md files="":
-    #!/usr/bin/env bash
-    set -euo pipefail
-    if [ -z "{{files}}" ]; then
-        markdownlint --ignore node_modules '**/*.md'
-    else
-        targets=$(printf '%s\n' {{files}} | grep -E '\.md$' || true)
-        if [ -n "$targets" ]; then markdownlint --ignore node_modules $targets; fi
-    fi
-
-# Lint shell scripts: all repo files, or only the .sh files in a passed list
-lint-sh files="":
-    #!/usr/bin/env bash
-    set -euo pipefail
-    if [ -z "{{files}}" ]; then
-        targets=$(find . -name '*.sh' -not -path './node_modules/*')
-    else
-        targets=$(printf '%s\n' {{files}} | grep -E '\.sh$' || true)
-    fi
-    if [ -n "$targets" ]; then shellcheck $targets; fi
-
-# Lint YAML: all repo files, or only the .yaml/.yml in a passed list (via uv)
-lint-yaml files="":
-    #!/usr/bin/env bash
-    set -euo pipefail
-    if [ -z "{{files}}" ]; then
-        targets=$(find . \( -name '*.yaml' -o -name '*.yml' \) -not -path './node_modules/*')
-    else
-        targets=$(printf '%s\n' {{files}} | grep -E '\.ya?ml$' || true)
-    fi
-    if [ -n "$targets" ]; then uvx yamllint $targets; fi
-
-# Lint Gitea Actions workflows: all, or only the workflow files in a passed list
-lint-actions files="":
-    #!/usr/bin/env bash
-    set -euo pipefail
-    if [ -z "{{files}}" ]; then
-        targets=$(find .gitea/workflows \( -name '*.yaml' -o -name '*.yml' \) 2>/dev/null || true)
-    else
-        targets=$(printf '%s\n' {{files}} | grep -E '^\.gitea/workflows/.*\.ya?ml$' || true)
-    fi
-    # actionlint also runs shellcheck on each `run:` block. No custom runner
-    # labels here (workflows use ubuntu-latest), so no -config-file is needed.
-    if [ -n "$targets" ]; then actionlint $targets; fi
-
-# Autofix all Markdown files
-fix-md:
-    markdownlint --fix --ignore node_modules '**/*.md'
-
-# Apply shellcheck's auto-fixable suggestions to all shell scripts
-fix-sh:
-    #!/usr/bin/env bash
-    set -euo pipefail
-    targets=$(find . -name '*.sh' -not -path './node_modules/*')
-    # shellcheck's diff carries ./ path segments that `git apply` rejects; strip them.
-    diff=$(shellcheck -f diff $targets 2>/dev/null | sed 's|/\./|/|g' || true)
-    if [ -n "$diff" ]; then printf '%s\n' "$diff" | git apply; fi
-
-# Lint everything (all repo files, or only a passed list of files)
-lint files="": (lint-md files) (lint-sh files) (lint-yaml files) (lint-actions files)
-
-# Autofix everything
-fix: fix-md fix-sh

dev-util/gitea-runner/Manifest

@@ -1,2 +1,2 @@
-DIST gitea-runner-3.3.2-vendor.tar.xz 3273532 BLAKE2B 376e88938aef1a945ca2da00f23d3320e5ab7efdaa539f3825aed104b3eab4c965359b1bef602613fb0e236d089146f14449fba4d0ba54a60062edb6aeae66a3 SHA512 92e202990a6e501205d7068a305e123442887263d1967b3ec3a38480b2e5f65592887a14ac861bfebf5c71060daab914bb38edd25f373e1414ebfda745bc367b
-DIST gitea-runner-3.3.2.tar.gz 485524 BLAKE2B 691b9f1d051a4879bc32b5d858123c7b13a92ce87ee27127e47ee0a7608a2208799a13d6bfb529889d6f083116d396a8d6abf5da5ae8d169fe216ff0ac9efcc9 SHA512 a0d86250da07262e654c7b9fafbbeeb2691e21ea76992bf555b2a57155ee8f60ea5fe436dc067af992ae9892a23fec208ca60802bc7fdf7fd81bb45d2d73c091
+DIST gitea-runner-1.0.6-vendor.tar.xz 3018704 BLAKE2B 39b861b1b454a22f23c80bacd551127d0812b71a336c79032fa01f8df834eca23e030479da76fc12358af955f7cb56bcc541b99df1fd7880a62fbf35b8859d4c SHA512 0f21ba48db4bbb9fc0738543a7123e884e93ab5b423b6ff99dfa913d6df6cf0db4d96bff2e32b82beee9fef8e81cfdef849d58050fe8d9a2abddb55af7da8a38
+DIST gitea-runner-1.0.6.tar.gz 327789 BLAKE2B 73d90dd6d7a44d594f2aa3bb91bf2831d56ce06bbbf9c36582ae9f479bb3296105d4cbea39f6b002f1d63ae8474f43f583469c68cffddbde0b8e807afeedaba0 SHA512 b6311e67a991c9fbdedf082012042222d8964edeccdccf5ac87c45d905894489a56bbce0cb2f124a08c672c5834e566c80bc1737e8c1dfc3e183331def344160

dev-util/gitea-runner/gitea-runner-1.0.6.ebuild

@@ -19,7 +19,7 @@ LICENSE="MIT Apache-2.0 BSD BSD-2 ISC MPL-2.0"
 SLOT="0"
 KEYWORDS="~amd64"
 
-BDEPEND=">=dev-lang/go-1.27"
+BDEPEND=">=dev-lang/go-1.26.0"
 # The runner shells out to the docker client for the Docker backend.
 RDEPEND="app-containers/docker-cli"
 

scripts/bump-version.sh

@@ -6,17 +6,12 @@
 # Expects a Gentoo environment with: go, pkgdev, git, curl, xz, jq.
 # Required env: BUMP_TOKEN, GITHUB_SERVER_URL, GITHUB_REPOSITORY.
 # Optional env: GITHUB_API_URL (defaults to ${GITHUB_SERVER_URL}/api/v1).
-#               BUMP_VERSION   target a specific upstream version (X.Y.Z, no
-#                              leading "v") instead of the latest release. An
-#                              explicit target may be older than the current
-#                              ebuild (useful to back out of a broken release).
 set -euo pipefail
 
 PN="gitea-runner"
 UPSTREAM_RSS="https://gitea.com/gitea/runner/releases.rss"
-UPSTREAM_ARCHIVE="https://gitea.com/api/v1/repos/gitea/runner/archive"
-UPSTREAM_GOMOD="https://gitea.com/api/v1/repos/gitea/runner/raw/go.mod"
-UPSTREAM_TAGS="https://gitea.com/api/v1/repos/gitea/runner/tags"
+UPSTREAM_ARCHIVE="https://gitea.com/gitea/runner/archive"
+UPSTREAM_GOMOD="https://gitea.com/gitea/runner/raw/tag"
 
 : "${BUMP_TOKEN:?BUMP_TOKEN is required}"
 : "${GITHUB_SERVER_URL:?GITHUB_SERVER_URL is required}"
@@ -30,22 +25,10 @@ host="${GITHUB_SERVER_URL#*://}"
 api() { curl -fsSL -H "Authorization: token ${BUMP_TOKEN}" "$@"; }
 
 # --- determine versions ------------------------------------------------------
-if [ -n "${BUMP_VERSION:-}" ]; then
-  latest="${BUMP_VERSION#v}"
-  echo "$latest" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$' \
-    || { echo "BUMP_VERSION must look like X.Y.Z (got '${BUMP_VERSION}')"; exit 1; }
-  # Fail fast if the tag doesn't exist upstream, before cloning anything.
-  # (The raw endpoint silently falls back to the default branch for an
-  # unknown ref, so ask the tags API, which 404s.)
-  curl -fsSL "${UPSTREAM_TAGS}/v${latest}" -o /dev/null \
-    || { echo "upstream tag v${latest} not found"; exit 1; }
-  echo "targeting explicit version ${latest}"
-else
 latest=$(curl -fsSL "$UPSTREAM_RSS" \
   | grep -oE '<title>v[0-9]+\.[0-9]+\.[0-9]+</title>' \
   | head -1 | sed -E 's#</?title>##g; s/^v//')
 [ -n "$latest" ] || { echo "could not parse upstream version"; exit 1; }
-fi
 
 WORK=$(mktemp -d)
 git clone "${scheme}://x-access-token:${BUMP_TOKEN}@${host}/${GITHUB_REPOSITORY}.git" "$WORK"
@@ -56,15 +39,11 @@ current=$(find "$pkgdir" -name "${PN}-*.ebuild" \
   | sed -E "s#.*/${PN}-(.*)\.ebuild#\1#" | sort -V | tail -1)
 echo "upstream=${latest} current=${current}"
 
-[ "$latest" != "$current" ] || { echo "already at ${latest}"; exit 0; }
 newest=$(printf '%s\n%s\n' "$current" "$latest" | sort -V | tail -1)
-if [ "$newest" = "$current" ]; then
-  if [ -n "${BUMP_VERSION:-}" ]; then
-    echo "warning: explicit target ${latest} is older than current ${current}; downgrading"
-  else
+if [ "$newest" = "$current" ] && [ "$latest" != "$current" ]; then
   echo "current ($current) is newer than upstream ($latest); nothing to do"; exit 0
 fi
-fi
+[ "$latest" != "$current" ] || { echo "already at latest ($current)"; exit 0; }
 
 branch="bump/${PN}-${latest}"
 if api "${API}/repos/${GITHUB_REPOSITORY}/branches/${branch}" >/dev/null 2>&1; then
@@ -103,7 +82,7 @@ git checkout -b "$branch"
 git mv "${pkgdir}/${PN}-${current}.ebuild" "${pkgdir}/${PN}-${latest}.ebuild"
 
 # Track the upstream go.mod's required Go version in BDEPEND.
-goreq=$(curl -fsSL "${UPSTREAM_GOMOD}?ref=v${latest}" \
+goreq=$(curl -fsSL "${UPSTREAM_GOMOD}/v${latest}/go.mod" \
   | grep -oE '^go [0-9]+\.[0-9]+(\.[0-9]+)?' | awk '{print $2}')
 [ -n "$goreq" ] && sed -i -E \
   "s#^BDEPEND=\">=dev-lang/go-[0-9.]+\"#BDEPEND=\">=dev-lang/go-${goreq}\"#" \
@@ -120,10 +99,13 @@ printf '[azy5030]\nlocation = %s\nmasters = gentoo\nauto-sync = false\n' "$WORK"
   > /etc/portage/repos.conf/azy5030.conf
 ( cd "${pkgdir}" && pkgdev manifest )
 
-# --- commit, push, open PR ---------------------------------------------------
-# No emerge/pkgcheck here: pushing the branch triggers CI, which runs pkgcheck,
-# builds the package from the Manifest (fetching the real release asset) and
-# asserts `gitea-runner --version`. A broken release shows up as a red PR.
+# --- validate, commit, push, open PR ----------------------------------------
+pkgcheck scan --repo "$WORK" "${pkgdir}" || true
+mkdir -p /etc/portage/package.accept_keywords
+echo 'dev-util/gitea-runner ~amd64' > /etc/portage/package.accept_keywords/gitea-runner
+emerge -v --getbinpkg "=dev-util/${PN}-${latest}"
+gitea-runner --version | grep -q "v${latest}"
+
 git add -A
 git commit -m "dev-util/${PN}: bump to ${latest}"
 git push origin "$branch"
@@ -138,7 +120,8 @@ Review checklist:
 - [ ] LICENSE still covers all vendored module licenses (\`go-licenses report ./...\`)
 - [ ] BDEPEND Go version matches upstream go.mod (set to >=${goreq:-unchanged})
 - [ ] version ldflags path \`internal/pkg/ver.version\` unchanged upstream
-- [ ] CI (pkgcheck + emerge + \`gitea-runner --version\`) is green on this PR
+
+CI build + \`gitea-runner --version\` passed in this workflow.
 EOF
 )
 api -X POST -H 'Content-Type: application/json' \