dev-util/gitea-runner: bump to 2.2.0

.gitea/workflows/bump.yaml

@@ -2,14 +2,7 @@ name: Bump
 on:
   schedule:
     - cron: '0 5 * * *'
-  workflow_dispatch:
-    inputs:
-      version:
-        description: >-
-          Upstream gitea/runner version to bump to (e.g. 3.4.0, no leading
-          "v"). Leave empty to use the latest upstream release.
-        required: false
-        type: string
+  workflow_dispatch: {}
 
 jobs:
   bump:
@@ -26,14 +19,7 @@ jobs:
         id: check
         env:
           BUMP_TOKEN: ${{ secrets.BUMP_TOKEN }}
-          BUMP_VERSION: ${{ inputs.version }}
         run: |
-          # An explicitly requested version always runs the full bump.
-          if [ -n "${BUMP_VERSION}" ]; then
-            echo "needed=true" >> "$GITHUB_OUTPUT"
-            echo "explicit version requested: ${BUMP_VERSION}"
-            exit 0
-          fi
           latest=$(wget -qO- https://gitea.com/gitea/runner/releases.rss \
             | grep -oE '<title>v[0-9]+\.[0-9]+\.[0-9]+</title>' \
             | head -1 | sed -E 's#</?title>##g; s/^v//')
@@ -65,12 +51,6 @@ jobs:
             > /etc/portage/repos.conf/gentoo.conf
           sed -i '/^verify-signature/d' /etc/portage/binrepos.conf/gentoo.conf
           printf '\nverify-signature = false\n' >> /etc/portage/binrepos.conf/gentoo.conf
-          # Upstream's go.mod can require a Go that Gentoo only has under
-          # ~amd64 (GOTOOLCHAIN=local forbids auto-download), so accept the
-          # testing-keyworded dev-lang/go. It is built from source when no
-          # stable binpkg satisfies the requirement.
-          mkdir -p /etc/portage/package.accept_keywords
-          echo 'dev-lang/go ~amd64' > /etc/portage/package.accept_keywords/go
           emerge -q --getbinpkg \
             dev-vcs/git net-misc/curl app-arch/xz-utils app-misc/jq \
             dev-lang/go dev-util/pkgdev
@@ -79,7 +59,6 @@ jobs:
         if: steps.check.outputs.needed == 'true'
         env:
           BUMP_TOKEN: ${{ secrets.BUMP_TOKEN }}
-          BUMP_VERSION: ${{ inputs.version }}
         run: |
           host=${GITHUB_SERVER_URL#http://}; host=${host#https://}
           curl -fsSL "http://x-access-token:${BUMP_TOKEN}@${host}/${GITHUB_REPOSITORY}/raw/branch/master/scripts/bump-version.sh" \

.gitea/workflows/ci.yaml

@@ -1,10 +1,5 @@
 name: CI
-# Restrict to branch pushes: an unfiltered `push` also fires for tag refs,
-# including the vendor-release tags the bump script creates via the API.
-on:
-  push:
-    branches:
-      - '**'
+on: [push]
 
 jobs:
   # Lint gate: runs on the plain Docker-backend runner (not the Gentoo
@@ -86,11 +81,6 @@ jobs:
             > /etc/portage/repos.conf/azy5030.conf
           mkdir -p /etc/portage/package.accept_keywords
           echo 'dev-util/gitea-runner ~amd64' > /etc/portage/package.accept_keywords/gitea-runner
-          # Upstream tracks new Go releases faster than Gentoo stabilises them
-          # (the ebuild's BDEPEND follows upstream go.mod), so accept the
-          # testing-keyworded dev-lang/go. No stable binpkg exists for it, so
-          # this compiles Go from source when a newer one is required.
-          echo 'dev-lang/go ~amd64' > /etc/portage/package.accept_keywords/go
 
       - name: QA scan
         run: pkgcheck scan --repo /var/db/repos/azy5030 dev-util/gitea-runner

.gitea/workflows/vendor-tags.yaml

@@ -1,43 +0,0 @@
-name: Vendor tags
-# The bump script creates the `${PN}-${ver}-vendor` release (which hosts the
-# vendor tarball) *before* the bump commit exists, so its tag can only point at
-# whatever master was at the time. The PR is then squash/rebase-merged, so the
-# branch commit never lands on master either. This job re-points each vendor
-# tag at the master commit that introduced that version's ebuild. It is
-# idempotent: a tag already on the right commit is left alone.
-#
-# Only ever force-*update* a tag here. Deleting a release's tag makes Gitea
-# delete the release and its assets, which would break the ebuild's SRC_URI.
-on:
-  push:
-    branches:
-      - master
-    paths:
-      - 'dev-util/**'
-
-jobs:
-  repoint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Point vendor tags at their bump commits
-        run: |
-          set -euo pipefail
-          git fetch --tags --force origin
-          for ebuild in dev-util/gitea-runner/gitea-runner-*.ebuild; do
-            ver=${ebuild##*/gitea-runner-}; ver=${ver%.ebuild}
-            tag="gitea-runner-${ver}-vendor"
-            if ! cur=$(git rev-parse --verify -q "refs/tags/${tag}^{commit}"); then
-              echo "${tag}: no such tag, skipping"; continue
-            fi
-            # git mv shows up as an addition of the new path (no --follow).
-            target=$(git log --diff-filter=A --format=%H -1 -- "$ebuild")
-            if [ "$cur" = "$target" ]; then
-              echo "${tag}: already at ${target}"; continue
-            fi
-            echo "${tag}: ${cur} -> ${target}"
-            git push --force origin "${target}:refs/tags/${tag}"
-          done

CLAUDE.md

@@ -52,9 +52,8 @@ re-uploaded as a release asset, or the build will fail Manifest verification. Th
 4. `git mv`s the ebuild to the new version, rewrites `BDEPEND`'s Go version from
    upstream `go.mod`, and regenerates the Manifest with `pkgdev manifest` (after copying
    both distfiles into `/var/cache/distfiles` and wiring a temporary `repos.conf`).
-5. Commits, pushes the branch, opens a PR against `master`. The script does **not**
-   emerge or pkgcheck the result itself: the branch push triggers CI, which does both
-   (and fetches the real release asset, which the script's local copy never would).
+5. Validates: `pkgcheck scan`, then `emerge` + `gitea-runner --version | grep v${ver}`.
+6. Commits, pushes the branch, opens a PR against `master`.
 
 Requires a `BUMP_TOKEN` repo secret (scopes: repository read/write, write release) plus
 a Gentoo env with `go pkgdev git curl xz jq`.
@@ -75,17 +74,6 @@ runner executes JS actions by `docker exec node …` *inside* the job container,
 `gentoo/stage3` ships no node, so any JS action fails with exit 127. The lint job has no
 `container:`, so it runs in the runner's default node-capable image and checkout works.
 
-## Vendor-tag repointing (`.gitea/workflows/vendor-tags.yaml`)
-
-The bump script creates the `${PN}-${ver}-vendor` release before the bump commit
-exists, so its tag points at whatever `master` was at the time (and squash/rebase
-merges mean the branch commit never lands on `master` anyway). On every push to
-`master` touching `dev-util/**`, this workflow force-updates each vendor tag whose
-ebuild is still in the tree to the `master` commit that added that ebuild. It only
-ever *updates* tags: deleting a release's tag makes Gitea delete the release and its
-assets, breaking the ebuild's `SRC_URI`. Tag pushes don't re-trigger CI because
-`ci.yaml` is filtered to branch pushes.
-
 ## Conventions / gotchas
 
 - **YAML** is linted by `.yamllint.yaml` (relaxed: line-length and document-start

dev-util/gitea-runner/Manifest

@@ -1,2 +1,2 @@
-DIST gitea-runner-3.4.0-vendor.tar.xz 3274276 BLAKE2B 22d86437a167bb7799d503bc707361f9f9a441ab3623f474ebe848dfd7b6dc98afc024c0d6cc74113326bcea83e8bb50ff4c993692646f5086d35fdbfa555a3e SHA512 cf4095ae2da6a5a3068e76a2057505616f725519397b9541f67f5b377217a7af4bbd9b6022628dca4a67b621673a2997c3af1c0054398874ff0f3d1a9a3affbe
-DIST gitea-runner-3.4.0.tar.gz 494665 BLAKE2B 6ce05560e622e3bdcaf5d35a9f1353cf452a4a277427730ee61dc123d77bcee1bb4ca6ba4bae40c41e35d05e25f68e1539f63d17310b76b694b13e0e1f8fbfbf SHA512 7f1ac2010f84b0b7976f4da7fe19dd2eeb67b4b280b4698e3f7dd29e45bb9f9847f6023333950fbfb385649e5d3f0d32503f19616bbbdc48114728a799f61454
+DIST gitea-runner-2.2.0-vendor.tar.xz 3049748 BLAKE2B 2d0b7ea0a42849001216a6a63b12ebd46f216a96f6f480231f04fd6589a271ee817faca368edd3a03980cd19ac31add639751dca56783aec8b30f08c9fed65f1 SHA512 f16741bdb29b6c790948f7f416171b0b943ae911a78e075e63d2cf291bd0289f7fe8a3f5bbc1a860be6f521b9b084c1dc1c3ef4be91cd0b13624053c528867a2
+DIST gitea-runner-2.2.0.tar.gz 418145 BLAKE2B 04d164cb0a064e5b828ac7fbf0958dffcdb043e17de44425b5f384ac9929dc85940f96c3617e8c729f7869fe37a1ed49b4b01df4813a0f35756faca740aa6f80 SHA512 b13df4747a2c9c24647331cf54defe4e6790799415c98d3b5635fd10a974f613faf04eaab2edbc93c1aa6fb3e9468ea5164af8354adb87c8ac5099bd32a3d609

dev-util/gitea-runner/gitea-runner-2.1.0.ebuild

@@ -19,7 +19,7 @@ LICENSE="MIT Apache-2.0 BSD BSD-2 ISC MPL-2.0"
 SLOT="0"
 KEYWORDS="~amd64"
 
-BDEPEND=">=dev-lang/go-1.27"
+BDEPEND=">=dev-lang/go-1.26.0"
 # The runner shells out to the docker client for the Docker backend.
 RDEPEND="app-containers/docker-cli"
 

dev-util/gitea-runner/gitea-runner-2.2.0.ebuild

@@ -0,0 +1,37 @@
+# Copyright 2026 Ali Zein Yousuf
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module
+
+DESCRIPTION="Gitea Actions runner (formerly act_runner)"
+HOMEPAGE="https://gitea.com/gitea/runner"
+SRC_URI="
+	https://gitea.com/api/v1/repos/gitea/runner/archive/v${PV}.tar.gz -> ${P}.tar.gz
+	https://git.azy.dev/azy5030/azy5030-overlay/releases/download/${PN}-${PV}-vendor/${P}-vendor.tar.xz
+"
+S="${WORKDIR}/runner"
+
+# Upstream is MIT; the remaining licenses cover the vendored Go modules that
+# are statically linked into the binary.
+LICENSE="MIT Apache-2.0 BSD BSD-2 ISC MPL-2.0"
+SLOT="0"
+KEYWORDS="~amd64"
+
+BDEPEND=">=dev-lang/go-1.26.0"
+# The runner shells out to the docker client for the Docker backend.
+RDEPEND="app-containers/docker-cli"
+
+src_compile() {
+	local ldflags=(
+		-s -w
+		-X "gitea.com/gitea/runner/internal/pkg/ver.version=v${PV}"
+	)
+	ego build -ldflags="${ldflags[*]}" -o gitea-runner .
+}
+
+src_install() {
+	dobin gitea-runner
+	einstalldocs
+}

scripts/bump-version.sh

@@ -6,17 +6,12 @@
 # Expects a Gentoo environment with: go, pkgdev, git, curl, xz, jq.
 # Required env: BUMP_TOKEN, GITHUB_SERVER_URL, GITHUB_REPOSITORY.
 # Optional env: GITHUB_API_URL (defaults to ${GITHUB_SERVER_URL}/api/v1).
-#               BUMP_VERSION   target a specific upstream version (X.Y.Z, no
-#                              leading "v") instead of the latest release. An
-#                              explicit target may be older than the current
-#                              ebuild (useful to back out of a broken release).
 set -euo pipefail
 
 PN="gitea-runner"
 UPSTREAM_RSS="https://gitea.com/gitea/runner/releases.rss"
 UPSTREAM_ARCHIVE="https://gitea.com/api/v1/repos/gitea/runner/archive"
 UPSTREAM_GOMOD="https://gitea.com/api/v1/repos/gitea/runner/raw/go.mod"
-UPSTREAM_TAGS="https://gitea.com/api/v1/repos/gitea/runner/tags"
 
 : "${BUMP_TOKEN:?BUMP_TOKEN is required}"
 : "${GITHUB_SERVER_URL:?GITHUB_SERVER_URL is required}"
@@ -30,22 +25,10 @@ host="${GITHUB_SERVER_URL#*://}"
 api() { curl -fsSL -H "Authorization: token ${BUMP_TOKEN}" "$@"; }
 
 # --- determine versions ------------------------------------------------------
-if [ -n "${BUMP_VERSION:-}" ]; then
-  latest="${BUMP_VERSION#v}"
-  echo "$latest" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$' \
-    || { echo "BUMP_VERSION must look like X.Y.Z (got '${BUMP_VERSION}')"; exit 1; }
-  # Fail fast if the tag doesn't exist upstream, before cloning anything.
-  # (The raw endpoint silently falls back to the default branch for an
-  # unknown ref, so ask the tags API, which 404s.)
-  curl -fsSL "${UPSTREAM_TAGS}/v${latest}" -o /dev/null \
-    || { echo "upstream tag v${latest} not found"; exit 1; }
-  echo "targeting explicit version ${latest}"
-else
-  latest=$(curl -fsSL "$UPSTREAM_RSS" \
+latest=$(curl -fsSL "$UPSTREAM_RSS" \
   | grep -oE '<title>v[0-9]+\.[0-9]+\.[0-9]+</title>' \
   | head -1 | sed -E 's#</?title>##g; s/^v//')
-  [ -n "$latest" ] || { echo "could not parse upstream version"; exit 1; }
-fi
+[ -n "$latest" ] || { echo "could not parse upstream version"; exit 1; }
 
 WORK=$(mktemp -d)
 git clone "${scheme}://x-access-token:${BUMP_TOKEN}@${host}/${GITHUB_REPOSITORY}.git" "$WORK"
@@ -56,15 +39,11 @@ current=$(find "$pkgdir" -name "${PN}-*.ebuild" \
   | sed -E "s#.*/${PN}-(.*)\.ebuild#\1#" | sort -V | tail -1)
 echo "upstream=${latest} current=${current}"
 
-[ "$latest" != "$current" ] || { echo "already at ${latest}"; exit 0; }
 newest=$(printf '%s\n%s\n' "$current" "$latest" | sort -V | tail -1)
-if [ "$newest" = "$current" ]; then
-  if [ -n "${BUMP_VERSION:-}" ]; then
-    echo "warning: explicit target ${latest} is older than current ${current}; downgrading"
-  else
+if [ "$newest" = "$current" ] && [ "$latest" != "$current" ]; then
   echo "current ($current) is newer than upstream ($latest); nothing to do"; exit 0
-  fi
 fi
+[ "$latest" != "$current" ] || { echo "already at latest ($current)"; exit 0; }
 
 branch="bump/${PN}-${latest}"
 if api "${API}/repos/${GITHUB_REPOSITORY}/branches/${branch}" >/dev/null 2>&1; then
@@ -120,10 +99,13 @@ printf '[azy5030]\nlocation = %s\nmasters = gentoo\nauto-sync = false\n' "$WORK"
   > /etc/portage/repos.conf/azy5030.conf
 ( cd "${pkgdir}" && pkgdev manifest )
 
-# --- commit, push, open PR ---------------------------------------------------
-# No emerge/pkgcheck here: pushing the branch triggers CI, which runs pkgcheck,
-# builds the package from the Manifest (fetching the real release asset) and
-# asserts `gitea-runner --version`. A broken release shows up as a red PR.
+# --- validate, commit, push, open PR ----------------------------------------
+pkgcheck scan --repo "$WORK" "${pkgdir}" || true
+mkdir -p /etc/portage/package.accept_keywords
+echo 'dev-util/gitea-runner ~amd64' > /etc/portage/package.accept_keywords/gitea-runner
+emerge -v --getbinpkg "=dev-util/${PN}-${latest}"
+gitea-runner --version | grep -q "v${latest}"
+
 git add -A
 git commit -m "dev-util/${PN}: bump to ${latest}"
 git push origin "$branch"
@@ -138,7 +120,8 @@ Review checklist:
 - [ ] LICENSE still covers all vendored module licenses (\`go-licenses report ./...\`)
 - [ ] BDEPEND Go version matches upstream go.mod (set to >=${goreq:-unchanged})
 - [ ] version ldflags path \`internal/pkg/ver.version\` unchanged upstream
-- [ ] CI (pkgcheck + emerge + \`gitea-runner --version\`) is green on this PR
+
+CI build + \`gitea-runner --version\` passed in this workflow.
 EOF
 )
 api -X POST -H 'Content-Type: application/json' \