ci(bump): gate toolchain install behind a cheap version check; fix binpkg verify #4

Merged

azy5030 merged 5 commits from ci/gate-bump-and-fix-binpkg-verify into master 2026-06-19 21:03:07 -05:00

Conversation 0 Commits 5 Files Changed 5

+242 -6

azy5030 commented 2026-06-19 20:18:49 -05:00

Owner

Copy Link

Copy Source

Why

The daily Bump job (runs/107 and every other scheduled run) does ~5–26 min
of work on every run before it ever checks whether a bump is needed — and on the
common no-op day it isn't. Timeline of a no-op run:

docker pull stage3 → emerge-webrsync → emerge … dev-lang/go dev-util/pkgdev (29 pkgs) → bump-version.sh finds already at latest and exits in 1 second.

go/pkgdev/xz/jq are only needed when a bump actually happens. Recent
no-op scheduled runs took 5m, 26m, 9m, 5m, 10m — all to do nothing.

Separately, the log on every emerge was flooded with binpkg GPG failures
(unknown key, pubring.kbx: No such file, Try running getuto). The
sed 's/^verify-signature = true/.../' matched nothing in the stage3 binhost
config, so the intended "disable binpkg signature verification" never took
effect (it worked anyway only because the failures are non-fatal).

What

• bump.yaml: add a cheap Check whether a bump is needed step that compares
  the newest upstream release (releases.rss) against the newest committed ebuild
  (Gitea contents API) using only base-image wget, and gate Sync ::gentoo,
  the toolchain install, and the bump step on its needed output. The gate only
  short-circuits when confident (both versions parsed and current ≥ upstream);
  on any doubt — failed fetch, unparseable version — it falls through to the full
  run, where bump-version.sh remains the source of truth and re-checks.
• bump.yaml + ci.yaml: replace the no-op sed with sed -i '/^verify-signature/d'
  • append verify-signature = false, so the knob is actually set regardless of
    the stage3 default contents.

Notes / limits

• The job container: still pulls gentoo/stage3 before the gate runs, so the
  ~3.5 min image pull on no-op days is unchanged; this saves the larger
  webrsync + 29-package emerge. A follow-up could split the gate into a separate
  container-less job to skip the pull too, but that depends on what the runner
  maps runs-on: ubuntu-latest to, so it's left out here.
• Validated: yamllint -c .yamllint.yaml clean on both files; version-comparison
  logic and the contents-API JSON parsing unit-tested locally (equal / upstream-newer /
  current-ahead / parse-failure cases).

🤖 Generated with Claude Code

## Why The daily **Bump** job (`runs/107` and every other scheduled run) does ~5–26 min of work on every run before it ever checks whether a bump is needed — and on the common no-op day it isn't. Timeline of a no-op run: `docker pull stage3` → `emerge-webrsync` → **`emerge … dev-lang/go dev-util/pkgdev` (29 pkgs)** → `bump-version.sh` finds `already at latest` and exits in **1 second**. `go`/`pkgdev`/`xz`/`jq` are only needed when a bump actually happens. Recent no-op scheduled runs took 5m, 26m, 9m, 5m, 10m — all to do nothing. Separately, the log on every emerge was flooded with binpkg GPG failures (`unknown key`, `pubring.kbx: No such file`, `Try running getuto`). The `sed 's/^verify-signature = true/.../'` matched nothing in the stage3 binhost config, so the intended "disable binpkg signature verification" never took effect (it worked anyway only because the failures are non-fatal). ## What - **`bump.yaml`**: add a cheap `Check whether a bump is needed` step that compares the newest upstream release (`releases.rss`) against the newest committed ebuild (Gitea contents API) using only base-image `wget`, and gate `Sync ::gentoo`, the toolchain install, and the bump step on its `needed` output. The gate only short-circuits when **confident** (both versions parsed and current ≥ upstream); on any doubt — failed fetch, unparseable version — it falls through to the full run, where `bump-version.sh` remains the source of truth and re-checks. - **`bump.yaml` + `ci.yaml`**: replace the no-op `sed` with `sed -i '/^verify-signature/d'` + append `verify-signature = false`, so the knob is actually set regardless of the stage3 default contents. ## Notes / limits - The job `container:` still pulls `gentoo/stage3` before the gate runs, so the ~3.5 min image pull on no-op days is unchanged; this saves the larger webrsync + 29-package emerge. A follow-up could split the gate into a separate container-less job to skip the pull too, but that depends on what the runner maps `runs-on: ubuntu-latest` to, so it's left out here. - Validated: `yamllint -c .yamllint.yaml` clean on both files; version-comparison logic and the contents-API JSON parsing unit-tested locally (equal / upstream-newer / current-ahead / parse-failure cases). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

azy5030 added 1 commit 2026-06-19 20:18:49 -05:00

ci(bump): gate toolchain install behind a cheap version check; fix binpkg verify ... f08859eaea

The daily Bump job emerged a full Go/pkgdev toolchain (and synced ::gentoo,
~5-26 min) on every run before bump-version.sh checked whether anything was
actually out of date — which, on the common no-op day, it isn't. Add a cheap
first step that compares the newest upstream release (releases.rss) against the
newest committed ebuild (Gitea contents API) using only base-image wget, and
gate the sync/install/bump steps on its `needed` output. The gate only
short-circuits when confident both versions parsed and current >= upstream;
on any doubt it falls through to the full run, where bump-version.sh remains
the source of truth.

Also fix the binpkg signature-verification disable in both workflows: the
`sed 's/^verify-signature = true/.../'` matched nothing in the stage3 binhost
config, so every emerge flooded the log with GPG failures ("unknown key",
missing pubring.kbx, "Try running getuto"). Delete any verify-signature line
and append `verify-signature = false` so the knob is actually set.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS

azy5030 added 1 commit 2026-06-19 20:22:02 -05:00

docs: add CLAUDE.md project guidance ... ece869162f

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS

azy5030 added 1 commit 2026-06-19 20:29:23 -05:00

ci: add Justfile + lint gate (markdown/shell/yaml/actions) ... eb9f6a0f1a

Mirror the homeserver repo's lint setup. Add a `Justfile` with
lint-md/lint-sh/lint-yaml/lint-actions recipes (and a `lint` aggregate +
fix recipes), an `.github`-style `.markdownlint.json`, and a `lint` job in
ci.yaml that runs `just lint` on the plain runner and gates the Gentoo
`build` job via `needs: lint`.

The overlay has no custom runner labels (workflows use ubuntu-latest), so
lint-actions calls actionlint without a -config-file, and no
.github/actionlint.yaml is needed. Also add the blank line before a list in
CLAUDE.md that markdownlint (MD032) flagged, and make the .markdownlint.json
referenced by .yamllint.yaml's comment actually exist.

All linters pass locally.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS

azy5030 added 1 commit 2026-06-19 20:38:11 -05:00

ci: check out via actions/checkout (repo is SHA-1, not SHA-256) ... 98ed1c32ce

Run 110's lint job failed at checkout ("couldn't find remote ref <sha>")
because GIT_DEFAULT_HASH: sha256 — copied from the SHA-256 homeserver repo —
made git init create a SHA-256 repo that can't resolve this repo's SHA-1
commits. This overlay is a plain SHA-1 repo, so checkout needs no hash override.

- lint job: drop the bogus GIT_DEFAULT_HASH: sha256 override.
- build job: replace the curl+tar checkout with actions/checkout into
  $GITHUB_WORKSPACE, registered with portage via repos.conf; pull dev-vcs/git
  in Configure portage (stage3 has no git, which checkout shells out to) and
  drop net-misc/curl (only the old checkout used it). QA scan / verify steps
  now reference $GITHUB_WORKSPACE.
- CLAUDE.md: correct the SHA-256 claim and rewrite the CI section for the
  two-job lint-gate + actions/checkout setup.

just lint passes; ci.yaml passes actionlint.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS

azy5030 added 1 commit 2026-06-19 20:46:04 -05:00

ci: keep curl+tar checkout in the build job (no node in stage3 container) ... 34d769625a

actions/checkout can't run in the build job: the Gitea runner executes JS
actions via `docker exec node …` inside the job container, and gentoo/stage3
ships no node, so checkout died with `exec: "node": ... not found` (exit 127)
in run 111. Revert the build job to the node-free curl+tar checkout (restore
net-misc/curl, /var/db/repos/azy5030 paths) and document why.

The lint job keeps actions/checkout — it has no container: and runs in the
runner's default node-capable image, where plain checkout works on this SHA-1
repo (confirmed green in run 111's lint job).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS

azy5030 merged commit 7dc4ace3d5 into master 2026-06-19 21:03:07 -05:00

azy5030 deleted branch ci/gate-bump-and-fix-binpkg-verify 2026-06-19 21:03:07 -05:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

azy5030 (Ali)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: azy5030/azy5030-overlay#4