actions/checkout can't run in the build job: the Gitea runner executes JS
actions via `docker exec node …` inside the job container, and gentoo/stage3
ships no node, so checkout died with `exec: "node": ... not found` (exit 127)
in run 111. Revert the build job to the node-free curl+tar checkout (restore
net-misc/curl, /var/db/repos/azy5030 paths) and document why.
The lint job keeps actions/checkout — it has no container: and runs in the
runner's default node-capable image, where plain checkout works on this SHA-1
repo (confirmed green in run 111's lint job).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS
Run 110's lint job failed at checkout ("couldn't find remote ref <sha>")
because GIT_DEFAULT_HASH: sha256 — copied from the SHA-256 homeserver repo —
made git init create a SHA-256 repo that can't resolve this repo's SHA-1
commits. This overlay is a plain SHA-1 repo, so checkout needs no hash override.
- lint job: drop the bogus GIT_DEFAULT_HASH: sha256 override.
- build job: replace the curl+tar checkout with actions/checkout into
$GITHUB_WORKSPACE, registered with portage via repos.conf; pull dev-vcs/git
in Configure portage (stage3 has no git, which checkout shells out to) and
drop net-misc/curl (only the old checkout used it). QA scan / verify steps
now reference $GITHUB_WORKSPACE.
- CLAUDE.md: correct the SHA-256 claim and rewrite the CI section for the
two-job lint-gate + actions/checkout setup.
just lint passes; ci.yaml passes actionlint.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS
Mirror the homeserver repo's lint setup. Add a `Justfile` with
lint-md/lint-sh/lint-yaml/lint-actions recipes (and a `lint` aggregate +
fix recipes), an `.github`-style `.markdownlint.json`, and a `lint` job in
ci.yaml that runs `just lint` on the plain runner and gates the Gentoo
`build` job via `needs: lint`.
The overlay has no custom runner labels (workflows use ubuntu-latest), so
lint-actions calls actionlint without a -config-file, and no
.github/actionlint.yaml is needed. Also add the blank line before a list in
CLAUDE.md that markdownlint (MD032) flagged, and make the .markdownlint.json
referenced by .yamllint.yaml's comment actually exist.
All linters pass locally.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS
The daily Bump job emerged a full Go/pkgdev toolchain (and synced ::gentoo,
~5-26 min) on every run before bump-version.sh checked whether anything was
actually out of date — which, on the common no-op day, it isn't. Add a cheap
first step that compares the newest upstream release (releases.rss) against the
newest committed ebuild (Gitea contents API) using only base-image wget, and
gate the sync/install/bump steps on its `needed` output. The gate only
short-circuits when confident both versions parsed and current >= upstream;
on any doubt it falls through to the full run, where bump-version.sh remains
the source of truth.
Also fix the binpkg signature-verification disable in both workflows: the
`sed 's/^verify-signature = true/.../'` matched nothing in the stage3 binhost
config, so every emerge flooded the log with GPG failures ("unknown key",
missing pubring.kbx, "Try running getuto"). Delete any verify-signature line
and append `verify-signature = false` so the knob is actually set.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS
azy5030