azy5030
7dc4ace3d5
## Why The daily **Bump** job (`runs/107` and every other scheduled run) does ~5–26 min of work on every run before it ever checks whether a bump is needed — and on the common no-op day it isn't. Timeline of a no-op run: `docker pull stage3` → `emerge-webrsync` → **`emerge … dev-lang/go dev-util/pkgdev` (29 pkgs)** → `bump-version.sh` finds `already at latest` and exits in **1 second**. `go`/`pkgdev`/`xz`/`jq` are only needed when a bump actually happens. Recent no-op scheduled runs took 5m, 26m, 9m, 5m, 10m — all to do nothing. Separately, the log on every emerge was flooded with binpkg GPG failures (`unknown key`, `pubring.kbx: No such file`, `Try running getuto`). The `sed 's/^verify-signature = true/.../'` matched nothing in the stage3 binhost config, so the intended "disable binpkg signature verification" never took effect (it worked anyway only because the failures are non-fatal). ## What - **`bump.yaml`**: add a cheap `Check whether a bump is needed` step that compares the newest upstream release (`releases.rss`) against the newest committed ebuild (Gitea contents API) using only base-image `wget`, and gate `Sync ::gentoo`, the toolchain install, and the bump step on its `needed` output. The gate only short-circuits when **confident** (both versions parsed and current ≥ upstream); on any doubt — failed fetch, unparseable version — it falls through to the full run, where `bump-version.sh` remains the source of truth and re-checks. - **`bump.yaml` + `ci.yaml`**: replace the no-op `sed` with `sed -i '/^verify-signature/d'` + append `verify-signature = false`, so the knob is actually set regardless of the stage3 default contents. ## Notes / limits - The job `container:` still pulls `gentoo/stage3` before the gate runs, so the ~3.5 min image pull on no-op days is unchanged; this saves the larger webrsync + 29-package emerge. A follow-up could split the gate into a separate container-less job to skip the pull too, but that depends on what the runner maps `runs-on: ubuntu-latest` to, so it's left out here. - Validated: `yamllint -c .yamllint.yaml` clean on both files; version-comparison logic and the contents-API JSON parsing unit-tested locally (equal / upstream-newer / current-ahead / parse-failure cases). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: #4 Co-authored-by: Ali Zein Yousuf <azy5030@gmail.com> Co-committed-by: Ali Zein Yousuf <azy5030@gmail.com>
67 lines
3.0 KiB
YAML
67 lines
3.0 KiB
YAML
name: Bump
|
|
on:
|
|
schedule:
|
|
- cron: '0 5 * * *'
|
|
workflow_dispatch: {}
|
|
|
|
jobs:
|
|
bump:
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: gentoo/stage3:amd64-openrc
|
|
steps:
|
|
# Cheap gate: compare the newest upstream release against the newest
|
|
# committed ebuild using only base-image tools (wget). The expensive
|
|
# toolchain install + bump below is skipped on the common no-op day, so a
|
|
# daily run that has nothing to do finishes in seconds instead of minutes.
|
|
# bump-version.sh re-checks this itself and remains the source of truth.
|
|
- name: Check whether a bump is needed
|
|
id: check
|
|
env:
|
|
BUMP_TOKEN: ${{ secrets.BUMP_TOKEN }}
|
|
run: |
|
|
latest=$(wget -qO- https://gitea.com/gitea/runner/releases.rss \
|
|
| grep -oE '<title>v[0-9]+\.[0-9]+\.[0-9]+</title>' \
|
|
| head -1 | sed -E 's#</?title>##g; s/^v//')
|
|
current=$(wget -qO- --header="Authorization: token ${BUMP_TOKEN}" \
|
|
"${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/contents/dev-util/gitea-runner" \
|
|
| grep -oE '"name": *"gitea-runner-[0-9.]+\.ebuild"' \
|
|
| sed -E 's#.*gitea-runner-([0-9.]+)\.ebuild.*#\1#' | sort -V | tail -1)
|
|
echo "upstream=${latest} current=${current}"
|
|
# Only short-circuit when we are CONFIDENT there is nothing to do
|
|
# (both versions parsed and current is >= upstream). On any doubt
|
|
# fall through to the full run and let bump-version.sh decide.
|
|
if [ -n "$latest" ] && [ -n "$current" ] \
|
|
&& [ "$(printf '%s\n%s\n' "$current" "$latest" | sort -V | tail -1)" = "$current" ]; then
|
|
echo "needed=false" >> "$GITHUB_OUTPUT"
|
|
echo "nothing to do (upstream ${latest}, have ${current})"
|
|
else
|
|
echo "needed=true" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Sync ::gentoo
|
|
if: steps.check.outputs.needed == 'true'
|
|
run: emerge-webrsync
|
|
|
|
- name: Configure portage + install tooling
|
|
if: steps.check.outputs.needed == 'true'
|
|
run: |
|
|
mkdir -p /etc/portage/repos.conf
|
|
printf '[DEFAULT]\nmain-repo = gentoo\n\n[gentoo]\nlocation = /var/db/repos/gentoo\n' \
|
|
> /etc/portage/repos.conf/gentoo.conf
|
|
sed -i '/^verify-signature/d' /etc/portage/binrepos.conf/gentoo.conf
|
|
printf '\nverify-signature = false\n' >> /etc/portage/binrepos.conf/gentoo.conf
|
|
emerge -q --getbinpkg \
|
|
dev-vcs/git net-misc/curl app-arch/xz-utils app-misc/jq \
|
|
dev-lang/go dev-util/pkgdev
|
|
|
|
- name: Check for new release and open PR
|
|
if: steps.check.outputs.needed == 'true'
|
|
env:
|
|
BUMP_TOKEN: ${{ secrets.BUMP_TOKEN }}
|
|
run: |
|
|
host=${GITHUB_SERVER_URL#http://}; host=${host#https://}
|
|
curl -fsSL "http://x-access-token:${BUMP_TOKEN}@${host}/${GITHUB_REPOSITORY}/raw/branch/master/scripts/bump-version.sh" \
|
|
-o /tmp/bump-version.sh
|
|
bash /tmp/bump-version.sh
|