azy5030
f08859eaea
CI / build (push) Successful in 6m25s
The daily Bump job emerged a full Go/pkgdev toolchain (and synced ::gentoo,
~5-26 min) on every run before bump-version.sh checked whether anything was
actually out of date — which, on the common no-op day, it isn't. Add a cheap
first step that compares the newest upstream release (releases.rss) against the
newest committed ebuild (Gitea contents API) using only base-image wget, and
gate the sync/install/bump steps on its `needed` output. The gate only
short-circuits when confident both versions parsed and current >= upstream;
on any doubt it falls through to the full run, where bump-version.sh remains
the source of truth.
Also fix the binpkg signature-verification disable in both workflows: the
`sed 's/^verify-signature = true/.../'` matched nothing in the stage3 binhost
config, so every emerge flooded the log with GPG failures ("unknown key",
missing pubring.kbx, "Try running getuto"). Delete any verify-signature line
and append `verify-signature = false` so the knob is actually set.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018MsAYv5RhNLE54fPrviVgS
67 lines
3.0 KiB
YAML
67 lines
3.0 KiB
YAML
name: Bump
|
|
on:
|
|
schedule:
|
|
- cron: '0 5 * * *'
|
|
workflow_dispatch: {}
|
|
|
|
jobs:
|
|
bump:
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: gentoo/stage3:amd64-openrc
|
|
steps:
|
|
# Cheap gate: compare the newest upstream release against the newest
|
|
# committed ebuild using only base-image tools (wget). The expensive
|
|
# toolchain install + bump below is skipped on the common no-op day, so a
|
|
# daily run that has nothing to do finishes in seconds instead of minutes.
|
|
# bump-version.sh re-checks this itself and remains the source of truth.
|
|
- name: Check whether a bump is needed
|
|
id: check
|
|
env:
|
|
BUMP_TOKEN: ${{ secrets.BUMP_TOKEN }}
|
|
run: |
|
|
latest=$(wget -qO- https://gitea.com/gitea/runner/releases.rss \
|
|
| grep -oE '<title>v[0-9]+\.[0-9]+\.[0-9]+</title>' \
|
|
| head -1 | sed -E 's#</?title>##g; s/^v//')
|
|
current=$(wget -qO- --header="Authorization: token ${BUMP_TOKEN}" \
|
|
"${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/contents/dev-util/gitea-runner" \
|
|
| grep -oE '"name": *"gitea-runner-[0-9.]+\.ebuild"' \
|
|
| sed -E 's#.*gitea-runner-([0-9.]+)\.ebuild.*#\1#' | sort -V | tail -1)
|
|
echo "upstream=${latest} current=${current}"
|
|
# Only short-circuit when we are CONFIDENT there is nothing to do
|
|
# (both versions parsed and current is >= upstream). On any doubt
|
|
# fall through to the full run and let bump-version.sh decide.
|
|
if [ -n "$latest" ] && [ -n "$current" ] \
|
|
&& [ "$(printf '%s\n%s\n' "$current" "$latest" | sort -V | tail -1)" = "$current" ]; then
|
|
echo "needed=false" >> "$GITHUB_OUTPUT"
|
|
echo "nothing to do (upstream ${latest}, have ${current})"
|
|
else
|
|
echo "needed=true" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Sync ::gentoo
|
|
if: steps.check.outputs.needed == 'true'
|
|
run: emerge-webrsync
|
|
|
|
- name: Configure portage + install tooling
|
|
if: steps.check.outputs.needed == 'true'
|
|
run: |
|
|
mkdir -p /etc/portage/repos.conf
|
|
printf '[DEFAULT]\nmain-repo = gentoo\n\n[gentoo]\nlocation = /var/db/repos/gentoo\n' \
|
|
> /etc/portage/repos.conf/gentoo.conf
|
|
sed -i '/^verify-signature/d' /etc/portage/binrepos.conf/gentoo.conf
|
|
printf '\nverify-signature = false\n' >> /etc/portage/binrepos.conf/gentoo.conf
|
|
emerge -q --getbinpkg \
|
|
dev-vcs/git net-misc/curl app-arch/xz-utils app-misc/jq \
|
|
dev-lang/go dev-util/pkgdev
|
|
|
|
- name: Check for new release and open PR
|
|
if: steps.check.outputs.needed == 'true'
|
|
env:
|
|
BUMP_TOKEN: ${{ secrets.BUMP_TOKEN }}
|
|
run: |
|
|
host=${GITHUB_SERVER_URL#http://}; host=${host#https://}
|
|
curl -fsSL "http://x-access-token:${BUMP_TOKEN}@${host}/${GITHUB_REPOSITORY}/raw/branch/master/scripts/bump-version.sh" \
|
|
-o /tmp/bump-version.sh
|
|
bash /tmp/bump-version.sh
|