Upgrade Gitea Actions runner to 5.4.0

Runner 5.2.4 -> 5.4.0. No config.yaml changes were required.

5.3.0 scopes cache entries by ref, like GitHub: a job restores from its own
ref, then the base branch, then the repository's default branch, and writes
only to its own ref. Existing (unscoped) caches therefore start out cold once
after the upgrade. 5.3.0 also adds GITEA_* aliases for the built-in GITHUB_*
environment variables and updates dependencies for CVE-2026-78661.

5.4.0 adds Windows and FreeBSD support, runner.ca_file for trusting a private
CA, and container.volumes; it signs release checksums and fixes large cache
uploads, concurrent Dockerfile actions, and git-lfs checkouts on git-lfs
versions before 3.8.0.

The node was still running 5.2.2 because a converge from a branch that
predated the previous upgrade downgraded it. This re-establishes 5.4.0 on
gitea-2; Gitea reports the version sent on each heartbeat, so the runners
updated on restart. Checksum verified against the published binary and
checksums.txt.

site-cookbooks/kosmos_gitea/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 This file is used to list changes made in each version of the kosmos_gitea cookbook.
 
+# 0.3.7
+
+- Upgrade the Gitea Actions runner from 5.2.4 to 5.4.0. No `config.yaml` changes
+  were required.
+- 5.3.0 scopes cache entries by ref, like GitHub: a job restores from its own
+  ref, then the base branch, then the repository's default branch, and writes
+  only to its own ref. Existing (unscoped) caches therefore start out cold once
+  after this upgrade. 5.3.0 also adds `GITEA_*` aliases for the built-in
+  `GITHUB_*` environment variables and updates dependencies for
+  CVE-2026-78661.
+- 5.4.0 adds Windows and FreeBSD support, `runner.ca_file` for trusting a
+  private CA, and `container.volumes`; it signs release checksums and fixes
+  large cache uploads, concurrent Dockerfile actions, and git-lfs checkouts on
+  git-lfs versions before 3.8.0.
+- This re-establishes 5.4.0 on gitea-2, which had been downgraded back to 5.2.2
+  by a converge from a branch that predated the previous upgrade. Gitea reports
+  the runner version sent on each heartbeat, so the runners update on restart.
+
 # 0.3.6
 
 - Stop pinning job containers to one shared Docker network. `container.network`

site-cookbooks/kosmos_gitea/attributes/default.rb

@@ -24,8 +24,8 @@ node.default["gitea"]["config"] = {
   }
 }
 
-node.default["gitea"]["runner"]["version"] = "5.2.4"
-node.default["gitea"]["runner"]["checksum"] = "674145e627e5c879d72c293a08991458cf73c81124e54afdd40cf6995098a01b"
+node.default["gitea"]["runner"]["version"] = "5.4.0"
+node.default["gitea"]["runner"]["checksum"] = "9c790a1ca58d1f80872146043fecec3a2b03c4739bc87d5cdf9a63e4f8d88abe"
 node.default["gitea"]["runner"]["cache_base_port"] = 8088
 node.default["gitea"]["runner"]["config"] = {
   "runner" => {

site-cookbooks/kosmos_gitea/metadata.rb

@@ -4,7 +4,7 @@ maintainer_email 'ops@kosmos.org'
 license 'MIT'
 description 'Installs/configures Gitea'
 long_description 'Installs/configures Gitea'
-version '0.3.6'
+version '0.3.7'
 chef_version '>= 14.0'
 
 depends "firewall"