From 3d0857289684ad4c27668338653f09e9ff1887fe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A2u=20Cao?= <raucao@kosmos.org>
Date: Thu, 5 Nov 2026 14:43:53 +0400
Subject: [PATCH] Upgrade Gitea Actions runner to 5.4.0

Runner 5.2.4 -> 5.4.0. No config.yaml changes were required.

5.3.0 scopes cache entries by ref, like GitHub: a job restores from its own
ref, then the base branch, then the repository's default branch, and writes
only to its own ref. Existing (unscoped) caches therefore start out cold once
after the upgrade. 5.3.0 also adds GITEA_* aliases for the built-in GITHUB_*
environment variables and updates dependencies for CVE-2026-78661.

5.4.0 adds Windows and FreeBSD support, runner.ca_file for trusting a private
CA, and container.volumes; it signs release checksums and fixes large cache
uploads, concurrent Dockerfile actions, and git-lfs checkouts on git-lfs
versions before 3.8.0.

The node was still running 5.2.2 because a converge from a branch that
predated the previous upgrade downgraded it. This re-establishes 5.4.0 on
gitea-2; Gitea reports the version sent on each heartbeat, so the runners
updated on restart. Checksum verified against the published binary and
checksums.txt.
---
 site-cookbooks/kosmos_gitea/CHANGELOG.md       | 18 ++++++++++++++++++
 .../kosmos_gitea/attributes/default.rb         |  4 ++--
 site-cookbooks/kosmos_gitea/metadata.rb        |  2 +-
 3 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/site-cookbooks/kosmos_gitea/CHANGELOG.md b/site-cookbooks/kosmos_gitea/CHANGELOG.md
index e5fa75a..9c3bdb9 100644
--- a/site-cookbooks/kosmos_gitea/CHANGELOG.md
+++ b/site-cookbooks/kosmos_gitea/CHANGELOG.md
@@ -2,6 +2,24 @@
 
 This file is used to list changes made in each version of the kosmos_gitea cookbook.
 
+# 0.3.7
+
+- Upgrade the Gitea Actions runner from 5.2.4 to 5.4.0. No `config.yaml` changes
+  were required.
+- 5.3.0 scopes cache entries by ref, like GitHub: a job restores from its own
+  ref, then the base branch, then the repository's default branch, and writes
+  only to its own ref. Existing (unscoped) caches therefore start out cold once
+  after this upgrade. 5.3.0 also adds `GITEA_*` aliases for the built-in
+  `GITHUB_*` environment variables and updates dependencies for
+  CVE-2026-78661.
+- 5.4.0 adds Windows and FreeBSD support, `runner.ca_file` for trusting a
+  private CA, and `container.volumes`; it signs release checksums and fixes
+  large cache uploads, concurrent Dockerfile actions, and git-lfs checkouts on
+  git-lfs versions before 3.8.0.
+- This re-establishes 5.4.0 on gitea-2, which had been downgraded back to 5.2.2
+  by a converge from a branch that predated the previous upgrade. Gitea reports
+  the runner version sent on each heartbeat, so the runners update on restart.
+
 # 0.3.6
 
 - Stop pinning job containers to one shared Docker network. `container.network`
diff --git a/site-cookbooks/kosmos_gitea/attributes/default.rb b/site-cookbooks/kosmos_gitea/attributes/default.rb
index 337f061..d9fcca5 100644
--- a/site-cookbooks/kosmos_gitea/attributes/default.rb
+++ b/site-cookbooks/kosmos_gitea/attributes/default.rb
@@ -24,8 +24,8 @@ node.default["gitea"]["config"] = {
   }
 }
 
-node.default["gitea"]["runner"]["version"] = "5.2.4"
-node.default["gitea"]["runner"]["checksum"] = "674145e627e5c879d72c293a08991458cf73c81124e54afdd40cf6995098a01b"
+node.default["gitea"]["runner"]["version"] = "5.4.0"
+node.default["gitea"]["runner"]["checksum"] = "9c790a1ca58d1f80872146043fecec3a2b03c4739bc87d5cdf9a63e4f8d88abe"
 node.default["gitea"]["runner"]["cache_base_port"] = 8088
 node.default["gitea"]["runner"]["config"] = {
   "runner" => {
diff --git a/site-cookbooks/kosmos_gitea/metadata.rb b/site-cookbooks/kosmos_gitea/metadata.rb
index 7d5bf5a..866dced 100644
--- a/site-cookbooks/kosmos_gitea/metadata.rb
+++ b/site-cookbooks/kosmos_gitea/metadata.rb
@@ -4,7 +4,7 @@ maintainer_email 'ops@kosmos.org'
 license 'MIT'
 description 'Installs/configures Gitea'
 long_description 'Installs/configures Gitea'
-version '0.3.6'
+version '0.3.7'
 chef_version '>= 14.0'
 
 depends "firewall"