From ff1dd735095e0d0b3f4e74e6c6233a3f1e2bcdf5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A2u=20Cao?= <raucao@kosmos.org>
Date: Sun, 25 Oct 2026 10:26:25 +0100
Subject: [PATCH] Upgrade Gitea Runner to 5.2.2

---
 site-cookbooks/kosmos_gitea/CHANGELOG.md          | 14 ++++++++++++++
 site-cookbooks/kosmos_gitea/attributes/default.rb |  4 ++--
 site-cookbooks/kosmos_gitea/metadata.rb           |  2 +-
 site-cookbooks/kosmos_gitea/recipes/runner.rb     |  3 +++
 4 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/site-cookbooks/kosmos_gitea/CHANGELOG.md b/site-cookbooks/kosmos_gitea/CHANGELOG.md
index 865cc45..c6cfb95 100644
--- a/site-cookbooks/kosmos_gitea/CHANGELOG.md
+++ b/site-cookbooks/kosmos_gitea/CHANGELOG.md
@@ -2,6 +2,20 @@
 
 This file is used to list changes made in each version of the kosmos_gitea cookbook.
 
+# 0.3.4
+
+- Upgrade the Gitea Actions runner from 5.0.0 to 5.2.2. No `config.yaml` changes
+  were required.
+- Runner services are now restarted automatically when the runner binary is
+  upgraded (previously a manual restart was needed).
+- Workflow-side behavior changes to be aware of (no cookbook change): the cache
+  and artifact servers now answer `HEAD` on GET routes, no longer redirect
+  trailing slashes or answer `OPTIONS`; build contexts no longer carry
+  `security.capability` xattrs, and an unreadable file in a build context is
+  skipped with a warning instead of producing a truncated tar. The runner now
+  builds on `connectrpc.com/connect/v2` and remains compatible with Gitea
+  servers on connect v1.
+
 # 0.3.3
 
 - Upgrade the Gitea Actions runner from 4.0.0 to 5.0.0. No `config.yaml` changes
diff --git a/site-cookbooks/kosmos_gitea/attributes/default.rb b/site-cookbooks/kosmos_gitea/attributes/default.rb
index d838d09..f7308b8 100644
--- a/site-cookbooks/kosmos_gitea/attributes/default.rb
+++ b/site-cookbooks/kosmos_gitea/attributes/default.rb
@@ -24,8 +24,8 @@ node.default["gitea"]["config"] = {
   }
 }
 
-node.default["gitea"]["runner"]["version"] = "5.0.0"
-node.default["gitea"]["runner"]["checksum"] = "3201f520b48abd353261b723c1e6b9bb3a82a56cabd4063e58d1fa191bbc50b2"
+node.default["gitea"]["runner"]["version"] = "5.2.2"
+node.default["gitea"]["runner"]["checksum"] = "5a2639fd2a57feeba29a9b1fb0e941489f092a4fa681c7c333c0372731248b63"
 node.default["gitea"]["runner"]["cache_base_port"] = 8088
 node.default["gitea"]["runner"]["config"] = {
   "runner" => {
diff --git a/site-cookbooks/kosmos_gitea/metadata.rb b/site-cookbooks/kosmos_gitea/metadata.rb
index 6d2d2cb..a847057 100644
--- a/site-cookbooks/kosmos_gitea/metadata.rb
+++ b/site-cookbooks/kosmos_gitea/metadata.rb
@@ -4,7 +4,7 @@ maintainer_email 'ops@kosmos.org'
 license 'MIT'
 description 'Installs/configures Gitea'
 long_description 'Installs/configures Gitea'
-version '0.3.3'
+version '0.3.4'
 chef_version '>= 14.0'
 
 depends "firewall"
diff --git a/site-cookbooks/kosmos_gitea/recipes/runner.rb b/site-cookbooks/kosmos_gitea/recipes/runner.rb
index bd63009..1833aa0 100644
--- a/site-cookbooks/kosmos_gitea/recipes/runner.rb
+++ b/site-cookbooks/kosmos_gitea/recipes/runner.rb
@@ -29,6 +29,9 @@ remote_file "/usr/local/bin/gitea_runner" do
   source download_url
   checksum node["gitea"]["runner"]["checksum"]
   mode "0750"
+  runners.each do |runner|
+    notifies :restart, "service[gitea-runner-#{runner["org"]}]", :delayed
+  end
 end
 
 directory "#{working_directory}/runners" do