.github: add gentoo job

Signed-off-by: Enrico Weigelt, metux IT consult <info@metux.net>

.github/docker/gentoo/Dockerfile

@@ -0,0 +1,87 @@
+# Prebuilt Gentoo image with all X-server build dependencies baked in.
+#
+# Why: the official Gentoo binhost is built with the default-profile USE flags
+# (no X), so the X-USE variants we need (freetype[harfbuzz], libglvnd[X], mesa,
+# and mesa's llvm) have no matching binary package and must be compiled from
+# source — a multi-hour job. Doing that once here, off the CI critical path,
+# lets the xserver-build-gentoo job start from a ready image and only run meson
+# (~5 min) instead of emerging 115 packages (~20 min) on every run.
+#
+# Built + pushed to GHCR by .github/workflows/gentoo-image.yml.
+FROM gentoo/stage3:latest
+
+# Sync the portage tree (stage3 ships none) and configure portage for a CI
+# build: official binhost for the bulk, our X USE flags for the few that must
+# be compiled, sandbox off (unprivileged container).
+RUN emerge-webrsync --quiet && \
+    cat >> /etc/portage/make.conf <<'EOF'
+
+# --- xlibre CI build settings ---
+ACCEPT_LICENSE="*"
+USE="${USE} X gbm egl gles2 udev harfbuzz png -systemd"
+FEATURES="${FEATURES} getbinpkg -sandbox -usersandbox -ipc-sandbox -network-sandbox -pid-sandbox"
+EMERGE_DEFAULT_OPTS="--jobs=4 --quiet-build=y --getbinpkg --binpkg-respect-use=y --autounmask-continue=y"
+EOF
+
+# Emerge the full X-server build dependency set (binary where the binhost has a
+# USE-matching package, from source otherwise — this is the one-time slow part).
+RUN emerge --oneshot \
+    app-emulation/spice-protocol \
+    dev-build/meson \
+    dev-build/ninja \
+    dev-libs/expat \
+    dev-libs/libbsd \
+    dev-libs/libevdev \
+    dev-libs/libffi \
+    dev-libs/libgcrypt \
+    dev-libs/libinput \
+    dev-libs/nettle \
+    dev-python/mako \
+    dev-vcs/git \
+    media-fonts/font-util \
+    media-libs/libepoxy \
+    media-libs/libglvnd \
+    media-libs/mesa \
+    net-libs/libtirpc \
+    sys-apps/dbus \
+    sys-libs/libunwind \
+    virtual/libudev \
+    virtual/pkgconfig \
+    x11-apps/xkbcomp \
+    x11-base/xorg-proto \
+    x11-libs/cairo \
+    x11-libs/libdrm \
+    x11-libs/libpciaccess \
+    x11-libs/libX11 \
+    x11-libs/libXau \
+    x11-libs/libXaw \
+    x11-libs/libxcb \
+    x11-libs/libXdmcp \
+    x11-libs/libXext \
+    x11-libs/libXfixes \
+    x11-libs/libXfont2 \
+    x11-libs/libXi \
+    x11-libs/libXinerama \
+    x11-libs/libxkbfile \
+    x11-libs/libXmu \
+    x11-libs/libXpm \
+    x11-libs/libXrandr \
+    x11-libs/libXrender \
+    x11-libs/libXres \
+    x11-libs/libxshmfence \
+    x11-libs/libXt \
+    x11-libs/libXtst \
+    x11-libs/libXv \
+    x11-libs/libxcvt \
+    x11-libs/pango \
+    x11-libs/pixman \
+    x11-libs/xcb-util \
+    x11-libs/xcb-util-image \
+    x11-libs/xcb-util-keysyms \
+    x11-libs/xcb-util-renderutil \
+    x11-libs/xcb-util-wm \
+    x11-misc/xkeyboard-config
+
+# Drop the caches/tree the build job does not need, to keep the image lean
+# (the dependencies themselves are installed into the rootfs and stay).
+RUN rm -rf /var/cache/binpkgs/* /var/cache/distfiles/* /var/db/repos/gentoo

.github/scripts/gentoo/run-xserver-build.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+
+set -e
+
+# Build dependencies are baked into the prebuilt GHCR image (see
+# .github/docker/gentoo/Dockerfile + .github/workflows/gentoo-image.yml), so we
+# only run meson here. Gentoo uses the standard /usr[/lib64] layout, so no extra
+# PKG_CONFIG_PATH is needed.
+echo "--> running xserver build ...."
+export MESON_BUILDDIR=_build
+
+rm -rf "$MESON_BUILDDIR"
+meson setup "$MESON_BUILDDIR" $MESON_ARGS
+meson configure "$MESON_BUILDDIR"
+meson compile -v -C "$MESON_BUILDDIR" $jobcount $ninja_args
+# tests not working yet
+# meson test -C "$MESON_BUILDDIR" --print-errorlogs $MESON_TEST_ARGS
+meson install --no-rebuild  -C "$MESON_BUILDDIR" $MESON_INSTALL_ARGS

.github/workflows/build-xserver.yml

@@ -675,6 +675,36 @@ jobs:
             - name: build
               run: ./.github/scripts/alpine/run-xserver-build.sh
 
+    xserver-build-gentoo:
+        runs-on: ubuntu-latest
+        needs: ubuntu-fetch-pkg
+        # packages:read lets the GITHUB_TOKEN pull the (currently private) GHCR
+        # image; contents:read is for checkout. Both become unnecessary once the
+        # package is public, but are harmless to keep.
+        permissions:
+            contents: read
+            packages: read
+        # Prebuilt image with all build deps baked in (built by gentoo-image.yml,
+        # pushed to GHCR). The job only runs meson (~5 min) instead of emerging
+        # 115 packages (~20 min). credentials let it pull while the package is
+        # private; harmless once it is public (then fork PRs can pull too).
+        container:
+            image: ghcr.io/x11libre/xserver-gentoo-deps:latest
+            credentials:
+                username: ${{ github.actor }}
+                password: ${{ secrets.GITHUB_TOKEN }}
+        env:
+            # werror off: Gentoo's hardened toolchain (FORTIFY_SOURCE) trips
+            # -Werror=format-truncation in the bundled Xtrans (a bounded snprintf
+            # into sun_path) which other platforms don't hit. Matches the other
+            # freshly-added lanes (solaris/openbsd) while the platform is new.
+            MESON_ARGS: -Dprefix=/usr -Dwerror=false -Dxcsecurity=true -Dxorg=true -Dxephyr=true -Dxvfb=true -Dxnest=true -Dxfbdev=false -Dsystemd_logind=false
+        steps:
+            - name: Check out repository code
+              uses: actions/checkout@v6
+            - name: build
+              run: ./.github/scripts/gentoo/run-xserver-build.sh
+
     xserver-build-cygwin:
         # skip the redundant same-repo PR rebuild (see ubuntu-fetch-pkg)
         if: >-
@@ -789,6 +819,7 @@ jobs:
             - xserver-build-dragonflybsd
             - xserver-build-netbsd
             - xserver-build-arch
+            - xserver-build-gentoo
         steps:
             - name: Checkout
               uses: actions/checkout@v6

.github/workflows/gentoo-image.yml

@@ -0,0 +1,47 @@
+name: Build Gentoo deps image
+
+# Builds the prebuilt Gentoo image (.github/docker/gentoo/Dockerfile) with all
+# X-server build dependencies baked in, and pushes it to GHCR. The
+# xserver-build-gentoo job pulls this image so it only has to run meson (~5 min)
+# instead of emerging the whole dependency set (~20 min) on every run.
+#
+# This is the one intentionally-slow job (it compiles the X-USE variants the
+# official binhost lacks: mesa, llvm, ...), but it runs off the PR critical path
+# — only on demand, on a weekly schedule, or when the Dockerfile changes.
+
+on:
+    workflow_dispatch:
+    schedule:
+        # weekly, Monday 04:00 UTC — keep the image fresh with the binhost
+        - cron: '0 4 * * 1'
+    push:
+        paths:
+            - '.github/docker/gentoo/**'
+            - '.github/workflows/gentoo-image.yml'
+
+permissions:
+    contents: read
+    packages: write
+
+jobs:
+    build-gentoo-image:
+        runs-on: ubuntu-latest
+        timeout-minutes: 300
+        steps:
+            - uses: actions/checkout@v6
+
+            - name: Log in to GHCR
+              run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+            - name: Build and push image
+              run: |
+                  set -eux
+                  owner=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
+                  img="ghcr.io/$owner/xserver-gentoo-deps"
+                  docker build \
+                      -t "$img:latest" \
+                      -t "$img:${GITHUB_SHA::12}" \
+                      -f .github/docker/gentoo/Dockerfile \
+                      .github/docker/gentoo
+                  docker push "$img:latest"
+                  docker push "$img:${GITHUB_SHA::12}"