Skip to content

Commit e8f7add

Browse files
hyperpolymathhyperpolymath
authored
chore(ci): replace mirror.yml with reusable wrapper (#341)
## Summary Replaces this repo's full `mirror.yml` (~145 lines, drift-prone) with a thin ~13-line wrapper that calls `hyperpolymath/standards/.github/workflows/mirror-reusable.yml@e6b2884722350515934d443daf23442f2195796f` (merged via standards#187). Forge selection (GitLab, Bitbucket, Codeberg, SourceHut, Disroot, Gitea, Radicle) remains gated by Actions `vars.<FORGE>_MIRROR_ENABLED` exactly as before. `secrets: inherit` flows the per-forge SSH keys through implicitly. ## Why Estate audit: 289 `mirror.yml` deployments across the org, 75 unique blob SHAs (76% drift). Drift is action-SHA pin churn, not feature variance — the canonical 7-forge job set is identical across sampled variants. Converging behind the reusable cuts ~94k LOC of estate scaffold and means future changes to mirror logic propagate via one SHA bump. Part of estate-wide convergence campaign 2026-05-26 (standards#199 / #187).
1 parent df0a037 commit e8f7add

1 file changed

Lines changed: 8 additions & 188 deletions

File tree

‎.github/workflows/mirror.yml‎

Lines changed: 8 additions & 188 deletions
Original file line numberDiff line numberDiff line change
@@ -1,195 +1,15 @@
11
# SPDX-License-Identifier: MPL-2.0
2-
# Consolidated workflow (behaviour-preserving merge).
3-
# Merged from: boj-build.yml, instant-sync.yml, mirror.yml
4-
name: Mirror & Sync
2+
name: Mirror to Git Forges
53

64
on:
75
push:
8-
branches:
9-
- main
10-
- master
11-
workflow_dispatch: null
12-
release:
13-
types:
14-
- published
6+
branches: [main]
7+
workflow_dispatch:
158

16-
permissions: read-all
9+
permissions:
10+
contents: read
1711

1812
jobs:
19-
mirror-gitlab:
20-
runs-on: ubuntu-latest
21-
if: vars.GITLAB_MIRROR_ENABLED == 'true'
22-
steps:
23-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
24-
with:
25-
fetch-depth: 0
26-
27-
- uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
28-
with:
29-
ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }}
30-
31-
- name: Mirror to GitLab
32-
run: |
33-
ssh-keyscan -t ed25519 gitlab.com >> ~/.ssh/known_hosts
34-
git remote add gitlab git@gitlab.com:hyperpolymath/${{ github.event.repository.name }}.git || true
35-
git push --force gitlab main
36-
37-
mirror-bitbucket:
38-
runs-on: ubuntu-latest
39-
if: vars.BITBUCKET_MIRROR_ENABLED == 'true'
40-
steps:
41-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
42-
with:
43-
fetch-depth: 0
44-
45-
- uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
46-
with:
47-
ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }}
48-
49-
- name: Mirror to Bitbucket
50-
run: |
51-
ssh-keyscan -t ed25519 bitbucket.org >> ~/.ssh/known_hosts
52-
git remote add bitbucket git@bitbucket.org:hyperpolymath/${{ github.event.repository.name }}.git || true
53-
git push --force bitbucket main
54-
55-
mirror-codeberg:
56-
runs-on: ubuntu-latest
57-
if: vars.CODEBERG_MIRROR_ENABLED == 'true'
58-
steps:
59-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
60-
with:
61-
fetch-depth: 0
62-
63-
- uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
64-
with:
65-
ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }}
66-
67-
- name: Mirror to Codeberg
68-
run: |
69-
ssh-keyscan -t ed25519 codeberg.org >> ~/.ssh/known_hosts
70-
git remote add codeberg git@codeberg.org:hyperpolymath/${{ github.event.repository.name }}.git || true
71-
git push --force codeberg main
72-
73-
mirror-sourcehut:
74-
runs-on: ubuntu-latest
75-
if: vars.SOURCEHUT_MIRROR_ENABLED == 'true'
76-
steps:
77-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
78-
with:
79-
fetch-depth: 0
80-
81-
- uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
82-
with:
83-
ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }}
84-
85-
- name: Mirror to SourceHut
86-
run: |
87-
ssh-keyscan -t ed25519 git.sr.ht >> ~/.ssh/known_hosts
88-
git remote add sourcehut git@git.sr.ht:~hyperpolymath/${{ github.event.repository.name }} || true
89-
git push --force sourcehut main
90-
91-
mirror-disroot:
92-
runs-on: ubuntu-latest
93-
if: vars.DISROOT_MIRROR_ENABLED == 'true'
94-
steps:
95-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
96-
with:
97-
fetch-depth: 0
98-
99-
- uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
100-
with:
101-
ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }}
102-
103-
- name: Mirror to Disroot
104-
run: |
105-
ssh-keyscan -t ed25519 git.disroot.org >> ~/.ssh/known_hosts
106-
git remote add disroot git@git.disroot.org:hyperpolymath/${{ github.event.repository.name }}.git || true
107-
git push --force disroot main
108-
109-
mirror-gitea:
110-
runs-on: ubuntu-latest
111-
if: vars.GITEA_MIRROR_ENABLED == 'true'
112-
steps:
113-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
114-
with:
115-
fetch-depth: 0
116-
117-
- uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
118-
with:
119-
ssh-private-key: ${{ secrets.GITEA_SSH_KEY }}
120-
121-
- name: Mirror to Gitea
122-
run: |
123-
ssh-keyscan -t ed25519 ${{ vars.GITEA_HOST }} >> ~/.ssh/known_hosts
124-
git remote add gitea git@${{ vars.GITEA_HOST }}:hyperpolymath/${{ github.event.repository.name }}.git || true
125-
git push --force gitea main
126-
127-
mirror-radicle:
128-
runs-on: ubuntu-latest
129-
if: vars.RADICLE_MIRROR_ENABLED == 'true'
130-
steps:
131-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
132-
with:
133-
fetch-depth: 0
134-
135-
- name: Setup Rust
136-
uses: dtolnay/rust-toolchain@6d9817901c499d6b02debbb57edb38d33daa680b # stable
137-
with:
138-
toolchain: stable
139-
140-
- name: Install Radicle
141-
run: |
142-
# Install via cargo (deliberately avoiding remote-script-exec install paths).
143-
cargo install radicle-cli --locked
144-
echo "$HOME/.cargo/bin" >> $GITHUB_PATH
145-
146-
- name: Mirror to Radicle
147-
run: |
148-
echo "${{ secrets.RADICLE_KEY }}" > ~/.radicle/keys/radicle
149-
chmod 600 ~/.radicle/keys/radicle
150-
rad sync --announce || echo "Radicle sync attempted"
151-
152-
dispatch:
153-
runs-on: ubuntu-latest
154-
steps:
155-
- name: Trigger Propagation
156-
uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v3
157-
with:
158-
token: ${{ secrets.FARM_DISPATCH_TOKEN }}
159-
repository: hyperpolymath/.git-private-farm
160-
event-type: propagate
161-
client-payload: |-
162-
{
163-
"repo": "${{ github.event.repository.name }}",
164-
"ref": "${{ github.ref }}",
165-
"sha": "${{ github.sha }}",
166-
"forges": ""
167-
}
168-
169-
- name: Confirm
170-
run: echo "::notice::Propagation triggered for ${{ github.event.repository.name }}"
171-
172-
trigger-boj:
173-
runs-on: ubuntu-latest
174-
steps:
175-
- name: Checkout
176-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
177-
- name: Trigger BoJ Server (Casket/ssg-mcp)
178-
env:
179-
# Pull GitHub context into env so the curl payload can be built
180-
# with `jq --arg` instead of inline interpolation — closes the
181-
# workflow_audit/unsafe_curl_payload finding and accidentally
182-
# also fixes a pre-existing JSON-escaping bug in the old payload
183-
# (a stray `}` outside the closing brace).
184-
REPO: ${{ github.repository }}
185-
BRANCH: ${{ github.ref_name }}
186-
run: |
187-
PAYLOAD=$(jq -nc \
188-
--arg repo "$REPO" \
189-
--arg branch "$BRANCH" \
190-
--arg engine "casket" \
191-
'{repo: $repo, branch: $branch, engine: $engine}')
192-
curl -X POST "http://boj-server.local:7700/cartridges/ssg-mcp/invoke" \
193-
-H "Content-Type: application/json" \
194-
-d "$PAYLOAD"
195-
continue-on-error: true
13+
mirror:
14+
uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@e6b2884722350515934d443daf23442f2195796f
15+
secrets: inherit

0 commit comments

Comments
 (0)