maa-framework/.github/workflows/mirror.yml at 5e0da3a8a08bddaef1060a62f196aa3b022f6182 · hyperpolymath/maa-framework · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
# SPDX-License-Identifier: AGPL-3.0-or-later
name: Mirror to GitLab/Codeberg/Bitbucket

on:
  push:
    branches: [main, master]
  workflow_dispatch:

# Prevent concurrent mirror operations to avoid race conditions
concurrency:
  group: mirror-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read

env:
  # SSH known hosts for security - prevents MITM attacks
  # These are the official SSH host keys for each platform
  GITLAB_HOST_KEY: "gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf"
  CODEBERG_HOST_KEY: "codeberg.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIVIC02vnjFyL+I4RHfvIGNtOgJMe769VTF1VR4EB3ZB"
  BITBUCKET_HOST_KEY: "bitbucket.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIazEu89wgQZ4bqs3d63QSMzYVa0MuJ2e2gKTKqu+UUO"

jobs:
  mirror-gitlab:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    if: vars.GITLAB_MIRROR_ENABLED == 'true'
    steps:
      - name: Add GitLab to known hosts
        run: |
          mkdir -p ~/.ssh
          echo "${{ env.GITLAB_HOST_KEY }}" >> ~/.ssh/known_hosts
          chmod 600 ~/.ssh/known_hosts

      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0

      - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
        with:
          ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }}

      - name: Mirror to GitLab
        run: |
          git remote add gitlab "git@gitlab.com:${{ github.repository_owner }}/${GITHUB_REPOSITORY#*/}.git" || true
          git push gitlab --all --force
          git push gitlab --tags --force

  mirror-codeberg:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    if: vars.CODEBERG_MIRROR_ENABLED == 'true'
    steps:
      - name: Add Codeberg to known hosts
        run: |
          mkdir -p ~/.ssh
          echo "${{ env.CODEBERG_HOST_KEY }}" >> ~/.ssh/known_hosts
          chmod 600 ~/.ssh/known_hosts

      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0

      - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
        with:
          ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }}

      - name: Mirror to Codeberg
        run: |
          git remote add codeberg "git@codeberg.org:${{ github.repository_owner }}/${GITHUB_REPOSITORY#*/}.git" || true
          git push codeberg --all --force
          git push codeberg --tags --force

  mirror-bitbucket:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    if: vars.BITBUCKET_MIRROR_ENABLED == 'true'
    steps:
      - name: Add Bitbucket to known hosts
        run: |
          mkdir -p ~/.ssh
          echo "${{ env.BITBUCKET_HOST_KEY }}" >> ~/.ssh/known_hosts
          chmod 600 ~/.ssh/known_hosts

      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          fetch-depth: 0

      - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
        with:
          ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }}

      - name: Mirror to Bitbucket
        run: |
          git remote add bitbucket "git@bitbucket.org:${{ github.repository_owner }}/${GITHUB_REPOSITORY#*/}.git" || true
          git push bitbucket --all --force
          git push bitbucket --tags --force