security: harden mirror workflow with SSH host verification (#1)

- Add SSH known_hosts verification for GitLab, Codeberg, and Bitbucket
  to prevent MITM attacks during mirror operations
- Add 10-minute job timeout to prevent indefinite hangs
- Add concurrency control to prevent race conditions on parallel pushes
- Use env vars for repository name with proper quoting for shell safety

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/mirror.yml

@@ -8,9 +8,15 @@ on:
 
 permissions: read-all
 
+# Prevent concurrent mirror operations to avoid race conditions
+concurrency:
+  group: mirror-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   mirror-gitlab:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     if: vars.GITLAB_MIRROR_ENABLED == 'true'
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
@@ -19,14 +25,21 @@ jobs:
       - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
         with:
           ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }}
+      - name: Add GitLab SSH host key
+        run: |
+          mkdir -p ~/.ssh
+          ssh-keyscan -t ed25519,rsa gitlab.com >> ~/.ssh/known_hosts 2>/dev/null
       - name: Mirror to GitLab
+        env:
+          REPO_NAME: ${{ github.event.repository.name }}
         run: |
-          git remote add gitlab git@gitlab.com:hyperpolymath/${GITHUB_REPOSITORY#*/}.git || true
+          git remote add gitlab "git@gitlab.com:hyperpolymath/${REPO_NAME}.git" || true
           git push gitlab --all --force
           git push gitlab --tags --force
 
   mirror-codeberg:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     if: vars.CODEBERG_MIRROR_ENABLED == 'true'
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
@@ -35,14 +48,21 @@ jobs:
       - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
         with:
           ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }}
+      - name: Add Codeberg SSH host key
+        run: |
+          mkdir -p ~/.ssh
+          ssh-keyscan -t ed25519,rsa codeberg.org >> ~/.ssh/known_hosts 2>/dev/null
       - name: Mirror to Codeberg
+        env:
+          REPO_NAME: ${{ github.event.repository.name }}
         run: |
-          git remote add codeberg git@codeberg.org:hyperpolymath/${GITHUB_REPOSITORY#*/}.git || true
+          git remote add codeberg "git@codeberg.org:hyperpolymath/${REPO_NAME}.git" || true
           git push codeberg --all --force
           git push codeberg --tags --force
 
   mirror-bitbucket:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     if: vars.BITBUCKET_MIRROR_ENABLED == 'true'
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
@@ -51,8 +71,14 @@ jobs:
       - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
         with:
           ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }}
+      - name: Add Bitbucket SSH host key
+        run: |
+          mkdir -p ~/.ssh
+          ssh-keyscan -t ed25519,rsa bitbucket.org >> ~/.ssh/known_hosts 2>/dev/null
       - name: Mirror to Bitbucket
+        env:
+          REPO_NAME: ${{ github.event.repository.name }}
         run: |
-          git remote add bitbucket git@bitbucket.org:hyperpolymath/${GITHUB_REPOSITORY#*/}.git || true
+          git remote add bitbucket "git@bitbucket.org:hyperpolymath/${REPO_NAME}.git" || true
           git push bitbucket --all --force
           git push bitbucket --tags --force