scripts/.github/workflows/mirror.yml at 5869f896969468ff92e2404a1dc36fd6e240a6fd · hyperpolymath/scripts · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
# SPDX-License-Identifier: AGPL-3.0-or-later
name: Mirror to GitLab/Codeberg/Bitbucket

on:
  push:
    branches: [main, master]
  workflow_dispatch:

# Principle of least privilege - only request what's needed
permissions:
  contents: read

env:
  # SSH host keys for verification (prevents MITM attacks)
  # These are the official public host keys from each service
  GITLAB_HOST_KEY: "gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf"
  CODEBERG_HOST_KEY: "codeberg.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIVIC02vnjFyL+I4RHfvIGNtOgJMe769VTF1VR4EB3ZB"
  BITBUCKET_HOST_KEY: "bitbucket.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIazEu89wgQZ4bqs3d63QSMzYVa0MuJ2e2gKTKqu+UUO"

jobs:
  mirror-gitlab:
    runs-on: ubuntu-latest
    if: vars.GITLAB_MIRROR_ENABLED == 'true'
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
        with:
          fetch-depth: 0

      - name: Setup SSH known_hosts
        run: |
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          echo "${{ env.GITLAB_HOST_KEY }}" >> ~/.ssh/known_hosts
          chmod 600 ~/.ssh/known_hosts

      - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
        with:
          ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }}

      - name: Mirror to GitLab
        id: mirror
        run: |
          set -euo pipefail
          REPO_NAME="${GITHUB_REPOSITORY#*/}"
          REMOTE_URL="git@gitlab.com:hyperpolymath/${REPO_NAME}.git"

          echo "::group::Adding remote"
          git remote add gitlab "$REMOTE_URL" 2>/dev/null || git remote set-url gitlab "$REMOTE_URL"
          echo "::endgroup::"

          echo "::group::Pushing branches"
          git push gitlab --all --force
          echo "::endgroup::"

          echo "::group::Pushing tags"
          git push gitlab --tags --force
          echo "::endgroup::"

          echo "mirror_status=success" >> "$GITHUB_OUTPUT"

      - name: Report failure
        if: failure()
        run: |
          echo "::error::GitLab mirror failed. Check SSH key configuration and repository access."
          exit 1

  mirror-codeberg:
    runs-on: ubuntu-latest
    if: vars.CODEBERG_MIRROR_ENABLED == 'true'
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
        with:
          fetch-depth: 0

      - name: Setup SSH known_hosts
        run: |
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          echo "${{ env.CODEBERG_HOST_KEY }}" >> ~/.ssh/known_hosts
          chmod 600 ~/.ssh/known_hosts

      - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
        with:
          ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }}

      - name: Mirror to Codeberg
        id: mirror
        run: |
          set -euo pipefail
          REPO_NAME="${GITHUB_REPOSITORY#*/}"
          REMOTE_URL="git@codeberg.org:hyperpolymath/${REPO_NAME}.git"

          echo "::group::Adding remote"
          git remote add codeberg "$REMOTE_URL" 2>/dev/null || git remote set-url codeberg "$REMOTE_URL"
          echo "::endgroup::"

          echo "::group::Pushing branches"
          git push codeberg --all --force
          echo "::endgroup::"

          echo "::group::Pushing tags"
          git push codeberg --tags --force
          echo "::endgroup::"

          echo "mirror_status=success" >> "$GITHUB_OUTPUT"

      - name: Report failure
        if: failure()
        run: |
          echo "::error::Codeberg mirror failed. Check SSH key configuration and repository access."
          exit 1

  mirror-bitbucket:
    runs-on: ubuntu-latest
    if: vars.BITBUCKET_MIRROR_ENABLED == 'true'
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
        with:
          fetch-depth: 0

      - name: Setup SSH known_hosts
        run: |
          mkdir -p ~/.ssh
          chmod 700 ~/.ssh
          echo "${{ env.BITBUCKET_HOST_KEY }}" >> ~/.ssh/known_hosts
          chmod 600 ~/.ssh/known_hosts

      - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
        with:
          ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }}

      - name: Mirror to Bitbucket
        id: mirror
        run: |
          set -euo pipefail
          REPO_NAME="${GITHUB_REPOSITORY#*/}"
          REMOTE_URL="git@bitbucket.org:hyperpolymath/${REPO_NAME}.git"

          echo "::group::Adding remote"
          git remote add bitbucket "$REMOTE_URL" 2>/dev/null || git remote set-url bitbucket "$REMOTE_URL"
          echo "::endgroup::"

          echo "::group::Pushing branches"
          git push bitbucket --all --force
          echo "::endgroup::"

          echo "::group::Pushing tags"
          git push bitbucket --tags --force
          echo "::endgroup::"

          echo "mirror_status=success" >> "$GITHUB_OUTPUT"

      - name: Report failure
        if: failure()
        run: |
          echo "::error::Bitbucket mirror failed. Check SSH key configuration and repository access."
          exit 1