security: harden mirror workflow with SSH host key verification (#1)

- Add SSH host key verification for GitLab, Codeberg, and Bitbucket
  to prevent MITM attacks (uses ed25519 keys)
- Reduce permissions from read-all to contents: read (least privilege)
- Add set -euo pipefail for proper error handling in shell scripts
- Add failure reporting steps for clearer error diagnostics
- Improve variable handling with proper quoting
- Add GitHub Actions log grouping for better readability

Co-authored-by: Claude <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/mirror.yml

@@ -6,7 +6,16 @@ on:
     branches: [main, master]
   workflow_dispatch:
 
-permissions: read-all
+# Principle of least privilege - only request what's needed
+permissions:
+  contents: read
+
+env:
+  # SSH host keys for verification (prevents MITM attacks)
+  # These are the official public host keys from each service
+  GITLAB_HOST_KEY: "gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf"
+  CODEBERG_HOST_KEY: "codeberg.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIVIC02vnjFyL+I4RHfvIGNtOgJMe769VTF1VR4EB3ZB"
+  BITBUCKET_HOST_KEY: "bitbucket.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIazEu89wgQZ4bqs3d63QSMzYVa0MuJ2e2gKTKqu+UUO"
 
 jobs:
   mirror-gitlab:
@@ -16,14 +25,44 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
         with:
           fetch-depth: 0
+
+      - name: Setup SSH known_hosts
+        run: |
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          echo "${{ env.GITLAB_HOST_KEY }}" >> ~/.ssh/known_hosts
+          chmod 600 ~/.ssh/known_hosts
+
       - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
         with:
           ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }}
+
       - name: Mirror to GitLab
+        id: mirror
         run: |
-          git remote add gitlab git@gitlab.com:hyperpolymath/${GITHUB_REPOSITORY#*/}.git || true
+          set -euo pipefail
+          REPO_NAME="${GITHUB_REPOSITORY#*/}"
+          REMOTE_URL="git@gitlab.com:hyperpolymath/${REPO_NAME}.git"
+
+          echo "::group::Adding remote"
+          git remote add gitlab "$REMOTE_URL" 2>/dev/null || git remote set-url gitlab "$REMOTE_URL"
+          echo "::endgroup::"
+
+          echo "::group::Pushing branches"
           git push gitlab --all --force
+          echo "::endgroup::"
+
+          echo "::group::Pushing tags"
           git push gitlab --tags --force
+          echo "::endgroup::"
+
+          echo "mirror_status=success" >> "$GITHUB_OUTPUT"
+
+      - name: Report failure
+        if: failure()
+        run: |
+          echo "::error::GitLab mirror failed. Check SSH key configuration and repository access."
+          exit 1
 
   mirror-codeberg:
     runs-on: ubuntu-latest
@@ -32,14 +71,44 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
         with:
           fetch-depth: 0
+
+      - name: Setup SSH known_hosts
+        run: |
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          echo "${{ env.CODEBERG_HOST_KEY }}" >> ~/.ssh/known_hosts
+          chmod 600 ~/.ssh/known_hosts
+
       - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
         with:
           ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }}
+
       - name: Mirror to Codeberg
+        id: mirror
         run: |
-          git remote add codeberg git@codeberg.org:hyperpolymath/${GITHUB_REPOSITORY#*/}.git || true
+          set -euo pipefail
+          REPO_NAME="${GITHUB_REPOSITORY#*/}"
+          REMOTE_URL="git@codeberg.org:hyperpolymath/${REPO_NAME}.git"
+
+          echo "::group::Adding remote"
+          git remote add codeberg "$REMOTE_URL" 2>/dev/null || git remote set-url codeberg "$REMOTE_URL"
+          echo "::endgroup::"
+
+          echo "::group::Pushing branches"
           git push codeberg --all --force
+          echo "::endgroup::"
+
+          echo "::group::Pushing tags"
           git push codeberg --tags --force
+          echo "::endgroup::"
+
+          echo "mirror_status=success" >> "$GITHUB_OUTPUT"
+
+      - name: Report failure
+        if: failure()
+        run: |
+          echo "::error::Codeberg mirror failed. Check SSH key configuration and repository access."
+          exit 1
 
   mirror-bitbucket:
     runs-on: ubuntu-latest
@@ -48,11 +117,41 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
         with:
           fetch-depth: 0
+
+      - name: Setup SSH known_hosts
+        run: |
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          echo "${{ env.BITBUCKET_HOST_KEY }}" >> ~/.ssh/known_hosts
+          chmod 600 ~/.ssh/known_hosts
+
       - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
         with:
           ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }}
+
       - name: Mirror to Bitbucket
+        id: mirror
         run: |
-          git remote add bitbucket git@bitbucket.org:hyperpolymath/${GITHUB_REPOSITORY#*/}.git || true
+          set -euo pipefail
+          REPO_NAME="${GITHUB_REPOSITORY#*/}"
+          REMOTE_URL="git@bitbucket.org:hyperpolymath/${REPO_NAME}.git"
+
+          echo "::group::Adding remote"
+          git remote add bitbucket "$REMOTE_URL" 2>/dev/null || git remote set-url bitbucket "$REMOTE_URL"
+          echo "::endgroup::"
+
+          echo "::group::Pushing branches"
           git push bitbucket --all --force
+          echo "::endgroup::"
+
+          echo "::group::Pushing tags"
           git push bitbucket --tags --force
+          echo "::endgroup::"
+
+          echo "mirror_status=success" >> "$GITHUB_OUTPUT"
+
+      - name: Report failure
+        if: failure()
+        run: |
+          echo "::error::Bitbucket mirror failed. Check SSH key configuration and repository access."
+          exit 1