Skip to content

Commit e9ec859

Browse files
hyperpolymathhyperpolymath
committed
chore: update mirror workflow for multi-forge sync
1 parent 5869f89 commit e9ec859

1 file changed

Lines changed: 82 additions & 101 deletions

File tree

‎.github/workflows/mirror.yml‎

Lines changed: 82 additions & 101 deletions
Original file line numberDiff line numberDiff line change
@@ -1,157 +1,138 @@
11
# SPDX-License-Identifier: AGPL-3.0-or-later
2-
name: Mirror to GitLab/Codeberg/Bitbucket
2+
# SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell
3+
name: Mirror to Git Forges
34

45
on:
56
push:
6-
branches: [main, master]
7+
branches: [main]
78
workflow_dispatch:
89

9-
# Principle of least privilege - only request what's needed
10-
permissions:
11-
contents: read
12-
13-
env:
14-
# SSH host keys for verification (prevents MITM attacks)
15-
# These are the official public host keys from each service
16-
GITLAB_HOST_KEY: "gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf"
17-
CODEBERG_HOST_KEY: "codeberg.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIVIC02vnjFyL+I4RHfvIGNtOgJMe769VTF1VR4EB3ZB"
18-
BITBUCKET_HOST_KEY: "bitbucket.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIazEu89wgQZ4bqs3d63QSMzYVa0MuJ2e2gKTKqu+UUO"
10+
permissions: read-all
1911

2012
jobs:
2113
mirror-gitlab:
2214
runs-on: ubuntu-latest
2315
if: vars.GITLAB_MIRROR_ENABLED == 'true'
2416
steps:
25-
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
17+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
2618
with:
2719
fetch-depth: 0
2820

29-
- name: Setup SSH known_hosts
30-
run: |
31-
mkdir -p ~/.ssh
32-
chmod 700 ~/.ssh
33-
echo "${{ env.GITLAB_HOST_KEY }}" >> ~/.ssh/known_hosts
34-
chmod 600 ~/.ssh/known_hosts
35-
36-
- uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
21+
- uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
3722
with:
3823
ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }}
3924

4025
- name: Mirror to GitLab
41-
id: mirror
4226
run: |
43-
set -euo pipefail
44-
REPO_NAME="${GITHUB_REPOSITORY#*/}"
45-
REMOTE_URL="git@gitlab.com:hyperpolymath/${REPO_NAME}.git"
27+
ssh-keyscan -t ed25519 gitlab.com >> ~/.ssh/known_hosts
28+
git remote add gitlab git@gitlab.com:hyperpolymath/${{ github.event.repository.name }}.git || true
29+
git push --force gitlab main
4630
47-
echo "::group::Adding remote"
48-
git remote add gitlab "$REMOTE_URL" 2>/dev/null || git remote set-url gitlab "$REMOTE_URL"
49-
echo "::endgroup::"
50-
51-
echo "::group::Pushing branches"
52-
git push gitlab --all --force
53-
echo "::endgroup::"
54-
55-
echo "::group::Pushing tags"
56-
git push gitlab --tags --force
57-
echo "::endgroup::"
31+
mirror-bitbucket:
32+
runs-on: ubuntu-latest
33+
if: vars.BITBUCKET_MIRROR_ENABLED == 'true'
34+
steps:
35+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
36+
with:
37+
fetch-depth: 0
5838

59-
echo "mirror_status=success" >> "$GITHUB_OUTPUT"
39+
- uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
40+
with:
41+
ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }}
6042

61-
- name: Report failure
62-
if: failure()
43+
- name: Mirror to Bitbucket
6344
run: |
64-
echo "::error::GitLab mirror failed. Check SSH key configuration and repository access."
65-
exit 1
45+
ssh-keyscan -t ed25519 bitbucket.org >> ~/.ssh/known_hosts
46+
git remote add bitbucket git@bitbucket.org:hyperpolymath/${{ github.event.repository.name }}.git || true
47+
git push --force bitbucket main
6648
6749
mirror-codeberg:
6850
runs-on: ubuntu-latest
6951
if: vars.CODEBERG_MIRROR_ENABLED == 'true'
7052
steps:
71-
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
53+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
7254
with:
7355
fetch-depth: 0
7456

75-
- name: Setup SSH known_hosts
76-
run: |
77-
mkdir -p ~/.ssh
78-
chmod 700 ~/.ssh
79-
echo "${{ env.CODEBERG_HOST_KEY }}" >> ~/.ssh/known_hosts
80-
chmod 600 ~/.ssh/known_hosts
81-
82-
- uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
57+
- uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
8358
with:
8459
ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }}
8560

8661
- name: Mirror to Codeberg
87-
id: mirror
8862
run: |
89-
set -euo pipefail
90-
REPO_NAME="${GITHUB_REPOSITORY#*/}"
91-
REMOTE_URL="git@codeberg.org:hyperpolymath/${REPO_NAME}.git"
63+
ssh-keyscan -t ed25519 codeberg.org >> ~/.ssh/known_hosts
64+
git remote add codeberg git@codeberg.org:hyperpolymath/${{ github.event.repository.name }}.git || true
65+
git push --force codeberg main
9266
93-
echo "::group::Adding remote"
94-
git remote add codeberg "$REMOTE_URL" 2>/dev/null || git remote set-url codeberg "$REMOTE_URL"
95-
echo "::endgroup::"
96-
97-
echo "::group::Pushing branches"
98-
git push codeberg --all --force
99-
echo "::endgroup::"
100-
101-
echo "::group::Pushing tags"
102-
git push codeberg --tags --force
103-
echo "::endgroup::"
67+
mirror-sourcehut:
68+
runs-on: ubuntu-latest
69+
if: vars.SOURCEHUT_MIRROR_ENABLED == 'true'
70+
steps:
71+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
72+
with:
73+
fetch-depth: 0
10474

105-
echo "mirror_status=success" >> "$GITHUB_OUTPUT"
75+
- uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
76+
with:
77+
ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }}
10678

107-
- name: Report failure
108-
if: failure()
79+
- name: Mirror to SourceHut
10980
run: |
110-
echo "::error::Codeberg mirror failed. Check SSH key configuration and repository access."
111-
exit 1
81+
ssh-keyscan -t ed25519 git.sr.ht >> ~/.ssh/known_hosts
82+
git remote add sourcehut git@git.sr.ht:~hyperpolymath/${{ github.event.repository.name }} || true
83+
git push --force sourcehut main
11284
113-
mirror-bitbucket:
85+
mirror-disroot:
11486
runs-on: ubuntu-latest
115-
if: vars.BITBUCKET_MIRROR_ENABLED == 'true'
87+
if: vars.DISROOT_MIRROR_ENABLED == 'true'
11688
steps:
117-
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
89+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
11890
with:
11991
fetch-depth: 0
12092

121-
- name: Setup SSH known_hosts
122-
run: |
123-
mkdir -p ~/.ssh
124-
chmod 700 ~/.ssh
125-
echo "${{ env.BITBUCKET_HOST_KEY }}" >> ~/.ssh/known_hosts
126-
chmod 600 ~/.ssh/known_hosts
127-
128-
- uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
93+
- uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
12994
with:
130-
ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }}
95+
ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }}
13196

132-
- name: Mirror to Bitbucket
133-
id: mirror
97+
- name: Mirror to Disroot
13498
run: |
135-
set -euo pipefail
136-
REPO_NAME="${GITHUB_REPOSITORY#*/}"
137-
REMOTE_URL="git@bitbucket.org:hyperpolymath/${REPO_NAME}.git"
99+
ssh-keyscan -t ed25519 git.disroot.org >> ~/.ssh/known_hosts
100+
git remote add disroot git@git.disroot.org:hyperpolymath/${{ github.event.repository.name }}.git || true
101+
git push --force disroot main
102+
103+
mirror-gitea:
104+
runs-on: ubuntu-latest
105+
if: vars.GITEA_MIRROR_ENABLED == 'true'
106+
steps:
107+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
108+
with:
109+
fetch-depth: 0
138110

139-
echo "::group::Adding remote"
140-
git remote add bitbucket "$REMOTE_URL" 2>/dev/null || git remote set-url bitbucket "$REMOTE_URL"
141-
echo "::endgroup::"
111+
- uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
112+
with:
113+
ssh-private-key: ${{ secrets.GITEA_SSH_KEY }}
142114

143-
echo "::group::Pushing branches"
144-
git push bitbucket --all --force
145-
echo "::endgroup::"
115+
- name: Mirror to Gitea
116+
run: |
117+
ssh-keyscan -t ed25519 ${{ vars.GITEA_HOST }} >> ~/.ssh/known_hosts
118+
git remote add gitea git@${{ vars.GITEA_HOST }}:hyperpolymath/${{ github.event.repository.name }}.git || true
119+
git push --force gitea main
146120
147-
echo "::group::Pushing tags"
148-
git push bitbucket --tags --force
149-
echo "::endgroup::"
121+
mirror-radicle:
122+
runs-on: ubuntu-latest
123+
if: vars.RADICLE_MIRROR_ENABLED == 'true'
124+
steps:
125+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
126+
with:
127+
fetch-depth: 0
150128

151-
echo "mirror_status=success" >> "$GITHUB_OUTPUT"
129+
- name: Install Radicle
130+
run: |
131+
curl -sSf https://radicle.xyz/install | sh
132+
echo "$HOME/.radicle/bin" >> $GITHUB_PATH
152133
153-
- name: Report failure
154-
if: failure()
134+
- name: Mirror to Radicle
155135
run: |
156-
echo "::error::Bitbucket mirror failed. Check SSH key configuration and repository access."
157-
exit 1
136+
echo "${{ secrets.RADICLE_KEY }}" > ~/.radicle/keys/radicle
137+
chmod 600 ~/.radicle/keys/radicle
138+
rad sync --announce || echo "Radicle sync attempted"

0 commit comments

Comments
 (0)