fix(ci): hoist secrets to job env in mirror-reusable; refresh example SHAs (#416)

## Task A — mirror-reusable.yml (two real bugs)

**Bug 1 — duplicate `if:` key.** The "Mirror to GitLab" step had `if:
${{ secrets.GITLAB_SSH_KEY != '' }}` twice (with `continue-on-error:
true` between). Removed the duplicate so the step has exactly one `if:`.

**Bug 2 — `secrets` context in step `if:`.** The `secrets` context is
**not** valid in step-level `if:` — it is an `Unrecognized named-value:
'secrets'` startup failure. Hoisted each forge secret to a job-level
`env:` block and changed every step `if:` to gate on `env.<FORGE>_KEY`,
matching the already-correct `mirror-radicle` job. Applied to all six
forge jobs: gitlab, bitbucket, codeberg, sourcehut, disroot, gitea.
Behaviour is identical; only the reference site moved. `actionlint`
clean.

## Task B — refresh stale example SHAs

The header copy-paste usage examples in
`{elixir-ci,deno-ci,rust-ci,changelog}-reusable.yml` pinned `@861b5e9…`
(stale, ~70 commits behind, beyond the staleness window). Refreshed to
current `main` HEAD `4762ba66441de05bccb36e074ba3d2202219126a`.
Comment-only.

## Validation

- `actionlint` clean on all 5 files.
- No `secrets.*` remains in any step `if:`.
- Task B diff is comment-only.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/changelog-reusable.yml

@@ -10,7 +10,7 @@
 # Caller example (auto-update CHANGELOG.md on every push to main):
 #   jobs:
 #     changelog:
-#       uses: hyperpolymath/standards/.github/workflows/changelog-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
+#       uses: hyperpolymath/standards/.github/workflows/changelog-reusable.yml@4762ba66441de05bccb36e074ba3d2202219126a
 #       permissions:
 #         contents: write
 #         pull-requests: write

.github/workflows/deno-ci-reusable.yml

@@ -23,7 +23,7 @@
 #
 #   jobs:
 #     deno-ci:
-#       uses: hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
+#       uses: hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@4762ba66441de05bccb36e074ba3d2202219126a
 
 name: Deno CI (reusable)
 

.github/workflows/elixir-ci-reusable.yml

@@ -33,13 +33,13 @@
 #
 #   jobs:
 #     elixir-ci:
-#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
+#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@4762ba66441de05bccb36e074ba3d2202219126a
 #
 # With dialyzer + customised versions:
 #
 #   jobs:
 #     elixir-ci:
-#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
+#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@4762ba66441de05bccb36e074ba3d2202219126a
 #       with:
 #         elixir-version: "1.18"
 #         enable_dialyzer: true
@@ -49,7 +49,7 @@
 #
 #   jobs:
 #     elixir-ci:
-#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
+#       uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@4762ba66441de05bccb36e074ba3d2202219126a
 #       with:
 #         working_directory: server
 

.github/workflows/mirror-reusable.yml

@@ -51,144 +51,169 @@ jobs:
     timeout-minutes: 20
     runs-on: ${{ inputs.runs-on }}
     if: vars.GITLAB_MIRROR_ENABLED == 'true'
+    # Map the secret to env so step `if:`s can gate on its presence: the
+    # `secrets` context is NOT available in `if:` (using it is an
+    # "Unrecognized named-value: 'secrets'" startup failure). `env` IS
+    # available in step `if:`, and secrets are valid in job-level `env`.
+    env:
+      GITLAB_KEY: ${{ secrets.GITLAB_SSH_KEY }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        if: ${{ secrets.GITLAB_SSH_KEY != '' }}
+        if: ${{ env.GITLAB_KEY != '' }}
         with:
           ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }}
       - name: Mirror to GitLab
-        if: ${{ secrets.GITLAB_SSH_KEY != '' }}
         # continue-on-error: GitLab branch protection on the mirror repo may block
         # force-push even for a deploy key. Owner action required: in GitLab go to
         # Settings → Repository → Protected branches → main and either allow force-push
         # for Maintainers/Developers or remove the protection on the mirror repo.
         # Until then this step is advisory-only; failures do not red main.
         continue-on-error: true
-        if: ${{ secrets.GITLAB_SSH_KEY != '' }}
+        if: ${{ env.GITLAB_KEY != '' }}
         run: |
           ssh-keyscan -t ed25519 gitlab.com >> ~/.ssh/known_hosts
           git remote add gitlab git@gitlab.com:hyperpolymath/${{ github.event.repository.name }}.git || true
           git push --force gitlab main
       - name: Skipped (GITLAB_SSH_KEY not configured)
-        if: ${{ secrets.GITLAB_SSH_KEY == '' }}
+        if: ${{ env.GITLAB_KEY == '' }}
         run: |
           echo "::notice::GITLAB_MIRROR_ENABLED=true but secrets.GITLAB_SSH_KEY is empty. Skipping GitLab mirror. Configure the GITLAB_SSH_KEY org/repo secret to enable."
 
   mirror-bitbucket:
     timeout-minutes: 20
     runs-on: ${{ inputs.runs-on }}
     if: vars.BITBUCKET_MIRROR_ENABLED == 'true'
+    # See mirror-gitlab: the `secrets` context is not valid in step `if:`;
+    # hoist to job-level `env` and gate steps on `env.BITBUCKET_KEY`.
+    env:
+      BITBUCKET_KEY: ${{ secrets.BITBUCKET_SSH_KEY }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        if: ${{ secrets.BITBUCKET_SSH_KEY != '' }}
+        if: ${{ env.BITBUCKET_KEY != '' }}
         with:
           ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }}
       - name: Mirror to Bitbucket
-        if: ${{ secrets.BITBUCKET_SSH_KEY != '' }}
+        if: ${{ env.BITBUCKET_KEY != '' }}
         run: |
           ssh-keyscan -t ed25519 bitbucket.org >> ~/.ssh/known_hosts
           git remote add bitbucket git@bitbucket.org:hyperpolymath/${{ github.event.repository.name }}.git || true
           git push --force bitbucket main
       - name: Skipped (BITBUCKET_SSH_KEY not configured)
-        if: ${{ secrets.BITBUCKET_SSH_KEY == '' }}
+        if: ${{ env.BITBUCKET_KEY == '' }}
         run: |
           echo "::notice::BITBUCKET_MIRROR_ENABLED=true but secrets.BITBUCKET_SSH_KEY is empty. Skipping Bitbucket mirror. Configure the BITBUCKET_SSH_KEY org/repo secret to enable."
 
   mirror-codeberg:
     timeout-minutes: 20
     runs-on: ${{ inputs.runs-on }}
     if: vars.CODEBERG_MIRROR_ENABLED == 'true'
+    # See mirror-gitlab: the `secrets` context is not valid in step `if:`;
+    # hoist to job-level `env` and gate steps on `env.CODEBERG_KEY`.
+    env:
+      CODEBERG_KEY: ${{ secrets.CODEBERG_SSH_KEY }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        if: ${{ secrets.CODEBERG_SSH_KEY != '' }}
+        if: ${{ env.CODEBERG_KEY != '' }}
         with:
           ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }}
       - name: Mirror to Codeberg
-        if: ${{ secrets.CODEBERG_SSH_KEY != '' }}
+        if: ${{ env.CODEBERG_KEY != '' }}
         run: |
           ssh-keyscan -t ed25519 codeberg.org >> ~/.ssh/known_hosts
           git remote add codeberg git@codeberg.org:hyperpolymath/${{ github.event.repository.name }}.git || true
           git push --force codeberg main
       - name: Skipped (CODEBERG_SSH_KEY not configured)
-        if: ${{ secrets.CODEBERG_SSH_KEY == '' }}
+        if: ${{ env.CODEBERG_KEY == '' }}
         run: |
           echo "::notice::CODEBERG_MIRROR_ENABLED=true but secrets.CODEBERG_SSH_KEY is empty. Skipping Codeberg mirror. Configure the CODEBERG_SSH_KEY org/repo secret to enable."
 
   mirror-sourcehut:
     timeout-minutes: 20
     runs-on: ${{ inputs.runs-on }}
     if: vars.SOURCEHUT_MIRROR_ENABLED == 'true'
+    # See mirror-gitlab: the `secrets` context is not valid in step `if:`;
+    # hoist to job-level `env` and gate steps on `env.SOURCEHUT_KEY`.
+    env:
+      SOURCEHUT_KEY: ${{ secrets.SOURCEHUT_SSH_KEY }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        if: ${{ secrets.SOURCEHUT_SSH_KEY != '' }}
+        if: ${{ env.SOURCEHUT_KEY != '' }}
         with:
           ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }}
       - name: Mirror to SourceHut
-        if: ${{ secrets.SOURCEHUT_SSH_KEY != '' }}
+        if: ${{ env.SOURCEHUT_KEY != '' }}
         run: |
           ssh-keyscan -t ed25519 git.sr.ht >> ~/.ssh/known_hosts
           git remote add sourcehut git@git.sr.ht:~hyperpolymath/${{ github.event.repository.name }} || true
           git push --force sourcehut main
       - name: Skipped (SOURCEHUT_SSH_KEY not configured)
-        if: ${{ secrets.SOURCEHUT_SSH_KEY == '' }}
+        if: ${{ env.SOURCEHUT_KEY == '' }}
         run: |
           echo "::notice::SOURCEHUT_MIRROR_ENABLED=true but secrets.SOURCEHUT_SSH_KEY is empty. Skipping SourceHut mirror. Configure the SOURCEHUT_SSH_KEY org/repo secret to enable."
 
   mirror-disroot:
     timeout-minutes: 20
     runs-on: ${{ inputs.runs-on }}
     if: vars.DISROOT_MIRROR_ENABLED == 'true'
+    # See mirror-gitlab: the `secrets` context is not valid in step `if:`;
+    # hoist to job-level `env` and gate steps on `env.DISROOT_KEY`.
+    env:
+      DISROOT_KEY: ${{ secrets.DISROOT_SSH_KEY }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        if: ${{ secrets.DISROOT_SSH_KEY != '' }}
+        if: ${{ env.DISROOT_KEY != '' }}
         with:
           ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }}
       - name: Mirror to Disroot
-        if: ${{ secrets.DISROOT_SSH_KEY != '' }}
+        if: ${{ env.DISROOT_KEY != '' }}
         run: |
           ssh-keyscan -t ed25519 git.disroot.org >> ~/.ssh/known_hosts
           git remote add disroot git@git.disroot.org:hyperpolymath/${{ github.event.repository.name }}.git || true
           git push --force disroot main
       - name: Skipped (DISROOT_SSH_KEY not configured)
-        if: ${{ secrets.DISROOT_SSH_KEY == '' }}
+        if: ${{ env.DISROOT_KEY == '' }}
         run: |
           echo "::notice::DISROOT_MIRROR_ENABLED=true but secrets.DISROOT_SSH_KEY is empty. Skipping Disroot mirror. Configure the DISROOT_SSH_KEY org/repo secret to enable."
 
   mirror-gitea:
     timeout-minutes: 20
     runs-on: ${{ inputs.runs-on }}
     if: vars.GITEA_MIRROR_ENABLED == 'true'
+    # See mirror-gitlab: the `secrets` context is not valid in step `if:`;
+    # hoist to job-level `env` and gate steps on `env.GITEA_KEY`.
+    env:
+      GITEA_KEY: ${{ secrets.GITEA_SSH_KEY }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
-        if: ${{ secrets.GITEA_SSH_KEY != '' }}
+        if: ${{ env.GITEA_KEY != '' }}
         with:
           ssh-private-key: ${{ secrets.GITEA_SSH_KEY }}
       - name: Mirror to Gitea
-        if: ${{ secrets.GITEA_SSH_KEY != '' }}
+        if: ${{ env.GITEA_KEY != '' }}
         run: |
           ssh-keyscan -t ed25519 ${{ vars.GITEA_HOST }} >> ~/.ssh/known_hosts
           git remote add gitea git@${{ vars.GITEA_HOST }}:hyperpolymath/${{ github.event.repository.name }}.git || true
           git push --force gitea main
       - name: Skipped (GITEA_SSH_KEY not configured)
-        if: ${{ secrets.GITEA_SSH_KEY == '' }}
+        if: ${{ env.GITEA_KEY == '' }}
         run: |
           echo "::notice::GITEA_MIRROR_ENABLED=true but secrets.GITEA_SSH_KEY is empty. Skipping Gitea mirror. Configure the GITEA_SSH_KEY org/repo secret to enable."
 

.github/workflows/rust-ci-reusable.yml

@@ -19,13 +19,13 @@
 #
 #   jobs:
 #     rust-ci:
-#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
+#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@4762ba66441de05bccb36e074ba3d2202219126a
 #
 # With audit + coverage enabled:
 #
 #   jobs:
 #     rust-ci:
-#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
+#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@4762ba66441de05bccb36e074ba3d2202219126a
 #       with:
 #         enable_audit: true
 #         enable_coverage: true
@@ -34,11 +34,11 @@
 #
 #   jobs:
 #     rust-ci-cli:
-#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
+#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@4762ba66441de05bccb36e074ba3d2202219126a
 #       with:
 #         working_directory: crates/cli
 #     rust-ci-server:
-#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@861b5e911d9e5dcfb3c0ab3dd2a9a3c8fd0a1613
+#       uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@4762ba66441de05bccb36e074ba3d2202219126a
 #       with:
 #         working_directory: crates/server
 #