rickub
hlassiege/darylpublic Fork
⑂ daf316f
Branches
main View all branches → View all tags →
Commits
⬇ Clone ▾
git clone https://git.rickub.com/hlassiege/daryl.git
git clone ssh://git@rickub.com/hlassiege/daryl.git

Host key fingerprint (ed25519): SHA256:iycHnxEyq0Q7uyVpB7JlznP0G7JrTPXLYRcAU5CSLhc — verify it before your first connect.

Download ZIP

ci: mirror the repository to github as a read-only copy

hlassiege committed 2026-11-12T14:05:50+01:00 Browse files
daf316f parent: 6d002a2
added .rickub/workflows/mirror-github.yml +71 -0
new file mode 100644
@@ -0,0 +1,71 @@
1+# Mirrors this repository to GitHub (read-only copy, rickub stays the source of truth).
2+# Pushes every branch and tag, removes on GitHub the ones deleted here, and overwrites any
3+# divergent history: nothing must ever be pushed to the GitHub copy directly.
4+#
5+# Setup:
6+# - GitHub: create the empty repository hlassiege/daryl, then add a deploy key with write
7+# access (Settings > Deploy keys). Turn off Issues, Wiki, Projects and Discussions, and
8+# restrict or disable pull requests.
9+# - rickub: store the private half of that deploy key in the secret GH_MIRROR_SSH_KEY.
10+name: Mirror to GitHub
11+
12+on:
13+ push:
14+ workflow_dispatch:
15+
16+# Workflow level: rickub ignores job-level concurrency. Runs queue, each one pushes the current state
17+concurrency:
18+ group: mirror-github
19+ cancel-in-progress: false
20+
21+jobs:
22+ mirror:
23+ runs-on: ubuntu-latest
24+
25+ steps:
26+ # fetch-depth 0 fetches the full history, every branch (as refs/remotes/origin/*) and every tag
27+ - name: Checkout code
28+ uses: actions/checkout@v4
29+ with:
30+ fetch-depth: 0
31+ persist-credentials: false
32+
33+ # GitHub host key pinned rather than fetched with ssh-keyscan
34+ - name: Push to GitHub
35+ env:
36+ SSH_KEY: ${{ secrets.GH_MIRROR_SSH_KEY }}
37+ shell: bash
38+ run: |
39+ mkdir -p ~/.ssh
40+
41+ # A key pasted from Windows carries CRLF line endings, and some secret stores flatten newlines
42+ # into spaces or literal \n: OpenSSH then fails with "error in libcrypto". Rebuild the PEM layout
43+ key=$(printf '%s' "$SSH_KEY" | tr -d '\r')
44+ key=${key//\\n/$'\n'}
45+ header=$(grep -oE -- '-----BEGIN [A-Z ]+-----' <<< "$key" || true)
46+ if [[ -n $header && $key != *$'\n'* ]]; then
47+ footer=$(grep -oE -- '-----END [A-Z ]+-----' <<< "$key")
48+ body=${key#"$header"}
49+ body=${body%"$footer"}
50+ key=$(printf '%s\n' "$header"; tr ' ' '\n' <<< "$body" | sed '/^$/d'; printf '%s\n' "$footer")
51+ fi
52+ printf '%s\n' "$key" > ~/.ssh/mirror_key
53+ chmod 600 ~/.ssh/mirror_key
54+
55+ # Fail early with a readable diagnosis (header and line count only, never the key itself)
56+ if ! ssh-keygen -y -f ~/.ssh/mirror_key > /dev/null; then
57+ first=$(head -n 1 ~/.ssh/mirror_key)
58+ [[ $first == -----* || $first == ssh-* ]] || first="(neither a PEM header nor a public key)"
59+ echo "GH_MIRROR_SSH_KEY is not a usable private key: $(wc -l < ~/.ssh/mirror_key) lines, first line: ${first:0:40}"
60+ echo "Expected the private key, without passphrase, from -----BEGIN OPENSSH PRIVATE KEY----- to -----END OPENSSH PRIVATE KEY-----"
61+ exit 1
62+ fi
63+ echo "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl" > ~/.ssh/known_hosts
64+ export GIT_SSH_COMMAND="ssh -i ~/.ssh/mirror_key -o IdentitiesOnly=yes"
65+
66+ # origin/HEAD would otherwise become a branch named HEAD on GitHub
67+ git remote set-head origin --delete 2>/dev/null || true
68+
69+ git push --force --prune git@github.com:hlassiege/daryl.git \
70+ 'refs/remotes/origin/*:refs/heads/*' \
71+ 'refs/tags/*:refs/tags/*'
new file mode 100644
@@ -0,0 +1,71 @@
1+# Mirrors this repository to GitHub (read-only copy, rickub stays the source of truth).
2+# Pushes every branch and tag, removes on GitHub the ones deleted here, and overwrites any
3+# divergent history: nothing must ever be pushed to the GitHub copy directly.
4+#
5+# Setup:
6+# - GitHub: create the empty repository hlassiege/daryl, then add a deploy key with write
7+# access (Settings > Deploy keys). Turn off Issues, Wiki, Projects and Discussions, and
8+# restrict or disable pull requests.
9+# - rickub: store the private half of that deploy key in the secret GH_MIRROR_SSH_KEY.
10+name: Mirror to GitHub
11+
12+on:
13+ push:
14+ workflow_dispatch:
15+
16+# Workflow level: rickub ignores job-level concurrency. Runs queue, each one pushes the current state
17+concurrency:
18+ group: mirror-github
19+ cancel-in-progress: false
20+
21+jobs:
22+ mirror:
23+ runs-on: ubuntu-latest
24+
25+ steps:
26+ # fetch-depth 0 fetches the full history, every branch (as refs/remotes/origin/*) and every tag
27+ - name: Checkout code
28+ uses: actions/checkout@v4
29+ with:
30+ fetch-depth: 0
31+ persist-credentials: false
32+
33+ # GitHub host key pinned rather than fetched with ssh-keyscan
34+ - name: Push to GitHub
35+ env:
36+ SSH_KEY: ${{ secrets.GH_MIRROR_SSH_KEY }}
37+ shell: bash
38+ run: |
39+ mkdir -p ~/.ssh
40+
41+ # A key pasted from Windows carries CRLF line endings, and some secret stores flatten newlines
42+ # into spaces or literal \n: OpenSSH then fails with "error in libcrypto". Rebuild the PEM layout
43+ key=$(printf '%s' "$SSH_KEY" | tr -d '\r')
44+ key=${key//\\n/$'\n'}
45+ header=$(grep -oE -- '-----BEGIN [A-Z ]+-----' <<< "$key" || true)
46+ if [[ -n $header && $key != *$'\n'* ]]; then
47+ footer=$(grep -oE -- '-----END [A-Z ]+-----' <<< "$key")
48+ body=${key#"$header"}
49+ body=${body%"$footer"}
50+ key=$(printf '%s\n' "$header"; tr ' ' '\n' <<< "$body" | sed '/^$/d'; printf '%s\n' "$footer")
51+ fi
52+ printf '%s\n' "$key" > ~/.ssh/mirror_key
53+ chmod 600 ~/.ssh/mirror_key
54+
55+ # Fail early with a readable diagnosis (header and line count only, never the key itself)
56+ if ! ssh-keygen -y -f ~/.ssh/mirror_key > /dev/null; then
57+ first=$(head -n 1 ~/.ssh/mirror_key)
58+ [[ $first == -----* || $first == ssh-* ]] || first="(neither a PEM header nor a public key)"
59+ echo "GH_MIRROR_SSH_KEY is not a usable private key: $(wc -l < ~/.ssh/mirror_key) lines, first line: ${first:0:40}"
60+ echo "Expected the private key, without passphrase, from -----BEGIN OPENSSH PRIVATE KEY----- to -----END OPENSSH PRIVATE KEY-----"
61+ exit 1
62+ fi
63+ echo "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl" > ~/.ssh/known_hosts
64+ export GIT_SSH_COMMAND="ssh -i ~/.ssh/mirror_key -o IdentitiesOnly=yes"
65+
66+ # origin/HEAD would otherwise become a branch named HEAD on GitHub
67+ git remote set-head origin --delete 2>/dev/null || true
68+
69+ git push --force --prune git@github.com:hlassiege/daryl.git \
70+ 'refs/remotes/origin/*:refs/heads/*' \
71+ 'refs/tags/*:refs/tags/*'