hlassiege/panoplie · 1f4ebcb

⑂ 1f4ebcb

ci: mirror the repository to github as a read-only copy

hlassiege committed 2026-11-07T19:43:07+01:00 Browse files

1f4ebcb parent: fbe81e1

added .rickub/workflows/mirror-github.yml +49 -0 Viewed

new file mode 100644
@@ -0,0 +1,49 @@
	1	+# Mirrors this repository to GitHub (read-only copy, rickub stays the source of truth).
	2	+# Pushes every branch and tag, removes on GitHub the ones deleted here, and overwrites any
	3	+# divergent history: nothing must ever be pushed to the GitHub copy directly.
	4	+#
	5	+# Setup:
	6	+# - GitHub: create the empty repository hlassiege/panoplie, then add a deploy key with write
	7	+# access (Settings > Deploy keys). Turn off Issues, Wiki, Projects and Discussions, and
	8	+# restrict or disable pull requests.
	9	+# - rickub: store the private half of that deploy key in the secret GH_MIRROR_SSH_KEY.
	10	+name: Mirror to GitHub
	11	+
	12	+on:
	13	+ push:
	14	+ workflow_dispatch:
	15	+
	16	+# Workflow level: rickub ignores job-level concurrency. Runs queue, each one pushes the current state
	17	+concurrency:
	18	+ group: mirror-github
	19	+ cancel-in-progress: false
	20	+
	21	+jobs:
	22	+ mirror:
	23	+ runs-on: ubuntu-latest
	24	+
	25	+ steps:
	26	+ # fetch-depth 0 fetches the full history, every branch (as refs/remotes/origin/*) and every tag
	27	+ - name: Checkout code
	28	+ uses: actions/checkout@v4
	29	+ with:
	30	+ fetch-depth: 0
	31	+ persist-credentials: false
	32	+
	33	+ # GitHub host key pinned rather than fetched with ssh-keyscan
	34	+ - name: Push to GitHub
	35	+ env:
	36	+ SSH_KEY: ${{ secrets.GH_MIRROR_SSH_KEY }}
	37	+ run: \|
	38	+ mkdir -p ~/.ssh
	39	+ printf '%s\n' "$SSH_KEY" > ~/.ssh/mirror_key
	40	+ chmod 600 ~/.ssh/mirror_key
	41	+ echo "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl" > ~/.ssh/known_hosts
	42	+ export GIT_SSH_COMMAND="ssh -i ~/.ssh/mirror_key -o IdentitiesOnly=yes"
	43	+
	44	+ # origin/HEAD would otherwise become a branch named HEAD on GitHub
	45	+ git remote set-head origin --delete 2>/dev/null \|\| true
	46	+
	47	+ git push --force --prune git@github.com:hlassiege/panoplie.git \
	48	+ 'refs/remotes/origin/:refs/heads/' \
	49	+ 'refs/tags/:refs/tags/'

++# Mirrors this repository to GitHub (read-only copy, rickub stays the source of truth).
++# Pushes every branch and tag, removes on GitHub the ones deleted here, and overwrites any
++# divergent history: nothing must ever be pushed to the GitHub copy directly.
++#
++# Setup:
++# - GitHub: create the empty repository hlassiege/panoplie, then add a deploy key with write
++#   access (Settings > Deploy keys). Turn off Issues, Wiki, Projects and Discussions, and
++#   restrict or disable pull requests.
++# - rickub: store the private half of that deploy key in the secret GH_MIRROR_SSH_KEY.
++name: Mirror to GitHub
++
++on:
++  push:
++  workflow_dispatch:
++
++# Workflow level: rickub ignores job-level concurrency. Runs queue, each one pushes the current state
++concurrency:
++  group: mirror-github
++  cancel-in-progress: false
++
++jobs:
++  mirror:
++    runs-on: ubuntu-latest
++
++    steps:
++      # fetch-depth 0 fetches the full history, every branch (as refs/remotes/origin/*) and every tag
++      - name: Checkout code
++        uses: actions/checkout@v4
++        with:
++          fetch-depth: 0
++          persist-credentials: false
++
++      # GitHub host key pinned rather than fetched with ssh-keyscan
++      - name: Push to GitHub
++        env:
++          SSH_KEY: ${{ secrets.GH_MIRROR_SSH_KEY }}
++        run: |
++          mkdir -p ~/.ssh
++          printf '%s\n' "$SSH_KEY" > ~/.ssh/mirror_key
++          chmod 600 ~/.ssh/mirror_key
++          echo "github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl" > ~/.ssh/known_hosts
++          export GIT_SSH_COMMAND="ssh -i ~/.ssh/mirror_key -o IdentitiesOnly=yes"
++
++          # origin/HEAD would otherwise become a branch named HEAD on GitHub
++          git remote set-head origin --delete 2>/dev/null || true
++
++          git push --force --prune git@github.com:hlassiege/panoplie.git \
++            'refs/remotes/origin/*:refs/heads/*' \
++            'refs/tags/*:refs/tags/*'