From 9617b86a26bb2f6fabdbb082499662a46e21d9a6 Mon Sep 17 00:00:00 2001 From: Jared Knowles Date: Tue, 11 Aug 2026 09:57:14 -0400 Subject: [PATCH] ci: mirror canonical tag objects, not the lightweight refs checkout builds v0.4.0 failed to mirror, and it would have failed at every future release. On a tag-triggered run, checkout materializes refs/tags/ as a LIGHTWEIGHT tag at the commit SHA; the annotated tag object Gitea holds is never fetched. Run 2070 therefore pushed a lightweight v0.4.0 to GitHub and reported success. Run 2076, on main with fetch-depth 0, did fetch the real annotated object and was rejected with "already exists" trying to correct it -- git will not clobber an existing tag. Gitea had e138eeb (annotated), GitHub had d2caa6d (the commit). Re-fetch canonical tag objects from Gitea before pushing. --force rewrites LOCAL tag refs only; it is not a force push and does not weaken the non-force guarantee on main. It is required: without it the fetch is rejected with "would clobber existing tag" and the lightweight ref survives to be mirrored again. Verified against a scratch clone -- lightweight d2caa6d becomes annotated e138eeb, peeling back to the same commit; without --force the tag is unchanged. The GitHub tag was repaired by hand out of band, so the two remotes already agree; this stops it recurring. --- .gitea/workflows/mirror-github.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.gitea/workflows/mirror-github.yml b/.gitea/workflows/mirror-github.yml index 69f3405..d540458 100644 --- a/.gitea/workflows/mirror-github.yml +++ b/.gitea/workflows/mirror-github.yml @@ -39,5 +39,17 @@ jobs: echo "PAT_GH is unset -- add it under Settings > Actions > Secrets." >&2 exit 1 fi + # On a tag-triggered run, checkout materializes refs/tags/ as a + # LIGHTWEIGHT tag at the commit SHA -- the annotated tag object Gitea + # holds is never fetched. Mirroring that strips the annotation, and the + # NEXT run on main (which does fetch the real object) is then rejected + # with "already exists" trying to correct it, because git will not + # clobber an existing tag. That is why v0.4.0 failed to mirror. + # + # Re-fetch canonical tag objects from Gitea first. --force here rewrites + # LOCAL tag refs only; it is not a force push and does not weaken the + # non-force guarantee on main documented above. + git fetch --tags --force origin + git push "https://x-access-token:${PAT_GH}@github.com/civilytics/uscogdata.git" \ HEAD:refs/heads/main --tags