Release 5/11: Gitea Actions mirror workflow (non-force push) #45

New Issue

2026-08-08T18:43:40-04:00

jared commented

2026-08-08 18:43:40 -04:00

Depends on #44 (mirror repo exists).

Sync Gitea → GitHub without --force, so a divergence fails loudly in CI instead of silently overwriting.

Why not Gitea's built-in push mirror

A push mirror force-updates the refs it owns. If anyone ever clicks Merge on a GitHub PR, the next sync overwrites main, the PR still displays "Merged", the commit becomes unreachable, and nothing anywhere says so. A plain git push is rejected as non-fast-forward the moment that happens — turning a silent data-loss trap into a red CI run in a place you already look.

The workflow

.gitea/workflows/mirror-github.yml:

name: Mirror to GitHub
on:
  push:
    branches: [main]
    tags: ['v*']
jobs:
  mirror:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - run: |
          git push https://x-access-token:${{ secrets.GITHUB_MIRROR_PAT }}@github.com/civilytics/uscogdata.git \
            main --tags     # no --force, on purpose

Setup

GitHub → Settings → Developer settings → PAT with repo scope on civilytics/uscogdata.
Gitea → repo Settings → Actions → Secrets → add GITHUB_MIRROR_PAT.

Do NOT add GitHub branch protection

Protection rules that block force-pushes also block the mirror's legitimate pushes. It breaks normal syncing to catch an abnormal case; the non-force push above already gets you the loud failure.

Done when

Secret added
Workflow committed and a push to main lands on GitHub

Depends on #44 (mirror repo exists). Sync Gitea → GitHub **without `--force`**, so a divergence fails loudly in CI instead of silently overwriting. ## Why not Gitea's built-in push mirror A push mirror force-updates the refs it owns. If anyone ever clicks **Merge** on a GitHub PR, the next sync overwrites `main`, the PR still displays "Merged", the commit becomes unreachable, and **nothing anywhere says so**. A plain `git push` is rejected as non-fast-forward the moment that happens — turning a silent data-loss trap into a red CI run in a place you already look. ## The workflow `.gitea/workflows/mirror-github.yml`: ```yaml name: Mirror to GitHub on: push: branches: [main] tags: ['v*'] jobs: mirror: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 with: { fetch-depth: 0 } - run: | git push https://x-access-token:${{ secrets.GITHUB_MIRROR_PAT }}@github.com/civilytics/uscogdata.git \ main --tags # no --force, on purpose ``` ## Setup 1. GitHub → Settings → Developer settings → PAT with `repo` scope on `civilytics/uscogdata`. 2. Gitea → repo Settings → Actions → Secrets → add `GITHUB_MIRROR_PAT`. ## Do NOT add GitHub branch protection Protection rules that block force-pushes also block the mirror's legitimate pushes. It breaks normal syncing to catch an abnormal case; the non-force push above already gets you the loud failure. ## Done when - [ ] Secret added - [ ] Workflow committed and a push to `main` lands on GitHub

~~jared referenced this issue 2026-08-08 18:43:41 -04:00~~

Release 7/11: tag v0.4.0 and register with r-universe #47

jared changed title from ~~Release 4/11: Gitea Actions mirror workflow (non-force push)~~ to Release 5/11: Gitea Actions mirror workflow (non-force push)

2026-08-08 18:44:09 -04:00

jared referenced this issue

2026-08-08 20:21:20 -04:00

ci: mirror main and tags to the GitHub mirror #54

jared commented

2026-08-09 09:20:27 -04:00