Repository navigation
shadowwhisperer.updated #35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Mirror to Framagit (SSH) | |
| on: | |
| push: | |
| branches: | |
| - '**' | |
| repository_dispatch: | |
| types: [shadowwhisperer.updated] | |
| env: | |
| FRAMAGIT_SSH: git@framagit.org:my-privacy-dns/matrix.git | |
| jobs: | |
| mirror: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Validate repository secrets & access | |
| run: | | |
| set -euo pipefail | |
| if [ -z "${{ secrets.FRAMAGIT_SSH_KEY}}" ]; then | |
| echo "ERROR: FRAMAGIT_SSH_KEY is not set." >&2 | |
| exit 1 | |
| else | |
| echo "SSH_KEY is present." | |
| fi | |
| - name: Set up SSH for Framagit | |
| run: | | |
| set -euo pipefail | |
| mkdir -p "$HOME/.ssh" | |
| chmod 700 "$HOME/.ssh" | |
| # Write private key from secret and secure it | |
| printf '%s\n' "${{ secrets.FRAMAGIT_SSH_KEY }}" > "$HOME/.ssh/id_rsa" | |
| chmod 600 "$HOME/.ssh/id_rsa" | |
| # Populate known_hosts (scan framagit.org). You can replace with a pinned key instead. | |
| ssh-keyscan -t rsa framagit.org >> "$HOME/.ssh/known_hosts" 2>/dev/null || true | |
| chmod 644 "$HOME/.ssh/known_hosts" | |
| # Prevent asking about host key during CI (we still added known_hosts) | |
| echo "SSH configured. Key and known_hosts created." | |
| - name: Lightweight read check (SSH) | |
| run: | | |
| set -euo pipefail | |
| if ! git ls-remote --exit-code "${FRAMAGIT_SSH}" HEAD >/dev/null 2>&1; then | |
| echo "ERROR: git ls-remote failed — check FRAMAGIT_SSH and SSH key." >&2 | |
| exit 1 | |
| else | |
| echo "git ls-remote succeeded — read access OK." | |
| fi | |
| - name: Test push permission with dry-run (SSH) | |
| run: | | |
| set -euo pipefail | |
| if [ ! git push --dry-run "${FRAMAGIT_SSH}" "HEAD:refs/heads/ci-connection-test" >/dev/null 2>&1 ]; then | |
| echo "ERROR: Test: Push permission failed — SSH key may be missing or keys not allowed." >&2 | |
| exit 1 | |
| else | |
| echo "Push permission test succeeded — write access OK." | |
| fi | |
| - name: Checkout repository (full history) | |
| uses: actions/checkout@main | |
| with: | |
| fetch-depth: 0 | |
| - name: Mirror to framagit (SSH) | |
| run: | | |
| set -euo pipefail | |
| echo "Ensuring framagit remote points to $FRAMAGIT_SSH" | |
| git remote remove framagit || true | |
| git remote add framagit "${FRAMAGIT_SSH}" | |
| git push --prune framagit 'refs/heads/*:refs/heads/*' 'refs/tags/*:refs/tags/*' | |
| echo "Remote list:" | |
| git remote -v | |
| echo "Performing dry-run push (no changes made)" | |
| git push --prune --mirror framagit --dry-run | |
| echo "Performing actual mirror push" | |
| git push --prune --mirror framagit |