plezy/.github/workflows/mirror-tags-to-github.yml

name: Mirror release tags to GitHub build bridge

# Gitea is the source of truth for releases, but this instance has no Windows
# runner (only ubuntu-latest on the homeserver), and Flutter Windows builds
# require a Windows host. So when a tag is pushed here, this workflow mirrors it
# to the public GitHub fork yorickr/plezy, whose windows-gitea-release workflow
# builds the Windows release on GitHub-hosted runners and publishes the
# artifacts back to this repo's Gitea release for the same tag.
#
# This file lives in .github/workflows (not .gitea/workflows) on purpose:
# Gitea's workflow discovery uses the first existing directory in
# [".gitea/workflows", ".github/workflows"], so a .gitea/workflows directory
# would shadow every other workflow in this repo (ci.yml et al.) on Gitea.
#
# The write path uses an SSH deploy key (secret RELEASE_PUSH_KEY) that only has
# access to the fork. ssh.github.com:443 is used because the homeserver
# demonstrably reaches GitHub over 443, and it avoids depending on outbound 22.
#
# The job-level guard keeps this from running on GitHub (the fork would
# otherwise attempt it on every mirrored tag and fail on the missing secret).

on:
  push:
    tags:
      - "*"
  workflow_dispatch:
    inputs:
      tag:
        description: "Tag to mirror to the GitHub build bridge (e.g. 2.13.0)"
        required: true
        type: string

jobs:
  mirror-tag:
    name: Mirror tag to GitHub
    if: github.server_url != 'https://github.com'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0

      - name: Mirror tag to GitHub fork
        shell: bash
        env:
          RELEASE_PUSH_KEY: ${{ secrets.RELEASE_PUSH_KEY }}
        run: |
          set -euo pipefail

          if [[ "${{ github.event_name }}" == "push" ]]; then
            TAG="${GITHUB_REF_NAME}"
          else
            TAG="${{ inputs.tag }}"
          fi

          if [[ -z "${TAG}" ]]; then
            echo "No tag to mirror" >&2
            exit 1
          fi
          if [[ -z "${RELEASE_PUSH_KEY}" ]]; then
            echo "Missing RELEASE_PUSH_KEY secret - refusing to mirror" >&2
            exit 1
          fi

          # The tag must exist in this repository.
          git rev-parse --verify "refs/tags/${TAG}" >/dev/null || {
            echo "Tag ${TAG} not found in this repository" >&2
            exit 1
          }

          REMOTE="git@ssh.github.com:yorickr/plezy.git"

          mkdir -p "${HOME}/.ssh"
          chmod 700 "${HOME}/.ssh"
          printf '%s\n' "${RELEASE_PUSH_KEY}" > "${HOME}/.ssh/id_ed25519"
          chmod 600 "${HOME}/.ssh/id_ed25519"
          # GitHub's published ed25519 host key (ssh.github.com shares it).
          printf '%s\n' \
            'github.com,ssh.github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl' \
            > "${HOME}/.ssh/known_hosts"

          export GIT_SSH_COMMAND="ssh -p 443 -i '${HOME}/.ssh/id_ed25519' -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile='${HOME}/.ssh/known_hosts'"

          # Already mirrored? Nothing to do (previous run may have succeeded,
          # or the tag was pushed to GitHub directly).
          if git ls-remote "${REMOTE}" "refs/tags/${TAG}" 2>/dev/null | grep -q .; then
            echo "Tag ${TAG} already exists on the GitHub build bridge - nothing to do"
            exit 0
          fi

          git push "${REMOTE}" "refs/tags/${TAG}:refs/tags/${TAG}"
          echo "Mirrored tag ${TAG} to the GitHub build bridge"