ci: move tag mirror workflow into .github/workflows

Gitea's workflow discovery scans the first existing directory in ['.gitea/workflows', '.github/workflows'] and ignores the rest, so a .gitea/workflows directory would silently shadow ci.yml and every other workflow on this repo. The mirror workflow now lives next to the others with a server_url guard so it only runs on Gitea.
2026-08-12 01:42:07 +02:00
parent eddbb236fe
commit a852d01b97
1 changed files with 12 additions and 4 deletions
@@ -0,0 +1,95 @@
+name: Mirror release tags to GitHub build bridge
+
+# Gitea is the source of truth for releases, but this instance has no Windows
+# runner (only ubuntu-latest on the homeserver), and Flutter Windows builds
+# require a Windows host. So when a tag is pushed here, this workflow mirrors it
+# to the public GitHub fork yorickr/plezy, whose windows-gitea-release workflow
+# builds the Windows release on GitHub-hosted runners and publishes the
+# artifacts back to this repo's Gitea release for the same tag.
+#
+# This file lives in .github/workflows (not .gitea/workflows) on purpose:
+# Gitea's workflow discovery uses the first existing directory in
+# [".gitea/workflows", ".github/workflows"], so a .gitea/workflows directory
+# would shadow every other workflow in this repo (ci.yml et al.) on Gitea.
+#
+# The write path uses an SSH deploy key (secret RELEASE_PUSH_KEY) that only has
+# access to the fork. ssh.github.com:443 is used because the homeserver
+# demonstrably reaches GitHub over 443, and it avoids depending on outbound 22.
+#
+# The job-level guard keeps this from running on GitHub (the fork would
+# otherwise attempt it on every mirrored tag and fail on the missing secret).
+
+on:
+  push:
+    tags:
+      - "*"
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Tag to mirror to the GitHub build bridge (e.g. 2.13.0)"
+        required: true
+        type: string
+
+jobs:
+  mirror-tag:
+    name: Mirror tag to GitHub
+    if: github.server_url != 'https://github.com'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+
+      - name: Mirror tag to GitHub fork
+        shell: bash
+        env:
+          RELEASE_PUSH_KEY: ${{ secrets.RELEASE_PUSH_KEY }}
+        run: |
+          set -euo pipefail
+
+          if [[ "${{ github.event_name }}" == "push" ]]; then
+            TAG="${GITHUB_REF_NAME}"
+          else
+            TAG="${{ inputs.tag }}"
+          fi
+
+          if [[ -z "${TAG}" ]]; then
+            echo "No tag to mirror" >&2
+            exit 1
+          fi
+          if [[ -z "${RELEASE_PUSH_KEY}" ]]; then
+            echo "Missing RELEASE_PUSH_KEY secret - refusing to mirror" >&2
+            exit 1
+          fi
+
+          # The tag must exist in this repository.
+          git rev-parse --verify "refs/tags/${TAG}" >/dev/null || {
+            echo "Tag ${TAG} not found in this repository" >&2
+            exit 1
+          }
+
+          REMOTE="git@ssh.github.com:yorickr/plezy.git"
+
+          mkdir -p "${HOME}/.ssh"
+          chmod 700 "${HOME}/.ssh"
+          printf '%s\n' "${RELEASE_PUSH_KEY}" > "${HOME}/.ssh/id_ed25519"
+          chmod 600 "${HOME}/.ssh/id_ed25519"
+          # GitHub's published ed25519 host key (ssh.github.com shares it).
+          printf '%s\n' \
+            'github.com,ssh.github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl' \
+            > "${HOME}/.ssh/known_hosts"
+
+          export GIT_SSH_COMMAND="ssh -p 443 -i '${HOME}/.ssh/id_ed25519' -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile='${HOME}/.ssh/known_hosts'"
+
+          # Already mirrored? Nothing to do (previous run may have succeeded,
+          # or the tag was pushed to GitHub directly).
+          if git ls-remote "${REMOTE}" "refs/tags/${TAG}" 2>/dev/null | grep -q .; then
+            echo "Tag ${TAG} already exists on the GitHub build bridge - nothing to do"
+            exit 0
+          fi
+
+          git push "${REMOTE}" "refs/tags/${TAG}:refs/tags/${TAG}"
+          echo "Mirrored tag ${TAG} to the GitHub build bridge"