From c1ee5f4cebc69663cddd570e3fad40df43965059 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 10 Nov 2026 21:32:33 +0000 Subject: [PATCH] ci(mirror): the template form, with no push to a forge mirror.yml called the reusable mirror workflow of the standards repository with 7 SSH key secrets. The Actions rule of this repository refuses that call, so the mirror did not start. The file is now the workflow of the estate template (hyperpolymath/rsr-template-repo at 0dfde85), as in system-et: the job checks out the full history and prints the commit. It does not push to a forge, and no secret is passed to it. A forge that mirrors this repository must pull from GitHub. Owner decision of 2026-11-10. README.adoc (workflows): the section on self-contained workflows names 4 files, and says that governance.yml stays a caller (owner decision: the bundle has 14 jobs, the template form has 1). Co-Authored-By: Claude Claude-Session: https://claude.ai/code/session_0136P7ZmiFSCoB3UR9Kk56rK --- .github/workflows/README.adoc | 17 ++++++++++------ .github/workflows/mirror.yml | 38 +++++++++++++++++++++++------------ 2 files changed, 36 insertions(+), 19 deletions(-) diff --git a/.github/workflows/README.adoc b/.github/workflows/README.adoc index 92e39f1..37ee39b 100644 --- a/.github/workflows/README.adoc +++ b/.github/workflows/README.adoc @@ -23,17 +23,22 @@ either loses real function — keep both. Rust-secrets check and a shell-secrets check). An inline TruffleHog job was removed earlier as redundant with gitleaks; do not add it again. -== Three workflows are self-contained, not reusable callers +== Four workflows are self-contained, not reusable callers -`hypatia-scan.yml`, `rust-ci.yml` and `scorecard.yml` follow the workflows of -the estate template (`hyperpolymath/rsr-template-repo`). Earlier each one +`hypatia-scan.yml`, `rust-ci.yml`, `scorecard.yml` and `mirror.yml` follow the +workflows of the estate template (`hyperpolymath/rsr-template-repo`). Earlier each one called a reusable workflow of the standards repository. Those calls did not start: the Actions rule of this repository refuses a reusable workflow of a -different owner, and each run failed with no job. Each `uses:` in these three +different owner, and each run failed with no job. Each `uses:` in these four files is now a step-level action, pinned to a full commit SHA. -`governance.yml` and `mirror.yml` are still callers of the standards -repository. They start only when the Actions rule permits that repository. +`mirror.yml` checks out the full history and prints the commit. It does not +push to another forge: a forge that mirrors this repository must pull from +GitHub. No SSH key secret is passed to a workflow. + +`governance.yml` is still a caller of the standards repository (owner +decision, 2026-11-10): the bundle there has 14 jobs, and the template form has +1. It starts only when the Actions rule permits that repository. == SAST tools are complementary, not redundant diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml index 4d0fec3..0869cf6 100644 --- a/.github/workflows/mirror.yml +++ b/.github/workflows/mirror.yml @@ -1,28 +1,40 @@ # SPDX-License-Identifier: MPL-2.0 +# +# After `mirror.yml` of the estate template (hyperpolymath/rsr-template-repo). +# The job checks out the full history and prints the commit. It does not push +# to another forge. +# +# The earlier form of this file called the reusable workflow `mirror-reusable.yml` of the +# standards repository. That call did not start: each run failed with no job. name: Mirror to Git Forges + on: push: branches: [main] workflow_dispatch: + concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: false + permissions: contents: read + jobs: mirror: - uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 - # Only the 7 key secrets that the called workflow declares. `secrets: - # inherit` gives every secret of this repository to the called workflow. - secrets: - GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }} - BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }} - CODEBERG_SSH_KEY: ${{ secrets.CODEBERG_SSH_KEY }} - SOURCEHUT_SSH_KEY: ${{ secrets.SOURCEHUT_SSH_KEY }} - DISROOT_SSH_KEY: ${{ secrets.DISROOT_SSH_KEY }} - GITEA_SSH_KEY: ${{ secrets.GITEA_SSH_KEY }} - RADICLE_KEY: ${{ secrets.RADICLE_KEY }} + name: Forge mirror readiness + runs-on: ubuntu-24.04 + timeout-minutes: 10 permissions: - actions: read contents: read - security-events: write + steps: + - name: Checkout repository with full history + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 0 + persist-credentials: false + + - name: Verify mirror ref integrity + run: | + set -euo pipefail + echo "Verified commit $(git rev-parse HEAD) (${GITHUB_REF:-HEAD}) ready for downstream forge pull mirrors."