feat: add Phase 6 — GitHub Push Mirrors

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 15:27:13 -06:00
parent 6e3b4c66d1
commit 058b85e146
3 changed files with 248 additions and 0 deletions
--- a/phase6_github_mirrors.sh
+++ b/phase6_github_mirrors.sh
@@ -0,0 +1,117 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# =============================================================================
+# phase6_github_mirrors.sh — Configure push mirrors from Gitea → GitHub
+# Depends on: Phase 4 complete (repos exist on Gitea primary)
+# For each repo:
+#   1. Create push mirror config (Gitea → GitHub)
+#   2. Trigger initial sync
+#   3. Disable GitHub Actions (since Gitea is now the CI source of truth)
+# Push mirrors ensure GitHub stays as an offsite backup. Every push to Gitea
+# is automatically mirrored to GitHub on commit + on a schedule.
+# Idempotent: skips repos that already have push mirrors configured.
+# =============================================================================
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+source "${SCRIPT_DIR}/lib/common.sh"
+
+load_env
+require_vars GITEA_ADMIN_TOKEN GITEA_INTERNAL_URL GITEA_ORG_NAME \
+             GITHUB_USERNAME GITHUB_MIRROR_TOKEN GITHUB_MIRROR_INTERVAL \
+             REPO_1_NAME REPO_2_NAME REPO_3_NAME
+
+phase_header 6 "GitHub Push Mirrors"
+
+REPOS=("$REPO_1_NAME" "$REPO_2_NAME" "$REPO_3_NAME")
+
+SUCCESS=0
+FAILED=0
+
+for repo in "${REPOS[@]}"; do
+  log_info "--- Processing repo: ${repo} ---"
+
+  # -------------------------------------------------------------------------
+  # Step A: Check if push mirror already exists
+  # The push_mirrors endpoint returns an array — if non-empty, skip.
+  # -------------------------------------------------------------------------
+  log_step "A" "Checking existing push mirrors for ${repo}..."
+  EXISTING_MIRRORS=$(gitea_api GET "/repos/${GITEA_ORG_NAME}/${repo}/push_mirrors" 2>/dev/null || echo "[]")
+  MIRROR_COUNT=$(printf '%s' "$EXISTING_MIRRORS" | jq 'length' 2>/dev/null || echo 0)
+
+  if [[ "$MIRROR_COUNT" -gt 0 ]]; then
+    log_info "Push mirror already configured for ${repo} — skipping"
+    SUCCESS=$((SUCCESS + 1))
+    continue
+  fi
+
+  # -------------------------------------------------------------------------
+  # Step B: Create push mirror
+  # Configures Gitea to push all refs to GitHub on every commit and on a
+  # schedule. Uses a dedicated GitHub PAT (GITHUB_MIRROR_TOKEN) which needs
+  # repo write scope.
+  # -------------------------------------------------------------------------
+  log_step "B" "Creating push mirror for ${repo}..."
+  MIRROR_PAYLOAD=$(jq -n \
+    --arg remote_address "https://github.com/${GITHUB_USERNAME}/${repo}.git" \
+    --arg remote_username "$GITHUB_USERNAME" \
+    --arg remote_password "$GITHUB_MIRROR_TOKEN" \
+    --arg interval "$GITHUB_MIRROR_INTERVAL" \
+    '{
+      remote_address: $remote_address,
+      remote_username: $remote_username,
+      remote_password: $remote_password,
+      interval: $interval,
+      sync_on_commit: true
+    }')
+
+  if gitea_api POST "/repos/${GITEA_ORG_NAME}/${repo}/push_mirrors" "$MIRROR_PAYLOAD" >/dev/null; then
+    log_success "Push mirror created for ${repo}"
+  else
+    log_error "Failed to create push mirror for ${repo}"
+    FAILED=$((FAILED + 1))
+    continue
+  fi
+
+  # -------------------------------------------------------------------------
+  # Step C: Trigger initial sync
+  # Forces an immediate push to GitHub rather than waiting for the interval.
+  # -------------------------------------------------------------------------
+  log_step "C" "Triggering initial sync for ${repo}..."
+  gitea_api POST "/repos/${GITEA_ORG_NAME}/${repo}/push_mirrors-sync" "" >/dev/null 2>&1 || true
+  log_info "Sync triggered (runs async)"
+
+  # -------------------------------------------------------------------------
+  # Step D: Disable GitHub Actions on the source repo
+  # Since Gitea is now the CI source of truth, we disable Actions on GitHub
+  # to prevent duplicate pipeline runs. The GitHub API doesn't have a direct
+  # "disable Actions" toggle, but we can disable it via the repository
+  # settings endpoint if the field is available. If not, log instructions.
+  # -------------------------------------------------------------------------
+  log_step "D" "Disabling GitHub Actions on ${repo}..."
+  DISABLE_RESPONSE=$(github_api PUT "/repos/${GITHUB_USERNAME}/${repo}/actions/permissions" \
+    '{"enabled": false}' 2>/dev/null || echo "FAILED")
+
+  if [[ "$DISABLE_RESPONSE" == "FAILED" ]]; then
+    log_warn "Could not disable GitHub Actions via API for ${repo}"
+    log_warn "  → Manually disable at: https://github.com/${GITHUB_USERNAME}/${repo}/settings/actions"
+  else
+    log_success "GitHub Actions disabled for ${repo}"
+  fi
+
+  SUCCESS=$((SUCCESS + 1))
+done
+
+# ---------------------------------------------------------------------------
+# Summary
+# ---------------------------------------------------------------------------
+printf '\n'
+TOTAL=${#REPOS[@]}
+log_info "Results: ${SUCCESS} succeeded, ${FAILED} failed (out of ${TOTAL})"
+
+if [[ $FAILED -gt 0 ]]; then
+  log_error "Some repos failed — check logs above"
+  exit 1
+fi
+
+log_success "Phase 6 complete — push mirrors configured"