feat: add Phase 6 — GitHub Push Mirrors
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
S
117
phase6_github_mirrors.sh
Executable file
117
phase6_github_mirrors.sh
Executable file
@@ -0,0 +1,117 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# phase6_github_mirrors.sh — Configure push mirrors from Gitea → GitHub
|
||||||
|
# Depends on: Phase 4 complete (repos exist on Gitea primary)
|
||||||
|
# For each repo:
|
||||||
|
# 1. Create push mirror config (Gitea → GitHub)
|
||||||
|
# 2. Trigger initial sync
|
||||||
|
# 3. Disable GitHub Actions (since Gitea is now the CI source of truth)
|
||||||
|
# Push mirrors ensure GitHub stays as an offsite backup. Every push to Gitea
|
||||||
|
# is automatically mirrored to GitHub on commit + on a schedule.
|
||||||
|
# Idempotent: skips repos that already have push mirrors configured.
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
source "${SCRIPT_DIR}/lib/common.sh"
|
||||||
|
|
||||||
|
load_env
|
||||||
|
require_vars GITEA_ADMIN_TOKEN GITEA_INTERNAL_URL GITEA_ORG_NAME \
|
||||||
|
GITHUB_USERNAME GITHUB_MIRROR_TOKEN GITHUB_MIRROR_INTERVAL \
|
||||||
|
REPO_1_NAME REPO_2_NAME REPO_3_NAME
|
||||||
|
|
||||||
|
phase_header 6 "GitHub Push Mirrors"
|
||||||
|
|
||||||
|
REPOS=("$REPO_1_NAME" "$REPO_2_NAME" "$REPO_3_NAME")
|
||||||
|
|
||||||
|
SUCCESS=0
|
||||||
|
FAILED=0
|
||||||
|
|
||||||
|
for repo in "${REPOS[@]}"; do
|
||||||
|
log_info "--- Processing repo: ${repo} ---"
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
# Step A: Check if push mirror already exists
|
||||||
|
# The push_mirrors endpoint returns an array — if non-empty, skip.
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
log_step "A" "Checking existing push mirrors for ${repo}..."
|
||||||
|
EXISTING_MIRRORS=$(gitea_api GET "/repos/${GITEA_ORG_NAME}/${repo}/push_mirrors" 2>/dev/null || echo "[]")
|
||||||
|
MIRROR_COUNT=$(printf '%s' "$EXISTING_MIRRORS" | jq 'length' 2>/dev/null || echo 0)
|
||||||
|
|
||||||
|
if [[ "$MIRROR_COUNT" -gt 0 ]]; then
|
||||||
|
log_info "Push mirror already configured for ${repo} — skipping"
|
||||||
|
SUCCESS=$((SUCCESS + 1))
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
# Step B: Create push mirror
|
||||||
|
# Configures Gitea to push all refs to GitHub on every commit and on a
|
||||||
|
# schedule. Uses a dedicated GitHub PAT (GITHUB_MIRROR_TOKEN) which needs
|
||||||
|
# repo write scope.
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
log_step "B" "Creating push mirror for ${repo}..."
|
||||||
|
MIRROR_PAYLOAD=$(jq -n \
|
||||||
|
--arg remote_address "https://github.com/${GITHUB_USERNAME}/${repo}.git" \
|
||||||
|
--arg remote_username "$GITHUB_USERNAME" \
|
||||||
|
--arg remote_password "$GITHUB_MIRROR_TOKEN" \
|
||||||
|
--arg interval "$GITHUB_MIRROR_INTERVAL" \
|
||||||
|
'{
|
||||||
|
remote_address: $remote_address,
|
||||||
|
remote_username: $remote_username,
|
||||||
|
remote_password: $remote_password,
|
||||||
|
interval: $interval,
|
||||||
|
sync_on_commit: true
|
||||||
|
}')
|
||||||
|
|
||||||
|
if gitea_api POST "/repos/${GITEA_ORG_NAME}/${repo}/push_mirrors" "$MIRROR_PAYLOAD" >/dev/null; then
|
||||||
|
log_success "Push mirror created for ${repo}"
|
||||||
|
else
|
||||||
|
log_error "Failed to create push mirror for ${repo}"
|
||||||
|
FAILED=$((FAILED + 1))
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
# Step C: Trigger initial sync
|
||||||
|
# Forces an immediate push to GitHub rather than waiting for the interval.
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
log_step "C" "Triggering initial sync for ${repo}..."
|
||||||
|
gitea_api POST "/repos/${GITEA_ORG_NAME}/${repo}/push_mirrors-sync" "" >/dev/null 2>&1 || true
|
||||||
|
log_info "Sync triggered (runs async)"
|
||||||
|
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
# Step D: Disable GitHub Actions on the source repo
|
||||||
|
# Since Gitea is now the CI source of truth, we disable Actions on GitHub
|
||||||
|
# to prevent duplicate pipeline runs. The GitHub API doesn't have a direct
|
||||||
|
# "disable Actions" toggle, but we can disable it via the repository
|
||||||
|
# settings endpoint if the field is available. If not, log instructions.
|
||||||
|
# -------------------------------------------------------------------------
|
||||||
|
log_step "D" "Disabling GitHub Actions on ${repo}..."
|
||||||
|
DISABLE_RESPONSE=$(github_api PUT "/repos/${GITHUB_USERNAME}/${repo}/actions/permissions" \
|
||||||
|
'{"enabled": false}' 2>/dev/null || echo "FAILED")
|
||||||
|
|
||||||
|
if [[ "$DISABLE_RESPONSE" == "FAILED" ]]; then
|
||||||
|
log_warn "Could not disable GitHub Actions via API for ${repo}"
|
||||||
|
log_warn " → Manually disable at: https://github.com/${GITHUB_USERNAME}/${repo}/settings/actions"
|
||||||
|
else
|
||||||
|
log_success "GitHub Actions disabled for ${repo}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
SUCCESS=$((SUCCESS + 1))
|
||||||
|
done
|
||||||
|
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
# Summary
|
||||||
|
# ---------------------------------------------------------------------------
|
||||||
|
printf '\n'
|
||||||
|
TOTAL=${#REPOS[@]}
|
||||||
|
log_info "Results: ${SUCCESS} succeeded, ${FAILED} failed (out of ${TOTAL})"
|
||||||
|
|
||||||
|
if [[ $FAILED -gt 0 ]]; then
|
||||||
|
log_error "Some repos failed — check logs above"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
log_success "Phase 6 complete — push mirrors configured"
|
||||||
79
phase6_post_check.sh
Executable file
79
phase6_post_check.sh
Executable file
@@ -0,0 +1,79 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# phase6_post_check.sh — Verify Phase 6 (GitHub Push Mirrors) succeeded
|
||||||
|
# Checks for each repo:
|
||||||
|
# 1. Push mirror config exists in Gitea
|
||||||
|
# 2. Triggers sync and verifies GitHub has matching latest commit
|
||||||
|
# Exits 0 only if ALL checks pass.
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
source "${SCRIPT_DIR}/lib/common.sh"
|
||||||
|
|
||||||
|
load_env
|
||||||
|
require_vars GITEA_ADMIN_TOKEN GITEA_INTERNAL_URL GITEA_ORG_NAME \
|
||||||
|
GITHUB_USERNAME GITHUB_TOKEN \
|
||||||
|
REPO_1_NAME REPO_2_NAME REPO_3_NAME
|
||||||
|
|
||||||
|
log_info "=== Phase 6 Post-Check ==="
|
||||||
|
|
||||||
|
REPOS=("$REPO_1_NAME" "$REPO_2_NAME" "$REPO_3_NAME")
|
||||||
|
PASS=0
|
||||||
|
FAIL=0
|
||||||
|
|
||||||
|
run_check() {
|
||||||
|
local description="$1"; shift
|
||||||
|
if "$@" 2>/dev/null; then
|
||||||
|
log_success "$description"
|
||||||
|
PASS=$((PASS + 1))
|
||||||
|
else
|
||||||
|
log_error "FAIL: $description"
|
||||||
|
FAIL=$((FAIL + 1))
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
for repo in "${REPOS[@]}"; do
|
||||||
|
log_info "--- Checking repo: ${repo} ---"
|
||||||
|
|
||||||
|
# Check 1: Push mirror exists
|
||||||
|
check_mirror_exists() {
|
||||||
|
local mirrors
|
||||||
|
mirrors=$(gitea_api GET "/repos/${GITEA_ORG_NAME}/$1/push_mirrors")
|
||||||
|
local count
|
||||||
|
count=$(printf '%s' "$mirrors" | jq 'length')
|
||||||
|
[[ "$count" -gt 0 ]]
|
||||||
|
}
|
||||||
|
run_check "Push mirror exists for ${repo}" check_mirror_exists "$repo"
|
||||||
|
|
||||||
|
# Check 2: Latest commit SHA matches between Gitea and GitHub
|
||||||
|
# Trigger a sync first, then compare HEAD commits
|
||||||
|
check_commit_sync() {
|
||||||
|
# Trigger sync
|
||||||
|
gitea_api POST "/repos/${GITEA_ORG_NAME}/$1/push_mirrors-sync" "" >/dev/null 2>&1 || true
|
||||||
|
# Brief wait for sync to propagate
|
||||||
|
sleep 3
|
||||||
|
|
||||||
|
# Get Gitea's latest commit
|
||||||
|
local gitea_sha github_sha
|
||||||
|
gitea_sha=$(gitea_api GET "/repos/${GITEA_ORG_NAME}/$1/commits?limit=1" | jq -r '.[0].sha')
|
||||||
|
# Get GitHub's latest commit
|
||||||
|
github_sha=$(github_api GET "/repos/${GITHUB_USERNAME}/$1/commits?per_page=1" | jq -r '.[0].sha')
|
||||||
|
|
||||||
|
[[ "$gitea_sha" == "$github_sha" ]]
|
||||||
|
}
|
||||||
|
run_check "Latest commit synced to GitHub for ${repo}" check_commit_sync "$repo"
|
||||||
|
done
|
||||||
|
|
||||||
|
# Summary
|
||||||
|
printf '\n'
|
||||||
|
log_info "Results: ${PASS} passed, ${FAIL} failed"
|
||||||
|
|
||||||
|
if [[ $FAIL -gt 0 ]]; then
|
||||||
|
log_error "Phase 6 post-check FAILED"
|
||||||
|
exit 1
|
||||||
|
else
|
||||||
|
log_success "Phase 6 post-check PASSED — push mirrors working"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
52
phase6_teardown.sh
Executable file
52
phase6_teardown.sh
Executable file
@@ -0,0 +1,52 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# phase6_teardown.sh — Remove push mirror config from all repos
|
||||||
|
# For each repo: fetches mirror ID from Gitea, then deletes it.
|
||||||
|
# Re-enables GitHub Actions on the source repos.
|
||||||
|
# Safe to run if mirrors have already been removed.
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
source "${SCRIPT_DIR}/lib/common.sh"
|
||||||
|
|
||||||
|
load_env
|
||||||
|
require_vars GITEA_ADMIN_TOKEN GITEA_INTERNAL_URL GITEA_ORG_NAME \
|
||||||
|
GITHUB_USERNAME GITHUB_TOKEN \
|
||||||
|
REPO_1_NAME REPO_2_NAME REPO_3_NAME
|
||||||
|
|
||||||
|
log_warn "=== Phase 6 Teardown: Push Mirrors ==="
|
||||||
|
|
||||||
|
REPOS=("$REPO_1_NAME" "$REPO_2_NAME" "$REPO_3_NAME")
|
||||||
|
|
||||||
|
printf 'This will remove all push mirror configurations. Continue? [y/N] '
|
||||||
|
read -r confirm
|
||||||
|
if [[ ! "$confirm" =~ ^[Yy]$ ]]; then
|
||||||
|
log_info "Teardown cancelled"
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
for repo in "${REPOS[@]}"; do
|
||||||
|
log_info "--- Processing: ${repo} ---"
|
||||||
|
|
||||||
|
# Get push mirror IDs (there could be multiple, delete all)
|
||||||
|
MIRRORS=$(gitea_api GET "/repos/${GITEA_ORG_NAME}/${repo}/push_mirrors" 2>/dev/null || echo "[]")
|
||||||
|
MIRROR_IDS=$(printf '%s' "$MIRRORS" | jq -r '.[].remote_name' 2>/dev/null || true)
|
||||||
|
|
||||||
|
if [[ -z "$MIRROR_IDS" ]]; then
|
||||||
|
log_info "No push mirrors found for ${repo} — already clean"
|
||||||
|
else
|
||||||
|
for mirror_id in $MIRROR_IDS; do
|
||||||
|
gitea_api DELETE "/repos/${GITEA_ORG_NAME}/${repo}/push_mirrors/${mirror_id}" >/dev/null 2>&1 || true
|
||||||
|
log_success "Removed push mirror '${mirror_id}' from ${repo}"
|
||||||
|
done
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Re-enable GitHub Actions
|
||||||
|
github_api PUT "/repos/${GITHUB_USERNAME}/${repo}/actions/permissions" \
|
||||||
|
'{"enabled": true}' >/dev/null 2>&1 || true
|
||||||
|
log_info "GitHub Actions re-enabled for ${repo}"
|
||||||
|
done
|
||||||
|
|
||||||
|
log_success "Phase 6 teardown complete"
|
||||||
Reference in New Issue
Block a user