Merge pull request #313 from claude/mirror-token-name
Mirror to GitHub: read the token from MIRROR_TOKEN
cnbrkdmrci authored 2 parents f9be780c244d7ccommit bf456154c8a9c68eefa27fdf5c19a4e30603cb05Browse files
- CI / Typecheck and bundlesuccess
- CI / Unit tests (1/2)success
- CI / Unit tests (2/2)success
- Deploy / Deploy to Cloudflaresuccess
- Deploy / Main's current tipsuccess
- End-to-end / End-to-end (agent reviews, tasks, Today)success
- End-to-end / End-to-end (git, PRs, Actions)success
- End-to-end / End-to-end (large pushes)success
- End-to-end / End-to-end (passkeys, registry, email)success
- End-to-end / End-to-end (real histories)success
- End-to-end / End-to-end (runner Docker)success
- End-to-end / End-to-end (security)success
- Live test / Containers, registry, sandboxes, webhooks, schedules, LFS and pull requestssuccess
- Mirror to GitHub / Push main to the GitHub mirrorsuccess
2 files changed+10−10
modified.github/workflows/mirror-to-github.yml+4−4View file
| @@ -2,7 +2,7 @@ | ||
| 2 | 2 | |
| 3 | 3 | # Keeps the public copy at github.com/codician-team/diffinery in step with main, |
| 4 | 4 | # through the deterministic rewrite in scripts/mirror-to-github.sh. Runs on Diffinery |
| 5 | -# only. Uses GITHUB_MIRROR_TOKEN (a fine-grained GitHub token with Contents and | |
| 5 | +# only. Uses MIRROR_TOKEN (a fine-grained GitHub token with Contents and | |
| 6 | 6 | # Workflows write on that one repository), a secret of the github-mirror environment. |
| 7 | 7 | # That environment is limited to protected branches, so the token also reaches runs |
| 8 | 8 | # after an agent's merge. Without the token the job says so and does nothing. |
| @@ -28,13 +28,13 @@ | ||
| 28 | 28 | environment: github-mirror |
| 29 | 29 | timeout-minutes: 10 |
| 30 | 30 | env: |
| 31 | - GITHUB_MIRROR_TOKEN: ${{ secrets.GITHUB_MIRROR_TOKEN }} | |
| 31 | + MIRROR_TOKEN: ${{ secrets.MIRROR_TOKEN }} | |
| 32 | 32 | steps: |
| 33 | 33 | - name: Check the GitHub token |
| 34 | 34 | id: token |
| 35 | 35 | run: | |
| 36 | - if [ -z "$GITHUB_MIRROR_TOKEN" ]; then | |
| 37 | - echo "::notice::GITHUB_MIRROR_TOKEN is not set, so GitHub is not updated." | |
| 36 | + if [ -z "$MIRROR_TOKEN" ]; then | |
| 37 | + echo "::notice::MIRROR_TOKEN is not set, so GitHub is not updated." | |
| 38 | 38 | echo "skip=true" >> "$GITHUB_OUTPUT" |
| 39 | 39 | fi |
| 40 | 40 | - uses: actions/checkout@v4 |
modifiedscripts/mirror-to-github.sh+6−6View file
| @@ -10,7 +10,7 @@ | ||
| 10 | 10 | # are mirrored. |
| 11 | 11 | # |
| 12 | 12 | # Reads Diffinery with DIFFINERY_TOKEN when set (not needed once the repo is public); |
| 13 | -# MIRROR_SRC can also be a local clone that has main. Pushes with GITHUB_MIRROR_TOKEN | |
| 13 | +# MIRROR_SRC can also be a local clone that has main. Pushes with MIRROR_TOKEN | |
| 14 | 14 | # when set, otherwise with whatever credentials git already has for github.com. |
| 15 | 15 | # Needs git-filter-repo 2.47.0 (pip install git-filter-repo==2.47.0); another |
| 16 | 16 | # version could write different commits. |
| @@ -37,8 +37,8 @@ | ||
| 37 | 37 | # The helper reads the token from the environment, so it never lands on a command line. |
| 38 | 38 | auth=(-c 'credential.https://diffinery.com.helper=!f() { [ "$1" = get ] && printf "username=x-token\npassword=%s\n" "$DIFFINERY_TOKEN"; }; f') |
| 39 | 39 | fi |
| 40 | -if [ -n "${GITHUB_MIRROR_TOKEN:-}" ]; then | |
| 41 | - auth+=(-c 'credential.https://github.com.helper=!f() { [ "$1" = get ] && printf "username=x-access-token\npassword=%s\n" "$GITHUB_MIRROR_TOKEN"; }; f') | |
| 40 | +if [ -n "${MIRROR_TOKEN:-}" ]; then | |
| 41 | + auth+=(-c 'credential.https://github.com.helper=!f() { [ "$1" = get ] && printf "username=x-access-token\npassword=%s\n" "$MIRROR_TOKEN"; }; f') | |
| 42 | 42 | fi |
| 43 | 43 | git "${auth[@]}" clone --quiet --bare --single-branch --branch main "$SRC" "$work/repo.git" |
| 44 | 44 | cd "$work/repo.git" |
| @@ -84,8 +84,8 @@ | ||
| 84 | 84 | done |
| 85 | 85 | |
| 86 | 86 | # Releases on the mirrored tags get the same name, notes and flags on GitHub (assets aren't copied). |
| 87 | -# Needs GITHUB_MIRROR_TOKEN for GitHub's API. | |
| 88 | -if [ -n "${GITHUB_MIRROR_TOKEN:-}" ] && [ ${#mirrored[@]} -gt 0 ]; then | |
| 87 | +# Needs MIRROR_TOKEN for GitHub's API. | |
| 88 | +if [ -n "${MIRROR_TOKEN:-}" ] && [ ${#mirrored[@]} -gt 0 ]; then | |
| 89 | 89 | MIRROR_TAGS="${mirrored[*]}" python3 - <<'PY' |
| 90 | 90 | import json, os, urllib.error, urllib.request |
| 91 | 91 | |
| @@ -107,7 +107,7 @@ | ||
| 107 | 107 | except urllib.error.HTTPError as e: |
| 108 | 108 | return e.code, None |
| 109 | 109 | |
| 110 | -token = os.environ["GITHUB_MIRROR_TOKEN"] | |
| 110 | +token = os.environ["MIRROR_TOKEN"] | |
| 111 | 111 | status, me = call("GET", f"{dst.split('/repos/')[0]}/user", token=token) |
| 112 | 112 | me = me.get("login") if status == 200 else None |
| 113 | 113 | status, releases = call("GET", f"{src}/releases?per_page=100", token=os.environ.get("DIFFINERY_TOKEN")) |