Mirror to GitHub: read the token from MIRROR_TOKEN

Secret names starting with GITHUB_ are reserved, as on GitHub, so the
github-mirror environment can't hold GITHUB_MIRROR_TOKEN.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0111z4cdbfHSp6ssggDFN2Nb

Claude authored 5 hours agosigned1 parent f9be780commit c244d7c186b756ff94a06bbd1b9a817554b9ea5dBrowse files

CI / Typecheck and bundlesuccess
CI / Unit tests (1/2)success
CI / Unit tests (2/2)success
End-to-end / End-to-end (agent reviews, tasks, Today)success
End-to-end / End-to-end (git, PRs, Actions)success
End-to-end / End-to-end (large pushes)success
End-to-end / End-to-end (passkeys, registry, email)success
End-to-end / End-to-end (real histories)success
End-to-end / End-to-end (runner Docker)success
End-to-end / End-to-end (security)success

2 files changed+10−10

modified.github/workflows/mirror-to-github.yml+4−4View file

modifiedscripts/mirror-to-github.sh+6−6View file

		@@ -2,7 +2,7 @@
2	2
3	3	# Keeps the public copy at github.com/codician-team/diffinery in step with main,
4	4	# through the deterministic rewrite in scripts/mirror-to-github.sh. Runs on Diffinery
5		-# only. Uses GITHUB_MIRROR_TOKEN (a fine-grained GitHub token with Contents and
	5	+# only. Uses MIRROR_TOKEN (a fine-grained GitHub token with Contents and
6	6	# Workflows write on that one repository), a secret of the github-mirror environment.
7	7	# That environment is limited to protected branches, so the token also reaches runs
8	8	# after an agent's merge. Without the token the job says so and does nothing.
		@@ -28,13 +28,13 @@
28	28	environment: github-mirror
29	29	timeout-minutes: 10
30	30	env:
31		- GITHUB_MIRROR_TOKEN: ${{ secrets.GITHUB_MIRROR_TOKEN }}
	31	+ MIRROR_TOKEN: ${{ secrets.MIRROR_TOKEN }}
32	32	steps:
33	33	- name: Check the GitHub token
34	34	id: token
35	35	run: \|
36		- if [ -z "$GITHUB_MIRROR_TOKEN" ]; then
37		- echo "::notice::GITHUB_MIRROR_TOKEN is not set, so GitHub is not updated."
	36	+ if [ -z "$MIRROR_TOKEN" ]; then
	37	+ echo "::notice::MIRROR_TOKEN is not set, so GitHub is not updated."
38	38	echo "skip=true" >> "$GITHUB_OUTPUT"
39	39	fi
40	40	- uses: actions/checkout@v4

		@@ -10,7 +10,7 @@
10	10	# are mirrored.
11	11	#
12	12	# Reads Diffinery with DIFFINERY_TOKEN when set (not needed once the repo is public);
13		-# MIRROR_SRC can also be a local clone that has main. Pushes with GITHUB_MIRROR_TOKEN
	13	+# MIRROR_SRC can also be a local clone that has main. Pushes with MIRROR_TOKEN
14	14	# when set, otherwise with whatever credentials git already has for github.com.
15	15	# Needs git-filter-repo 2.47.0 (pip install git-filter-repo==2.47.0); another
16	16	# version could write different commits.
		@@ -37,8 +37,8 @@
37	37	# The helper reads the token from the environment, so it never lands on a command line.
38	38	auth=(-c 'credential.https://diffinery.com.helper=!f() { [ "$1" = get ] && printf "username=x-token\npassword=%s\n" "$DIFFINERY_TOKEN"; }; f')
39	39	fi
40		-if [ -n "${GITHUB_MIRROR_TOKEN:-}" ]; then
41		- auth+=(-c 'credential.https://github.com.helper=!f() { [ "$1" = get ] && printf "username=x-access-token\npassword=%s\n" "$GITHUB_MIRROR_TOKEN"; }; f')
	40	+if [ -n "${MIRROR_TOKEN:-}" ]; then
	41	+ auth+=(-c 'credential.https://github.com.helper=!f() { [ "$1" = get ] && printf "username=x-access-token\npassword=%s\n" "$MIRROR_TOKEN"; }; f')
42	42	fi
43	43	git "${auth[@]}" clone --quiet --bare --single-branch --branch main "$SRC" "$work/repo.git"
44	44	cd "$work/repo.git"
		@@ -84,8 +84,8 @@
84	84	done
85	85
86	86	# Releases on the mirrored tags get the same name, notes and flags on GitHub (assets aren't copied).
87		-# Needs GITHUB_MIRROR_TOKEN for GitHub's API.
88		-if [ -n "${GITHUB_MIRROR_TOKEN:-}" ] && [ ${#mirrored[@]} -gt 0 ]; then
	87	+# Needs MIRROR_TOKEN for GitHub's API.
	88	+if [ -n "${MIRROR_TOKEN:-}" ] && [ ${#mirrored[@]} -gt 0 ]; then
89	89	MIRROR_TAGS="${mirrored[*]}" python3 - <<'PY'
90	90	import json, os, urllib.error, urllib.request
91	91
		@@ -107,7 +107,7 @@
107	107	except urllib.error.HTTPError as e:
108	108	return e.code, None
109	109
110		-token = os.environ["GITHUB_MIRROR_TOKEN"]
	110	+token = os.environ["MIRROR_TOKEN"]
111	111	status, me = call("GET", f"{dst.split('/repos/')[0]}/user", token=token)
112	112	me = me.get("login") if status == 200 else None
113	113	status, releases = call("GET", f"{src}/releases?per_page=100", token=os.environ.get("DIFFINERY_TOKEN"))

codician/diffinerypublic

Mirror to GitHub: read the token from MIRROR_TOKEN