chadtmiller.com/knotless
git that lives in your Atmosphere account
1
10
The workflows guide shows how to mirror a repository to another git host
docs/guide/workflows.md+45−0
| @@ -201,6 +201,51 @@ Pulls get no secrets. The runner replaces each secret's value with `***` in | ||
the public log, but a step can still leak one transformed, encoded or a | ||
little at a time. | ||
| ||
## Mirror to another git host | ||
| ||
Git is what knotless shares with every other forge, so a workflow can keep | ||
a copy of a repository on one, such as [Tangled](https://tangled.org). Each | ||
push to the repository then pushes the same ref there. The step has a clone | ||
of the repository, its history included, at the commit pushed. | ||
| ||
First make the repository on the other host, and give it a deploy key: an | ||
SSH key made for this alone, its public half added to your account there. | ||
Then give the private half to the runners, for the refs to mirror: | ||
| ||
```sh | ||
ssh-keygen -t ed25519 -N '' -C mirror -f mirror | ||
knotless secret knotless://alice.example.com/my-project set MIRROR_KEY \ | ||
--ref 'refs/heads/*' --ref 'refs/tags/*' < mirror | ||
``` | ||
| ||
And add the workflow, with the SSH address the other host's repository page | ||
shows: | ||
| ||
```yaml | ||
# .knotless/workflows/mirror.yml | ||
on: | ||
push: {refs: [refs/heads/*, refs/tags/*]} | ||
image: debian:stable-slim | ||
secrets: [MIRROR_KEY] | ||
env: {MIRROR: git@knot.example.com:alice.example.com/my-project} | ||
steps: | ||
- name: mirror | ||
run: | | ||
apt-get update -qq && apt-get install -qq -y git openssh-client >/dev/null | ||
printf '%s\n' "$MIRROR_KEY" > /tmp/key && chmod 600 /tmp/key | ||
git config --global --add safe.directory /work | ||
GIT_SSH_COMMAND='ssh -i /tmp/key -o StrictHostKeyChecking=accept-new' \ | ||
git push "$MIRROR" "+$KNOTLESS_RUN_SHA:$KNOTLESS_RUN_REF" | ||
``` | ||
| ||
The `+` makes the mirror follow the repository even where history was | ||
rewritten. A branch or tag deleted here stays on the mirror until deleted | ||
there. `accept-new` trusts the host's key on first sight. To pin it, put | ||
the host's line from `ssh-keyscan` in the workflow instead. | ||
| ||
Only the code is mirrored. Pulls, issues and stars stay on the forge they | ||
were written on. | ||
| ||
## Run pulls and the merge queue | ||
| ||
Start the runner with `--pulls` to run open pulls too. A pull runs at its | ||