fiwdev/Fiw-Gentoo-Dots
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Fiw-Gentoo-Dots/docs/ci.md
fi3w0 ca8c5de013
Some checks are pending
Check and mirror to GitHub / checks (push) Waiting to run
Details
Check and mirror to GitHub / github-mirror (push) Blocked by required conditions
Details
Add Forgejo CI and GitHub mirroring after checks
2026-10-03 23:28:26 +02:00

2.9 KiB
Raw Blame History

CI and GitHub synchronization

Push changes to the primary Forgejo repository. Its .forgejo/workflows/ci.yml runs these checks:

  • Publishable files pass the privacy scanner.
  • The prebuilt TUI matches VERSION, its frontend source and binary checksums.
  • Pinned editor assets match their recorded fingerprints.
  • Python and Go checks pass using temporary homes and fixtures.

Successful push or manual runs then synchronize Git branches and tags to Fi3w0/Fiw-Gentoo-Dots on GitHub. Pull request runs perform checks without mirroring. GitHub's separate workflow runs the same checks on received pushes and pull requests.

The runner uses a Debian container with Python 3.11 and pinned Go 1.26.7. Remote checkout/setup actions use fixed commit IDs. CI checks the installer code without installing Gentoo packages, applying live desktop configs or deploying bootloaders. It verifies the existing release bundle; changing frontend source requires rebuilding and committing its matching bundle.

Forgejo setup

Repository Actions must be enabled and an available runner must match ubuntu-latest. If your runner has another label, set the Forgejo repository Actions variable CI_RUNNER_LABEL to that label. The runner needs Docker to execute the workflow's container jobs. See the Forgejo 10 Actions guide for runner and secret settings used by this instance.

Add the repository Actions secret GH_MIRROR_SSH_KEY with the complete private SSH deploy key registered on the GitHub mirror. The initial key is stored locally at local/ci/github-mirror, outside version control. The corresponding GitHub deploy key is named Forgejo mirror, with write access. GitHub documents deploy key management. The workflow exposes the key only to the mirroring step and uses a temporary mode-600 key file, removed when the process exits. GitHub's Ed25519 host key is pinned in tools/ci/github_known_hosts from its authenticated metadata API.

The Run workflow action retries synchronization after adding a secret or runner. Pushing another commit also triggers it.

Sync behaviour

The mirror fetches the current source repository and checks that the triggering ref still points to the commit reviewed by that CI run. Superseded runs skip publication. Branches and annotated tags keep their original history and IDs. Pushes are atomic and use ordinary fast-forward rules. Divergent GitHub edits cause an error for review. GitHub-only refs and refs deleted at the source are retained. Keep normal development on Forgejo to maintain a consistent mirror.

For an explicit manual sync with the initial local deploy key:

python3 tools/ci/mirror.py --key-file local/ci/github-mirror

The shared check command is:

python3 tools/ci/check.py