ci: nudge git.hanzo.ai to pull on push #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Sync to git.hanzo.ai | |
| # DIRECTION: this repo on git.hanzo.ai is a PULL MIRROR fetching github.com/hanzoai/authz. | |
| # GitHub is UPSTREAM, git.hanzo.ai is DOWNSTREAM. The giveaway is what this file does: | |
| # mirror-sync tells Gitea to PULL, which only makes sense if GitHub is the source. | |
| # | |
| # This matters beyond labeling: a pull mirror force-updates its refs from upstream on | |
| # every fetch, so anything committed directly on git.hanzo.ai is DISCARDED on the next | |
| # sync. Do not treat the mirror as writable, and do not reword this into a "native on | |
| # git.hanzo.ai" claim — that is the intended end state, not today's. | |
| # | |
| # What IS true: CI/CD runs on git.hanzo.ai — arcd executes .hanzo/workflows/ on the | |
| # Hanzo git-runner. Making git.hanzo.ai canonical means converting the repo | |
| # pull-mirror -> native and flipping the write path; an ops migration, not a config edit. | |
| # | |
| # So this nudge is a LATENCY fix, not a canonicality one: it asks Gitea to pull now | |
| # instead of waiting out the ~10-minute mirror interval, so arcd sees the new commit | |
| # sooner. Without this file the repo still mirrors — just later. | |
| # | |
| # IDEMPOTENT: mirror-sync just tells Gitea to pull HEAD, so N nudges == 1 (same latest | |
| # state); concurrency coalesces a burst of pushes to a single in-flight sync. FAST: no | |
| # checkout, one bounded curl, hard timeouts. FAIL-SOFT: a missing token or hiccup never | |
| # fails the push (the App webhook still mirrors). Set HANZO_GIT_TOKEN to enable the nudge. | |
| on: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| # Only the newest push's sync needs to run — cancel any older in-flight one (it would | |
| # pull a now-stale HEAD). This is what makes rapid pushes idempotent + cheap. | |
| concurrency: | |
| group: sync-git-hanzo-ai | |
| cancel-in-progress: true | |
| jobs: | |
| sync: | |
| # `.github/workflows` is also on Gitea's WORKFLOW_DIRS, so with Actions enabled on | |
| # the mirror this file runs THERE too on every sync — where asking git.hanzo.ai to | |
| # pull is circular. github.server_url is setting.AppURL on Gitea | |
| # (services/actions/context.go:89), so this is the exact test for "am I upstream". | |
| if: ${{ github.server_url == 'https://github.com' }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 2 | |
| steps: | |
| - name: Nudge git.hanzo.ai to pull HEAD (mirror-sync) | |
| continue-on-error: true | |
| env: | |
| HANZO_GIT_TOKEN: ${{ secrets.HANZO_GIT_TOKEN }} | |
| run: | | |
| set -u | |
| if [ -z "${HANZO_GIT_TOKEN:-}" ]; then | |
| echo "HANZO_GIT_TOKEN not set — relying on the mirror App webhook. Skipping nudge." | |
| exit 0 | |
| fi | |
| if curl -fsS --max-time 20 --retry 2 --retry-delay 2 -X POST \ | |
| -H "Authorization: token ${HANZO_GIT_TOKEN}" \ | |
| "https://git.hanzo.ai/api/v1/repos/hanzoai/authz/mirror-sync"; then | |
| echo "git.hanzo.ai mirror-sync triggered" | |
| else | |
| echo "mirror-sync nudge failed (non-fatal) — the App webhook still mirrors" | |
| fi |