name: Mirror to GitHub

on:
  push:
    branches: [master]
    tags: ["*"]
  workflow_dispatch:

# Serialized rather than cancel-in-progress: aborting a push halfway leaves the
# mirror behind whatever triggered the run, and nothing would retry it.
concurrency:
  group: ${{ github.workflow }}

jobs:
  push-to-github:
    runs-on: ubuntu-latest
    if: github.repository == 'coracle/flotilla'

    steps:
      - name: Push master and tags to GitHub
        env:
          GH_MIRROR_TOKEN: ${{ secrets.GH_MIRROR_TOKEN }}
        run: |
          git clone --bare "${{ github.server_url }}/${{ github.repository }}.git" repo.git
          cd repo.git

          # Explicit refspecs rather than --mirror, which pushes everything
          # under refs/ and would fail the whole push: gitea publishes 260-odd
          # refs/pull/* refs, and github rejects that namespace outright
          # ("deny updating a hidden ref"). Force so gitea always wins.
          git push --force --prune \
            "https://x-access-token:$GH_MIRROR_TOKEN@github.com/coracle-social/flotilla.git" \
            'refs/heads/master:refs/heads/master' \
            'refs/tags/*:refs/tags/*'