sync-mirror.yml

name: Sync mirror

# One-way backup: Kortexio/ContextMemory (source of truth) -> vitorcastro78/ContextMemory.
# PEER_SYNC_TOKEN must be a PAT with Contents: write on the backup repository.

on:
  push:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  sync:
    if: github.repository == 'Kortexio/ContextMemory'
    runs-on: ubuntu-latest
    env:
      PEER_REPO: vitorcastro78/ContextMemory
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          # Avoid persisting GITHUB_TOKEN in http.*.extraheader — it overrides
          # any PAT embedded in a remote URL and causes 403 as the source org/bot.
          persist-credentials: false

      - name: Mirror to backup
        env:
          PEER_TOKEN: ${{ secrets.PEER_SYNC_TOKEN }}
        run: |
          set -euo pipefail
          if [ -z "${PEER_TOKEN:-}" ]; then
            echo "PEER_SYNC_TOKEN is not set; skipping mirror."
            exit 0
          fi

          STATUS="$(curl -sS -o /dev/null -w '%{http_code}' \
            -H "Authorization: Bearer ${PEER_TOKEN}" \
            -H "Accept: application/vnd.github+json" \
            "https://api.github.com/repos/${PEER_REPO}")"
          if [ "$STATUS" != "200" ]; then
            echo "::error::PEER_SYNC_TOKEN cannot access ${PEER_REPO} (HTTP ${STATUS}). Rotate the secret: fine-grained PAT, Contents: write on ${PEER_REPO}."
            exit 1
          fi

          # Strip any leftover Authorization headers from checkout / runner config.
          git config --local --unset-all "http.https://github.com/.extraheader" || true
          git config --local --unset-all http.extraheader || true

          BASIC="$(printf 'x-access-token:%s' "${PEER_TOKEN}" | base64 -w 0)"
          git config --local "http.https://github.com/.extraheader" "AUTHORIZATION: basic ${BASIC}"

          git remote remove peer 2>/dev/null || true
          git remote add peer "https://github.com/${PEER_REPO}.git"

          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
            git push peer --all
            git push peer --tags
            exit 0
          fi

          if [[ "${{ github.ref }}" == refs/tags/* ]]; then
            git push peer "${{ github.ref }}"
          else
            git push peer "HEAD:${{ github.ref_name }}"
          fi