Gitea stays the source of truth and push-mirrors this repository to
GitHub. With the org variable BUILD_ON=github (set on both forges), the
jobs in .gitea/workflows/ci.yml skip and .github/workflows/ci.yml does
the same work on GitHub Actions, then reports one commit status back to
Gitea ("github/ci (branch)" or "github/ci (tag)"). A new `github` job in
the Gitea workflow waits for that status and passes or fails with it, so
the Gitea run still carries the real result.
With BUILD_ON unset nothing changes: every GitHub job skips and Gitea
builds as before. That is also the fallback if GitHub is unavailable.
The GitHub-era workflows are replaced by the single ci.yml, which mirrors
the Gitea one job for job. Everything it uses is pinned to a full SHA.
jcoffey-dev