ci: build on GitHub via the mirror, switchable with BUILD_ON #10

Merged

jcoffey-dev merged 1 commits from ci/build-on-github into main 2026-09-30 06:51:56 +00:00

Conversation 0 Commits 1 Files Changed 7

+255 -321

jcoffey-dev commented 2026-09-30 06:18:17 +00:00

Owner

Copy link

Copy source

Gitea stays the source of truth and push-mirrors every commit and tag to the GitHub replica. This lets GitHub Actions do the heavy building (native amd64 and arm64 runners) while Gitea keeps releases, announcements and gating.

The switch is the organization variable BUILD_ON, set on both forges:

• BUILD_ON=github: .github/workflows/ci.yml runs on GitHub, publishes to the Gitea registry/releases as before, and posts a github/ci (branch|tag) commit status back. Gitea's build jobs skip; a new github job waits for that status, so this repository's Gitea checks still pass or fail with the real result.
• BUILD_ON unset: nothing changes. GitHub's jobs skip and Gitea builds exactly as today. This is also the fallback if GitHub is unavailable.

Merging this is inert until the variable is set.

GitHub-era workflows that would misbehave once mirrored (scheduled releases, GHCR publishing and pruning) are removed, as is any dependabot.yml: every mirror sync deletes branches that exist only on GitHub, so its pull requests could never land.

GitHub organization settings this needs: variables BUILD_ON, REGISTRY, GITEA_URL; secret GITEA_TOKEN (write:repository + write:package); the three pinned docker/* actions allowed.

Gitea stays the source of truth and push-mirrors every commit and tag to the GitHub replica. This lets GitHub Actions do the heavy building (native amd64 and arm64 runners) while Gitea keeps releases, announcements and gating. **The switch** is the organization variable `BUILD_ON`, set on both forges: - `BUILD_ON=github`: `.github/workflows/ci.yml` runs on GitHub, publishes to the Gitea registry/releases as before, and posts a `github/ci (branch|tag)` commit status back. Gitea's build jobs skip; a new `github` job waits for that status, so this repository's Gitea checks still pass or fail with the real result. - `BUILD_ON` unset: nothing changes. GitHub's jobs skip and Gitea builds exactly as today. This is also the fallback if GitHub is unavailable. Merging this is inert until the variable is set. GitHub-era workflows that would misbehave once mirrored (scheduled releases, GHCR publishing and pruning) are removed, as is any `dependabot.yml`: every mirror sync deletes branches that exist only on GitHub, so its pull requests could never land. GitHub organization settings this needs: variables `BUILD_ON`, `REGISTRY`, `GITEA_URL`; secret `GITEA_TOKEN` (write:repository + write:package); the three pinned `docker/*` actions allowed.

jcoffey-dev added 1 commit 2026-09-30 06:18:17 +00:00

ci: build on GitHub from the Gitea push mirror, switched by BUILD_ON ... e80b6d48ce

Gitea stays the source of truth and push-mirrors this repository to
GitHub. With the org variable BUILD_ON=github (set on both forges), the
jobs in .gitea/workflows/ci.yml skip and .github/workflows/ci.yml does
the same work on GitHub Actions, then reports one commit status back to
Gitea ("github/ci (branch)" or "github/ci (tag)"). A new `github` job in
the Gitea workflow waits for that status and passes or fails with it, so
the Gitea run still carries the real result.

With BUILD_ON unset nothing changes: every GitHub job skips and Gitea
builds as before. That is also the fallback if GitHub is unavailable.

The GitHub-era workflows are replaced by the single ci.yml, which mirrors
the Gitea one job for job. Everything it uses is pinned to a full SHA.

.github/dependabot.yml is removed: Dependabot would open its pull
requests on the GitHub replica, where every mirror sync prunes the
branches it pushes.

jcoffey-dev merged commit 45154663c5 into main 2026-09-30 06:51:56 +00:00

jcoffey-dev deleted branch ci/build-on-github 2026-09-30 06:51:58 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something isn't working

dependencies

Dependency updates

documentation

Docs, README or site copy

duplicate

Already tracked elsewhere

enhancement

New feature or improvement

good first issue

Good for newcomers

help wanted

Contributions welcome

invalid

Not a valid issue

needs info

Waiting on the reporter for details

question

Needs an answer, not a code change

security

Security issue or hardening

translation

New language or translation fixes

wontfix

Will not be worked on

priority

p1

High priority

priority

p2

Medium priority

priority

p3

Low priority

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

jcoffey-dev (John Coffey)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: coffey-labs/cairnobs#10