ci: build on GitHub via the mirror, switchable with BUILD_ON

jcoffey-dev commented

2026-09-30 06:18:15 +00:00

Owner

Gitea stays the source of truth and push-mirrors every commit and tag to the GitHub replica. This lets GitHub Actions do the heavy building (native amd64 and arm64 runners) while Gitea keeps releases, announcements and gating.

The switch is the organization variable BUILD_ON, set on both forges:

BUILD_ON=github: .github/workflows/ci.yml runs on GitHub, publishes to the Gitea registry/releases as before, and posts a github/ci (branch|tag) commit status back. Gitea's build jobs skip; a new github job waits for that status, so this repository's Gitea checks still pass or fail with the real result.
BUILD_ON unset: nothing changes. GitHub's jobs skip and Gitea builds exactly as today. This is also the fallback if GitHub is unavailable.

Merging this is inert until the variable is set.

GitHub-era workflows that would misbehave once mirrored (scheduled releases, GHCR publishing and pruning) are removed, as is any dependabot.yml: every mirror sync deletes branches that exist only on GitHub, so its pull requests could never land.

GitHub organization settings this needs: variables BUILD_ON, REGISTRY, GITEA_URL; secret GITEA_TOKEN (write:repository + write:package); the three pinned docker/* actions allowed.

Gitea stays the source of truth and push-mirrors every commit and tag to the GitHub replica. This lets GitHub Actions do the heavy building (native amd64 and arm64 runners) while Gitea keeps releases, announcements and gating. **The switch** is the organization variable `BUILD_ON`, set on both forges: - `BUILD_ON=github`: `.github/workflows/ci.yml` runs on GitHub, publishes to the Gitea registry/releases as before, and posts a `github/ci (branch|tag)` commit status back. Gitea's build jobs skip; a new `github` job waits for that status, so this repository's Gitea checks still pass or fail with the real result. - `BUILD_ON` unset: nothing changes. GitHub's jobs skip and Gitea builds exactly as today. This is also the fallback if GitHub is unavailable. Merging this is inert until the variable is set. GitHub-era workflows that would misbehave once mirrored (scheduled releases, GHCR publishing and pruning) are removed, as is any `dependabot.yml`: every mirror sync deletes branches that exist only on GitHub, so its pull requests could never land. GitHub organization settings this needs: variables `BUILD_ON`, `REGISTRY`, `GITEA_URL`; secret `GITEA_TOKEN` (write:repository + write:package); the three pinned `docker/*` actions allowed.

jcoffey-dev added 1 commit 2026-09-30 06:18:15 +00:00

ci: build on GitHub from the Gitea push mirror, switched by BUILD_ON

ci / web (pull_request) Successful in 15s

Details

ci / github (pull_request) Skipped

Details

ci / go (pull_request) Successful in 1m18s

Details

ci / publish (pull_request) Skipped

Details

ci / docker-build (pull_request) Successful in 37s

Details

1a416143eb

Gitea stays the source of truth and push-mirrors this repository to
GitHub. With the org variable BUILD_ON=github (set on both forges), the
jobs in .gitea/workflows/ci.yml skip and .github/workflows/ci.yml does
the same work on GitHub Actions, then reports one commit status back to
Gitea ("github/ci (branch)" or "github/ci (tag)"). A new `github` job in
the Gitea workflow waits for that status and passes or fails with it, so
the Gitea run still carries the real result.

With BUILD_ON unset nothing changes: every GitHub job skips and Gitea
builds as before. That is also the fallback if GitHub is unavailable.

The GitHub-era workflows are replaced by the single ci.yml, which mirrors
the Gitea one job for job. Everything it uses is pinned to a full SHA.

jcoffey-dev merged commit 0ba0bef6c0 into main

2026-09-30 06:52:04 +00:00

jcoffey-dev deleted branch ci/build-on-github

2026-09-30 06:52:07 +00:00

ci: build on GitHub via the mirror, switchable with BUILD_ON #8