Mirror main to GitHub and publish images to GHCR #14

2026-10-15T16:47:45-07:00

dejima-agent commented

2026-10-15 16:47:45 -07:00

Summary generated by LLM agent

Publishes Dotcom Arcade to a read-only mirror at github.com/branderson/dotcom-arcade, following dejima's mirror/ setup, and builds images on GHCR.

mirror/github-mirror.sh, a single-repository version of dejima's script, publishes the forge's main plus one commit that adds a read-only notice under the README title. It also publishes the tags on main. Every forge SHA is kept, and each sync fast-forwards. --dry-run and --transform work as in dejima. --settings turns off issues, PRs, projects, wiki and discussions, but leaves Actions on, since Actions builds the images.
mirror/dotcom-arcade-github-mirror.{service,timer} is an hourly user timer. Setup is in the service header: copy the script to ~/.local/bin, write ~/.config/dotcom-arcade/github-mirror.env, and use a deploy key behind an ssh Host alias.
.github/workflows/images.yml builds the same three images, with the same tags, to ghcr.io/<owner>/ using GITHUB_TOKEN. Gitea ignores .github/workflows while .gitea/workflows exists, so the forge's builds are unchanged.
In the docs:
- prebuilt images now point at ghcr.io/branderson/;
- there's a new docs/08-development/github-mirror.md;
- CONTRIBUTING.md drops upstream's fork, issue and PR instructions, which wouldn't work against a read-only mirror;
- .dejima.md notes that the mirror runs only on the host.
scripts/upstream-status.sh now fetches with --no-tags, so upstream's v1.0.x tags can't end up in a clone and clash with Dotcom Arcade's own versions.

After merging and installing the timer:

Run github-mirror.sh --dry-run, then let the first sync run.
Run github-mirror.sh --settings.
Set each of the three GHCR packages to public after their first build.

Testing:

The script passes shellcheck.
A dry run against this repository built the mirror commit and pushed nothing.
The transform is idempotent, and stops on a README with no title or a symlinked README.
The dejima git guard blocks pushes even to a local bare repo, so the real push, and running a second sync with nothing to do, are untested here. The first run on the host will show them.
The workflow YAML parses. It hasn't run on GitHub yet.

History check: everything that goes public with the mirror, since its history is the forge's. The private IPs and paths in history all come from upstream commits that are already public. Our own commits carry Reviewed-on: https://gitbox.branderson.io/... trailers, which the dejima mirror already publishes, and one commit message names the flashbox VM. Rewriting history to remove them would change every SHA on the forge, so I've left both alone.

**Summary generated by LLM agent** Publishes Dotcom Arcade to a read-only mirror at github.com/branderson/dotcom-arcade, following dejima's `mirror/` setup, and builds images on GHCR. - `mirror/github-mirror.sh`, a single-repository version of dejima's script, publishes the forge's `main` plus one commit that adds a read-only notice under the README title. It also publishes the tags on `main`. Every forge SHA is kept, and each sync fast-forwards. `--dry-run` and `--transform` work as in dejima. `--settings` turns off issues, PRs, projects, wiki and discussions, but leaves Actions on, since Actions builds the images. - `mirror/dotcom-arcade-github-mirror.{service,timer}` is an hourly user timer. Setup is in the service header: copy the script to `~/.local/bin`, write `~/.config/dotcom-arcade/github-mirror.env`, and use a deploy key behind an ssh Host alias. - `.github/workflows/images.yml` builds the same three images, with the same tags, to `ghcr.io/<owner>/` using `GITHUB_TOKEN`. Gitea ignores `.github/workflows` while `.gitea/workflows` exists, so the forge's builds are unchanged. - In the docs: - prebuilt images now point at `ghcr.io/branderson/`; - there's a new `docs/08-development/github-mirror.md`; - `CONTRIBUTING.md` drops upstream's fork, issue and PR instructions, which wouldn't work against a read-only mirror; - `.dejima.md` notes that the mirror runs only on the host. - `scripts/upstream-status.sh` now fetches with `--no-tags`, so upstream's `v1.0.x` tags can't end up in a clone and clash with Dotcom Arcade's own versions. After merging and installing the timer: 1. Run `github-mirror.sh --dry-run`, then let the first sync run. 2. Run `github-mirror.sh --settings`. 3. Set each of the three GHCR packages to public after their first build. Testing: - The script passes shellcheck. - A dry run against this repository built the mirror commit and pushed nothing. - The transform is idempotent, and stops on a README with no title or a symlinked README. - The dejima git guard blocks pushes even to a local bare repo, so the real push, and running a second sync with nothing to do, are untested here. The first run on the host will show them. - The workflow YAML parses. It hasn't run on GitHub yet. History check: everything that goes public with the mirror, since its history is the forge's. The private IPs and paths in history all come from upstream commits that are already public. Our own commits carry `Reviewed-on: https://gitbox.branderson.io/...` trailers, which the dejima mirror already publishes, and one commit message names the flashbox VM. Rewriting history to remove them would change every SHA on the forge, so I've left both alone.

dejima-agent added 1 commit 2026-10-15 16:47:46 -07:00

feat: mirror main to GitHub and publish images to GHCR 2d1d8cce46

mirror/github-mirror.sh publishes main and its tags to a read-only
GitHub mirror, adding a notice under the README title, with a systemd
timer to run it hourly. A GitHub Actions workflow builds the images on
the mirror and pushes them to ghcr.io. The docs point prebuilt images
there, and CONTRIBUTING no longer invites issues and pull requests.

upstream-status.sh now fetches without tags, so upstream's version tags
stay out of local clones.

branderson approved these changes 2026-10-15 17:00:54 -07:00

branderson merged commit a2d899be6f into main

2026-10-15 17:00:59 -07:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: branderson/dotcom-arcade#14