sync-gitcode.yml

name: Sync to GitCode

on:
  push:
    branches: [main]
  workflow_dispatch: {}
  workflow_call:
    inputs:
      release_tag:
        required: true
        type: string
      source_sha:
        required: true
        type: string
    secrets:
      GITCODE_TOKEN:
        required: true

concurrency:
  group: gitcode-sync-${{ github.ref }}
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  sync:
    if: github.repository_owner == 'codewhale-hq' && (github.event_name != 'push' || vars.GITCODE_MIRROR == 'enabled')
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          fetch-depth: 0
          ref: ${{ inputs.source_sha || github.sha }}

      - name: Push to GitCode
        env:
          GITCODE_TOKEN: ${{ secrets.GITCODE_TOKEN }}
          GITCODE_USER: ${{ vars.GITCODE_USERNAME || 'HunterBown' }}
          GITCODE_REPO: ${{ vars.GITCODE_REPOSITORY || 'HunterBown/Codewhale' }}
          RELEASE_TAG: ${{ inputs.release_tag }}
          SOURCE_SHA: ${{ inputs.source_sha || github.sha }}
        shell: bash
        run: |
          set -euo pipefail

          if [ -z "${GITCODE_TOKEN:-}" ]; then
            echo "::error::GITCODE_TOKEN secret is not set; cannot push to GitCode." >&2
            exit 1
          fi

          ENCODED_USER="$(printf '%s' "${GITCODE_USER}" | python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.stdin.read(), safe=""))')"
          ENCODED_TOKEN="$(printf '%s' "${GITCODE_TOKEN}" | python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.stdin.read(), safe=""))')"
          git remote add gitcode "https://${ENCODED_USER}:${ENCODED_TOKEN}@gitcode.com/${GITCODE_REPO}.git"

          if [[ -n "${RELEASE_TAG}" ]]; then
            if ! [[ "${RELEASE_TAG}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] ||
                [[ "$(git rev-parse 'HEAD^{commit}')" != "${SOURCE_SHA}" ]]; then
              echo "::error::GitCode release source does not match the frozen tag input." >&2
              exit 1
            fi
            ./scripts/release/verify-remote-tag.sh \
              "https://github.com/${GITHUB_REPOSITORY}.git" "${RELEASE_TAG}" "${SOURCE_SHA}"
            scripts/release/mirror-push.sh gitcode "tag ${RELEASE_TAG}" "refs/tags/${RELEASE_TAG}:refs/tags/${RELEASE_TAG}"
          elif [[ "${GITHUB_REF}" != refs/heads/main ]]; then
            echo "::error::GitCode mirrors main only; dispatch this workflow from main." >&2
            exit 1
          elif [[ "${GITHUB_EVENT_NAME}" == workflow_dispatch ]]; then
            scripts/release/mirror-push.sh gitcode "main" HEAD:refs/heads/main --force
            scripts/release/mirror-push.sh gitcode "release tags" "refs/tags/v*:refs/tags/v*"
          else
            scripts/release/mirror-push.sh gitcode "main" HEAD:refs/heads/main --force
          fi