ci(mirror): the template form, with no push to a forge

.github/workflows/README.adoc

@@ -23,17 +23,22 @@ either loses real function — keep both.
 Rust-secrets check and a shell-secrets check). An inline TruffleHog job was
 removed earlier as redundant with gitleaks; do not add it again.
 
-== Three workflows are self-contained, not reusable callers
+== Four workflows are self-contained, not reusable callers
 
-`hypatia-scan.yml`, `rust-ci.yml` and `scorecard.yml` follow the workflows of
-the estate template (`hyperpolymath/rsr-template-repo`). Earlier each one
+`hypatia-scan.yml`, `rust-ci.yml`, `scorecard.yml` and `mirror.yml` follow the
+workflows of the estate template (`hyperpolymath/rsr-template-repo`). Earlier each one
 called a reusable workflow of the standards repository. Those calls did not
 start: the Actions rule of this repository refuses a reusable workflow of a
-different owner, and each run failed with no job. Each `uses:` in these three
+different owner, and each run failed with no job. Each `uses:` in these four
 files is now a step-level action, pinned to a full commit SHA.
 
-`governance.yml` and `mirror.yml` are still callers of the standards
-repository. They start only when the Actions rule permits that repository.
+`mirror.yml` checks out the full history and prints the commit. It does not
+push to another forge: a forge that mirrors this repository must pull from
+GitHub. No SSH key secret is passed to a workflow.
+
+`governance.yml` is still a caller of the standards repository (owner
+decision, 2026-11-10): the bundle there has 14 jobs, and the template form has
+1. It starts only when the Actions rule permits that repository.
 
 == SAST tools are complementary, not redundant
 

.github/workflows/mirror.yml

@@ -1,28 +1,40 @@
 # SPDX-License-Identifier: MPL-2.0
+#
+# After `mirror.yml` of the estate template (hyperpolymath/rsr-template-repo).
+# The job checks out the full history and prints the commit. It does not push
+# to another forge.
+#
+# The earlier form of this file called the reusable workflow `mirror-reusable.yml` of the
+# standards repository. That call did not start: each run failed with no job.
 name: Mirror to Git Forges
+
 on:
   push:
     branches: [main]
   workflow_dispatch:
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: false
+
 permissions:
   contents: read
+
 jobs:
   mirror:
-    uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7
-    # Only the 7 key secrets that the called workflow declares. `secrets:
-    # inherit` gives every secret of this repository to the called workflow.
-    secrets:
-      GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }}
-      BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }}
-      CODEBERG_SSH_KEY: ${{ secrets.CODEBERG_SSH_KEY }}
-      SOURCEHUT_SSH_KEY: ${{ secrets.SOURCEHUT_SSH_KEY }}
-      DISROOT_SSH_KEY: ${{ secrets.DISROOT_SSH_KEY }}
-      GITEA_SSH_KEY: ${{ secrets.GITEA_SSH_KEY }}
-      RADICLE_KEY: ${{ secrets.RADICLE_KEY }}
+    name: Forge mirror readiness
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
     permissions:
-      actions: read
       contents: read
-      security-events: write
+    steps:
+      - name: Checkout repository with full history
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Verify mirror ref integrity
+        run: |
+          set -euo pipefail
+          echo "Verified commit $(git rev-parse HEAD) (${GITHUB_REF:-HEAD}) ready for downstream forge pull mirrors."