From 8d816c8860dc26638abf1b1663e422f1a39c6fae Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Fri, 6 Nov 2026 15:19:25 +0000
Subject: [PATCH 1/2] ci: pause three mirrors pending owner configuration

---
 .github/workflows/mirror.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index f84e22c..913a805 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -16,10 +16,11 @@ jobs:
     uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6
     secrets:
       GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }}
-      BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }}
       CODEBERG_SSH_KEY: ${{ secrets.CODEBERG_SSH_KEY }}
-      SOURCEHUT_SSH_KEY: ${{ secrets.SOURCEHUT_SSH_KEY }}
-      DISROOT_SSH_KEY: ${{ secrets.DISROOT_SSH_KEY }}
+      # Owner pause, 2026-11-06: Bitbucket, SourceHut and Disroot are off
+      # pending their approved host/credential configuration. This reusable
+      # skips a target whose key is not passed. Restore each named secret
+      # here only after its configuration is ready; secrets are retained.
       # Gitea is off for now: vars.GITEA_HOST is unset, so the job failed on
       # every push. The reusable skips a forge whose key is not passed; add
       # GITEA_SSH_KEY back here once the host is configured.

From a26a9fa0fec2dc10e466b8a9a1360ccd92965e63 Mon Sep 17 00:00:00 2001
From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com>
Date: Fri, 6 Nov 2026 15:29:31 +0000
Subject: [PATCH 2/2] ci: limit mirror dispatches to the canonical main branch

---
 .github/workflows/mirror.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 913a805..b8159a9 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -13,6 +13,9 @@ permissions:
 
 jobs:
   mirror:
+    # A manual dispatch from a feature branch has no local main ref to push.
+    # Mirror only the canonical branch, as the push trigger already requires.
+    if: github.ref == 'refs/heads/main'
     uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6
     secrets:
       GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }}