coilyco-flight-deck/agentic-os

Watch

Activate forgejo->github mirror: provision GITHUB_MIRROR_PAT (dormant fleet-wide) #218

New issue

Closed

opened 2026-06-15 14:31:16 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-06-15 14:31:16 +00:00

Owner

Follow-up from #1 (forgejo-canonical release pipeline).

The release pipeline added in #1 (.forgejo/workflows/release.yml) is live and cuts Forgejo releases on every push to main. The companion .forgejo/workflows/mirror-to-github.yml job (force-push Forgejo main + v* tags to the read-only coilysiren/agentic-os GitHub mirror) is dormant: it no-ops with GITHUB_MIRROR_PAT secret not set; skipping.

This is a fleet-wide pre-existing condition, not specific to agentic-os. ward's identical mirror job also skips - GITHUB_MIRROR_PAT is set nowhere (not org-level on coilyco-flight-deck, not per-repo on ward or agentic-os). The only org-level Actions secret today is CI_RELEASE_TOKEN. So forgejo->github mirroring is currently not happening anywhere via Actions.

Why it has not bitten yet. The fleet's uses: coilysiren/agentic-os/actions/*@main references resolve the composite actions from the GitHub mirror, and that actions/ tree is unchanged by #1, so action resolution still works against whatever state github.com/coilysiren/agentic-os is in. The Forgejo side is canonical and self-sufficient (the release workflow references its own actions locally via uses: ./actions/...).

To activate the mirror (deferred, needs a credential Kai must mint):

Create a GitHub PAT (fine-grained, contents: write) scoped to coilysiren/agentic-os (and the other fleet GitHub mirrors if doing this fleet-wide).
Stash it in SSM (e.g. /github/mirror-pat) and add it to SSM.md.
Set it as the GITHUB_MIRROR_PAT Actions secret - ideally org-level on coilyco-flight-deck so ward / o2r / repo-recall / agentic-os all inherit it and their existing mirror jobs go live at once.

Done when: a push to coilyco-flight-deck/agentic-os main mirrors main + the new v* tag to github.com/coilysiren/agentic-os within the same pipeline run, and the same holds for ward.

Decide org-level vs per-repo. Org-level is one secret for the whole fleet but a single PAT with write to every mirror; per-repo is N secrets but tighter scoping.

**Follow-up from #1** (forgejo-canonical release pipeline). The release pipeline added in #1 (`.forgejo/workflows/release.yml`) is live and cuts Forgejo releases on every push to main. The companion `.forgejo/workflows/mirror-to-github.yml` job (force-push Forgejo `main` + `v*` tags to the read-only `coilysiren/agentic-os` GitHub mirror) is **dormant**: it no-ops with `GITHUB_MIRROR_PAT secret not set; skipping`. **This is a fleet-wide pre-existing condition, not specific to agentic-os.** ward's identical mirror job also skips - `GITHUB_MIRROR_PAT` is set nowhere (not org-level on `coilyco-flight-deck`, not per-repo on ward or agentic-os). The only org-level Actions secret today is `CI_RELEASE_TOKEN`. So forgejo->github mirroring is currently not happening anywhere via Actions. **Why it has not bitten yet.** The fleet's `uses: coilysiren/agentic-os/actions/*@main` references resolve the composite actions from the GitHub mirror, and that `actions/` tree is unchanged by #1, so action resolution still works against whatever state github.com/coilysiren/agentic-os is in. The Forgejo side is canonical and self-sufficient (the release workflow references its own actions locally via `uses: ./actions/...`). **To activate the mirror (deferred, needs a credential Kai must mint):** 1. Create a GitHub PAT (fine-grained, `contents: write`) scoped to `coilysiren/agentic-os` (and the other fleet GitHub mirrors if doing this fleet-wide). 2. Stash it in SSM (e.g. `/github/mirror-pat`) and add it to `SSM.md`. 3. Set it as the `GITHUB_MIRROR_PAT` Actions secret - ideally org-level on `coilyco-flight-deck` so ward / o2r / repo-recall / agentic-os all inherit it and their existing mirror jobs go live at once. **Done when:** a push to `coilyco-flight-deck/agentic-os` main mirrors `main` + the new `v*` tag to `github.com/coilysiren/agentic-os` within the same pipeline run, and the same holds for ward. Decide org-level vs per-repo. Org-level is one secret for the whole fleet but a single PAT with write to every mirror; per-repo is N secrets but tighter scoping.

coilysiren added the

priority

autonomy

async-consult

labels

2026-06-17 07:04:35 +00:00

coilysiren commented

2026-06-18 06:42:11 +00:00

Author

Owner

Goose triage - 2026-06-17

Tier: P4 (score 52) - Low priority backlog item, not urgent
Mode: consult - Needs human to mint credential and approve access

_{Auto-generated by ward exec goose-triage (qwen3-coder:30b), edited in place on each run. Labels are the conclusion; this is the why.}

**Goose triage** - 2026-06-17 - **Tier:** `P4` (score 52) - Low priority backlog item, not urgent - **Mode:** `consult` - Needs human to mint credential and approve access <sub>Auto-generated by `ward exec goose-triage` (qwen3-coder:30b), edited in place on each run. Labels are the conclusion; this is the why.</sub>

coilysiren added

priority

and removed

priority

labels

2026-07-01 04:29:26 +00:00

coilysiren closed this issue

2026-07-06 20:42:45 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/agentic-os#218

No description provided.

Rows
Columns