From 4bbe976e7ad2abf6dfef310b00308fe3513119ee Mon Sep 17 00:00:00 2001
From: Breadway <plasticbread849@gmail.com>
Date: Fri, 3 Jul 2026 13:55:13 +0800
Subject: [PATCH] CI: migrate release workflow from GitHub Actions to Forgejo
 Actions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

GitHub Actions self-hosted runners require per-repo registration on a
personal (non-org) account — every new bakery repo needed a manually
provisioned runner on hestia, which nobody had noticed was broken
until this session. Forgejo Actions' runner already serves every repo
with zero registration. Moves release.yml there (dl.breadway.dev is
the primary bakery fetch target either way; GitHub release upload is
kept as the fallback path, now via an explicit token since Forgejo
Actions has no ambient GITHUB_TOKEN), and adds a mirror workflow to
keep GitHub in sync automatically instead of manual dual-remote pushes.
---
 .forgejo/workflows/mirror.yml  | 19 ++++++++++++
 .forgejo/workflows/release.yml | 53 +++++++++++++++++++++++++++++++++
 .github/workflows/release.yml  | 54 ----------------------------------
 3 files changed, 72 insertions(+), 54 deletions(-)
 create mode 100644 .forgejo/workflows/mirror.yml
 create mode 100644 .forgejo/workflows/release.yml
 delete mode 100644 .github/workflows/release.yml

diff --git a/.forgejo/workflows/mirror.yml b/.forgejo/workflows/mirror.yml
new file mode 100644
index 0000000..7603cc8
--- /dev/null
+++ b/.forgejo/workflows/mirror.yml
@@ -0,0 +1,19 @@
+name: Mirror to GitHub
+
+on:
+  push:
+    branches: ['**']
+    tags: ['**']
+
+jobs:
+  mirror:
+    runs-on: [self-hosted, hestia]
+    steps:
+      - name: Mirror to GitHub
+        run: |
+          set -euo pipefail
+          git clone --mirror "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" repo.git
+          cd repo.git
+          git push --prune \
+            "https://x-access-token:${{ secrets.MIRROR_TOKEN }}@github.com/Breadway/breadmon.git" \
+            '+refs/heads/*:refs/heads/*' '+refs/tags/*:refs/tags/*'
diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
new file mode 100644
index 0000000..7903d69
--- /dev/null
+++ b/.forgejo/workflows/release.yml
@@ -0,0 +1,53 @@
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  build:
+    runs-on: [self-hosted, hestia]
+    steps:
+      - name: checkout
+        run: |
+          set -euo pipefail
+          rm -rf src && mkdir src
+          git clone --branch "${GITHUB_REF_NAME}" --depth 1 \
+            "https://git.breadway.dev/${GITHUB_REPOSITORY}.git" src
+
+      - name: build
+        run: cd src && cargo build --release --locked
+
+      - name: prepare artifacts
+        run: |
+          set -euo pipefail
+          VERSION="${GITHUB_REF_NAME#v}"
+          PKG_DIR="/srv/breadway-dl/breadmon/${VERSION}"
+          mkdir -p "${PKG_DIR}"
+          cp "src/target/release/breadmon" "${PKG_DIR}/breadmon-x86_64"
+          strip "${PKG_DIR}/breadmon-x86_64"
+          sha256sum "${PKG_DIR}/breadmon-x86_64" | awk '{print $1}' \
+            > "${PKG_DIR}/breadmon-x86_64.sha256"
+          cp src/bakery.toml "${PKG_DIR}/bakery.toml"
+          ln -sfn "${VERSION}" "/srv/breadway-dl/breadmon/latest"
+
+      - name: regenerate index.json
+        run: |
+          set -euo pipefail
+          rm -rf /tmp/bread-ecosystem-ci
+          git clone https://git.breadway.dev/Breadway/bread-ecosystem.git /tmp/bread-ecosystem-ci
+          bash /tmp/bread-ecosystem-ci/scripts/gen-index.sh
+
+      - name: upload to GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GH_RELEASE_TOKEN }}
+        run: |
+          set -euo pipefail
+          VERSION="${GITHUB_REF_NAME#v}"
+          PKG_DIR="/srv/breadway-dl/breadmon/${VERSION}"
+          gh release create "${GITHUB_REF_NAME}" --repo Breadway/breadmon \
+            --title "breadmon v${VERSION}" --generate-notes 2>/dev/null || true
+          gh release upload "${GITHUB_REF_NAME}" --repo Breadway/breadmon \
+            "${PKG_DIR}/breadmon-x86_64" \
+            "${PKG_DIR}/breadmon-x86_64.sha256" \
+            --clobber
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
deleted file mode 100644
index e3bc6ee..0000000
--- a/.github/workflows/release.yml
+++ /dev/null
@@ -1,54 +0,0 @@
-name: release
-
-on:
-  push:
-    tags: ["v*"]
-
-permissions:
-  contents: write
-
-env:
-  DL_DIR: /srv/breadway-dl
-  ECOSYSTEM_DIR: /tmp/bread-ecosystem-ci
-
-jobs:
-  build:
-    runs-on: [self-hosted, hestia]
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: build
-        run: cargo build --release --locked
-
-      - name: prepare artifacts
-        run: |
-          VERSION="${GITHUB_REF_NAME#v}"
-          PKG_DIR="${DL_DIR}/breadmon/${VERSION}"
-          mkdir -p "${PKG_DIR}"
-          cp "target/release/breadmon" "${PKG_DIR}/breadmon-x86_64"
-          strip "${PKG_DIR}/breadmon-x86_64"
-          sha256sum "${PKG_DIR}/breadmon-x86_64" | awk '{print $1}' \
-            > "${PKG_DIR}/breadmon-x86_64.sha256"
-          cp bakery.toml "${PKG_DIR}/bakery.toml"
-          ln -sfn "${VERSION}" "${DL_DIR}/breadmon/latest"
-
-      - name: ensure bread-ecosystem
-        run: |
-          rm -rf "${ECOSYSTEM_DIR}"
-          git clone https://github.com/Breadway/bread-ecosystem.git "${ECOSYSTEM_DIR}"
-
-      - name: regenerate index.json
-        run: bash "${ECOSYSTEM_DIR}/scripts/gen-index.sh"
-
-      - name: upload to GitHub Release
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          VERSION="${GITHUB_REF_NAME#v}"
-          PKG_DIR="${DL_DIR}/breadmon/${VERSION}"
-          gh release create "${GITHUB_REF_NAME}" \
-            --title "breadmon v${VERSION}" --generate-notes 2>/dev/null || true
-          gh release upload "${GITHUB_REF_NAME}" \
-            "${PKG_DIR}/breadmon-x86_64" \
-            "${PKG_DIR}/breadmon-x86_64.sha256" \
-            --clobber