sync-sourceforge-git.yml

name: Sync Git to SourceForge

on:
  push:
    branches: ["main"]
    tags: ["v*"]
  workflow_dispatch:

concurrency:
  group: sf-git-sync
  cancel-in-progress: false

jobs:
  sync:
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    env:
      # Boolean only — never inject the private key into the whole job env.
      HAS_SF_KEY: ${{ secrets.SF_SSH_KEY != '' }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 0
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup SSH for SourceForge Git
        if: env.HAS_SF_KEY == 'true'
        env:
          SF_SSH_KEY: ${{ secrets.SF_SSH_KEY }}
        run: |
          mkdir -p ~/.ssh
          printf '%s\n' "$SF_SSH_KEY" > ~/.ssh/sf_deploy
          chmod 600 ~/.ssh/sf_deploy
          ssh-keyscan -H git.code.sf.net >> ~/.ssh/known_hosts 2>/dev/null

      - name: Push to SourceForge Git Mirror
        if: env.HAS_SF_KEY == 'true'
        env:
          SF_USER: ${{ secrets.SF_USER }}
        run: |
          git remote add sf "ssh://${SF_USER}@git.code.sf.net/p/telcochisel/code" || git remote set-url sf "ssh://${SF_USER}@git.code.sf.net/p/telcochisel/code"
          
          # Force sync all release tags
          GIT_SSH_COMMAND="ssh -i ~/.ssh/sf_deploy -o BatchMode=yes -o StrictHostKeyChecking=accept-new" git push --tags --force sf
          
          # Attempt to push main. A non-fast-forward rejection is an expected
          # SourceForge server protection (denyNonFastForwards), not a CI
          # failure — warn and exit 0 so the mirror job stays green. Tags above
          # still force-sync regardless.
          if ! GIT_SSH_COMMAND="ssh -i ~/.ssh/sf_deploy -o BatchMode=yes -o StrictHostKeyChecking=accept-new" git push --force sf main; then
            echo "::warning::SourceForge rejected non-fast-forward push to 'main' (server-side denyNonFastForwards protection). Tags were still synced."
            echo "::notice::To sync rewritten history, use SourceForge Admin > Code > 'Delete Everything' then re-run this workflow."
            exit 0
          fi
          echo "✓ Successfully synced main branch and tags to SourceForge Git"

      - name: Warn if SF_SSH_KEY is missing
        if: env.HAS_SF_KEY != 'true'
        run: |
          echo "::warning::SF_SSH_KEY secret is absent — SourceForge Git sync skipped"