Forgejo Github Mirror

@dataverket/forgejo-github-mirrorv2026.10.05.1· 1d agoWORKFLOWS

01README

One workflow, @dataverket/mirror-forgejo-to-github, that mirrors every repository of a Forgejo org to a GitHub org and keeps it that way. Each run lists the org's repositories, creates the missing ones on GitHub (empty, same name and visibility), gives each a Forgejo push mirror that pushes on every commit and on an interval, points GitHub's default branch at the forge's, and fails when a mirror reports a push error. It never deletes anything on GitHub. Only repositories this run saw take part, so a repository deleted or renamed on the forge is not recreated from an old record; empty, archived, forked and pull-mirror repositories are skipped; and a private repository is never mirrored into a GitHub repository that is not private. The forge, both orgs and both tokens are inputs. A token is named by vault and key, never passed as a value, because workflow inputs are recorded in cleartext in the run history. Built on @dataverket/forgejo and @dataverket/github, both dependencies.

02Workflows1

@dataverket/mirror-forgejo-to-github45608093-5a0d-4c1e-9854-03454fa14d96

Mirror every repository of one Forgejo org to one GitHub org. The forge, both orgs and the vault keys of both tokens are required inputs; the GitHub endpoints default to github.com. Tokens are named by vault and key, never passed as values: input values are recorded in cleartext in the run history. Discovers the org's repositories, ensures each exists under the GitHub org (created empty, same name and visibility), then ensures a Forgejo push mirror (push on every commit plus an interval) that ca

discover

1.repos— Every repository the token sees under the org, one record each.

github

1.ensure-${{ self.repo.attributes.name }}— The repository under the GitHub org, created empty when missing, same name and visibility. Only repositories this run discovered take part, and only those with commits: the forge marks a repository with no commits as empty, and a push mirror of one would push nothing and delete every branch on GitHub, so empty repositories are neither created on GitHub nor mirrored until their first commit lands on the forge.

mirrors

1.mirror-${{ self.repo.attributes.name }}— A push mirror from the forge repository to its GitHub twin, pushing on every commit and on the interval; the token never leaves the vault except to Forgejo. Same rules as above, and one more: a private forge repository is mirrored only when this run saw its GitHub twin as private, so a twin that already existed as public never receives private code (the audit then fails the run).

defaults

1.default-branch-${{ self.repo.attributes.name }}— GitHub's default branch follows the forge's, so a mirror whose default is not main is not rejected for deleting GitHub's. Same repositories as the mirrors job. A repository whose first push has not landed yet has no branches and fails here; the next run converges it, so the failure is allowed.

audit

1.list-mirrors— Every push mirror under the org with its last push and last error.

2.all-mirrors-healthy— Mirrors to other remotes (not the GitHub org) are outside this workflow and not audited here.

3.no-private-repo-on-public-github— A private forge repository whose GitHub twin is not private. The mirrors job skips it, but a mirror made before the forge repository turned private keeps pushing: make the twin private or delete that mirror.

03Previous Versions1

2026.09.30.1Sep 30, 2026