name: Mirror to Gitfor

on:
  push:
    branches: [main]
    tags: ["v*"]

concurrency:
  group: mirror-gitfor
  cancel-in-progress: false

permissions:
  contents: read

jobs:
  mirror:
    runs-on: ubuntu-latest
    # GITFOR_TOKEN lives in this environment, not in repository secrets, so
    # the deployment rules on it (restrict to main and v* tags) decide who
    # can reach it.
    environment: mirror
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Push to Gitfor
        env:
          GITFOR_TOKEN: ${{ secrets.GITFOR_TOKEN }}
        run: |
          git push --force \
            "https://ncx:${GITFOR_TOKEN}@gitfor.dev/amandoti/cindermail.git" \
            "refs/remotes/origin/main:refs/heads/main" \
            "refs/tags/*:refs/tags/*"