GitHub is the source of truth; Gitea (origin) is a just-in-case copy that had
drifted two commits behind. Rather than require a credential on GitHub's side
or convert the repo to a read-only Gitea mirror, wire it into the local
workflow:
- scripts/mirror-gitea.sh — pushes prod + all tags to the Gitea remote
(--branches for every branch). Refuses to push to a GitHub remote, prints
what it did, exits non-zero when the mirror could not be updated.
- scripts/hooks/pre-push — git has no post-push hook, so the mirror runs before
a push that includes prod/main or a tag; skips other remotes, deletions and
its own recursion.
- scripts/hooks/post-merge — refreshes the mirror after `git pull`/merge on
prod, which is how a PR squash-merged on GitHub reaches the mirror.
- scripts/install-git-hooks.sh — one-time per clone; sets
core.hooksPath=scripts/hooks so the hooks stay versioned with the repo.
Mirror failures are warnings: a Gitea outage never blocks a push to GitHub.
AGENTS.md documents the setup plus the GitHub-only release flow.
Verified: script + hooks exercised for the prod/tag case, the feature-branch
skip, the Gitea-remote skip and the recursion guard; the mirror is idempotent
(no-op when already in sync).
