ci: sync-codeberg job — auto-push public to codeberg when CI passes

.gitea/workflows/ci.yml

@@ -186,3 +186,23 @@ jobs:
             exit 1
           fi
           echo "All action refs are SHA-pinned."
+
+  # Push public to Codeberg when all checks pass — nightly mirror.
+  # Requires CODECBERG_TOKEN secret in the repo settings.
+  sync-codeberg:
+    runs-on: ubuntu-latest
+    needs: [go-vet, go-test, rust-test, cross-compile, web-build, installer-integrity, no-ai-attribution, action-pins]
+    if: github.ref == 'refs/heads/public'
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+      - name: Push public to Codeberg
+        run: |
+          if [ -z "${{ secrets.CODECBERG_TOKEN }}" ]; then
+            echo "[INFO] [sync] CODECBERG_TOKEN not set — skipping codeberg push"
+            exit 0
+          fi
+          git remote add codeberg-ci "https://${{ secrets.CODECBERG_TOKEN }}@codeberg.org/Fimeg/RedFlag.git"
+          git push codeberg-ci public:public
+          echo "Pushed public to codeberg.org/Fimeg/RedFlag"