project the tested ref onto the public forge

Fast-forward checked before the push, exact SHA read back after. Gitea is the
only thing that publishes.

.gitea/workflows/ci.yml

@@ -48,3 +48,38 @@ jobs:
 
       - name: test
         run: cargo test --features "test_all_features"
+
+  # The projection. Gitea is the only thing that publishes; the laptop pushes
+  # here and nowhere else. Fast-forward is checked before the push and the
+  # exact SHA is read back afterwards.
+  sync-public:
+    runs-on: ubuntu-latest
+    needs: [check]
+    if: github.ref == 'refs/heads/public'
+    env:
+      PUBLIC_FORGE_TOKEN: ${{ secrets.PUBLIC_FORGE_TOKEN }}
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          fetch-depth: 0
+      - name: Publish and verify exact SHA
+        run: |
+          set -euo pipefail
+          : "${PUBLIC_FORGE_TOKEN:?PUBLIC_FORGE_TOKEN is required}"
+          expected="${GITHUB_SHA}"
+          forge_url='https://forge.caseytunturi.com/Fimeg/smithay.git'
+
+          remote_sha="$(git ls-remote "$forge_url" refs/heads/public | awk '{print $1}')"
+          if [ -n "$remote_sha" ]; then
+            git cat-file -e "${remote_sha}^{commit}" 2>/dev/null || {
+              echo "[publish] remote public SHA is not in tested history" >&2; exit 1; }
+            git merge-base --is-ancestor "$remote_sha" "$expected" || {
+              echo "[publish] refusing non-fast-forward public history" >&2; exit 1; }
+          fi
+
+          auth="$(printf 'publisher-smithay:%s' "$PUBLIC_FORGE_TOKEN" | base64 -w0)"
+          git -c "http.https://forge.caseytunturi.com/.extraheader=Authorization: Basic $auth" \
+            push "$forge_url" public:public
+
+          test "$(git ls-remote "$forge_url" refs/heads/public | awk '{print $1}')" = "$expected"
+          echo "[publish] exact SHA is anonymous on Forgejo: $expected"