souveraine/.gitea/workflows/publish.yml

name: publish

# The public branch is an output. Nothing here builds or tests the product --
# `ci.yml` on `primary` did that against the source this projection was
# constructed from. This workflow only carries an already-constructed,
# already-gated candidate to the forge that is allowed to serve it, and proves
# the forge serves exactly that.
#
# It lives on the public branch because that is where the push lands, and it is
# deliberately the only workflow that does: `ci.yml` stays internal because it
# names internal build hosts.

on:
  push:
    branches: [public]
  workflow_dispatch:

jobs:
  # The gate travels with the tree it judges. A candidate that reaches this
  # branch has already passed on the source side; running it again here means
  # the thing actually being published is the thing that was actually checked,
  # rather than something that resembled it an hour ago.
  public-surface:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0
      - name: Gate the published tree
        run: |
          set -euo pipefail
          if [ ! -f .publication/surface_gate.py ]; then
            echo "::error::the public tree carries no gate; refusing to publish it"
            exit 1
          fi
          # The manifest is private -- its redaction table quotes what it
          # removes -- so the published tree is checked against the rules the
          # gate carries, with no exception list available to excuse anything.
          python3 - <<'PY' > /tmp/bare-manifest.json
          import json
          json.dump({
              "schema_version": 1,
              "repository": "Fimeg/souveraine",
              "public_roots": [], "public_root_files": [],
              "review_required": [], "forbidden": [], "forbidden_classes": [],
              "exceptions": [{"path": ".publication/*", "rule": r,
                              "reason": "the gate names the patterns it refuses",
                              "reviewed": "2026-09-04"}
                             for r in ("internal-host", "internal-email", "rfc1918",
                                       "home-path", "bearer-token", "ai-attribution")],
          }, open("/dev/stdout", "w"))
          PY
          python3 .publication/surface_gate.py \
            --repo . --sha "$GITHUB_SHA" \
            --manifest /tmp/bare-manifest.json \
            --out /tmp/published-surface.md || true
          cat /tmp/published-surface.md
          # Tree shape is empty in the bare manifest, so only content, history
          # and file-class findings can deny here. Those are the ones that must
          # never reach a public forge.
          if grep -E '^\| deny \|' /tmp/published-surface.md | grep -vq 'unclassified-root'; then
            echo "::error::published tree carries content or history findings"
            exit 1
          fi
          echo "published tree carries no content or history findings"

  publish-forge:
    runs-on: ubuntu-latest
    needs: [public-surface]
    env:
      PUBLIC_FORGE_TOKEN: ${{ secrets.PUBLIC_FORGE_TOKEN }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0
      - name: Publish and verify exact SHA
        run: |
          set -euo pipefail
          : "${PUBLIC_FORGE_TOKEN:?PUBLIC_FORGE_TOKEN is required}"
          expected="${GITHUB_SHA}"
          forge_url='https://forge.caseytunturi.com/Fimeg/souveraine.git'

          # Ordinary publication is fast-forward only. .publication/EPOCH may
          # authorise exactly one replacement, and only of the SHA it names, so
          # the authorisation is spent the moment it is used.
          lease=""
          remote_sha="$(git ls-remote "$forge_url" refs/heads/public | awk '{print $1}')"
          if [ -n "$remote_sha" ]; then
            if git cat-file -e "${remote_sha}^{commit}" 2>/dev/null &&
               git merge-base --is-ancestor "$remote_sha" "$expected"; then
              :
            else
              authorised="$(awk '$1 == "replaces" { print $2 }' .publication/EPOCH 2>/dev/null || true)"
              if [ -n "$authorised" ] && [ "$authorised" = "$remote_sha" ]; then
                echo "[publish] epoch authorised to replace $remote_sha"
                lease="$remote_sha"
              else
                echo "[publish] refusing non-fast-forward public history" >&2
                echo "[publish] remote is $remote_sha; EPOCH authorises ${authorised:-nothing}" >&2
                exit 1
              fi
            fi
          fi

          auth="$(printf 'publisher-souveraine:%s' "$PUBLIC_FORGE_TOKEN" | base64 -w0)"
          if [ -n "$lease" ]; then
            git -c "http.https://forge.caseytunturi.com/.extraheader=Authorization: Basic $auth" \
              push --force-with-lease="refs/heads/public:$lease" "$forge_url" HEAD:public
          else
            git -c "http.https://forge.caseytunturi.com/.extraheader=Authorization: Basic $auth" \
              push "$forge_url" HEAD:public
          fi

          forge_sha="$(git ls-remote "$forge_url" refs/heads/public | awk '{print $1}')"
          test "$forge_sha" = "$expected"
          git fetch --force --no-tags "$forge_url" \
            refs/heads/public:refs/remotes/public-forge/public
          test "$(git rev-parse refs/remotes/public-forge/public)" = "$forge_sha"
          echo "[publish] Forgejo anonymously serves exact published SHA: $forge_sha"

  # Downstreams reproduce the anonymously fetched Forgejo ref. A missing
  # credential or a divergent history is a visible degraded mirror, never a
  # failure of the canonical publication.
  mirror-downstreams:
    runs-on: ubuntu-latest
    needs: [publish-forge]
    env:
      CODEBERG_TOKEN: ${{ secrets.CODEBERG_TOKEN }}
      MIRROR_GITHUB_TOKEN: ${{ secrets.MIRROR_GITHUB_TOKEN }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0
      - name: Mirror downstreams from Forgejo
        run: |
          set -euo pipefail
          expected="${GITHUB_SHA}"
          forge_url='https://forge.caseytunturi.com/Fimeg/souveraine.git'
          forge_sha="$(git ls-remote "$forge_url" refs/heads/public | awk '{print $1}')"
          test "$forge_sha" = "$expected"
          git fetch --force --no-tags "$forge_url" \
            refs/heads/public:refs/remotes/public-forge/public
          test "$(git rev-parse refs/remotes/public-forge/public)" = "$forge_sha"

          mirror_downstream() {
            label="$1"; url="$2"; host="$3"; user="$4"; token="$5"

            if [ -z "$token" ]; then
              echo "::warning::[mirror] $label credential absent; Forgejo is published, $label is degraded"
              return 0
            fi
            if ! remote_sha="$(git ls-remote "$url" refs/heads/public | awk '{print $1}')"; then
              echo "::warning::[mirror] cannot read $label public ref; Forgejo remains authoritative"
              return 0
            fi

            lease=""
            if [ -n "$remote_sha" ]; then
              if ! git fetch --force --no-tags "$url" \
                "refs/heads/public:refs/remotes/mirror-check/$label"; then
                echo "::warning::[mirror] cannot fetch $label public ref; leaving it unchanged"
                return 0
              fi
              if ! git merge-base --is-ancestor "$remote_sha" "$forge_sha"; then
                authorised="$(awk '$1 == "replaces" { print $2 }' .publication/EPOCH 2>/dev/null || true)"
                if [ -n "$authorised" ] && [ "$authorised" = "$remote_sha" ]; then
                  echo "[mirror] $label follows the authorised epoch from $remote_sha"
                  lease="$remote_sha"
                else
                  echo "::warning::[mirror] refusing non-fast-forward $label history; explicit alignment required"
                  return 0
                fi
              fi
            fi

            auth="$(printf '%s:%s' "$user" "$token" | base64 -w0)"
            if [ -n "$lease" ]; then
              if ! git -c "http.https://$host/.extraheader=Authorization: Basic $auth" \
                push --force-with-lease="refs/heads/public:$lease" \
                "$url" refs/remotes/public-forge/public:public; then
                echo "::warning::[mirror] $label epoch push failed; Forgejo remains authoritative"
                return 0
              fi
            elif ! git -c "http.https://$host/.extraheader=Authorization: Basic $auth" \
              push "$url" refs/remotes/public-forge/public:public; then
              echo "::warning::[mirror] $label push failed; Forgejo remains authoritative"
              return 0
            fi

            mirrored_sha="$(git ls-remote "$url" refs/heads/public | awk '{print $1}')"
            if [ "$mirrored_sha" != "$forge_sha" ]; then
              echo "::warning::[mirror] $label SHA mismatch after push; Forgejo remains authoritative"
              return 0
            fi
            echo "[mirror] $label agrees with Forgejo: $forge_sha"
          }

          mirror_downstream codeberg 'https://codeberg.org/Fimeg/souveraine.git' codeberg.org Fimeg "$CODEBERG_TOKEN"
          mirror_downstream github 'https://github.com/Fimeg/souveraine.git' github.com Fimeg "$MIRROR_GITHUB_TOKEN"