Hu

.env.example

@@ -3,7 +3,7 @@ APP_ID=12345
 GITHUB_CLIENT_ID=Iv1.12345def
 GITHUB_CLIENT_SECRET=clientsecret
 
-# Private key for the GitHub App
+# Private key for the GitHub App (base64 encoded or raw)
 PRIVATE_KEY=-----BEGIN RSA PRIVATE KEY-----\nYOUR KEY HERE WITH \n INCLUDED=\n-----END RSA PRIVATE KEY-----\n
 
 # Auth configs
@@ -27,3 +27,33 @@ NODE_ENV=development
 # Used for GHEC configs, where private mirrors are kept in a different org
 PUBLIC_ORG=
 PRIVATE_ORG=
+
+# GitHub Enterprise (GHE.com Data Residency / GHES) configuration.
+# Leave unset to use the github.com defaults shown below. For GHE/GHES, set
+# each custom URL explicitly.
+# GITHUB_SERVER_URL=
+# GITHUB_API_URL=
+# GITHUB_GRAPHQL_URL=
+
+# Committer email domain used on sync commits. Defaults to
+# `users.noreply.github.com`. Set explicitly for GHE/GHES; the exact value
+# depends on the instance configuration.
+# GITHUB_USER_EMAIL_DOMAIN=
+
+# Used to skip branch protection creation if organization level branch protections are used instead
+SKIP_BRANCH_PROTECTION_CREATION=
+
+# Used to create mirrors with internal visibility instead of private for use in GitHub Enterprise Cloud organizations
+CREATE_MIRRORS_WITH_INTERNAL_VISIBILITY=
+
+# Used for syncing logic to avoid having EMU users listed as committer
+DELETE_INTERNAL_MERGE_COMMITS_ON_SYNC=
+
+# Used to configure the timeout for syncing a mirror before the task gets backgrounded (default is 30 seconds)
+MIRROR_SYNC_TIMEOUT_MS=
+
+# Used to configure the number of commits to push at a time when syncing a mirror (default is 1000)
+MIRROR_PUSH_CHUNK_SIZE=
+
+# Used to disable mirror deletion through private mirrors. Hides the delete action in the UI and rejects direct API calls.
+DISABLE_MIRROR_DELETION=

.github/ISSUE_TEMPLATE/config.yml

@@ -2,5 +2,5 @@ blank_issues_enabled: false
 
 contact_links:
   - name: Ask a question
-    url: https://github.com/github/private-mirrors/discussions/new
+    url: https://github.com/github-community-projects/private-mirrors/discussions/new?category=q-a
     about: Ask a question or start a discussion

.github/pull_request_template.md

@@ -18,10 +18,6 @@ examples: "feat: add new logger" or "fix: remove unused imports"
 ### Author/Contributor
 
 - [ ] If documentation is needed for this change, has that been included in this pull request
+- [ ] run `npm run format` and fix any formatting issues that have been introduced
 - [ ] run `npm run lint` and fix any linting issues that have been introduced
 - [ ] run `npm run test` and run tests
-- [ ] If publishing new data to the public (scorecards, security scan results, code quality results, live dashboards, etc.), please request review from `@jeffrey-luszcz`
-
-### Reviewer
-
-- [ ] Label as either `bug`, `documentation`, `enhancement`, `infrastructure`, `maintenance`, or `breaking`

.github/release-drafter.yml

@@ -5,9 +5,12 @@ template: |
   # Changelog
   $CHANGES
 
-  See details of [all code changes](https://github.com/github-community-projects/private-mirrors/compare/$PREVIOUS_TAG...v$RESOLVED_VERSION) since previous release
+  See details of [all code changes](https://github.com/$OWNER/$REPOSITORY/compare/$PREVIOUS_TAG...v$RESOLVED_VERSION) since previous release
 
 categories:
+  - title: '💥 Breaking Changes'
+    labels:
+      - 'breaking'
   - title: '🚀 Features'
     labels:
       - 'feature'
@@ -32,14 +35,18 @@ version-resolver:
   major:
     labels:
       - 'breaking'
+      - 'major'
   minor:
     labels:
       - 'enhancement'
-      - 'fix'
+      - 'feature'
+      - 'minor'
   patch:
     labels:
+      - 'fix'
       - 'documentation'
       - 'maintenance'
+      - 'patch'
   default: patch
 autolabeler:
   - label: 'automation'

.github/workflows/auto-labeler.yml

@@ -12,13 +12,10 @@ permissions:
 jobs:
   main:
     permissions:
-      contents: write
+      contents: read
       pull-requests: write
-    name: Auto label pull requests
-    runs-on: ubuntu-latest
-    steps:
-      - uses: release-drafter/release-drafter@3f0f87098bd6b5c5b9a36d49c41d998ea58f9348 # pin@v6
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          config-name: release-drafter.yml
+    uses: github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml@6f158f242fe68adb5a2698ef47e06dac07ac7e71
+    with:
+      config-name: release-drafter.yml
+    secrets:
+      github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/build.yml

@@ -1,20 +1,33 @@
 name: Run Build
 
 on:
-  - push
-  - workflow_dispatch
-  - pull_request
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+  pull_request:
+
+permissions:
+  contents: read
 
 jobs:
   build:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
 
       - name: Install Dependencies
-        run: npm install
+        run: npm ci --ignore-scripts
 
       - name: Run Build
         run: NEXT_TELEMETRY_DISABLED=1 npm run build

.github/workflows/docker-build.yml

@@ -1,17 +1,43 @@
 name: Build Docker Image
 
 on:
-  - push
-  - workflow_dispatch
-  - pull_request
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+  pull_request:
+
+permissions:
+  contents: read
+  packages: write
 
 jobs:
   docker-build:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+
+      - name: Get Git commit timestamps
+        run: echo "TIMESTAMP=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
+
+      - name: Validate build configuration
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          call: check
 
       - name: Build Docker image
-        run: docker build -t private-mirrors .
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          push: false
+          tags: private-mirrors
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+        env:
+          SOURCE_DATE_EPOCH: ${{ env.TIMESTAMP }}

.github/workflows/docker-publish.yml

@@ -0,0 +1,98 @@
+name: Docker
+
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+on:
+  schedule:
+    - cron: '38 18 * * *'
+  push:
+    branches: [ "main" ]
+    # Publish semver tags as releases.
+    tags: [ 'v*.*.*' ]
+  pull_request:
+    branches: [ "main" ]
+
+env:
+  # Use docker.io for Docker Hub if empty
+  REGISTRY: ghcr.io
+  # github.repository as <account>/<repo>
+  IMAGE_NAME: ${{ github.repository }}
+
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      # This is used to complete the identity challenge
+      # with sigstore/fulcio when running outside of PRs.
+      id-token: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      # Install the cosign tool except on PR
+      # https://github.com/sigstore/cosign-installer
+      - name: Install cosign
+        if: github.event_name != 'pull_request'
+        uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
+        with:
+          cosign-release: 'v2.2.4'
+
+      # Set up BuildKit Docker container builder to be able to build
+      # multi-platform images and export cache
+      # https://github.com/docker/setup-buildx-action
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
+
+      # Login against a Docker registry except on PR
+      # https://github.com/docker/login-action
+      - name: Log into registry ${{ env.REGISTRY }}
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Extract metadata (tags, labels) for Docker
+      # https://github.com/docker/metadata-action
+      - name: Extract Docker metadata
+        id: meta
+        uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+
+      # Build and push Docker image with Buildx (don't push on PR)
+      # https://github.com/docker/build-push-action
+      - name: Build and push Docker image
+        id: build-and-push
+        uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
+        with:
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      # Sign the resulting Docker image digest except on PRs.
+      # This will only write to the public Rekor transparency log when the Docker
+      # repository is public to avoid leaking data.  If you would like to publish
+      # transparency data even for private images, pass --force to cosign below.
+      # https://github.com/sigstore/cosign
+      - name: Sign the published Docker image
+        if: ${{ github.event_name != 'pull_request' }}
+        env:
+          # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
+          TAGS: ${{ steps.meta.outputs.tags }}
+          DIGEST: ${{ steps.build-and-push.outputs.digest }}
+        # This step uses the identity token to provision an ephemeral certificate
+        # against the sigstore community Fulcio instance.
+        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

.github/workflows/lint.yml

@@ -1,20 +1,33 @@
 name: Run Lint
 
 on:
-  - push
-  - workflow_dispatch
-  - pull_request
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+  pull_request:
+
+permissions:
+  contents: read
 
 jobs:
   lint:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version-file: '.nvmrc'
+          cache: 'npm'
 
       - name: Install Dependencies
-        run: npm install
+        run: npm ci --ignore-scripts
 
       - name: Run Lint
         run: npm run lint