Per-repo GitHub mirror push: keep Vercel/GitHub-bound deploy pipelines working while Gluecron is canonical#207
○Openccantynz opened this issue 24d ago
ccantynzAuthorcommented 24d ago
Owner question 2026-08-08: "how do the other platforms know we are using gluecron now" — they don't. Vercel (and anything else wired to github.com/ccantynz-alt/*) still deploys from GitHub, which no longer receives merges. Concrete live case: the XSS fix for verom (PR #5450) is merged on Gluecron but a GitHub-connected Vercel project would still serve the unfixed code.
Vercel cannot pull from gluecron.com, so the bridge is a mirror push: after a merge to a repo's default branch, Gluecron pushes that branch to a configured GitHub remote. Gluecron stays the source of truth; GitHub becomes a delivery pipe for deploy integrations.
Hook: at the end of the shared merge chain in pr-merge-gated.ts (single chokepoint, never inline a copy), fire-and-forget git push <mirror> <defaultBranch> from the bare repo. Failures recorded (platform_errors + a repo-settings status line "last mirror push: failed — "), never blocking the merge.
Also mirror on direct pushes to the default branch (post-receive), best-effort.
Settings UI: one card in repo settings, with a "push now" button for backfill and a visible last-sync status (honest-degradation rule — a silent broken mirror would be the worst outcome).
Loop safety: mirror pushes are outbound-only; Gluecron never pulls from the mirror, so no echo risk.
Interim, until built: manual git push github main per repo after merges that need deploying — say which repos deploy from GitHub (Vercel) and the owner/agent can run the sync.
Related: docs/CUTOVER_RUNBOOK.md Phase 4 (retiring GitHub for the platform repo is separate — product repos need GitHub as long as Vercel does).
Owner question 2026-08-08: "how do the other platforms know we are using gluecron now" — they don't. Vercel (and anything else wired to
github.com/ccantynz-alt/*) still deploys from GitHub, which no longer receives merges. Concrete live case: the XSS fix for verom (PR #5450) is merged on Gluecron but a GitHub-connected Vercel project would still serve the unfixed code.Vercel cannot pull from gluecron.com, so the bridge is a mirror push: after a merge to a repo's default branch, Gluecron pushes that branch to a configured GitHub remote. Gluecron stays the source of truth; GitHub becomes a delivery pipe for deploy integrations.
Design sketch:
mirror_url(e.g.https://github.com/ccantynz-alt/<repo>.git) +mirror_token(encrypted — org-secrets AES-256-GCM infra exists) + enabled flag.pr-merge-gated.ts(single chokepoint, never inline a copy), fire-and-forgetgit push <mirror> <defaultBranch>from the bare repo. Failures recorded (platform_errors + a repo-settings status line "last mirror push: failed — "), never blocking the merge.Interim, until built: manual
git push github mainper repo after merges that need deploying — say which repos deploy from GitHub (Vercel) and the owner/agent can run the sync.Related: docs/CUTOVER_RUNBOOK.md Phase 4 (retiring GitHub for the platform repo is separate — product repos need GitHub as long as Vercel does).