Split the GitHub mirror so Gitea creates its runs and no delete is dropped

.gitea/workflows/mirror-delete.yaml

@@ -0,0 +1,41 @@
+name: Mirror deletions
+
+on:
+  delete:
+
+permissions:
+  contents: read
+
+jobs:
+  # No concurrency group: Gitea cancels a queued run when the next one in its group arrives, dropping the delete.
+  delete:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Delete the ref from GitHub once Gitea no longer has it
+        env:
+          MIRROR_GITHUB_TOKEN: ${{ secrets.MIRROR_GITHUB_TOKEN }}
+          MIRROR_URL: https://github.com/larvit/smpp-js.git
+          REF: ${{ github.event.ref }}
+          SOURCE_URL: ${{ github.server_url }}/${{ github.repository }}.git
+        run: |
+          # Gitea Actions sends the full ref name here, where its webhooks send the short one.
+          case "$REF" in
+            refs/heads/*|refs/tags/*) ;;
+            *) echo "delete event names '$REF', not a full branch or tag ref"; exit 1 ;;
+          esac
+
+          # ls-remote --exit-code: 0 the ref exists, 2 it does not, anything else the remote could not be read.
+          on_gitea=0
+          git ls-remote --exit-code "$SOURCE_URL" "$REF" > /dev/null || on_gitea=$?
+          if [ "$on_gitea" -ne 2 ]; then exit "$on_gitea"; fi
+
+          on_github=0
+          git ls-remote --exit-code "$MIRROR_URL" "$REF" > /dev/null || on_github=$?
+          if [ "$on_github" -eq 2 ]; then exit 0; fi
+          if [ "$on_github" -ne 0 ]; then exit "$on_github"; fi
+
+          git init --bare --quiet mirror.git
+          git -C mirror.git -c credential.helper= \
+            -c credential.helper='!f() { echo username=x-access-token; echo "password=$MIRROR_GITHUB_TOKEN"; }; f' \
+            push "$MIRROR_URL" ":$REF"

.gitea/workflows/mirror.yaml

@@ -1,7 +1,6 @@
 name: Mirror
 
 on:
-  delete:
   push:
   schedule:
     - cron: '17 3 * * *'
@@ -12,11 +11,10 @@ permissions:
 
 jobs:
   push:
-    if: github.event_name != 'delete'
     runs-on: ubuntu-24.04
     timeout-minutes: 10
+    # Gitea 1.26 rolls back a run whose jobs share a group, so the delete job lives in mirror-delete.yaml.
     concurrency:
-      cancel-in-progress: false
       group: mirror
     steps:
       - name: Push every branch and tag to GitHub, overwriting a same-named ref
@@ -29,39 +27,3 @@ jobs:
           git -C mirror.git -c credential.helper= \
             -c credential.helper='!f() { echo username=x-access-token; echo "password=$MIRROR_GITHUB_TOKEN"; }; f' \
             push "$MIRROR_URL" '+refs/heads/*:refs/heads/*' '+refs/tags/*:refs/tags/*'
-
-  delete:
-    if: github.event_name == 'delete'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    concurrency:
-      cancel-in-progress: false
-      group: mirror
-    steps:
-      - name: Delete the ref from GitHub once Gitea no longer has it
-        env:
-          MIRROR_GITHUB_TOKEN: ${{ secrets.MIRROR_GITHUB_TOKEN }}
-          MIRROR_URL: https://github.com/larvit/smpp-js.git
-          REF: ${{ github.event.ref }}
-          SOURCE_URL: ${{ github.server_url }}/${{ github.repository }}.git
-        run: |
-          # Gitea Actions sends the full ref name here, where its webhooks send the short one.
-          case "$REF" in
-            refs/heads/*|refs/tags/*) ;;
-            *) echo "delete event names '$REF', not a full branch or tag ref"; exit 1 ;;
-          esac
-
-          # ls-remote --exit-code: 0 the ref exists, 2 it does not, anything else the remote could not be read.
-          on_gitea=0
-          git ls-remote --exit-code "$SOURCE_URL" "$REF" > /dev/null || on_gitea=$?
-          if [ "$on_gitea" -ne 2 ]; then exit "$on_gitea"; fi
-
-          on_github=0
-          git ls-remote --exit-code "$MIRROR_URL" "$REF" > /dev/null || on_github=$?
-          if [ "$on_github" -eq 2 ]; then exit 0; fi
-          if [ "$on_github" -ne 0 ]; then exit "$on_github"; fi
-
-          git init --bare --quiet mirror.git
-          git -C mirror.git -c credential.helper= \
-            -c credential.helper='!f() { echo username=x-access-token; echo "password=$MIRROR_GITHUB_TOKEN"; }; f' \
-            push "$MIRROR_URL" ":$REF"

AGENTS.md

@@ -146,6 +146,11 @@ docker compose run --rm node npm run build
   verified rather than asserted.
 - `typescript` is pinned to the 6.x line because `typescript-eslint` peer-requires `<6.1.0`. Move to
   TypeScript 7 once that constraint lifts.
+- GitHub mirrors Gitea through `.gitea/workflows/mirror.yaml`, which never prunes, and
+  `mirror-delete.yaml`, one run per deleted ref. A delete run that fails or outlives Gitea's queue
+  timeout leaves the ref on GitHub until it is re-run. Accepted: a stale ref there is harmless, and
+  refs only GitHub has must survive. Maintainer's call, 2026-09-14; valid while nothing deploys from
+  GitHub.
 
 ## Defects found in 0.4.0
 

todo.md

@@ -115,10 +115,10 @@ refuses to delete its default branch.
       URL in `package.json` resolves from then on.
 - [ ] Push `main` and make it GitHub's default branch.
 - [ ] Remove Renovate and CodeRabbit from the GitHub repository.
-- [ ] Mirror to GitHub from `.gitea/workflows/mirror.yaml`, with `MIRROR_GITHUB_TOKEN`. Every push
-      sends all of Gitea's branches and tags, overwriting a same-named ref, and a branch or tag deleted
-      on Gitea is deleted there too. Refs only GitHub has, its pull requests and forks stay, so one can
-      be taken in. Maintainer's call, 2026-09-14.
+- [ ] Mirror to GitHub from `.gitea/workflows/mirror.yaml` and `mirror-delete.yaml`, with
+      `MIRROR_GITHUB_TOKEN`. A push of a commit carrying the workflow, and the nightly run, send all of
+      Gitea's branches and tags, overwriting a same-named ref; a branch or tag deleted on Gitea is
+      deleted there too. Refs only GitHub has stay. Maintainer's call, 2026-09-14.
 
 ## Close the GitHub backlog