Split the GitHub mirror so Gitea creates its runs and no delete is dropped

.gitea/workflows/mirror-delete.yaml

@@ -0,0 +1,41 @@
+name: Mirror deletions
+
+on:
+  delete:
+
+permissions:
+  contents: read
+
+jobs:
+  # No concurrency group: Gitea cancels a queued run when the next one in its group arrives, dropping the delete.
+  delete:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Delete the ref from GitHub once Gitea no longer has it
+        env:
+          MIRROR_GITHUB_TOKEN: ${{ secrets.MIRROR_GITHUB_TOKEN }}
+          MIRROR_URL: https://github.com/larvit/smpp-js.git
+          REF: ${{ github.event.ref }}
+          SOURCE_URL: ${{ github.server_url }}/${{ github.repository }}.git
+        run: |
+          # Gitea Actions sends the full ref name here, where its webhooks send the short one.
+          case "$REF" in
+            refs/heads/*|refs/tags/*) ;;
+            *) echo "delete event names '$REF', not a full branch or tag ref"; exit 1 ;;
+          esac
+
+          # ls-remote --exit-code: 0 the ref exists, 2 it does not, anything else the remote could not be read.
+          on_gitea=0
+          git ls-remote --exit-code "$SOURCE_URL" "$REF" > /dev/null || on_gitea=$?
+          if [ "$on_gitea" -ne 2 ]; then exit "$on_gitea"; fi
+
+          on_github=0
+          git ls-remote --exit-code "$MIRROR_URL" "$REF" > /dev/null || on_github=$?
+          if [ "$on_github" -eq 2 ]; then exit 0; fi
+          if [ "$on_github" -ne 0 ]; then exit "$on_github"; fi
+
+          git init --bare --quiet mirror.git
+          git -C mirror.git -c credential.helper= \
+            -c credential.helper='!f() { echo username=x-access-token; echo "password=$MIRROR_GITHUB_TOKEN"; }; f' \
+            push "$MIRROR_URL" ":$REF"

.gitea/workflows/mirror.yaml

@@ -0,0 +1,29 @@
+name: Mirror
+
+on:
+  push:
+  schedule:
+    - cron: '17 3 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  push:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    # Gitea 1.26 rolls back a run whose jobs share a group, so the delete job lives in mirror-delete.yaml.
+    concurrency:
+      group: mirror
+    steps:
+      - name: Push every branch and tag to GitHub, overwriting a same-named ref
+        env:
+          MIRROR_GITHUB_TOKEN: ${{ secrets.MIRROR_GITHUB_TOKEN }}
+          MIRROR_URL: https://github.com/larvit/smpp-js.git
+          SOURCE_URL: ${{ github.server_url }}/${{ github.repository }}.git
+        run: |
+          git clone --bare --quiet "$SOURCE_URL" mirror.git
+          git -C mirror.git -c credential.helper= \
+            -c credential.helper='!f() { echo username=x-access-token; echo "password=$MIRROR_GITHUB_TOKEN"; }; f' \
+            push "$MIRROR_URL" '+refs/heads/*:refs/heads/*' '+refs/tags/*:refs/tags/*'

AGENTS.md

@@ -139,6 +139,11 @@ docker compose run --rm node npm run build
   verified rather than asserted.
 - `typescript` is pinned to the 6.x line because `typescript-eslint` peer-requires `<6.1.0`. Move to
   TypeScript 7 once that constraint lifts.
+- GitHub mirrors Gitea through `.gitea/workflows/mirror.yaml`, which never prunes, and
+  `mirror-delete.yaml`, one run per deleted ref. A delete run that fails or outlives Gitea's queue
+  timeout leaves the ref on GitHub until it is re-run. Accepted: a stale ref there is harmless, and
+  refs only GitHub has must survive. Maintainer's call, 2026-09-14; valid while nothing deploys from
+  GitHub.
 
 ## Defects found in 0.4.0
 

todo.md

@@ -73,8 +73,8 @@ Every defect listed in the AGENTS.md table has a regression test naming the beha
 
 ## Move the repository to Gitea
 
-`gitea.larvit.se/larvit/smpp-js` is the repository. `github.com/larvit/smpp-js` becomes a push mirror
-of it and the place issues are filed. Maintainer's calls, 2026-09-13 and 2026-09-14.
+`gitea.larvit.se/larvit/smpp-js` is the repository. `github.com/larvit/smpp-js` mirrors it and is the
+place issues are filed. Maintainer's calls, 2026-09-13 and 2026-09-14.
 
 - [x] `larvit/smpp-js` holds `main`, from `typescript`, and `v0.4.0`, from `master`. `rewrite-base`
       and the `renovate/*` branches stayed behind.
@@ -105,8 +105,8 @@ of it and the place issues are filed. Maintainer's calls, 2026-09-13 and 2026-09
 ## Retire the GitHub repository
 
 Nothing here starts before 0.5.0 is published. Maintainer's call, 2026-09-14. Then in this order:
-the push mirror replaces GitHub's branches with Gitea's, which closes every pull request based on
-`master` without a reply, and GitHub refuses to delete the default branch it syncs over.
+deleting GitHub's old branches closes every pull request based on them without a reply, and GitHub
+refuses to delete its default branch.
 
 - [ ] Close the backlog below.
 - [ ] Close [#71](https://github.com/larvit/larvitsmpp/pull/71), pointing at Gitea.
@@ -114,7 +114,10 @@ the push mirror replaces GitHub's branches with Gitea's, which closes every pull
       URL in `package.json` resolves from then on.
 - [ ] Push `main` and make it GitHub's default branch.
 - [ ] Remove Renovate and CodeRabbit from the GitHub repository.
-- [ ] Add it to Gitea as a push mirror, with a GitHub credential that can write to it.
+- [ ] Mirror to GitHub from `.gitea/workflows/mirror.yaml` and `mirror-delete.yaml`, with
+      `MIRROR_GITHUB_TOKEN`. A push of a commit carrying the workflow, and the nightly run, send all of
+      Gitea's branches and tags, overwriting a same-named ref; a branch or tag deleted on Gitea is
+      deleted there too. Refs only GitHub has stay. Maintainer's call, 2026-09-14.
 
 ## Close the GitHub backlog