From 30423d7dd69a580f1744209d0695d3b19266bf25 Mon Sep 17 00:00:00 2001
From: pyr0ball <pyroballpcs@gmail.com>
Date: Fri, 26 Jun 2026 19:25:10 -0700
Subject: [PATCH] =?UTF-8?q?fix(ci):=20restore=20green=20CI=20=E2=80=94=20r?=
 =?UTF-8?q?uff=20install=20+=20mirror=20secret=20rename?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two workflow fixes:
- ci.yml: add explicit `pip install ruff` before lint step; also add
  freeze/** to push trigger so RC branches run CI
- mirror.yml: rename GITHUB_MIRROR_TOKEN → GH_MIRROR_TOKEN to match
  org-level secret; Forgejo reserves the GITHUB_* prefix so that name
  was silently shadowed, causing mirror pushes to fail with auth errors
---
 .forgejo/workflows/ci.yml     | 5 ++++-
 .forgejo/workflows/mirror.yml | 7 ++++---
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 9f70b2e..1e4f0b6 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -7,7 +7,7 @@ name: CI
 
 on:
   push:
-    branches: [main, 'feature/**', 'fix/**']
+    branches: [main, 'feature/**', 'fix/**', 'freeze/**']
   pull_request:
     branches: [main]
 
@@ -29,6 +29,9 @@ jobs:
       - name: Install dependencies
         run: pip install -r requirements.txt
 
+      - name: Install lint tools
+        run: pip install ruff
+
       - name: Lint
         run: ruff check .
 
diff --git a/.forgejo/workflows/mirror.yml b/.forgejo/workflows/mirror.yml
index 83d273d..5b1f887 100644
--- a/.forgejo/workflows/mirror.yml
+++ b/.forgejo/workflows/mirror.yml
@@ -1,6 +1,7 @@
 # Mirror push to GitHub and Codeberg on every push to main or tag.
 # Copied from Circuit-Forge/cf-agents workflows/mirror.yml
-# Required secrets: GITHUB_MIRROR_TOKEN, CODEBERG_MIRROR_TOKEN
+# Required secrets: GH_MIRROR_TOKEN, CODEBERG_MIRROR_TOKEN
+# Note: Forgejo reserves the GITHUB_* prefix for secret names — use GH_* instead.
 
 name: Mirror
 
@@ -19,10 +20,10 @@ jobs:
 
       - name: Mirror to GitHub
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_MIRROR_TOKEN }}
+          GH_MIRROR_PAT: ${{ secrets.GH_MIRROR_TOKEN }}
           REPO: ${{ github.event.repository.name }}
         run: |
-          git remote add github "https://x-access-token:${GITHUB_TOKEN}@github.com/CircuitForgeLLC/${REPO}.git"
+          git remote add github "https://x-access-token:${GH_MIRROR_PAT}@github.com/CircuitForgeLLC/${REPO}.git"
           git push github --mirror
 
       - name: Mirror to Codeberg