# .github/workflows/pr-mirror-repo-sync.yml — CANARY WRAPPER
# DO NOT EDIT — managed by mirror-pipeline rollouts.
# Steady-state pinned to vyos/.github@production. Temporarily repointed
# during mirror-pipeline canary-verification windows (rollouts 1a/1b/2,
# and any future rollout that needs a canary). After each canary passes,
# the pin is restored to @production. See ~/.claude/plans/2026-05-17-mirror-
# pipeline-rollout-2-inclusion-mechanism.md Task 3 Step 8 for the
# canonical restore procedure.
name: PR Mirror and Repo Sync

on:
  pull_request_target:
    types: [closed]
    branches: [rolling]
  workflow_dispatch:
    inputs:
      sync_branch:
        required: true
        type: string

permissions:
  contents: write
  pull-requests: write
  issues: write

jobs:
  call:
    if: |
      github.repository_owner == 'vyos'
      && (github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch')
    uses: vyos/.github/.github/workflows/pr-mirror-repo-sync.yml@production
    with:
      sync_branch: ${{ inputs.sync_branch || github.event.pull_request.base.ref }}
    secrets: inherit