T6940: added pr mirror sync caller workflows (revised), and cleaned up old workflows

4 files changed, 73 insertions, 37 deletions

diff --git a/.github/workflows/cleanup-mirror-pr-branch.yml b/.github/workflows/cleanup-mirror-pr-branch.yml
new file mode 100644
index 000000000..c5de9ab73
--- /dev/null
+++ b/.github/workflows/cleanup-mirror-pr-branch.yml
@@ -0,0 +1,35 @@
+name: Cleanup pr mirror branch
+
+on:
+  pull_request:
+    types: [closed]
+    branches:
+        - current
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: 'Branch to delete'
+        required: true
+
+permissions:
+  contents: write
+
+jobs:
+  delete_branch:
+    if: ${{ (github.event_name == 'workflow_dispatch' || startsWith(github.event.pull_request.head.ref, 'mirror/')) && github.repository_owner != 'vyos' }}
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Delete branch
+        run: |
+          branch=${{ github.event_name == 'workflow_dispatch' && github.event.inputs.branch || github.event.pull_request.head.ref }}
+          if [[ $branch != mirror/* ]]; then
+            echo "Branch name to clean must start with 'mirror/'"
+            exit 1
+          fi
+          repo=${{ github.repository }}
+          git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}
+          git push origin --delete $branch
diff --git a/.github/workflows/repo-sync.yml b/.github/workflows/repo-sync.yml
deleted file mode 100644
index 752cf947a..000000000
--- a/.github/workflows/repo-sync.yml
+++ /dev/null
@@ -1,18 +0,0 @@
-name: Repo-sync
-
-on:
-    pull_request_target:
-      types:
-        - closed
-      branches:
-        - current
-        - equuleus
-    workflow_dispatch:
-
-jobs:
-  trigger-sync:
-    uses: vyos/.github/.github/workflows/trigger-repo-sync.yml@current
-    secrets:
-      REMOTE_REPO: ${{ secrets.REMOTE_REPO }}
-      REMOTE_OWNER: ${{ secrets.REMOTE_OWNER }}
-      PAT: ${{ secrets.PAT }}
diff --git a/.github/workflows/trigger-pr-mirror-repo-sync.yml b/.github/workflows/trigger-pr-mirror-repo-sync.yml
new file mode 100644
index 000000000..9653c2dca
--- /dev/null
+++ b/.github/workflows/trigger-pr-mirror-repo-sync.yml
@@ -0,0 +1,38 @@
+name: Trigger Mirror PR and Repo Sync
+on:
+  pull_request_target:
+      types:
+        - closed
+      branches:
+        - current
+
+env:
+  GH_TOKEN: ${{ secrets.PAT }}
+
+concurrency:
+  group: trigger-pr-mirror-repo-sync-${{ github.event.pull_request.base.ref }}
+  cancel-in-progress: false
+jobs:
+  trigger-mirror-pr-repo-sync:
+    if: ${{ github.repository_owner == 'vyos' }}
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      contents: write
+
+    steps:
+    - name: Bullfrog Secure Runner
+      uses: bullfrogsec/bullfrog@v0
+      with:
+        egress-policy: audit
+
+    - name: Trigger repo sync
+      shell: bash
+      run: |
+        echo "Triggering sync workflow for ${{ secrets.REMOTE_OWNER }}/${{ secrets.REMOTE_REPO }}"
+        echo "Triggering sync workflow with PAT ${{ secrets.PAT }}"
+        curl -X POST \
+          -H "Accept: application/vnd.github.everest-preview+json" \
+          -H "Authorization: Bearer ${{ secrets.PAT }}" \
+          https://api.github.com/repos/${{ secrets.REMOTE_OWNER }}/${{ secrets.REMOTE_REPO }}/actions/workflows/mirror-pr-and-sync.yml/dispatches \
+          -d '{"ref":"git-actions", "inputs": {"pr_number": "${{  github.event.pull_request.number }}", "sync_branch": "${{ github.event.pull_request.base.ref }}"}}'
diff --git a/.github/workflows/trigger-pr.yml b/.github/workflows/trigger-pr.yml
deleted file mode 100644
index f88458a81..000000000
--- a/.github/workflows/trigger-pr.yml
+++ /dev/null
@@ -1,19 +0,0 @@
-name: Trigger PR
-
-on:
-    pull_request_target:
-      types:
-        - closed
-      branches:
-        - circinus
-
-jobs:
-  trigger-PR:
-    uses: vyos/.github/.github/workflows/trigger-pr.yml@current
-    with:
-      source_branch: 'circinus'
-      target_branch: 'circinus'
-    secrets:
-      REMOTE_REPO: ${{ secrets.REMOTE_REPO }}
-      REMOTE_OWNER: ${{ secrets.REMOTE_OWNER }}
-      PAT: ${{ secrets.PAT }}