4 files changed, 83 insertions, 1 deletions
diff --git a/.github/workflows/cla-check.yml b/.github/workflows/cla-check.yml
new file mode 100644
index 0000000..625ff78
--- /dev/null
+++ b/.github/workflows/cla-check.yml
@@ -0,0 +1,18 @@
+name: "CLA Check"
+
+permissions:
+  actions: write
+  contents: read
+  pull-requests: write
+  statuses: write
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, closed]
+  issue_comment:
+    types: [created]
+
+jobs:
+  call-cla-assistant:
+    uses: vyos/vyos-cla-signatures/.github/workflows/cla-reusable.yml@current
+    secrets: inherit
+\ No newline at end of file
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index a2659e1..4020b87 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -38,7 +38,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v6
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/pr-mirror-repo-sync.yml b/.github/workflows/pr-mirror-repo-sync.yml
new file mode 100644
index 0000000..0f6c449
--- /dev/null
+++ b/.github/workflows/pr-mirror-repo-sync.yml
@@ -0,0 +1,30 @@
+# .github/workflows/pr-mirror-repo-sync.yml
+# DO NOT EDIT — managed by mirror-pipeline rollout.
+# To opt out: set vars.MIRROR_ENABLED=false in this repo's Actions variables.
+name: PR Mirror and Repo Sync
+
+on:
+  pull_request_target:
+    types: [closed]
+    branches: [current]
+  workflow_dispatch:
+    inputs:
+      sync_branch:
+        required: true
+        type: string
+
+permissions:
+  contents: write
+  pull-requests: write
+  issues: write
+
+jobs:
+  call:
+    if: |
+      github.repository_owner == 'vyos'
+      && (github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch')
+      && vars.MIRROR_ENABLED != 'false'
+    uses: vyos/.github/.github/workflows/pr-mirror-repo-sync.yml@current
+    with:
+      sync_branch: ${{ inputs.sync_branch || github.event.pull_request.base.ref }}
+    secrets: inherit
diff --git a/.github/workflows/trigger-rebuild-repo-package.yml b/.github/workflows/trigger-rebuild-repo-package.yml
new file mode 100644
index 0000000..e26669b
--- /dev/null
+++ b/.github/workflows/trigger-rebuild-repo-package.yml
@@ -0,0 +1,34 @@
+name: Trigger to build a deb package from repo
+
+on:
+  pull_request_target:
+    types:
+      - closed
+    branches:
+      - current
+      - circinus
+      - sagitta
+  workflow_dispatch:
+
+jobs:
+  get_repo_name:
+    runs-on: ubuntu-latest
+    outputs:
+      PACKAGE_NAME: ${{ steps.package_name.outputs.PACKAGE_NAME }}
+    steps:
+      - name: Set variables
+        id: package_name
+        run: |
+          echo "PACKAGE_NAME=$(basename ${{ github.repository }})" >> $GITHUB_OUTPUT
+
+  trigger-build:
+    needs: get_repo_name
+    uses: vyos/.github/.github/workflows/trigger-rebuild-repo-package.yml@current
+    with:
+      branch: ${{ github.event.pull_request.base.ref }}
+      package_name: ${{ needs.get_repo_name.outputs.PACKAGE_NAME }}
+    secrets:
+      REMOTE_OWNER: ${{ secrets.REMOTE_OWNER }}
+      REMOTE_REUSE_REPO: ${{ secrets.REMOTE_REUSE_REPO }}
+      GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
+      PAT: ${{ secrets.PAT }}