feat: Switch mirror workflow to SSH

Author: hyperpolymath

.github/workflows/mirror.yml

@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 name: Mirror to GitLab and Bitbucket
 
 on:
@@ -7,41 +8,65 @@ on:
       - 'v*'
   workflow_dispatch:
 
+permissions: read-all
+
 jobs:
   mirror-gitlab:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     if: ${{ vars.GITLAB_MIRROR_ENABLED == 'true' }}
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
 
+      - name: Setup SSH
+        uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
+        with:
+          ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }}
+
+      - name: Add GitLab to known hosts
+        run: |
+          mkdir -p ~/.ssh
+          ssh-keyscan -t ed25519 gitlab.com >> ~/.ssh/known_hosts
+
       - name: Push to GitLab
         env:
-          GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }}
           REPO_NAME: ${{ github.event.repository.name }}
         run: |
-          git remote add gitlab https://oauth2:${GITLAB_TOKEN}@gitlab.com/hyperpolymath/${REPO_NAME}.git || true
+          git remote add gitlab git@gitlab.com:hyperpolymath/${REPO_NAME}.git || true
           git push gitlab HEAD:main --force || git push gitlab HEAD:master --force
           git push gitlab --tags --force
 
   mirror-bitbucket:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     if: ${{ vars.BITBUCKET_MIRROR_ENABLED == 'true' }}
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
 
+      - name: Setup SSH
+        uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
+        with:
+          ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }}
+
+      - name: Add Bitbucket to known hosts
+        run: |
+          mkdir -p ~/.ssh
+          ssh-keyscan -t ed25519 bitbucket.org >> ~/.ssh/known_hosts
+
       - name: Push to Bitbucket
         env:
-          BITBUCKET_TOKEN: ${{ secrets.BITBUCKET_TOKEN }}
           REPO_NAME: ${{ github.event.repository.name }}
         run: |
-          git remote add bitbucket https://x-token-auth:${BITBUCKET_TOKEN}@bitbucket.org/hyperpolymath/${REPO_NAME}.git || true
+          git remote add bitbucket git@bitbucket.org:hyperpolymath/${REPO_NAME}.git || true
           git push bitbucket HEAD:main --force || git push bitbucket HEAD:master --force
           git push bitbucket --tags --force