chore(deps): bump qte77/gha-github-mirror-action from 72829a031ed7d581f4c1061a8863e88ff3cfefd8 to 3c8bd03d1c17576cb085090320fe01149a663158

[dependabot]

Bumps qte77/gha-github-mirror-action from 72829a031ed7d581f4c1061a8863e88ff3cfefd8 to 3c8bd03d1c17576cb085090320fe01149a663158.

Changelog

Sourced from qte77/gha-github-mirror-action's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning, i.e. MAJOR.MINOR.PATCH (Breaking.Feature.Patch).

Types of changes:

• Added / Changed / Deprecated / Removed / Fixed / Security

[Unreleased]

Changed

• Release mechanism: bump-and-release.yaml replaced by thin uses: callers (bump-version.yml, tag-release.yml, publish-release.yml) onto the qte77/.github reusable release workflows.

Removed

• .github/scripts/delete_branch_pr_tag.shqte77/.github#23

Added

• scripts/clone-local.sh: clone GitHub repos to a local directory as bare mirrors (--mirror first run, fetch on re-run). Supports OWNER (via gh repo list) or CONFIG (curated YAML) modes. See README → Usage → Local clone.
• BATS test suite covering infra meta-tests, mirror.sh logic, and clone-local.sh behavior (see tests/unit/)
• source_pat input: authenticates the clone of a private or non-GitHub source
• github_url/github_pat inputs: mirror into a GitHub target (invert/router modes) as a third push --mirror call alongside GitLab/Codeberg. See README → Usage → Modes.
• Self-clobber guard: refuses to mirror into the repo running the action (HTTPS-form targets only)
• Hub: github field in config/repos.yaml/mirror-all.yaml matrix, gating all three PATs on their matching URL being set
• shellcheck + actionlint CI checks for scripts/*.sh and .github/scripts/*.sh
• Dependabot groups: — weekly github-actions-minor-patch group for minor/patch updates
• lint-docs.yml: supplementary markdownlint check for docs/**/*.md, closing a coverage gap in the shared reusable lint workflow (its markdownlint-cli2-action defaults to root-level files only)

Fixed

• ::add-mask:: now actually masks: previously emitted inside the scrubbed output pipeline, so the runner only ever saw ::add-mask::*** instead of the real PAT
• Hub mirror-all.yaml passed every configured PAT unconditionally, even when its target URL was unset; PATs are now gated on their matching URL
• Credential-on-disk residue: the credentialed clone URL no longer lingers in $CLONE_DIR/config after cloning, and the temporary clone directory is now cleaned up via a trap that also covers the clone-failure path

---

[0.1.0] - 2026-03-24

Added

• Core mirror.sh script: config validation, bare clone, --mirror push to GitLab and/or Codeberg
• PAT masking in CI logs (::add-mask:: in GHA, sed scrubbing in push output)
• Dual-target support: continues to second target if first push fails
• action.yaml: composite action with source_repo, gitlab, codeberg inputs
• mirror-all.yaml: central hub workflow (schedule + dispatch, matrix from config/repos.yaml)

... (truncated)

Commits

• 3c8bd03 ci(lint): add shellcheck + actionlint (#47)
• 11d16aa feat(mirror): add source auth, GitHub target, and credential hardening (#50)
• 607fc95 docs(readme,changelog): add mirror Modes section, fix stale claims, pre-stage...
• 4f7a6a9 ci(release): adopt qte77/.github reusable bump/tag/publish workflows (#46)
• 8dad2d2 chore(deps): group minor/patch github-actions dependabot updates (#44)
• 180f599 docs(plan): note hub PAT-reuse limitation for same-host cross-account routing...
• a894f1d chore(deps): bump callowayproject/bump-my-version from 1.4.1 to 1.5.1 (#39)
• 4ebfe26 chore(deps): bump github/codeql-action from 4 to 4.37.4 (#38)
• 3f0ddcc docs: add arc 0001 plan for mirror modes + backlog sweep (#42)
• 39c7995 fix(tests): stop mutating global git identity, fix gpg-signing + rerun collis...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)