ops: move to forgejo-primary hosting with mirror-only codeberg/github

docs/BRANCH_PROTECTION.md

@@ -1,4 +1,4 @@
-# Branch Protection (Codeberg)
+# Branch Protection (Forgejo Primary)
 
 `main` should be protected to satisfy constitutional governance (`all changes merge through pull requests`) and to require CI before merge.
 
@@ -20,6 +20,7 @@
 Optional overrides:
 
 ```sh
+EVERY_CHANNEL_FORGE_HOST=https://forge.every.channel \
 EVERY_CHANNEL_FORGE_REPO=every-channel/every.channel \
 EVERY_CHANNEL_PROTECTED_BRANCH=main \
 EVERY_CHANNEL_REQUIRED_CHECKS="ci-gates / checks" \
@@ -29,7 +30,8 @@ EVERY_CHANNEL_REQUIRED_APPROVALS=1 \
 
 Token source order:
 
-1. `CODEBERG_TOKEN` env var
-2. `secrets/codeberg-token.age` via `agenix` or `age`
+1. `EVERY_CHANNEL_FORGE_TOKEN` / `FORGE_TOKEN` / `CODEBERG_TOKEN` env var
+2. `secrets/forge-token.age` (preferred) via `agenix` or `age`
+3. `secrets/codeberg-token.age` (compat) via `agenix` or `age`
 
 The token must have repository admin scope to edit branch protection.

docs/DEPLOY_CLOUDFLARE.md

@@ -1,6 +1,7 @@
 # Cloudflare Deploy (Forgejo Actions)
 
 This repo deploys `https://every.channel` via Wrangler.
+The deploy workflow is intended to run on the primary Forgejo host (not Codeberg/GitHub mirrors).
 
 ## Prereqs
 
@@ -13,6 +14,10 @@ CI and deploy workflows:
 - PR/main checks: `.forgejo/workflows/ci-gates.yml`
 - Deploy (main only, depends on checks): `.forgejo/workflows/deploy-cloudflare.yml`
 
+Mirror behavior:
+
+- Workflow jobs are guarded to skip execution on `https://codeberg.org`.
+
 ## Manual deploy (local)
 
 ```sh

docs/GIT_HOSTING.md

@@ -0,0 +1,45 @@
+# Git Hosting Topology
+
+Primary host:
+
+- Forgejo (`origin`)
+
+Mirrors (push-only):
+
+- Codeberg (`mirror-codeberg`)
+- GitHub (`mirror-github`)
+
+Codeberg and GitHub are distribution mirrors only. CI/actions should run on Forgejo primary.
+
+## Configure local remotes
+
+```sh
+./scripts/git-configure-hosting.sh
+```
+
+Defaults:
+
+- `origin`: `git@forge.every.channel:every-channel/every.channel.git`
+- `mirror-codeberg`: `git@codeberg.org:every-channel/every.channel.git`
+- `mirror-github`: `git@github.com:every-channel/every.channel.git`
+
+You can override via env vars:
+
+- `EVERY_CHANNEL_PRIMARY_GIT_URL`
+- `EVERY_CHANNEL_CODEBERG_GIT_URL`
+- `EVERY_CHANNEL_GITHUB_GIT_URL`
+
+## Push mirrors
+
+```sh
+./scripts/git-push-mirrors.sh
+```
+
+## Disable actions on Codeberg mirror
+
+```sh
+EVERY_CHANNEL_FORGE_HOST=https://codeberg.org \
+EVERY_CHANNEL_FORGE_REPO=every-channel/every.channel \
+EVERY_CHANNEL_FORGE_ACTIONS_ENABLED=false \
+./scripts/forge-set-repo-actions.sh
+```