[minor] Transition internal GHE repo sync to native Git ref mirroring

CONTRIBUTING.md

@@ -134,13 +134,14 @@ Automatically builds and publishes versioned documentation to GitHub Pages:
 - Version tags (`x.x.x`) are grouped by minor release (`x.x`)
 
 ### Update Internal GHE Repo
-**Workflow:** [`.github/workflows/update-internal-repo.yaml`](.github/workflows/update-internal-repo.yaml)
-**Triggers:** Pushes to any branch (excluding tags)
-
-Synchronizes changes to the internal IBM GitHub Enterprise repository:
-- Copies files from public repo to `automation-paas-cd-pipeline/mas-gitops` on github.ibm.com
-- Uses [`copy-gitops.sh`](build/bin/copy-gitops.sh) to selectively sync files
-- Maintains branch parity between public and internal repositories
+**Script:** [`build/bin/sync-internal-mirror.sh`](build/bin/sync-internal-mirror.sh)
+**Deployment:** [`build/deploy/internal-mirror-cronjob.yaml`](build/deploy/internal-mirror-cronjob.yaml) (OpenShift / Kubernetes CronJob)
+
+Mirrors all branches, tags, and commit history directly from public GitHub to the internal IBM GitHub Enterprise repository using the internal pull model:
+- Clones `ibm-mas/gitops` bare and mirrors to `automation-paas-cd-pipeline/mas-gitops` on github.ibm.com
+- Retains exact commit SHAs, author metadata, and tag definitions (1:1 parity)
+- Automatically prunes deleted upstream branches and tags (`--prune`)
+- Executed periodically inside the IBM network to respect GHE network boundaries
 
 
 RBAC

build/bin/sync-internal-mirror.sh

@@ -0,0 +1,121 @@
+#!/usr/bin/env bash
+# ==============================================================================
+# Script: sync-internal-mirror.sh
+# Purpose: Synchronize public github.com/ibm-mas/gitops to internal IBM GHE
+#          (github.ibm.com/automation-paas-cd-pipeline/mas-gitops) using
+#          native Git ref mirroring (pull model).
+#
+# Usage:
+#   ./sync-internal-mirror.sh [OPTIONS]
+#
+# Options:
+#   --dry-run              Run git push with --dry-run
+#   --source <repo>        Source repo (default: ibm-mas/gitops)
+#   --target <repo>        Target repo (default: automation-paas-cd-pipeline/mas-gitops)
+#   --ghe-host <host>      GHE host (default: github.ibm.com)
+#   --ghe-token <token>    GHE token (can also be set via GHE_TOKEN env var)
+#   --public-token <token> GitHub token (can also be set via PUBLIC_TOKEN env var)
+#   -h, --help             Show this help message
+#
+# Environment variables:
+#   SOURCE_REPO  (default: "ibm-mas/gitops")
+#   TARGET_REPO  (default: "automation-paas-cd-pipeline/mas-gitops")
+#   GHE_HOST     (default: "github.ibm.com")
+#   GHE_TOKEN    (required: PAT or Functional ID token with repo & workflow scope)
+#   PUBLIC_TOKEN (optional: token for public GitHub, unauthenticated if not set)
+# ==============================================================================
+
+set -euo pipefail
+
+SOURCE_REPO="${SOURCE_REPO:-ibm-mas/gitops}"
+TARGET_REPO="${TARGET_REPO:-automation-paas-cd-pipeline/mas-gitops}"
+GHE_HOST="${GHE_HOST:-github.ibm.com}"
+PUBLIC_TOKEN="${PUBLIC_TOKEN:-}"
+GHE_TOKEN="${GHE_TOKEN:-}"
+DRY_RUN=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --dry-run)
+      DRY_RUN="--dry-run"
+      shift
+      ;;
+    --source)
+      SOURCE_REPO="$2"
+      shift 2
+      ;;
+    --target)
+      TARGET_REPO="$2"
+      shift 2
+      ;;
+    --ghe-host)
+      GHE_HOST="$2"
+      shift 2
+      ;;
+    --ghe-token)
+      GHE_TOKEN="$2"
+      shift 2
+      ;;
+    --public-token)
+      PUBLIC_TOKEN="$2"
+      shift 2
+      ;;
+    -h|--help)
+      sed -n '2,24p' "$0" | sed 's/^# //' | sed 's/^#//'
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      exit 1
+      ;;
+  esac
+done
+
+if [[ -z "${GHE_TOKEN}" ]]; then
+  echo "ERROR: GHE_TOKEN environment variable or --ghe-token argument is required to authenticate against ${GHE_HOST}." >&2
+  exit 1
+fi
+
+# Configure temporary working directory
+WORK_DIR=$(mktemp -d)
+trap 'rm -rf "${WORK_DIR}"' EXIT
+
+cd "${WORK_DIR}"
+
+# Build source clone URL (public GitHub or direct path/URL)
+if [[ "${SOURCE_REPO}" =~ ^(https?://|/|\.) ]]; then
+  SOURCE_URL="${SOURCE_REPO}"
+elif [[ -n "${PUBLIC_TOKEN}" ]]; then
+  SOURCE_URL="https://x-access-token:${PUBLIC_TOKEN}@github.com/${SOURCE_REPO}.git"
+else
+  SOURCE_URL="https://github.com/${SOURCE_REPO}.git"
+fi
+
+# Build target URL (internal GHE or direct path/URL)
+if [[ "${TARGET_REPO}" =~ ^(https?://|/|\.) ]]; then
+  TARGET_URL="${TARGET_REPO}"
+else
+  TARGET_URL="https://x-access-token:${GHE_TOKEN}@${GHE_HOST}/${TARGET_REPO}.git"
+fi
+
+echo "=== Internal Mirror Sync Started ==="
+echo "Timestamp : $(date -u +"%Y-%m-%dT%H:%M:%SZ")"
+echo "Source    : https://github.com/${SOURCE_REPO}"
+echo "Target    : https://${GHE_HOST}/${TARGET_REPO}"
+if [[ -n "${DRY_RUN}" ]]; then
+  echo "Mode      : DRY RUN"
+fi
+
+echo "Cloning source repository (bare)..."
+git clone --bare "${SOURCE_URL}" repo.git
+cd repo.git
+
+echo "Pushing refs/heads/* and refs/tags/* to target repository..."
+# Explicitly push heads and tags; avoid pushing internal GitHub pull-request refs (refs/pull/*)
+if [[ -n "${DRY_RUN}" ]]; then
+  git push --dry-run --prune --force "${TARGET_URL}" "refs/heads/*:refs/heads/*" "refs/tags/*:refs/tags/*"
+else
+  git push --prune --force "${TARGET_URL}" "refs/heads/*:refs/heads/*" "refs/tags/*:refs/tags/*"
+fi
+
+echo "=== Internal Mirror Sync Completed Successfully ==="

build/deploy/internal-mirror-cronjob.yaml

@@ -0,0 +1,91 @@
+---
+# ==============================================================================
+# OpenShift / Kubernetes CronJob for Internal GHE Pull Mirror
+# Target: Syncs github.com/ibm-mas/gitops -> github.ibm.com/automation-paas-cd-pipeline/mas-gitops
+# ==============================================================================
+apiVersion: v1
+kind: Secret
+metadata:
+  name: mas-gitops-ghe-mirror-secret
+  labels:
+    app.kubernetes.io/name: mas-gitops-pull-mirror
+    app.kubernetes.io/part-of: mas-gitops-mirroring
+type: Opaque
+stringData:
+  # Replace with internal Functional ID (FID) Personal Access Token having repo & workflow scopes
+  GHE_TOKEN: "<REPLACE_WITH_INTERNAL_GHE_FID_TOKEN>"
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: mas-gitops-pull-mirror
+  labels:
+    app.kubernetes.io/name: mas-gitops-pull-mirror
+    app.kubernetes.io/part-of: mas-gitops-mirroring
+spec:
+  # Schedule: Every 15 minutes
+  schedule: "*/15 * * * *"
+  # Forbid overlapping executions to prevent race conditions during git push
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 5
+  jobTemplate:
+    spec:
+      backoffLimit: 2
+      template:
+        metadata:
+          labels:
+            app.kubernetes.io/name: mas-gitops-pull-mirror
+        spec:
+          restartPolicy: OnFailure
+          securityContext:
+            runAsNonRoot: true
+            seccompProfile:
+              type: RuntimeDefault
+          containers:
+            - name: git-mirror
+              image: image-registry.openshift-image-registry.svc:5000/openshift/tools:latest
+              imagePullPolicy: IfNotPresent
+              securityContext:
+                allowPrivilegeEscalation: false
+                readOnlyRootFilesystem: false
+                runAsNonRoot: true
+                capabilities:
+                  drop:
+                    - ALL
+              resources:
+                requests:
+                  cpu: 100m
+                  memory: 256Mi
+                limits:
+                  cpu: 500m
+                  memory: 512Mi
+              env:
+                - name: SOURCE_REPO
+                  value: "ibm-mas/gitops"
+                - name: TARGET_REPO
+                  value: "automation-paas-cd-pipeline/mas-gitops"
+                - name: GHE_HOST
+                  value: "github.ibm.com"
+                - name: GHE_TOKEN
+                  valueFrom:
+                    secretKeyRef:
+                      name: mas-gitops-ghe-mirror-secret
+                      key: GHE_TOKEN
+              command:
+                - /bin/bash
+                - -c
+                - |
+                  set -euo pipefail
+                  WORK_DIR=$(mktemp -d)
+                  trap 'rm -rf "${WORK_DIR}"' EXIT
+                  cd "${WORK_DIR}"
+
+                  echo "Cloning source bare: https://github.com/${SOURCE_REPO}.git"
+                  git clone --bare "https://github.com/${SOURCE_REPO}.git" repo.git
+                  cd repo.git
+
+                  echo "Pushing mirror refs to https://${GHE_HOST}/${TARGET_REPO}..."
+                  git push --prune --force "https://x-access-token:${GHE_TOKEN}@${GHE_HOST}/${TARGET_REPO}.git" "refs/heads/*:refs/heads/*" "refs/tags/*:refs/tags/*"
+
+                  echo "Mirror sync completed successfully at $(date -u +"%Y-%m-%dT%H:%M:%SZ")"