Module github 

Optional private GitHub mirror.

mirror ensures the target GitHub repo exists (creating it under the right account kind when it doesn’t) and pushes the requested branches to it.

SECURITY — the token must never leak:

• The GitHub REST calls carry the token in the Authorization header, never in a URL or query string, so a formatted request URL is tokenless.
• The git push carries the token in an environment variable (GIT_CONFIG_VALUE_0), applied by git as an http.extraheader — it is never in the push URL or in argv, so it can’t be seen in ps.
• Error messages format only HTTP {status} / transport kind, never a response body (which could echo request data) and never the token. As defense-in-depth, git’s stderr is scrubbed of the token before it is used.

Structs

TokenCheck

The result of preflighting a GitHub token against a repo’s mirror config (mirror check): whether it authenticates, what it can see, and whether it can push .github/workflows/ if the repo ships any.

Enums

RepoAccess

A token’s access to the mirror’s target GitHub repo, from GET /repos/{owner}/{repo}.

Functions

branches_to_mirror

From the just-updated refs, the short branch names the policy opts into the mirror: a refs/heads/<b> update whose <b> appears in configured.

check_token

Preflight token against owner/repo: does it authenticate, what scopes does it carry (if introspectable), and what access does it have to the repo. Never returns an Err — a failed call surfaces as valid: false or RepoAccess::Error so the caller can report every check even when one of the two calls fails.

mirror

Mirror branches of the bare repo at repo_path to github.com/{owner}/{repo_name}, creating the (private-by-default) GitHub repo first if it doesn’t exist.