GitHub to GitLab Mirror

GitHub main is the single source of truth. GitLab exists to build and deploy the same commit internally.

Safety Rules

• Discover both remotes from their URLs; do not assume they are named origin

and gitlab.

• Never merge, cherry-pick, or push GitLab-only commits into GitHub.
• A fast-forward update to GitLab may proceed after verification.
• Rewriting a divergent GitLab branch requires explicit user authorization and

an exact --force-with-lease expectation.

• Do not change the local branch or working tree to mirror remote refs.

Status

1. Fetch both authoritative refs:

bash git remote -v git fetch <github-remote> main git fetch <gitlab-remote> main

1. Record both SHAs and show commits unique to either side:

bash git rev-parse <github-remote>/main git rev-parse <gitlab-remote>/main git log --oneline <gitlab-remote>/main..<github-remote>/main git log --oneline <github-remote>/main..<gitlab-remote>/main

1. Classify the relationship:

• Equal: already mirrored.
• GitLab is an ancestor of GitHub: safe fast-forward.
• GitHub is an ancestor of GitLab: GitLab contains mirror-only commits.
• Neither is an ancestor: the remotes diverged.

Synchronize

For a verified fast-forward:

bash
git push <gitlab-remote> <github-remote>/main:refs/heads/main

For a GitLab-ahead or divergent branch, stop and display the GitLab-only commits. An explicit request to restore GitLab as the GitHub mirror authorizes discarding those mirror-only commits. Use the previously fetched GitLab SHA as the lease:

bash
git push \
  --force-with-lease=refs/heads/main:<expected-gitlab-sha> \
  <gitlab-remote> \
  <github-remote>/main:refs/heads/main

If the lease fails, fetch and reassess instead of weakening the protection.

Verify

Fetch both remotes again and require exact SHA equality from fresh refs:

bash
git fetch <github-remote> main
git fetch <gitlab-remote> main
test "$(git rev-parse <github-remote>/main)" = \
  "$(git rev-parse <gitlab-remote>/main)"

If GitHub advanced during the synchronization, return to the Status phase and mirror the new SHA. Do not claim success until one fresh fetch of both remotes observes equality.

Report both final SHAs and whether the GitLab build/deploy pipeline was triggered. Do not describe the mirror as synchronized until the SHAs match. The scheduled mirror job in .gitlab-ci.yml is the automation reference.