build.yml: checkout, the upstream merge and the build's GitHub downloads from our pull mirrors [skip ci]

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.forgejo/workflows/build.yml

@@ -38,6 +38,7 @@ concurrency:
 
 env:
   REGISTRY: forge.quinefoundation.com
+  MIRRORS: https://forge.quinefoundation.com/quine-global-labs
   IMAGE: forge.quinefoundation.com/quine-global-labs/aurora
   TAG: stable
 
@@ -46,7 +47,8 @@ jobs:
     runs-on: runner-x86-linux
     timeout-minutes: 300
     steps:
-      - uses: actions/checkout@v4
+      # Our pull mirror of code.forgejo.org/actions/checkout.
+      - uses: https://forge.quinefoundation.com/quine-global-labs/mirror-actions-checkout@v4
         with:
           fetch-depth: 0
 
@@ -55,7 +57,8 @@ jobs:
         run: |
           git config user.name "forgejo-actions"
           git config user.email "actions@forge.quinefoundation.com"
-          git fetch --no-tags https://github.com/ublue-os/aurora.git main
+          # Our pull mirror of github.com/ublue-os/aurora, synced hourly.
+          git fetch --no-tags "$MIRRORS/mirror-ublue-os-aurora.git" main
           before=$(git rev-parse HEAD)
           git merge --no-edit -m "Merge upstream ublue-os/aurora main" FETCH_HEAD
           if [ "$(git rev-parse HEAD)" != "$before" ]; then
@@ -64,6 +67,26 @@ jobs:
             echo "Already up to date with upstream."
           fi
 
+      - name: Point downloads at our mirrors
+        # Rewrites the GitHub files Aurora's build scripts fetch to our pull
+        # mirrors (public repos in this org, so the build needs no login).
+        # In the checkout only, not committed: committing would conflict
+        # with upstream's edits to these scripts at every merge. A URL that
+        # upstream changes no longer matches and is fetched from GitHub as
+        # before. skip-worktree keeps `git status` clean, which the Justfile
+        # reads to label the image with the commit rather than "deadbeef".
+        run: |
+          files=$(grep -rlE 'github(usercontent)?\.com/(ublue-os/(akmods|countme)|rcaloras/bash-preexec|coreos/fedora-coreos-config)/' build_scripts)
+          sed -i -E \
+            -e "s#https://github\.com/ublue-os/akmods/raw/refs/heads/([^/]+)/#$MIRRORS/mirror-ublue-os-akmods/raw/branch/\1/#g" \
+            -e "s#https://raw\.githubusercontent\.com/ublue-os/countme/([^/]+)/#$MIRRORS/mirror-ublue-os-countme/raw/branch/\1/#g" \
+            -e "s#https://raw\.githubusercontent\.com/rcaloras/bash-preexec/([0-9a-f]{40})/#$MIRRORS/mirror-rcaloras-bash-preexec/raw/commit/\1/#g" \
+            -e "s#https://raw\.githubusercontent\.com/coreos/fedora-coreos-config/refs/heads/([^/]+)/#$MIRRORS/mirror-coreos-fedora-coreos-config/raw/branch/\1/#g" \
+            $files
+          git update-index --skip-worktree $files
+          git diff -U0 --no-ext-diff HEAD -- $files | grep '^[-+][^-+]' || true
+          grep -rn "$MIRRORS" build_scripts
+
       - name: Log in to the registry
         env:
           REGISTRY_USER: ${{ vars.REGISTRY_USER || github.actor }}