feat: mirror to Codeberg via SSH deploy key

Push clean copy (without .forgejo/ and prds/) to Codeberg on
each push to main. Uses SSH deploy key for authentication.

Also bumps kcl-ci to v1.40.0.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.forgejo/workflows/mirror-branch.yml

@@ -1,9 +1,9 @@
-# Generated by KCL v1.38.0 - DO NOT EDIT
+# Generated by KCL v1.40.0 - DO NOT EDIT
 # Source: .forgejo/kcl-ci/main.k
 # kcl-ci local: ~/stuff/gitrepos/wxs/actions/kcl-ci
 # kcl-ci remote: https://git.wxs.ro/actions/kcl-ci
 
-name: Mirror Branch
+name: Mirror to Remote
 'on':
   push:
     branches:
@@ -18,8 +18,8 @@ concurrency:
 env:
   READ_REPO_TOKEN: ${{ secrets.READ_REPO_TOKEN }}
 jobs:
-  update-mirror:
-    name: Update Mirror Branch
+  push-mirror:
+    name: Push to Mirror
     runs-on: grunt
     steps:
     - name: Checkout code
@@ -27,28 +27,30 @@ jobs:
       with:
         fetch-depth: '0'
         token: ${{ github.token }}
-    - name: Configure git credentials
+    - name: Configure SSH for mirror
       run: |-
-        git config --local user.name "forgejo-actions[bot]"
-        git config --local user.email "forgejo-actions[bot]@git.wxs.ro"
-        # Clear checkout action's extraheader (read-only token)
-        git config --local --unset-all http.https://git.wxs.ro/.extraheader || true
-        # Set remote URL with write token
-        git remote set-url origin "https://token:${GITHUB_TOKEN}@git.wxs.ro/${{ github.repository }}.git"
+        mkdir -p ~/.ssh
+        echo "${MIRROR_SSH_KEY}" > ~/.ssh/mirror_key
+        chmod 600 ~/.ssh/mirror_key
+        ssh-keyscan codeberg.org >> ~/.ssh/known_hosts 2>/dev/null
+        export GIT_SSH_COMMAND="ssh -i ~/.ssh/mirror_key -o StrictHostKeyChecking=no"
       env:
-        GITHUB_TOKEN: ${{ github.token }}
-    - name: Create mirror branch
+        MIRROR_SSH_KEY: ${{ secrets.CODEBERG_MIRROR_SSH_KEY }}
+    - name: Prepare and push to mirror
       run: |-
-        # Create or reset the mirror branch from current HEAD
-        git checkout -B codeberg
-
         # Remove excluded paths
         rm -rf .forgejo
         rm -rf prds
 
-        # Commit and force-push
+        # Commit cleaned tree (detached from source history)
+        git checkout -B mirror-staging
         git add -A
-        git commit -m "mirror: $(git log -1 --format='%h %s' main) [skip ci]" || echo "No changes to commit"
-        git push origin codeberg --force
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
+        git diff --cached --quiet || git commit -m "mirror: $(git log -1 --format='%h %s' main)"
+
+        # Push to remote via SSH
+        export GIT_SSH_COMMAND="ssh -i ~/.ssh/mirror_key -o StrictHostKeyChecking=no"
+        git remote add mirror git@codeberg.org:vtmocanu/claude-code-action.git
+        git push mirror mirror-staging:main --force
+
+        # Cleanup
+        rm -f ~/.ssh/mirror_key