T8943: migrate mirror wrapper to App-ready uniform stub (rollout 1b Task 5)

[andamasov]

Summary

Rollout 1b (mirror pipeline PAT→App migration), Task 5. Switches this repo's mirror wrapper from explicit secrets: PAT/REMOTE_OWNER pass-through to secrets: inherit and adopts the uniform stub (incl. vars.MIRROR_ENABLED per-repo kill-switch, default-on). Behavior-neutral against the current PAT-using central workflow. Prepares for the App-token central-workflow update (Task 7).

• Plan: ~/.claude/plans/2026-05-26-mirror-rollout-1b-revised.md Task 5
• Tracking: T8943

🤖 Generated by robots

[github-actions]

👍
No issues in PR Title / Commit Title

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: c1993d17-0355-4c1d-a857-30a071040c5e

📥 Commits

Reviewing files that changed from the base of the PR and between bb79a96 and 0474dec.

📒 Files selected for processing (1)

• .github/workflows/pr-mirror-repo-sync.yml

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated GitHub workflow for the mirror repo sync with a managed-by notice and user opt-out guidance.
  • Tightened job execution conditions to reduce unintended runs and refined manual dispatch input handling.
  • Simplified secret passing to the called workflow and adjusted workflow permissions for repository contents, pull requests, and issues.

Walkthrough

Adds a managed-by header with opt-out via vars.MIRROR_ENABLED=false (lines 1-3). Changes workflow_dispatch to require string sync_branch, renames primary job to call, gates job execution on github.repository_owner == 'vyos', merged PR/manual dispatch, and vars.MIRROR_ENABLED != 'false'; resolves sync_branch from inputs.sync_branch or PR base ref, switches to secrets: inherit, and sets write permissions for contents, pull-requests, and issues (lines 13-30).

Changes

Mirror pipeline workflow configuration

Layer / File(s)

Summary

Managed-by header and workflow execution gating .github/workflows/pr-mirror-repo-sync.yml

Lines 1-3: Header comment documents the workflow is managed and shows opt-out via vars.MIRROR_ENABLED=false. Lines 13-30: workflow_dispatch input sync_branch changed to required string; job renamed to call and guarded by github.repository_owner == 'vyos' and vars.MIRROR_ENABLED != 'false', allowing runs for merged pull_request_target and manual dispatch; invocation passes sync_branch as inputs.sync_branch or github.event.pull_request.base.ref, uses secrets: inherit, and sets contents, pull-requests, and issues write permissions.

✨ Finishing Touches

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch feature/rollout-1-wrapper-migration

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}