Keep the owid/public-skills mirror in sync automatically

[danyx23]

GH repo owid/public-skills is a private mirror of this repo. It exists because an org-level plugin in Claude Desktop / Claude Web has to be installed from a repo inside the owid org and it has to be private, so this repo’s content is republished there.

This adds .github/workflows/mirror-to-public-skills.yml, which on every push to main:

1. checks out owid/public-skills,
2. runs that repo’s own sync-upstream.sh — merge this repo’s main, regenerate the mirror’s README, push.

All the sync logic lives in the mirror; this workflow only triggers it. Nothing about this repo’s own content or CI changes.

Before merging

Add a repository secret MIRROR_SYNC_TOKEN: a fine-grained PAT scoped to owid/public-skills only, with Contents: read and write. The default GITHUB_TOKEN cannot reach another repository. Without the secret the first step fails with an explanation instead of an opaque checkout error.

Notes

• The mirror’s README.md is derived (.mirror/readme-notice.md + this repo’s README.md, regenerated each sync), so it can never drift or need a manual merge resolution.
• sync-upstream.sh fails loudly on a conflict in any file other than that README — which should not happen unless someone commits to upstream-owned files in the mirror.
• A weekly cron repairs drift if a push-triggered run ever fails; the sync is idempotent, so no-op runs are free. workflow_dispatch allows a manual re-run.
• Actions are disabled on the mirror, so mirrored copies of this repo’s workflows do not run there and the push does not trigger anything.

🤖 Generated with Claude Code

[danyx23]

Tested end to end against the real mirror before merge, by temporarily letting the workflow fire on this branch.

To prove the token can write and not merely read, the mirror’s README.md was deliberately clobbered first; the run repaired it:

MIRROR_SYNC_TOKEN can reach owid/public-skills.
==> fetching upstream
==> already up to date with upstream/main
==> regenerating README.md from .mirror/readme-notice.md + upstream README
[main 3465dcb] Re-apply mirror notice to README
==> pushing to origin/main
   6d1cbe3..3465dcb  main -> main

The resulting README was byte-identical to notice + upstream README, committed as github-actions[bot]. All test commits and the temporary branch trigger have been removed from both repos; the mirror is back to a clean history.

The first attempt failed with a bare Not Found from actions/checkout because the token could not see the private repo — which reads as though the repo does not exist. That is why the preflight step in the second commit exists: it now names the likely cause (expired, wrong resource owner, approval pending, repo not selected) instead.