mirror-python.yml

# Mirror python:3.14-slim from Docker Hub into GHCR as quarantine/python.
#
# This caller only defines triggers and the image-specific inputs; the actual
# digest-check-and-copy logic lives in the reusable _mirror-image.yml workflow.
#
# Naming convention: "mirror-<image>.yml" for image mirror workflows, kept
# separate from "build-<app>.yml" build workflows. See
# docs/contributing/workflow-naming.md.
name: mirror / quarantine/python

on:
  # Daily upstream check at 06:00 UTC.
  schedule:
    - cron: "0 6 * * *"
  # Manual run, with an optional force copy.
  workflow_dispatch:
    inputs:
      force:
        description: "Copy even when the source and destination digests match."
        required: false
        default: false
        type: boolean

# Avoid overlapping runs for this specific image mirror.
concurrency:
  group: mirror-quarantine-python
  cancel-in-progress: false

permissions:
  contents: read
  packages: write

jobs:
  mirror-python:
    uses: ./.github/workflows/_mirror-image.yml
    with:
      source_image: docker.io/library/python
      source_tag: 3.14-slim
      dest_image: ghcr.io/toddysm/quarantine/python
      dest_tag: 3.14-slim
      force: ${{ github.event_name == 'workflow_dispatch' && inputs.force || false }}