github-lookinglass

name

github-lookinglass

description

File a Vionix LookinGlass mirror request for a github.com GitHub Action by filling out the IssueOps form at https://<git-host>/github/vionix-lookinglass/issues/new?template=mirrorrepo.yaml. Use this skill whenever the user asks to mirror a github.com repo/action into <git-host>, to "create a mirror request", "onboard a github action", or mentions vionix-lookinglass mirror issues — even if they only provide the upstream URL. It maps the user's intent to every form field, submits the issue with the gh CLI, and explains the follow-up IssueOps commands (@vionix validate, @vionix lgtm) and the GHAS exposed-secrets resume flow.

GitHub LookinGlass Mirror Request

Creates the IssueOps request that mirrors a public github.com GitHub Action into https://<git-host>/github/UPSTREAM_ORG-UPSTREAM_REPO. The form is defined by the mirrorrepo.yaml issue template of github/vionix-lookinglass, and the automation parses the issue body by the exact field headings, so the format below must be preserved.

Mirror naming

A LookinGlass mirror is a repository in GitHub Enterprise (<git-host>) under the server organization github. The upstream github.com/ORG/REPO maps to the internal repository github/ORG-REPO, so workflow references should use github/ORG-REPO@VERSION. For example, https://github.com/pozil/auto-assign-issue is mirrored as pozil/auto-assign-issue and should be referenced as pozil/auto-assign-issue@v1.4.0.

Filling out the form

Given a PROVIDED_URL like https://github.com/OWNER/REPO:

Field	How to fill it
Title	Mirror repo PROVIDED_URL
🔗 Repository URL	PROVIDED_URL (strip trailing / and .git)
💥 Repository Type	Keep the default: github-action-repo
📋 General Reasons	Check the boxes matching the user's stated reasons: API rate-limit problems downloading the action (1st) or pulling Docker images (2nd), and verified-owner customization (3rd). For everything not matched, check ONLY the last one: It is from an unverified org owner, but a cusstomization is required for general Viasat teams.
🛃 Repository justification	Capture the user's intent in a sentence (why/where the action is used). If the user provided none, state that no justification was provided and ask them to edit the issue with one.
👀 Repository visibility	Public (only option)
👑 Repository Owner	github (only option)
👥 Repository access	Keep the default: @github-actions-innersource-admins,maintain
🔗 Primary Usecase Url	The internal https://<git-host>/OWNER/REPO where the user intends to use the action (ask if unknown; the mirror is removed if unused for 2 weeks)

Submitting with the gh CLI

Write the body to a file preserving the exact ### headings (they must match the form labels), then create the issue with the mirrorrepo label (normally applied by the template):

### 🔗 Repository URL

https://github.com/pozil/auto-assign-issue

### 💥 Repository Type

github-action-repo

### 📋 General Reasons

- [ ] Problems with API rate limit exceeded while this Github runner cannot download this action.
- [ ] Problems with API rate limits exceeded while this action pulls Docker Images from Dockerhub.
- [ ] It is from a verified org owner in the Marketplace, but I need to customize it for general purpose.
- [x] It is from an unverified org owner, but a cusstomization is required for general Viasat teams.

### 🛃 Repository justification

Used by the Vionix LookingGlass IssueOps automation to auto-assign mirror request issues to the parent admins team with weighted assignments ().

### 👀 Repository visibility

Public

### 👑 Repository Owner

github

### 👥 Repository access

@github-actions-innersource-admins,maintain

### 🔗 Primary Usecase Url

https://<git-host>/Viasat/vionix

GH_HOST=<git-host> gh issue create -R github/vionix-lookinglass \
  --title "Mirror repo https://github.com/pozil/auto-assign-issue" \
  --label mirrorrepo \
  --body-file /tmp/mirror-request.md

Example request created with this skill: https:///github/vionix-lookinglass/issues/107

What happens after submitting

1. The IssueOps automation reacts, assigns a user from the parent team github-actions-innersource-admins, and validates the form (@vionix validate can re-run validation at any time; @vionix assign re-runs the weighted assignment on demand — e.g. when nobody was selected — so requests never get stuck unassigned).
2. On ✅ Validation passed, an authorized admin comments @vionix lgtm to fulfill the request: repo creation, mirror sync, records in mirrors.yaml, docs under mirrors/github.com/ORG/REPO/, and a Slack thread in the configured channel.
3. If GHAS push protection blocks the sync (🔐 GHAS Push Protection blocked the mirror sync comment), follow its steps: open each unblock-secret URL, mark the secret as It's used in tests, add the label Resolved Exposed Secrets to the issue, and comment @vionix lgtm again to resume. The accepted risk is recorded in the record's plural risks map — a single accepted-by-requester message in risks.exposed_secrets (risks.exposed_dependabot is a placeholder implemented later) — in mirrors.yaml, in the mirror docs, and in the Slack thread (Supply Chain Risk / Upstream State).
4. The issue closes automatically when the mirror completes.

Customized mirrors — missing LookinGlass feature

LookinGlass mirrors track the upstream repository only. When a mirrored action must be customized for Viasat, the customization is maintained in a viasat/CUSTOMIZATION_BRANCH branch (e.g. viasat/main) on the mirror repo, on top of the upstream code.

Feature gap: LookinGlass does not yet flag mirrors that carry such branches. ALL GitHub actions mirrored under the github org MUST be flagged when a custom Viasat branch exists, so maintainers know the branch has to be kept rebased/validated on every upstream sync.

The desired feature is specified in of github/vionix-lookinglass (features index: docs/DESIRED-FEATURES.md): the find-customization job of the scheduled vionix-features-sync.yaml cron workflow (three times a day — morning, afternoon, evening — Monday to Friday; shared with 's compliance-finder/garbage-collector jobs) scans every mirror repo in the github org for viasat/* branches, flags the matches, and updates MIRRORS.md with a "Customization Needed" column carrying the branch name.

Until that ships, flag customized mirrors manually in MIRRORS.md and in the consolidation record (docs/EXTERNAL-MIRROR-ACTIONS.md §4 of vionix-github-workflows).