From bac4f8e81db60e0675977192196d86075b6a1e4c Mon Sep 17 00:00:00 2001
From: Nim G <theredspoon@users.noreply.github.com>
Date: Tue, 2 Jun 2026 01:00:59 -0300
Subject: [PATCH 1/2] ci: mirror Matrix pilot through enjimi ingress

---
 .github/workflows/mirror-to-enjimi.yml | 71 ++++++++++++++++++++++++--
 1 file changed, 66 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/mirror-to-enjimi.yml b/.github/workflows/mirror-to-enjimi.yml
index 5cc61a1c8e7..f06a144645a 100644
--- a/.github/workflows/mirror-to-enjimi.yml
+++ b/.github/workflows/mirror-to-enjimi.yml
@@ -5,19 +5,80 @@ on:
     branches:
       - native-matrix-channel-pilot
 
+permissions:
+  contents: read
+
 jobs:
   mirror:
     if: github.repository == 'theredspoon/ironclaw'
     runs-on: ubuntu-latest
+    env:
+      ENJIMI_REPOSITORY: enjimi/ironclaw
+      MIRROR_BRANCH: mirror/native-matrix-channel-pilot
+      TARGET_BRANCH: deployment-target
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Push to enjimi
+      - name: Generate enjimi mirror token
+        id: enjimi_token
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
+        with:
+          app-id: ${{ secrets.ENJIMI_MIRROR_APP_ID }}
+          private-key: ${{ secrets.ENJIMI_MIRROR_APP_PRIVATE_KEY }}
+          owner: enjimi
+          repositories: ironclaw
+
+      - name: Push to enjimi mirror ingress branch
+        env:
+          ENJIMI_TOKEN: ${{ steps.enjimi_token.outputs.token }}
+          SOURCE_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          git remote add enjimi "https://x-access-token:${ENJIMI_TOKEN}@github.com/${ENJIMI_REPOSITORY}.git"
+          git push enjimi "HEAD:refs/heads/${MIRROR_BRANCH}"
+
+      - name: Open or update deployment target PR
         env:
-          ENJIMI_PAT: ${{ secrets.ENJIMI_PAT }}
+          GH_TOKEN: ${{ steps.enjimi_token.outputs.token }}
+          SOURCE_SHA: ${{ github.sha }}
         run: |
-          git remote add enjimi https://x-access-token:${ENJIMI_PAT}@github.com/enjimi/ironclaw.git
-          git push enjimi HEAD:refs/heads/main
+          set -euo pipefail
+
+          existing_pr="$(
+            gh api --method GET "repos/${ENJIMI_REPOSITORY}/pulls" \
+              -F state=open \
+              -F base="${TARGET_BRANCH}" \
+              -F head="enjimi:${MIRROR_BRANCH}" \
+              --jq '.[0].number // empty'
+          )"
+
+          pr_body="$(
+            cat <<EOF
+          Mirrors reviewed source from theredspoon/ironclaw.
+
+          - source repository: \`${GITHUB_REPOSITORY}\`
+          - source branch: \`${GITHUB_REF_NAME}\`
+          - source sha: \`${SOURCE_SHA}\`
+          - target branch: \`${TARGET_BRANCH}\`
+
+          After this PR merges, \`${ENJIMI_REPOSITORY}:${TARGET_BRANCH}\` triggers the pilot Linux artifact workflow.
+          EOF
+          )"
+
+          if [[ -n "${existing_pr}" ]]; then
+            gh pr edit "${existing_pr}" \
+              --repo "${ENJIMI_REPOSITORY}" \
+              --title "Deploy Matrix pilot source ${SOURCE_SHA:0:12}" \
+              --body "${pr_body}"
+            echo "Updated existing enjimi deployment PR #${existing_pr}"
+          else
+            gh pr create \
+              --repo "${ENJIMI_REPOSITORY}" \
+              --base "${TARGET_BRANCH}" \
+              --head "${MIRROR_BRANCH}" \
+              --title "Deploy Matrix pilot source ${SOURCE_SHA:0:12}" \
+              --body "${pr_body}"
+          fi

From 62ef674e7940d8c044d0baadbcec6736d082a608 Mon Sep 17 00:00:00 2001
From: Nim G <theredspoon@users.noreply.github.com>
Date: Tue, 2 Jun 2026 01:21:19 -0300
Subject: [PATCH 2/2] ci: use mirror app client id

---
 .github/workflows/mirror-to-enjimi.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/mirror-to-enjimi.yml b/.github/workflows/mirror-to-enjimi.yml
index f06a144645a..62dc739c55b 100644
--- a/.github/workflows/mirror-to-enjimi.yml
+++ b/.github/workflows/mirror-to-enjimi.yml
@@ -24,10 +24,10 @@ jobs:
 
       - name: Generate enjimi mirror token
         id: enjimi_token
-        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         with:
-          app-id: ${{ secrets.ENJIMI_MIRROR_APP_ID }}
-          private-key: ${{ secrets.ENJIMI_MIRROR_APP_PRIVATE_KEY }}
+          client-id: ${{ vars.ENJIMI_IRONCLAW_MIRROR_CLIENT_ID }}
+          private-key: ${{ secrets.ENJIMI_IRONCLAW_MIRROR_PRIVATE_KEY }}
           owner: enjimi
           repositories: ironclaw