Sync: the GitHub copy over SSH with a deploy key (host keys pinned) (#178)

Sync: the GitHub copy over SSH with a deploy key, host keys pinned (#178)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017K4vyY3yUD3GsvoZaAtKkD

.github/workflows/sync.yml

@@ -3,7 +3,7 @@ name: sync
 # per branch: main goes out to every copy, fast-forward only (a copy with commits of its own is reported, never
 # overwritten); the branches a copy is told to send back (claude/* from cloud sessions on GitHub) come in as PRs here,
 # and Time's council reviews and lands them like any other. Each copy's token is a secret named in sync.json and passed
-# below; a copy without one is skipped. On a GitHub copy, turn GitHub Actions off: these workflows must run here only.
+# below (a token for https, a deploy key for ssh); a copy without one is skipped. On a GitHub copy, turn GitHub Actions off: these workflows must run here only.
 on:
   push:
     branches: [main]
@@ -27,9 +27,12 @@ jobs:
         with:
           sparse-checkout: .github/time
           persist-credentials: false
+      # a copy over SSH (a deploy key) needs the ssh client; the job image may not have it
+      - run: command -v ssh || (apt-get update -qq && apt-get install -y -qq --no-install-recommends openssh-client >/dev/null)
       - run: python3 .github/time/sync.py
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TIME_TOKEN: ${{ secrets.TIME_TOKEN }}   # branches and PRs on the home go in as the `time` user
           SYNC_FORCE: ${{ inputs.force && '1' || '' }}
-          GITHUB_MIRROR_TOKEN: ${{ secrets.GITHUB_MIRROR_TOKEN }}   # github.com/teahubxyz/time: Contents read/write
+          GITHUB_MIRROR_KEY: ${{ secrets.GITHUB_MIRROR_KEY }}       # github.com/teahubxyz/time: a deploy key with write access
+          GITHUB_MIRROR_TOKEN: ${{ secrets.GITHUB_MIRROR_TOKEN }}   # or a token, for a copy over https