In T317820#8340204, @brennen wrote:

It's also likely to be true that people care about seeing their contributions mirrored to GitHub for reputational / career / social standing purposes, since evidence of participation there is treated as the de facto real-world proxy for having done open source work in a bunch of contexts.

I don't like this state of affairs, but it's worth acknowledging that people may have reasons to care.

In T317820#8342476, @thcipriani wrote:

In T317820#8333031, @dduvall wrote:

I would think it would be on a repo by repo basis in the settings. Who has access to the wikimedia GitHub org? Seems like someone on our team should since we're the Gerrit/GitLab folks at WMF.

FWIW, it is not on a repo-by-repo basis. Gerrit actively pushes (see replication settings for gerrit in puppet.

Also, 🎉 you're now an owner in the GitHub org.

---

+1 for keeping mirroring to GitHub.

We don't have mirrors for every repo on Gerrit. There was one manual step to mirroring—the repository had to be manually created in GitHub first. After that, mirroring worked automagically.

There are two problems with mirroring from GitLab:

1. How to do it
2. How to stop Gerrit from doing it: does archiving a repo in Gerrit mean it's still mirrored from Gerrit to GitHub if the GitHub repo exists? If that's the case: can we modify replication settings to stop it?

Having the ability to inherit project config from the parent project (https://gitlab.com/gitlab-org/gitlab/-/issues/28593) would make operations like this easier to setup for large swaths of our hosted repos.

How to stop Gerrit from doing it: does archiving a repo in Gerrit mean it's still mirrored from Gerrit to GitHub if the GitHub repo exists? If that's the case: can we modify replication settings to stop it?

In Gerrit, the GitHub replica is configured with a group which is granted the read permission:

profile::gerrit::replication:
    github:
        url: 'git@github.com:wikimedia/${name}'
        authGroup: 'mediawiki-replication'
        mirror: false
        push:
            - '+refs/heads/*:refs/heads/*'
            - '+refs/tags/*:refs/tags/*'
...

From replication plugin config doc:

**remote.NAME.authGroup
Specifies the name of a group that the remote should use to access the repositories. ...
In the project administration web interface the read access can be specified for this group to control if a project should be replicated or not to the remote.

The permission is granted in https://gerrit.wikimedia.org/r/admin/repos/All-Projects,access which ALLOW the Read permission on refs/*. Thus all projects should depend on it and thus are replicated.

When archiving a repository (via Projects-Cleanup), we simply update the description to prefix it with [ARCHIVED] and mark the repository Read-only. It is still replicated though. We would need to reparent it from All-Projects to a new All-Archived-Projects which would BLOCK or DENY the Read permission to mediawiki-replication group.