GitHub Backups

GitHub jobs incrementally maintain complete Git mirrors and can also collect Git LFS objects, wikis, repository metadata, and release assets. Each job snapshots its combined managed workspace to one or more Restic repositories.

Use github-repository for an explicit URL list or github-owner to discover every repository owned by an organization or user.

Explicit repositories

One job can back up one or several repository URLs:

jobs:
  - job-id: example-github-repositories
    type: github-repository
    description: Complete GitHub repository backups.
    restic-repository-ids:
      - personal-b2
      - personal-local
    source:
      repository-urls:
        - git@github.com:example/example-repository.git
        - git@github.com:example/another-repository.git
      components:
        git: true
        lfs: true
        wiki: false
        metadata: false
        release-assets: false
      migration-timeout-seconds: 3600

Every component flag is required, at least one must be true, and lfs requires git. Every URL uses the same component and authentication settings. The optional Restic tag defaults to job-id.

Only safe github.com clone URLs are accepted:

git@github.com:OWNER/REPOSITORY.git
https://github.com/OWNER/REPOSITORY.git

Credentials, query strings, and fragments embedded in URLs are rejected. The list must identify distinct repositories; SSH and HTTPS URLs for the same repository cannot appear together.

Organization or user

Use github-owner to discover repositories on every run:

jobs:
  - job-id: example-organization
    type: github-owner
    restic-repository-ids:
      - personal-local
    source:
      owner-url: https://github.com/example
      clone-protocol: ssh
      components:
        git: true
        lfs: false
        wiki: false
        metadata: false
        release-assets: false
      migration-timeout-seconds: 3600

Discovery includes public, private, archived, and fork repositories visible to the active GitHub credentials and owned by the account. clone-protocol defaults to ssh. With no explicit API token, discovery uses gh auth login.

New repositories receive new owner/repository workspaces. Repositories no longer returned by GitHub are omitted from new snapshots but remain available in older immutable snapshots. Their local workspace is not deleted automatically.

Owner-job dry runs contact GitHub read-only to show the discovered plan. They do not create local files, run Git, or contact Restic.

Components

Component Backed-up data Update behavior
git Objects reachable through remote Git refs, including branch and tag history Initial git clone --mirror; later git remote update --prune
lfs Git LFS objects reachable from the mirror git lfs fetch --all origin
wiki Repository wiki as a separate Git mirror Missing wikis are recorded as not-present
metadata GitHub migration export with issues, pull requests, comments, attachments, and release metadata A new migration archive is requested each run
release-assets Binary files attached to releases New and changed assets download atomically

A Git-only job enables git and disables every other component. It contains commits, branches, tags, trees, and normal Git file content. It does not contain issue discussions, pull-request comments, submodule repository contents, or commits deleted from every remote ref. Without lfs, it contains pointer files but not the referenced large objects.

Next steps

Deliberate limits

This workflow does not export GitHub Actions artifacts, logs or caches, packages, secret values, forks as independent repositories, automatically discovered submodule repositories, or GitHub Enterprise. Add each independent Git or submodule repository URL that must be retained.