Built in private, released in public: self-hosted GitLab to GitHub

The workshop is a self-hosted GitLab I own and run. The shop window is GitHub. Development happens in private with no metered CI bill and full control of the runners; when a release is ready, one GitLab CI job mirrors the source to GitHub and cuts a release with the built binaries. Here's the actual pipeline that does it, gotchas included.