fix: use FORGE_API_BASE for /repos/migrate endpoint, build payload with jq

- FORGE_API is repo-scoped; /repos/migrate needs the global FORGE_API_BASE
- Use jq -n --arg for safe JSON construction (no shell interpolation)
- Update docs to reference FORGE_API_BASE

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/mirror-bootstrap.md

@@ -8,7 +8,7 @@ How to populate an empty Forgejo repo from an external source using
 | Variable | Example | Purpose |
 |---|---|---|
 | `FORGE_URL` | `http://forgejo:3000` | Forgejo instance base URL |
-| `FORGE_API` | `${FORGE_URL}/api/v1` | API base (set by `lib/env.sh`) |
+| `FORGE_API_BASE` | `${FORGE_URL}/api/v1` | Global API base (set by `lib/env.sh`) |
 | `FORGE_TOKEN` | (admin or org-owner token) | Must have `repo:create` scope |
 
 The target org/user must already exist on the Forgejo instance.

lib/mirrors.sh

@@ -4,7 +4,7 @@
 # Usage: source lib/mirrors.sh; mirror_push
 #        source lib/mirrors.sh; mirror_pull_register <clone_url> <owner> <repo_name> [interval]
 # Requires: PROJECT_REPO_ROOT, PRIMARY_BRANCH, MIRROR_* vars from load-project.sh
-#           FORGE_API, FORGE_TOKEN for pull-mirror registration
+#           FORGE_API_BASE, FORGE_TOKEN for pull-mirror registration
 
 # shellcheck disable=SC2154  # globals set by load-project.sh / calling script
 
@@ -56,7 +56,7 @@ mirror_push() {
 #   interval   — sync interval (default: "8h0m0s"; Forgejo duration format)
 #
 # Requires:
-#   FORGE_API, FORGE_TOKEN (from env.sh)
+#   FORGE_API_BASE, FORGE_TOKEN (from env.sh)
 #
 # Returns 0 on success, 1 on failure.  Prints the new repo JSON to stdout.
 # ---------------------------------------------------------------------------
@@ -66,8 +66,8 @@ mirror_pull_register() {
   local repo_name="$3"
   local interval="${4:-8h0m0s}"
 
-  if [ -z "${FORGE_API:-}" ] || [ -z "${FORGE_TOKEN:-}" ]; then
-    echo "ERROR: FORGE_API and FORGE_TOKEN must be set" >&2
+  if [ -z "${FORGE_API_BASE:-}" ] || [ -z "${FORGE_TOKEN:-}" ]; then
+    echo "ERROR: FORGE_API_BASE and FORGE_TOKEN must be set" >&2
     return 1
   fi
 
@@ -77,23 +77,25 @@ mirror_pull_register() {
   fi
 
   local payload
-  payload=$(cat <<ENDJSON
-{
-  "clone_addr": "${clone_url}",
-  "repo_name": "${repo_name}",
-  "repo_owner": "${owner}",
-  "mirror": true,
-  "mirror_interval": "${interval}",
-  "service": "git"
-}
-ENDJSON
-  )
+  payload=$(jq -n \
+    --arg clone_addr "$clone_url" \
+    --arg repo_name  "$repo_name" \
+    --arg repo_owner "$owner" \
+    --arg interval   "$interval" \
+    '{
+      clone_addr:      $clone_addr,
+      repo_name:       $repo_name,
+      repo_owner:      $repo_owner,
+      mirror:          true,
+      mirror_interval: $interval,
+      service:         "git"
+    }')
 
   local http_code body
   body=$(curl -s -w "\n%{http_code}" -X POST \
     -H "Authorization: token ${FORGE_TOKEN}" \
     -H "Content-Type: application/json" \
-    "${FORGE_API}/repos/migrate" \
+    "${FORGE_API_BASE}/repos/migrate" \
     -d "$payload")
 
   http_code=$(printf '%s' "$body" | tail -n1)