diff --git a/.ci/README.md b/.ci/README.md
index ef88d0ef90..719d931872 100644
--- a/.ci/README.md
+++ b/.ci/README.md
@@ -147,3 +147,7 @@ critical lines... (like publish github releases, uploading files to sourceforge
 "dry-run" mode could be added.
 
 Make sure to cleanup after the test, e.g. discard the draft github release.
+
+## Workflow git-repo-sync
+
+Synchronizes the github git repository pmd/pmd on every push to sourceforge.
diff --git a/.ci/git-repo-sync.sh b/.ci/git-repo-sync.sh
new file mode 100755
index 0000000000..a32d6c9b03
--- /dev/null
+++ b/.ci/git-repo-sync.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+# Exit this script immediately if a command/function exits with a non-zero status.
+set -e
+
+SCRIPT_INCLUDES="log.bash utils.bash setup-secrets.bash"
+# shellcheck source=inc/fetch_ci_scripts.bash
+source "$(dirname "$0")/inc/fetch_ci_scripts.bash" && fetch_ci_scripts
+
+function git_repo_sync() {
+    echo
+    pmd_ci_utils_determine_build_env pmd/pmd
+    echo
+
+    if pmd_ci_utils_is_fork_or_pull_request; then
+        pmd_ci_log_error "This should not run on forked repositories or pull requests"
+        exit 0
+    fi
+
+    # only builds on pmd/pmd continue here
+    pmd_ci_log_group_start "Setup environment"
+        pmd_ci_setup_secrets_private_env
+        pmd_ci_setup_secrets_gpg_key
+        pmd_ci_setup_secrets_ssh
+    pmd_ci_log_group_end
+
+    pmd_ci_log_group_start "Git Sync"
+        git remote add pmd-sf "${PMD_SF_USER}@git.code.sf.net:/p/pmd/code"
+        if [ -n "${PMD_CI_BRANCH}" ]; then
+            git push pmd-sf "${PMD_CI_BRANCH}:${PMD_CI_BRANCH}"
+            pmd_ci_log_success "Successfully pushed ${PMD_CI_BRANCH} to sourceforge"
+        elif [ -n "${PMD_CI_TAG}" ]; then
+            git push pmd-sf tag "${PMD_CI_TAG}"
+            pmd_ci_log_success "Successfully pushed tag ${PMD_CI_TAG} to sourceforge"
+        else
+            pmd_ci_log_error "Don't know what to do: neither PMD_CI_BRANCH nor PMD_CI_TAG is set"
+            exit 1
+        fi
+    pmd_ci_log_group_end
+}
+
+git_repo_sync
+
+exit 0
diff --git a/.github/workflows/git-repo-sync.yml b/.github/workflows/git-repo-sync.yml
new file mode 100644
index 0000000000..18981e5f7f
--- /dev/null
+++ b/.github/workflows/git-repo-sync.yml
@@ -0,0 +1,49 @@
+name: git-repo-sync
+
+on:
+  push:
+    branches:
+      - main
+      - master
+    tags:
+      - '**'
+  pull_request:
+  schedule:
+    # build it monthly: At 04:00 on day-of-month 1.
+    - cron:  '0 4 1 * *'
+
+jobs:
+  build:
+    runs-on: ${{ matrix.os }}
+    continue-on-error: false
+    strategy:
+      matrix:
+        os: [ ubuntu-latest, windows-latest, macos-latest ]
+    if: ${{ !contains(github.event.head_commit.message, '[skip ci]') }}
+    steps:
+    - uses: actions/checkout@v2
+      with:
+        fetch-depth: 2
+    - uses: actions/cache@v2
+      with:
+        path: |
+          ~/.m2/repository
+          ~/.cache
+          vendor/bundle
+        key: ${{ runner.os }}-${{ hashFiles('**/pom.xml') }}
+        restore-keys: |
+          ${{ runner.os }}-
+    - name: Set up Ruby 2.7
+      uses: actions/setup-ruby@v1
+      with:
+        ruby-version: 2.7
+    - name: Setup Environment
+      shell: bash
+      run: |
+        echo "LANG=en_US.UTF-8" >> $GITHUB_ENV
+        echo "PMD_CI_SCRIPTS_URL=https://raw.githubusercontent.com/pmd/build-tools/master/scripts" >> $GITHUB_ENV
+    - name: Sync
+      run: .ci/git-repo-sync.sh
+      shell: bash
+      env:
+        PMD_CI_SECRET_PASSPHRASE: ${{ secrets.PMD_CI_SECRET_PASSPHRASE }}