sloanops.admin/3031023-xyz-public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Promote Decap staging branch to cms

Browse Source
This commit is contained in:
Kevin
2026-09-04 03:38:49 -04:00
parent 09a491b16b
commit 4104b921f2
4 changed files with 46 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/decap-cms-gitea-setup.md
+15 -15
View File
@@ -1,23 +1,23 @@
# Decap CMS pilot: Gitea settings
# Decap CMS: Gitea settings
Status: applied to the preview-only pilot on 2026-09-04. The stable preview,
narrow CORS policy, public PKCE OAuth application, and both branch-protection
rules are active. Nothing has been merged to `main`.
Status: the preview-only pilot was accepted for promotion on 2026-09-04. The
repository now targets the permanent `cms` staging branch. Update the exact
CORS origin and PKCE OAuth redirect only after its first preview deployment
confirms the predicted alias. Nothing has been merged to `main`.
The repository implementation targets these fixed public values:
| Setting | Value |
| --- | --- |
| Gitea repository | `SloanOps/3031023-xyz` |
| Decap write branch | `cms-pilot` |
| Planned live write branch | `cms` |
| Decap write branch | `cms` |
| Gitea base URL | `https://git.sloanops.com` |
| Gitea API root | `https://git.sloanops.com/api/v1` |
| Stable CMS origin | `https://cms-pilot-3031023-xyz-www.ksloan90.workers.dev` |
| Exact OAuth redirect URI | `https://cms-pilot-3031023-xyz-www.ksloan90.workers.dev/admin/` |
| Stable CMS origin | `https://cms-3031023-xyz-www.ksloan90.workers.dev` |
| Exact OAuth redirect URI | `https://cms-3031023-xyz-www.ksloan90.workers.dev/admin/` |
| Required status context | `CMS content validation / cms-content-validation (pull_request)` |
The pilot and planned live branch names are intentionally slash-free. Decap
The pilot and permanent branch names are intentionally slash-free. Decap
CMS 3.15.1 inserts the configured Gitea branch directly into its tree-API URL;
a slash-named branch such as `cms/pilot` is split as an API path and its 404 is
presented as an empty collection. The permanent `cms` branch is still a
@@ -38,7 +38,7 @@ through the normal infrastructure change process:
```yaml
- GITEA__cors__ENABLED=true
- GITEA__cors__ALLOW_DOMAIN=https://cms-pilot-3031023-xyz-www.ksloan90.workers.dev
- GITEA__cors__ALLOW_DOMAIN=https://cms-3031023-xyz-www.ksloan90.workers.dev
- GITEA__cors__METHODS=GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS
- GITEA__cors__MAX_AGE=10m
- GITEA__cors__ALLOW_CREDENTIALS=false
@@ -56,7 +56,7 @@ token or cookie:
```bash
curl --request OPTIONS 'https://git.sloanops.com/api/v1/version' \
--header 'Origin: https://cms-pilot-3031023-xyz-www.ksloan90.workers.dev' \
--header 'Origin: https://cms-3031023-xyz-www.ksloan90.workers.dev' \
--header 'Access-Control-Request-Method: GET' \
--header 'Access-Control-Request-Headers: authorization,content-type'
```
@@ -71,10 +71,10 @@ behavior before continuing.
The Gitea OAuth2 application was created after the stable preview origin and
CORS response were verified:
- Application name: `3031023.xyz Decap CMS pilot`.
- Application name: `3031023.xyz Decap CMS`.
- Confidential client: **unchecked**. The browser client must use PKCE.
- Redirect URI: exactly
`https://cms-pilot-3031023-xyz-www.ksloan90.workers.dev/admin/`, including the
`https://cms-3031023-xyz-www.ksloan90.workers.dev/admin/`, including the
trailing slash.
- Do not add wildcards, localhost, either production hostname, or the journal
preview as additional redirects.
@@ -148,7 +148,7 @@ directly into the flat uploads directory, and the local verifier rejects nested
media paths. Gitea file patterns are case-insensitive; CI verifies actual file
signatures and the 500 KiB limit before a preview can upload.
Everything not listed is protected from CMS/client pushes on `cms-pilot` and
Everything not listed is protected from CMS/client pushes on `cms` and
on every differently named branch, including:
```text
@@ -177,7 +177,7 @@ altered by choosing another branch name.
## Verification before an editor invitation
1. Run `npm ci`, `npm run verify:cms`, and both site build/verifier pairs.
2. Create `cms-pilot` from the reviewed baseline only after approval.
2. Create `cms` from the reviewed baseline only after approval.
3. Apply both protection rules together and confirm `main` is priority 1 and
`*` is priority 2.
4. Use the same non-operator account intended for Decap to prove allowed