sloanops.admin/3031023-xyz-public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Promote Decap staging branch to cms

Browse Source
This commit is contained in:
Kevin
2026-09-04 03:38:49 -04:00
parent 09a491b16b
commit 4104b921f2
4 changed files with 46 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/decap-cms-pilot.md
+26 -24
View File
@@ -1,8 +1,9 @@
# Decap CMS Gitea pilot
# Decap CMS Gitea pilot and promotion
Status: preview-only pilot infrastructure is active on `cms-pilot`: the stable
preview, narrow Gitea CORS policy, public PKCE OAuth application, and two
repository protection rules are configured. Nothing has been merged to
Status: the preview-only pilot was accepted for promotion to the permanent
`cms` staging branch on 2026-09-04. Repository configuration now targets the
predicted stable `cms` preview origin. CORS and OAuth must be changed together
only after that first preview confirms the alias. Nothing has been merged to
`main`, and production remains unchanged.
Updated: 2026-09-04
@@ -55,14 +56,14 @@ recorded in [Decap CMS pilot: Gitea settings](decap-cms-gitea-setup.md).
## Repository implementation
The `review/decap-cms-pilot` branch now contains the repository-side portion of
the pilot:
The reviewed pilot implementation is the baseline for the permanent `cms`
staging branch:
- `public/admin/` provides a permanently no-index admin shell and one shared
configuration for both site builds.
- The shell pins Decap CMS `3.15.1` by exact URL and verified SHA-384 integrity
value rather than a floating release range.
- The backend is fixed to `SloanOps/3031023-xyz` and `cms-pilot` and contains
- The backend is fixed to `SloanOps/3031023-xyz` and `cms` and contains
only the public client ID for the non-confidential Gitea PKCE application.
- All four Markdown content collections and every persisted frontmatter field
are modeled with the current Astro/Zod bounds. Markdown controls remain
@@ -88,8 +89,9 @@ the pilot:
by its former auto-detected private address. Warm jobs reuse dependency
tarballs without caching `node_modules`.
The pilot dependencies are active: the public client ID, exact-origin CORS
policy, `cms-pilot` branch, and both protection rules have been verified.
The pilot dependencies were verified on `cms-pilot`. The same protection rules
apply to `cms`; its exact-origin CORS and OAuth values are the remaining
operator-controlled promotion step.
## Proposed pilot architecture
@@ -98,7 +100,7 @@ Decap at /admin/
|
| Gitea PKCE OAuth and content/media commits only
v
cms-pilot branch
cms branch
|
+--> primary no-index Worker preview
|
@@ -119,11 +121,11 @@ is acceptable because both sites belong to the same root-domain repository and
the same owner. One Decap configuration exposes clearly labeled Primary Site
and Journal collection groups.
Preview URLs for branch `cms-pilot`:
Predicted preview URLs for branch `cms`:
- `https://cms-pilot-3031023-xyz-www.ksloan90.workers.dev/admin/`
- `https://cms-pilot-3031023-xyz-www.ksloan90.workers.dev/`
- `https://cms-pilot-3031023-xyz-blog.ksloan90.workers.dev/`
- `https://cms-3031023-xyz-www.ksloan90.workers.dev/admin/`
- `https://cms-3031023-xyz-www.ksloan90.workers.dev/`
- `https://cms-3031023-xyz-blog.ksloan90.workers.dev/`
Confirm the aliases from the successful Gitea Actions run rather than treating
these predicted URLs as authoritative.
@@ -229,13 +231,13 @@ Preview deployment remains branch-specific and may use the existing Worker
workflows. Cloudflare credentials stay scoped to the deployment step; content
validation does not need them.
Because Decap writes to a fixed `cms-pilot` branch, SloanOps creates the pull
Because Decap writes to a fixed `cms` branch, SloanOps creates the pull
request in Gitea. After an approved merge, synchronize the CMS branch with
`main` before the next editing cycle. Do not automate production merge.
If the pilot is accepted, replace the disposable branch with a permanent,
slash-free `cms` branch. It remains a preview/staging branch and retains the
same pull-request, validation, and approval path into `main`.
The accepted pilot is promoted by replacing the disposable branch with the
permanent, slash-free `cms` branch. It remains a preview/staging branch and
retains the same pull-request, validation, and approval path into `main`.
## Gitea and Decap setup
@@ -244,11 +246,11 @@ same pull-request, validation, and approval path into `main`.
2. Enable Gitea API CORS for the exact approved preview origin or origins.
Allow only required methods and headers, including `Authorization` and
`Content-Type`; do not use a wildcard origin.
3. Create `cms-pilot` from the reviewed repository baseline.
3. Create `cms` from the reviewed repository baseline.
4. Review the pinned Decap admin assets beneath `public/admin/`. Do not replace
the exact version and integrity value with a floating range.
5. Configure the Gitea backend for `SloanOps/3031023-xyz` and branch
`cms-pilot`.
`cms`.
6. Model every persisted frontmatter field with limits matching
`src/content.config.ts`. Do not let a CMS save silently remove an existing
field.
@@ -269,7 +271,7 @@ not record OAuth tokens or Cloudflare credentials.
| DC-02 | Open each preview `/admin/` route | Admin shell loads and remains no-index. |
| DC-03 | Authenticate with the approved operator account | PKCE login succeeds and the configured collections load. |
| DC-04 | Authenticate with an account without repository write access | Repository editing is unavailable. |
| DC-05 | Edit an existing draft journal post | One content-only commit lands on `cms-pilot`; the blog preview rebuilds. |
| DC-05 | Edit an existing draft journal post | One content-only commit lands on `cms`; the blog preview rebuilds. |
| DC-06 | Create, edit, and delete a disposable journal post | Filename, dates, tags, body, draft state, and cleanup remain schema-valid. |
| DC-07 | Edit a primary FAQ | Only the primary preview rebuilds and displays the change. |
| DC-08 | Edit service ordering and featured state | YAML types remain correct and the primary verifier passes. |
@@ -279,10 +281,10 @@ not record OAuth tokens or Cloudflare credentials.
| DC-12 | Attempt to modify `.gitea/workflows/**`, source, package, script, schema, Wrangler, and site-manifest paths with the CMS account | Gitea rejects every push. |
| DC-13 | Attempt to create a differently named branch and change a protected file | The fallback rule rejects the push; branch naming cannot bypass protection. |
| DC-14 | Attempt a direct push to `main` | Gitea rejects it. |
| DC-15 | Open a pull request from `cms-pilot` to `main` | Both sites validate; required review and merge controls are present. |
| DC-15 | Open a pull request from `cms` to `main` | Both sites validate; required review and merge controls are present. |
| DC-16 | Attempt to merge without status or approval | Gitea blocks the merge. |
| DC-17 | Inspect both preview responses | Expected routes work; preview metadata/headers prevent indexing; production remains unchanged. |
| DC-18 | Revert the disposable CMS changes on `cms-pilot` | Preview returns to baseline without changing either public site. |
| DC-18 | Revert disposable CMS changes on `cms` | Preview returns to baseline without changing either public site. |
| DC-19 | Refresh, sign out, reauthenticate, and let a session expire | Session behavior is understandable and no unsaved-content loss is observed. |
| DC-20 | Review commit attribution and audit history | Gitea identifies the editor and the exact content/media changes. |
@@ -312,7 +314,7 @@ account control over executable deployment files.
If the pilot is rejected or paused:
1. Revert or delete disposable changes on `cms-pilot`.
1. Revert or delete disposable changes on `cms`.
2. Delete the two disposable preview aliases/versions if desired; do not delete
production Workers or retained legacy rollback resources.
3. Revoke/delete the Decap OAuth application.