Record completed internal CMS rollout
This commit is contained in:
Kevin
@@ -1,9 +1,9 @@
|
||||
# Decap CMS: Gitea settings
|
||||
|
||||
Status: the preview-only pilot was accepted for promotion on 2026-09-04. The
|
||||
repository now targets the permanent `cms` staging branch. Update the exact
|
||||
CORS origin and PKCE OAuth redirect only after its first preview deployment
|
||||
confirms the predicted alias. Nothing has been merged to `main`.
|
||||
Status: applied and verified for internal use on 2026-09-04. The repository
|
||||
targets the permanent `cms` staging branch, the CMS application is deployed
|
||||
from `main`, and `sloanops.admin` is the approved internal editor. Client or
|
||||
public access remains out of scope.
|
||||
|
||||
The repository implementation targets these fixed public values:
|
||||
|
||||
@@ -14,7 +14,8 @@ The repository implementation targets these fixed public values:
|
||||
| Gitea base URL | `https://git.sloanops.com` |
|
||||
| Gitea API root | `https://git.sloanops.com/api/v1` |
|
||||
| Stable CMS origin | `https://cms-3031023-xyz-www.ksloan90.workers.dev` |
|
||||
| Exact OAuth redirect URI | `https://cms-3031023-xyz-www.ksloan90.workers.dev/admin/` |
|
||||
| Production admin origin | `https://3031023.xyz` |
|
||||
| Exact OAuth redirects | `https://cms-3031023-xyz-www.ksloan90.workers.dev/admin/` and `https://3031023.xyz/admin/` |
|
||||
| Required status context | `CMS content validation / cms-content-validation (pull_request)` |
|
||||
|
||||
The pilot and permanent branch names are intentionally slash-free. Decap
|
||||
@@ -24,10 +25,10 @@ presented as an empty collection. The permanent `cms` branch is still a
|
||||
non-production staging branch: changes reach `main` only through the protected
|
||||
pull-request flow.
|
||||
|
||||
The Workers alias was confirmed after the first approved preview deployment.
|
||||
If Cloudflare later assigns a different stable origin,
|
||||
update the repository configuration, CORS origin, and OAuth redirect URI
|
||||
together through review before enabling login.
|
||||
The stable Worker alias and production admin route were confirmed. If either
|
||||
origin changes, update repository configuration, CORS, and OAuth together
|
||||
through review. Branch-specific preview aliases are intentionally not
|
||||
registered and will return `Unregistered Redirect URI` during login.
|
||||
|
||||
## Runner cache settings
|
||||
|
||||
@@ -53,24 +54,23 @@ action branches on every job; npm packages remain keyed separately by
|
||||
## Applied CORS policy
|
||||
|
||||
The tracked Gitea service in
|
||||
`/home/sloan/gitRepos/SloanOps/infrastructure/docker-compose.yml` contains
|
||||
these entries in the existing `gitea.environment` list and was deployed
|
||||
through the normal infrastructure change process:
|
||||
`/home/sloan/gitRepos/SloanOps/infrastructure/docker-compose.yml` was deployed
|
||||
with exact origins for the internal CMS applications. The two origins relevant
|
||||
to this repository are represented by these settings:
|
||||
|
||||
```yaml
|
||||
- GITEA__cors__ENABLED=true
|
||||
- GITEA__cors__ALLOW_DOMAIN=https://cms-3031023-xyz-www.ksloan90.workers.dev
|
||||
- GITEA__cors__ALLOW_DOMAIN=https://cms-3031023-xyz-www.ksloan90.workers.dev,https://3031023.xyz
|
||||
- GITEA__cors__METHODS=GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS
|
||||
- GITEA__cors__MAX_AGE=10m
|
||||
- GITEA__cors__ALLOW_CREDENTIALS=false
|
||||
- GITEA__cors__HEADERS=Authorization,Content-Type
|
||||
```
|
||||
|
||||
This is one exact origin, no wildcard, no cookie-bearing cross-origin request,
|
||||
and only the API methods and non-safelisted request headers used by the Gitea
|
||||
backend. Do not add the production domains, the journal preview, arbitrary
|
||||
Workers preview hosts, or localhost. Gitea's same-origin login page continues
|
||||
to use its own session cookie; Decap API calls use the OAuth bearer token.
|
||||
These are exact origins, not wildcards, and API requests do not carry cookies.
|
||||
Do not add arbitrary Worker preview hosts or localhost. Gitea's same-origin
|
||||
login page continues to use its own session cookie; Decap API calls use the
|
||||
OAuth bearer token.
|
||||
|
||||
After an approved Gitea deployment, verify a preflight without including a
|
||||
token or cookie:
|
||||
@@ -94,11 +94,11 @@ CORS response were verified:
|
||||
|
||||
- Application name: `3031023.xyz Decap CMS`.
|
||||
- Confidential client: **unchecked**. The browser client must use PKCE.
|
||||
- Redirect URI: exactly
|
||||
`https://cms-3031023-xyz-www.ksloan90.workers.dev/admin/`, including the
|
||||
trailing slash.
|
||||
- Do not add wildcards, localhost, either production hostname, or the journal
|
||||
preview as additional redirects.
|
||||
- Redirect URIs: exactly
|
||||
`https://cms-3031023-xyz-www.ksloan90.workers.dev/admin/` and
|
||||
`https://3031023.xyz/admin/`, including trailing slashes.
|
||||
- Do not add wildcards, localhost, the journal hostname, or branch-specific
|
||||
Worker preview aliases as additional redirects.
|
||||
- Copy only the public client ID into `backend.app_id` in
|
||||
`public/admin/config.yml` through a reviewed commit.
|
||||
- Do not store or use a client secret in the repository, Actions, Cloudflare,
|
||||
@@ -158,6 +158,11 @@ merge, administrator, or bypass allowlists.
|
||||
| Protection bypass allowlist | Enabled only for the named SloanOps operator user/team |
|
||||
| CMS/client account | Write access, but absent from every allowlist |
|
||||
|
||||
Do not assume a local Git identity can use the operator bypass. A direct
|
||||
protected-file push was rejected during the final Journal repair sync, and the
|
||||
successful path was a short branch followed by PR #11 into `cms`. Prefer that
|
||||
reviewable path for all operator-authored CMS code and configuration changes.
|
||||
|
||||
Enter this exact single value in **Unprotected file patterns**:
|
||||
|
||||
```text
|
||||
@@ -197,18 +202,22 @@ Workflows, source, scripts, package files, schemas, manifests, Wrangler
|
||||
configuration, `site.json` files, and the CMS application therefore cannot be
|
||||
altered by choosing another branch name.
|
||||
|
||||
## Verification before an editor invitation
|
||||
## Routine verification and promotion
|
||||
|
||||
1. Run `npm ci`, `npm run verify:cms`, and both site build/verifier pairs.
|
||||
2. Create `cms` from the reviewed baseline only after approval.
|
||||
3. Apply both protection rules together and confirm `main` is priority 1 and
|
||||
`*` is priority 2.
|
||||
4. Use the same non-operator account intended for Decap to prove allowed
|
||||
Markdown edits succeed and every protected-path/direct-`main` attempt fails.
|
||||
5. Open, but do not merge, a pull request into `main`. Confirm Gitea reports
|
||||
the exact required status context above and blocks merge without both its
|
||||
successful result and a current SloanOps approval.
|
||||
6. Confirm both branch previews remain no-index and production is unchanged.
|
||||
2. For CMS application/configuration work, branch from current `cms`, open a
|
||||
pull request back into `cms`, and review the no-index version previews.
|
||||
The required CMS status is scoped to pull requests into `main`, so the local
|
||||
full check is mandatory before this staging merge.
|
||||
3. Open `cms` to `main` and confirm Gitea reports the exact required status
|
||||
context above and blocks merge without its successful result and current
|
||||
SloanOps approval.
|
||||
4. Merge deliberately, then confirm each affected production Worker workflow
|
||||
succeeds and smoke-test the public routes.
|
||||
5. Merge the resulting `main` commit back into `cms` through another
|
||||
protected-branch pull request if the histories diverge.
|
||||
6. Confirm previews remain no-index and never expand OAuth/CORS for a temporary
|
||||
branch alias.
|
||||
|
||||
Do not treat a Decap UI restriction as authorization. Gitea's first-match
|
||||
branch rules are the enforcement boundary, and the pull-request build is the
|
||||
|
||||
Reference in New Issue
Block a user