From 8a7942c4c4db6e8fa37e60790e033341c16c24c5 Mon Sep 17 00:00:00 2001 From: Kevin Date: Sat, 5 Sep 2026 19:37:11 -0400 Subject: [PATCH] Point pilot deployments and CMS preview at SloanOps --- .gitea/workflows/deploy-blog.yml | 8 ++++++-- .gitea/workflows/deploy.yml | 8 ++++++-- .gitea/workflows/production-blog.yml | 8 ++++++-- .gitea/workflows/production-candidate.yml | 8 ++++++-- docs/decap-cms-gitea-setup.md | 14 ++++++++------ docs/preview-deployment.md | 12 +++++++----- public/admin/config.yml | 4 ++-- scripts/verify-decap.mjs | 2 +- wrangler/blog.production.jsonc | 1 + wrangler/www.production.jsonc | 1 + 10 files changed, 44 insertions(+), 22 deletions(-) diff --git a/.gitea/workflows/deploy-blog.yml b/.gitea/workflows/deploy-blog.yml index 4cd75a0..497d39a 100644 --- a/.gitea/workflows/deploy-blog.yml +++ b/.gitea/workflows/deploy-blog.yml @@ -41,6 +41,10 @@ jobs: run: npm run build:site - name: Verify selected output run: npm run verify:build + - name: Verify SloanOps account target + env: + CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }} + run: test "$CLOUDFLARE_ACCOUNT_ID" = "9894ee8f9432da1018e0f3861d86dedb" - name: Upload non-production preview version run: | raw_ref="${GITHUB_REF_NAME:-${GITEA_REF_NAME:-preview}}" @@ -48,5 +52,5 @@ jobs: preview_alias="${preview_alias:-preview}" npx wrangler versions upload --config wrangler/blog.production.jsonc --preview-alias "$preview_alias" env: - CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }} - CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }} + CLOUDFLARE_API_TOKEN: ${{ secrets.CF_MIGRATION_API_TOKEN }} + CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }} diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index cbbaa0b..1b8cb17 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -41,6 +41,10 @@ jobs: run: npm run build:site - name: Verify selected output run: npm run verify:build + - name: Verify SloanOps account target + env: + CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }} + run: test "$CLOUDFLARE_ACCOUNT_ID" = "9894ee8f9432da1018e0f3861d86dedb" - name: Upload non-production preview version run: | raw_ref="${GITHUB_REF_NAME:-${GITEA_REF_NAME:-preview}}" @@ -48,5 +52,5 @@ jobs: preview_alias="${preview_alias:-preview}" npx wrangler versions upload --config wrangler/www.production.jsonc --preview-alias "$preview_alias" env: - CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }} - CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }} + CLOUDFLARE_API_TOKEN: ${{ secrets.CF_MIGRATION_API_TOKEN }} + CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }} diff --git a/.gitea/workflows/production-blog.yml b/.gitea/workflows/production-blog.yml index 20ff24e..7c23d8d 100644 --- a/.gitea/workflows/production-blog.yml +++ b/.gitea/workflows/production-blog.yml @@ -42,8 +42,12 @@ jobs: run: npm run build:site - name: Verify production blog output run: npm run verify:build + - name: Verify SloanOps account target + env: + CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }} + run: test "$CLOUDFLARE_ACCOUNT_ID" = "9894ee8f9432da1018e0f3861d86dedb" - name: Deploy Worker without custom domains or routes run: npx wrangler deploy --config wrangler/blog.production.jsonc env: - CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }} - CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }} + CLOUDFLARE_API_TOKEN: ${{ secrets.CF_MIGRATION_API_TOKEN }} + CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }} diff --git a/.gitea/workflows/production-candidate.yml b/.gitea/workflows/production-candidate.yml index 7778ee9..7eddb63 100644 --- a/.gitea/workflows/production-candidate.yml +++ b/.gitea/workflows/production-candidate.yml @@ -42,8 +42,12 @@ jobs: run: npm run build:site - name: Verify production output run: npm run verify:build + - name: Verify SloanOps account target + env: + CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }} + run: test "$CLOUDFLARE_ACCOUNT_ID" = "9894ee8f9432da1018e0f3861d86dedb" - name: Deploy Worker without custom domains or routes run: npx wrangler deploy --config wrangler/www.production.jsonc env: - CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }} - CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }} + CLOUDFLARE_API_TOKEN: ${{ secrets.CF_MIGRATION_API_TOKEN }} + CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }} diff --git a/docs/decap-cms-gitea-setup.md b/docs/decap-cms-gitea-setup.md index c476f51..8ec7ba5 100644 --- a/docs/decap-cms-gitea-setup.md +++ b/docs/decap-cms-gitea-setup.md @@ -1,6 +1,8 @@ # Decap CMS: Gitea settings -Status: applied and verified for internal use on 2026-09-04. The repository +Status: SloanOps destination configuration prepared 2026-09-05; exact-origin +CORS and OAuth replacement must accompany the protected CMS merge. Prior +source-account settings were verified for internal use on 2026-09-04. The repository targets the permanent `cms` staging branch, the CMS application is deployed from `main`, and `sloanops.admin` is the approved internal editor. Client or public access remains out of scope. @@ -13,9 +15,9 @@ The repository implementation targets these fixed public values: | Decap write branch | `cms` | | Gitea base URL | `https://git.sloanops.com` | | Gitea API root | `https://git.sloanops.com/api/v1` | -| Stable CMS origin | `https://cms-3031023-xyz-www.ksloan90.workers.dev` | +| Stable CMS origin | `https://cms-3031023-xyz-www.sloanops.workers.dev` | | Production admin origin | `https://3031023.xyz` | -| Exact OAuth redirects | `https://cms-3031023-xyz-www.ksloan90.workers.dev/admin/` and `https://3031023.xyz/admin/` | +| Exact OAuth redirects | `https://cms-3031023-xyz-www.sloanops.workers.dev/admin/` and `https://3031023.xyz/admin/` | | Required status context | `CMS content validation / cms-content-validation (pull_request)` | The pilot and permanent branch names are intentionally slash-free. Decap @@ -60,7 +62,7 @@ to this repository are represented by these settings: ```yaml - GITEA__cors__ENABLED=true -- GITEA__cors__ALLOW_DOMAIN=https://cms-3031023-xyz-www.ksloan90.workers.dev,https://3031023.xyz +- GITEA__cors__ALLOW_DOMAIN=https://cms-3031023-xyz-www.sloanops.workers.dev,https://3031023.xyz - GITEA__cors__METHODS=GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS - GITEA__cors__MAX_AGE=10m - GITEA__cors__ALLOW_CREDENTIALS=false @@ -77,7 +79,7 @@ token or cookie: ```bash curl --request OPTIONS 'https://git.sloanops.com/api/v1/version' \ - --header 'Origin: https://cms-3031023-xyz-www.ksloan90.workers.dev' \ + --header 'Origin: https://cms-3031023-xyz-www.sloanops.workers.dev' \ --header 'Access-Control-Request-Method: GET' \ --header 'Access-Control-Request-Headers: authorization,content-type' ``` @@ -95,7 +97,7 @@ CORS response were verified: - Application name: `3031023.xyz Decap CMS`. - Confidential client: **unchecked**. The browser client must use PKCE. - Redirect URIs: exactly - `https://cms-3031023-xyz-www.ksloan90.workers.dev/admin/` and + `https://cms-3031023-xyz-www.sloanops.workers.dev/admin/` and `https://3031023.xyz/admin/`, including trailing slashes. - Do not add wildcards, localhost, the journal hostname, or branch-specific Worker preview aliases as additional redirects. diff --git a/docs/preview-deployment.md b/docs/preview-deployment.md index 585b105..4543871 100644 --- a/docs/preview-deployment.md +++ b/docs/preview-deployment.md @@ -6,14 +6,16 @@ They do not deploy the version to production traffic. | Site key | Versioned Worker | Stable `cms` alias | Production hostname | | --- | --- | --- | --- | -| `www` | `3031023-xyz-www` | `cms-3031023-xyz-www.ksloan90.workers.dev` | `3031023.xyz` | -| `blog` | `3031023-xyz-blog` | `cms-3031023-xyz-blog.ksloan90.workers.dev` | `blog.3031023.xyz` | +| `www` | `3031023-xyz-www` | `cms-3031023-xyz-www.sloanops.workers.dev` | `3031023.xyz` | +| `blog` | `3031023-xyz-blog` | `cms-3031023-xyz-blog.sloanops.workers.dev` | `blog.3031023.xyz` | The workflows derive the preview alias from the branch name, build with preview robots rules, run output verification, and call `wrangler versions -upload`. They use the existing `CF_API_TOKEN` and `CF_ACCOUNT_ID` repository -secrets but contain no DNS, routes, custom-domain mutations, account IDs, or -tokens in source. +upload`. They use organization secrets `CF_MIGRATION_API_TOKEN` and +`CF_MIGRATION_ACCOUNT_ID`. Wrangler pins the destination SloanOps account ID. +They contain no DNS, route, or custom-domain mutations and no token values. +The current token expires 2026-10-05; replace it in organization secrets before +that date. Changing the old shared secret pair would affect unmigrated repos. Only the stable CMS and production admin origins are registered with Gitea OAuth/CORS. A CMS login attempt from a temporary branch alias is expected to diff --git a/public/admin/config.yml b/public/admin/config.yml index 97f48a8..31ef861 100644 --- a/public/admin/config.yml +++ b/public/admin/config.yml @@ -8,8 +8,8 @@ backend: auth_endpoint: https://git.sloanops.com/login/oauth/authorize publish_mode: simple -site_url: https://cms-3031023-xyz-www.ksloan90.workers.dev -display_url: https://cms-3031023-xyz-www.ksloan90.workers.dev +site_url: https://cms-3031023-xyz-www.sloanops.workers.dev +display_url: https://cms-3031023-xyz-www.sloanops.workers.dev show_preview_links: false media_folder: public/images/uploads diff --git a/scripts/verify-decap.mjs b/scripts/verify-decap.mjs index f28e33a..d62c66d 100644 --- a/scripts/verify-decap.mjs +++ b/scripts/verify-decap.mjs @@ -18,7 +18,7 @@ function expectSubset(actual, expected, path) { const configPath = 'public/admin/config.yml'; const config = yaml.load(await readFile(configPath, 'utf8')); -const expectedOrigin = 'https://cms-3031023-xyz-www.ksloan90.workers.dev'; +const expectedOrigin = 'https://cms-3031023-xyz-www.sloanops.workers.dev'; const expectedBackend = { name: 'gitea', repo: 'SloanOps/3031023-xyz', diff --git a/wrangler/blog.production.jsonc b/wrangler/blog.production.jsonc index d2fd0b4..c66128f 100644 --- a/wrangler/blog.production.jsonc +++ b/wrangler/blog.production.jsonc @@ -3,5 +3,6 @@ "name": "3031023-xyz-blog", "compatibility_date": "2026-09-02", "workers_dev": true, + "account_id": "9894ee8f9432da1018e0f3861d86dedb", "assets": { "directory": "../dist/blog", "not_found_handling": "404-page" } } diff --git a/wrangler/www.production.jsonc b/wrangler/www.production.jsonc index c65469a..70d7ba0 100644 --- a/wrangler/www.production.jsonc +++ b/wrangler/www.production.jsonc @@ -3,5 +3,6 @@ "name": "3031023-xyz-www", "compatibility_date": "2026-09-02", "workers_dev": true, + "account_id": "9894ee8f9432da1018e0f3861d86dedb", "assets": { "directory": "../dist/www", "not_found_handling": "404-page" } }