sloanops.admin/3031023-xyz-public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request 'Promote reviewed SloanOps account migration to production' (#18) from cms into main

Browse Source 
Reviewed-on: SloanOps/3031023-xyz#18
This commit is contained in:
sloanops.admin
2026-09-06 00:09:36 +00:00
parent af101449e9 5420a3f4e5
commit 620b4e15e5
10 changed files with 44 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/deploy-blog.yml
+6 -2
View File
@@ -41,6 +41,10 @@ jobs:
run: npm run build:site
- name: Verify selected output
run: npm run verify:build
- name: Verify SloanOps account target
env:
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }}
run: test "$CLOUDFLARE_ACCOUNT_ID" = "9894ee8f9432da1018e0f3861d86dedb"
- name: Upload non-production preview version
run: |
raw_ref="${GITHUB_REF_NAME:-${GITEA_REF_NAME:-preview}}"
@@ -48,5 +52,5 @@ jobs:
preview_alias="${preview_alias:-preview}"
npx wrangler versions upload --config wrangler/blog.production.jsonc --preview-alias "$preview_alias"
env:
CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
CLOUDFLARE_API_TOKEN: ${{ secrets.CF_MIGRATION_API_TOKEN }}
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }}
.gitea/workflows/deploy.yml
+6 -2
View File
@@ -41,6 +41,10 @@ jobs:
run: npm run build:site
- name: Verify selected output
run: npm run verify:build
- name: Verify SloanOps account target
env:
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }}
run: test "$CLOUDFLARE_ACCOUNT_ID" = "9894ee8f9432da1018e0f3861d86dedb"
- name: Upload non-production preview version
run: |
raw_ref="${GITHUB_REF_NAME:-${GITEA_REF_NAME:-preview}}"
@@ -48,5 +52,5 @@ jobs:
preview_alias="${preview_alias:-preview}"
npx wrangler versions upload --config wrangler/www.production.jsonc --preview-alias "$preview_alias"
env:
CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
CLOUDFLARE_API_TOKEN: ${{ secrets.CF_MIGRATION_API_TOKEN }}
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }}
.gitea/workflows/production-blog.yml
+6 -2
View File
@@ -42,8 +42,12 @@ jobs:
run: npm run build:site
- name: Verify production blog output
run: npm run verify:build
- name: Verify SloanOps account target
env:
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }}
run: test "$CLOUDFLARE_ACCOUNT_ID" = "9894ee8f9432da1018e0f3861d86dedb"
- name: Deploy Worker without custom domains or routes
run: npx wrangler deploy --config wrangler/blog.production.jsonc
env:
CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
CLOUDFLARE_API_TOKEN: ${{ secrets.CF_MIGRATION_API_TOKEN }}
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }}
.gitea/workflows/production-candidate.yml
+6 -2
View File
@@ -42,8 +42,12 @@ jobs:
run: npm run build:site
- name: Verify production output
run: npm run verify:build
- name: Verify SloanOps account target
env:
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }}
run: test "$CLOUDFLARE_ACCOUNT_ID" = "9894ee8f9432da1018e0f3861d86dedb"
- name: Deploy Worker without custom domains or routes
run: npx wrangler deploy --config wrangler/www.production.jsonc
env:
CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }}
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }}
CLOUDFLARE_API_TOKEN: ${{ secrets.CF_MIGRATION_API_TOKEN }}
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }}
docs/decap-cms-gitea-setup.md
+8 -6
View File
@@ -1,6 +1,8 @@
# Decap CMS: Gitea settings
Status: applied and verified for internal use on 2026-09-04. The repository
Status: SloanOps destination configuration prepared 2026-09-05; exact-origin
CORS and OAuth replacement must accompany the protected CMS merge. Prior
source-account settings were verified for internal use on 2026-09-04. The repository
targets the permanent `cms` staging branch, the CMS application is deployed
from `main`, and `sloanops.admin` is the approved internal editor. Client or
public access remains out of scope.
@@ -13,9 +15,9 @@ The repository implementation targets these fixed public values:
| Decap write branch | `cms` |
| Gitea base URL | `https://git.sloanops.com` |
| Gitea API root | `https://git.sloanops.com/api/v1` |
| Stable CMS origin | `https://cms-3031023-xyz-www.ksloan90.workers.dev` |
| Stable CMS origin | `https://cms-3031023-xyz-www.sloanops.workers.dev` |
| Production admin origin | `https://3031023.xyz` |
| Exact OAuth redirects | `https://cms-3031023-xyz-www.ksloan90.workers.dev/admin/` and `https://3031023.xyz/admin/` |
| Exact OAuth redirects | `https://cms-3031023-xyz-www.sloanops.workers.dev/admin/` and `https://3031023.xyz/admin/` |
| Required status context | `CMS content validation / cms-content-validation (pull_request)` |
The pilot and permanent branch names are intentionally slash-free. Decap
@@ -60,7 +62,7 @@ to this repository are represented by these settings:
```yaml
- GITEA__cors__ENABLED=true
- GITEA__cors__ALLOW_DOMAIN=https://cms-3031023-xyz-www.ksloan90.workers.dev,https://3031023.xyz
- GITEA__cors__ALLOW_DOMAIN=https://cms-3031023-xyz-www.sloanops.workers.dev,https://3031023.xyz
- GITEA__cors__METHODS=GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS
- GITEA__cors__MAX_AGE=10m
- GITEA__cors__ALLOW_CREDENTIALS=false
@@ -77,7 +79,7 @@ token or cookie:
```bash
curl --request OPTIONS 'https://git.sloanops.com/api/v1/version' \
--header 'Origin: https://cms-3031023-xyz-www.ksloan90.workers.dev' \
--header 'Origin: https://cms-3031023-xyz-www.sloanops.workers.dev' \
--header 'Access-Control-Request-Method: GET' \
--header 'Access-Control-Request-Headers: authorization,content-type'
```
@@ -95,7 +97,7 @@ CORS response were verified:
- Application name: `3031023.xyz Decap CMS`.
- Confidential client: **unchecked**. The browser client must use PKCE.
- Redirect URIs: exactly
`https://cms-3031023-xyz-www.ksloan90.workers.dev/admin/` and
`https://cms-3031023-xyz-www.sloanops.workers.dev/admin/` and
`https://3031023.xyz/admin/`, including trailing slashes.
- Do not add wildcards, localhost, the journal hostname, or branch-specific
Worker preview aliases as additional redirects.
docs/preview-deployment.md
+7 -5
View File
@@ -6,14 +6,16 @@ They do not deploy the version to production traffic.
| Site key | Versioned Worker | Stable `cms` alias | Production hostname |
| --- | --- | --- | --- |
| `www` | `3031023-xyz-www` | `cms-3031023-xyz-www.ksloan90.workers.dev` | `3031023.xyz` |
| `blog` | `3031023-xyz-blog` | `cms-3031023-xyz-blog.ksloan90.workers.dev` | `blog.3031023.xyz` |
| `www` | `3031023-xyz-www` | `cms-3031023-xyz-www.sloanops.workers.dev` | `3031023.xyz` |
| `blog` | `3031023-xyz-blog` | `cms-3031023-xyz-blog.sloanops.workers.dev` | `blog.3031023.xyz` |
The workflows derive the preview alias from the branch name, build with
preview robots rules, run output verification, and call `wrangler versions
upload`. They use the existing `CF_API_TOKEN` and `CF_ACCOUNT_ID` repository
secrets but contain no DNS, routes, custom-domain mutations, account IDs, or
tokens in source.
upload`. They use organization secrets `CF_MIGRATION_API_TOKEN` and
`CF_MIGRATION_ACCOUNT_ID`. Wrangler pins the destination SloanOps account ID.
They contain no DNS, route, or custom-domain mutations and no token values.
The current token expires 2026-10-05; replace it in organization secrets before
that date. Changing the old shared secret pair would affect unmigrated repos.
Only the stable CMS and production admin origins are registered with Gitea
OAuth/CORS. A CMS login attempt from a temporary branch alias is expected to
public/admin/config.yml
+2 -2
View File
@@ -8,8 +8,8 @@ backend:
auth_endpoint: https://git.sloanops.com/login/oauth/authorize
publish_mode: simple
site_url: https://cms-3031023-xyz-www.ksloan90.workers.dev
display_url: https://cms-3031023-xyz-www.ksloan90.workers.dev
site_url: https://cms-3031023-xyz-www.sloanops.workers.dev
display_url: https://cms-3031023-xyz-www.sloanops.workers.dev
show_preview_links: false
media_folder: public/images/uploads
scripts/verify-decap.mjs
+1 -1
View File
@@ -18,7 +18,7 @@ function expectSubset(actual, expected, path) {
const configPath = 'public/admin/config.yml';
const config = yaml.load(await readFile(configPath, 'utf8'));
const expectedOrigin = 'https://cms-3031023-xyz-www.ksloan90.workers.dev';
const expectedOrigin = 'https://cms-3031023-xyz-www.sloanops.workers.dev';
const expectedBackend = {
name: 'gitea',
repo: 'SloanOps/3031023-xyz',
wrangler/blog.production.jsonc
+1
View File
@@ -3,5 +3,6 @@
"name": "3031023-xyz-blog",
"compatibility_date": "2026-09-02",
"workers_dev": true,
"account_id": "9894ee8f9432da1018e0f3861d86dedb",
"assets": { "directory": "../dist/blog", "not_found_handling": "404-page" }
}
wrangler/www.production.jsonc
+1
View File
@@ -3,5 +3,6 @@
"name": "3031023-xyz-www",
"compatibility_date": "2026-09-02",
"workers_dev": true,
"account_id": "9894ee8f9432da1018e0f3861d86dedb",
"assets": { "directory": "../dist/www", "not_found_handling": "404-page" }
}