sloanops.admin/3031023-xyz-public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Point pilot deployments and CMS preview at SloanOps

Browse Source
This commit is contained in:
Kevin
2026-09-05 19:37:11 -04:00
parent 09064da856
commit 8a7942c4c4
10 changed files with 44 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/deploy-blog.yml
+6 -2
View File
@@ -41,6 +41,10 @@ jobs:
run: npm run build:site run: npm run build:site
- name: Verify selected output - name: Verify selected output
run: npm run verify:build run: npm run verify:build
- name: Verify SloanOps account target
env:
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }}
run: test "$CLOUDFLARE_ACCOUNT_ID" = "9894ee8f9432da1018e0f3861d86dedb"
- name: Upload non-production preview version - name: Upload non-production preview version
run: | run: |
raw_ref="${GITHUB_REF_NAME:-${GITEA_REF_NAME:-preview}}" raw_ref="${GITHUB_REF_NAME:-${GITEA_REF_NAME:-preview}}"
@@ -48,5 +52,5 @@ jobs:
preview_alias="${preview_alias:-preview}" preview_alias="${preview_alias:-preview}"
npx wrangler versions upload --config wrangler/blog.production.jsonc --preview-alias "$preview_alias" npx wrangler versions upload --config wrangler/blog.production.jsonc --preview-alias "$preview_alias"
env: env:
CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }} CLOUDFLARE_API_TOKEN: ${{ secrets.CF_MIGRATION_API_TOKEN }}
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }} CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }}
.gitea/workflows/deploy.yml
+6 -2
View File
@@ -41,6 +41,10 @@ jobs:
run: npm run build:site run: npm run build:site
- name: Verify selected output - name: Verify selected output
run: npm run verify:build run: npm run verify:build
- name: Verify SloanOps account target
env:
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }}
run: test "$CLOUDFLARE_ACCOUNT_ID" = "9894ee8f9432da1018e0f3861d86dedb"
- name: Upload non-production preview version - name: Upload non-production preview version
run: | run: |
raw_ref="${GITHUB_REF_NAME:-${GITEA_REF_NAME:-preview}}" raw_ref="${GITHUB_REF_NAME:-${GITEA_REF_NAME:-preview}}"
@@ -48,5 +52,5 @@ jobs:
preview_alias="${preview_alias:-preview}" preview_alias="${preview_alias:-preview}"
npx wrangler versions upload --config wrangler/www.production.jsonc --preview-alias "$preview_alias" npx wrangler versions upload --config wrangler/www.production.jsonc --preview-alias "$preview_alias"
env: env:
CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }} CLOUDFLARE_API_TOKEN: ${{ secrets.CF_MIGRATION_API_TOKEN }}
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }} CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }}
.gitea/workflows/production-blog.yml
+6 -2
View File
@@ -42,8 +42,12 @@ jobs:
run: npm run build:site run: npm run build:site
- name: Verify production blog output - name: Verify production blog output
run: npm run verify:build run: npm run verify:build
- name: Verify SloanOps account target
env:
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }}
run: test "$CLOUDFLARE_ACCOUNT_ID" = "9894ee8f9432da1018e0f3861d86dedb"
- name: Deploy Worker without custom domains or routes - name: Deploy Worker without custom domains or routes
run: npx wrangler deploy --config wrangler/blog.production.jsonc run: npx wrangler deploy --config wrangler/blog.production.jsonc
env: env:
CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }} CLOUDFLARE_API_TOKEN: ${{ secrets.CF_MIGRATION_API_TOKEN }}
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }} CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }}
.gitea/workflows/production-candidate.yml
+6 -2
View File
@@ -42,8 +42,12 @@ jobs:
run: npm run build:site run: npm run build:site
- name: Verify production output - name: Verify production output
run: npm run verify:build run: npm run verify:build
- name: Verify SloanOps account target
env:
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }}
run: test "$CLOUDFLARE_ACCOUNT_ID" = "9894ee8f9432da1018e0f3861d86dedb"
- name: Deploy Worker without custom domains or routes - name: Deploy Worker without custom domains or routes
run: npx wrangler deploy --config wrangler/www.production.jsonc run: npx wrangler deploy --config wrangler/www.production.jsonc
env: env:
CLOUDFLARE_API_TOKEN: ${{ secrets.CF_API_TOKEN }} CLOUDFLARE_API_TOKEN: ${{ secrets.CF_MIGRATION_API_TOKEN }}
CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_ACCOUNT_ID }} CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CF_MIGRATION_ACCOUNT_ID }}
docs/decap-cms-gitea-setup.md
+8 -6
View File
@@ -1,6 +1,8 @@
# Decap CMS: Gitea settings # Decap CMS: Gitea settings
Status: applied and verified for internal use on 2026-09-04. The repository Status: SloanOps destination configuration prepared 2026-09-05; exact-origin
CORS and OAuth replacement must accompany the protected CMS merge. Prior
source-account settings were verified for internal use on 2026-09-04. The repository
targets the permanent `cms` staging branch, the CMS application is deployed targets the permanent `cms` staging branch, the CMS application is deployed
from `main`, and `sloanops.admin` is the approved internal editor. Client or from `main`, and `sloanops.admin` is the approved internal editor. Client or
public access remains out of scope. public access remains out of scope.
@@ -13,9 +15,9 @@ The repository implementation targets these fixed public values:
| Decap write branch | `cms` | | Decap write branch | `cms` |
| Gitea base URL | `https://git.sloanops.com` | | Gitea base URL | `https://git.sloanops.com` |
| Gitea API root | `https://git.sloanops.com/api/v1` | | Gitea API root | `https://git.sloanops.com/api/v1` |
| Stable CMS origin | `https://cms-3031023-xyz-www.ksloan90.workers.dev` | | Stable CMS origin | `https://cms-3031023-xyz-www.sloanops.workers.dev` |
| Production admin origin | `https://3031023.xyz` | | Production admin origin | `https://3031023.xyz` |
| Exact OAuth redirects | `https://cms-3031023-xyz-www.ksloan90.workers.dev/admin/` and `https://3031023.xyz/admin/` | | Exact OAuth redirects | `https://cms-3031023-xyz-www.sloanops.workers.dev/admin/` and `https://3031023.xyz/admin/` |
| Required status context | `CMS content validation / cms-content-validation (pull_request)` | | Required status context | `CMS content validation / cms-content-validation (pull_request)` |
The pilot and permanent branch names are intentionally slash-free. Decap The pilot and permanent branch names are intentionally slash-free. Decap
@@ -60,7 +62,7 @@ to this repository are represented by these settings:
```yaml ```yaml
- GITEA__cors__ENABLED=true - GITEA__cors__ENABLED=true
- GITEA__cors__ALLOW_DOMAIN=https://cms-3031023-xyz-www.ksloan90.workers.dev,https://3031023.xyz - GITEA__cors__ALLOW_DOMAIN=https://cms-3031023-xyz-www.sloanops.workers.dev,https://3031023.xyz
- GITEA__cors__METHODS=GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS - GITEA__cors__METHODS=GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS
- GITEA__cors__MAX_AGE=10m - GITEA__cors__MAX_AGE=10m
- GITEA__cors__ALLOW_CREDENTIALS=false - GITEA__cors__ALLOW_CREDENTIALS=false
@@ -77,7 +79,7 @@ token or cookie:
```bash ```bash
curl --request OPTIONS 'https://git.sloanops.com/api/v1/version' \ curl --request OPTIONS 'https://git.sloanops.com/api/v1/version' \
--header 'Origin: https://cms-3031023-xyz-www.ksloan90.workers.dev' \ --header 'Origin: https://cms-3031023-xyz-www.sloanops.workers.dev' \
--header 'Access-Control-Request-Method: GET' \ --header 'Access-Control-Request-Method: GET' \
--header 'Access-Control-Request-Headers: authorization,content-type' --header 'Access-Control-Request-Headers: authorization,content-type'
``` ```
@@ -95,7 +97,7 @@ CORS response were verified:
- Application name: `3031023.xyz Decap CMS`. - Application name: `3031023.xyz Decap CMS`.
- Confidential client: **unchecked**. The browser client must use PKCE. - Confidential client: **unchecked**. The browser client must use PKCE.
- Redirect URIs: exactly - Redirect URIs: exactly
`https://cms-3031023-xyz-www.ksloan90.workers.dev/admin/` and `https://cms-3031023-xyz-www.sloanops.workers.dev/admin/` and
`https://3031023.xyz/admin/`, including trailing slashes. `https://3031023.xyz/admin/`, including trailing slashes.
- Do not add wildcards, localhost, the journal hostname, or branch-specific - Do not add wildcards, localhost, the journal hostname, or branch-specific
Worker preview aliases as additional redirects. Worker preview aliases as additional redirects.
docs/preview-deployment.md
+7 -5
View File
@@ -6,14 +6,16 @@ They do not deploy the version to production traffic.
| Site key | Versioned Worker | Stable `cms` alias | Production hostname | | Site key | Versioned Worker | Stable `cms` alias | Production hostname |
| --- | --- | --- | --- | | --- | --- | --- | --- |
| `www` | `3031023-xyz-www` | `cms-3031023-xyz-www.ksloan90.workers.dev` | `3031023.xyz` | | `www` | `3031023-xyz-www` | `cms-3031023-xyz-www.sloanops.workers.dev` | `3031023.xyz` |
| `blog` | `3031023-xyz-blog` | `cms-3031023-xyz-blog.ksloan90.workers.dev` | `blog.3031023.xyz` | | `blog` | `3031023-xyz-blog` | `cms-3031023-xyz-blog.sloanops.workers.dev` | `blog.3031023.xyz` |
The workflows derive the preview alias from the branch name, build with The workflows derive the preview alias from the branch name, build with
preview robots rules, run output verification, and call `wrangler versions preview robots rules, run output verification, and call `wrangler versions
upload`. They use the existing `CF_API_TOKEN` and `CF_ACCOUNT_ID` repository upload`. They use organization secrets `CF_MIGRATION_API_TOKEN` and
secrets but contain no DNS, routes, custom-domain mutations, account IDs, or `CF_MIGRATION_ACCOUNT_ID`. Wrangler pins the destination SloanOps account ID.
tokens in source. They contain no DNS, route, or custom-domain mutations and no token values.
The current token expires 2026-10-05; replace it in organization secrets before
that date. Changing the old shared secret pair would affect unmigrated repos.
Only the stable CMS and production admin origins are registered with Gitea Only the stable CMS and production admin origins are registered with Gitea
OAuth/CORS. A CMS login attempt from a temporary branch alias is expected to OAuth/CORS. A CMS login attempt from a temporary branch alias is expected to
public/admin/config.yml
+2 -2
View File
@@ -8,8 +8,8 @@ backend:
auth_endpoint: https://git.sloanops.com/login/oauth/authorize auth_endpoint: https://git.sloanops.com/login/oauth/authorize
publish_mode: simple publish_mode: simple
site_url: https://cms-3031023-xyz-www.ksloan90.workers.dev site_url: https://cms-3031023-xyz-www.sloanops.workers.dev
display_url: https://cms-3031023-xyz-www.ksloan90.workers.dev display_url: https://cms-3031023-xyz-www.sloanops.workers.dev
show_preview_links: false show_preview_links: false
media_folder: public/images/uploads media_folder: public/images/uploads
scripts/verify-decap.mjs
+1 -1
View File
@@ -18,7 +18,7 @@ function expectSubset(actual, expected, path) {
const configPath = 'public/admin/config.yml'; const configPath = 'public/admin/config.yml';
const config = yaml.load(await readFile(configPath, 'utf8')); const config = yaml.load(await readFile(configPath, 'utf8'));
const expectedOrigin = 'https://cms-3031023-xyz-www.ksloan90.workers.dev'; const expectedOrigin = 'https://cms-3031023-xyz-www.sloanops.workers.dev';
const expectedBackend = { const expectedBackend = {
name: 'gitea', name: 'gitea',
repo: 'SloanOps/3031023-xyz', repo: 'SloanOps/3031023-xyz',
wrangler/blog.production.jsonc
+1
View File
@@ -3,5 +3,6 @@
"name": "3031023-xyz-blog", "name": "3031023-xyz-blog",
"compatibility_date": "2026-09-02", "compatibility_date": "2026-09-02",
"workers_dev": true, "workers_dev": true,
"account_id": "9894ee8f9432da1018e0f3861d86dedb",
"assets": { "directory": "../dist/blog", "not_found_handling": "404-page" } "assets": { "directory": "../dist/blog", "not_found_handling": "404-page" }
} }
wrangler/www.production.jsonc
+1
View File
@@ -3,5 +3,6 @@
"name": "3031023-xyz-www", "name": "3031023-xyz-www",
"compatibility_date": "2026-09-02", "compatibility_date": "2026-09-02",
"workers_dev": true, "workers_dev": true,
"account_id": "9894ee8f9432da1018e0f3861d86dedb",
"assets": { "directory": "../dist/www", "not_found_handling": "404-page" } "assets": { "directory": "../dist/www", "not_found_handling": "404-page" }
} }