sloanops.admin/3031023-xyz-public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Activate Gitea OAuth for CMS pilot

Browse Source
This commit is contained in:
Kevin
2026-09-04 01:01:12 -04:00
parent 7eeb9e1e01
commit 93090ecf87
3 changed files with 26 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/decap-cms-pilot.md
+11 -12
View File
@@ -1,8 +1,9 @@
# Decap CMS Gitea pilot
Status: repository implementation prepared for review; no OAuth application,
Gitea CORS change, branch protection, branch push, preview deployment, or
production merge has been performed.
Status: preview-only pilot infrastructure is active on `cms/pilot`: the stable
preview, narrow Gitea CORS policy, public PKCE OAuth application, and two
repository protection rules are configured. Nothing has been merged to
`main`, and production remains unchanged.
Updated: 2026-09-04
@@ -32,9 +33,8 @@ activation, repository invitation, or removal of a rollback resource.
Astro/Zod validation and are suitable for a bounded Decap pilot.
- The live Gitea instance reported version `1.27.3` during the Phase 9 review.
Decap's Gitea backend requires Gitea 1.20 or newer.
- A preflight request from the proposed CMS origin currently returns `405`
without an access-control origin header. Gitea CORS must be configured before
browser-based Decap authentication or repository access will work.
- Credential-free preflight verification grants the exact stable CMS origin
and does not grant an unrelated origin.
- Decap authenticates to Gitea with a non-confidential PKCE OAuth application.
Its Gitea backend currently has no editorial pull-request workflow, so it
writes directly to the configured branch.
@@ -50,10 +50,10 @@ References:
- <https://docs.gitea.com/usage/access-control/protected-branches/>
- <https://github.com/decaporg/decap-cms/issues/7115>
The exact, unapplied Gitea CORS, OAuth, and two-rule branch-protection settings
are recorded in [Decap CMS pilot: unapplied Gitea settings](decap-cms-gitea-setup.md).
The exact Gitea CORS, OAuth, and two-rule branch-protection settings are
recorded in [Decap CMS pilot: Gitea settings](decap-cms-gitea-setup.md).
## Repository implementation under review
## Repository implementation
The `review/decap-cms-pilot` branch now contains the repository-side portion of
the pilot:
@@ -62,9 +62,8 @@ the pilot:
configuration for both site builds.
- The shell pins Decap CMS `3.15.1` by exact URL and verified SHA-384 integrity
value rather than a floating release range.
- The backend is fixed to `SloanOps/3031023-xyz` and `cms/pilot`. Its public
OAuth client ID remains an explicit placeholder until the separately
approved non-confidential Gitea application exists.
- The backend is fixed to `SloanOps/3031023-xyz` and `cms/pilot` and contains
only the public client ID for the non-confidential Gitea PKCE application.
- All four Markdown collections and every persisted frontmatter field are
modeled with the current Astro/Zod bounds. Markdown controls are text-first;
image embedding and general file widgets are absent.