22124 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
jmiller	8c63b00953	Merge pull request 'fix(ci): recreate dev container to avoid name conflict on deploy' (#740) from fix/deploy-dev-container-conflict into dev	2026-07-05 15:18:53 +00:00
jmiller	6b81922c47	fix(ci): recreate dev container to avoid name conflict on deploy ... After the tag fix (#737) the dev deploy builds and pushes the image fine but fails at `docker compose up -d` with: Conflict. The container name "/mokogitea-dev" is already in use The dev service uses a fixed container_name, and the symlinked /opt/gitea-dev path makes compose's derived project name unstable, so an existing container is not recognized as the project's and `up` tries to create rather than recreate. Remove any lingering fixed-name container first, pin the compose project name, and force a fresh recreate so migrations run against the new image. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 10:17:08 -05:00
jmiller	2713c49aec	Merge pull request 'fix(ci): pass TAG/REGISTRY_TOKEN into remote shell in dev deploy' (#737) from fix/deploy-dev-var-expansion into dev	2026-07-05 06:15:01 +00:00
jmiller	3917bf6a29	fix(ci): pass TAG/REGISTRY_TOKEN into remote shell in dev deploy ... The dev deploy step used an unquoted SSH heredoc and referenced runner-side values as \$TAG / \$REGISTRY_TOKEN, deferring their expansion to the remote shell where those names are unset. The Docker build tag collapsed to "mokogitea:" and every dev deploy failed with `invalid tag ... invalid reference format` before any migration or server boot could run. Inject TAG and REGISTRY_TOKEN as an env prefix on the ssh command (`TAG='...' REGISTRY_TOKEN='...' bash -s`) and switch to a quoted heredoc so every $var expands in exactly one place: the remote host. Also fixes HEALTH_FMT (was defined on the runner but referenced remotely) and adds an explicit empty-TAG guard so a future regression fails loudly instead of building an untagged image. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 01:08:32 -05:00
jmiller	89ed32e961	Merge pull request 'fix: repair unit-test compile + vet failures (partial integration cleanup)' (#736) from fix/vet-test-suite-blockers into dev	2026-07-05 05:58:38 +00:00
jmiller	948e7bcd21	fix: partial repair of tests/integration compile errors (license test) ... api_license_keys_test.go used the outdated NewRequestWithBody signature (passing []byte where io.Reader is now required) — wrapped the string bodies in strings.NewReader. Note: tests/integration remains broadly pre-existing-broken across multiple other fork-added files (api_packages_composer type mismatch, etc.); those are a separate dedicated cleanup, not part of #727. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 00:27:30 -05:00
jmiller	5d797431f0	fix: repair pre-existing test-suite compile/vet failures ... `go vet ./...` (finally runnable with a local Go toolchain) surfaced three pre-existing failures that prevented the whole test tree from compiling — which is very likely why the "Project CI / Tests" job never went green. None relate to #727; all pre-existing on main. - modules/util/util_test.go: CryptoRandomInt/String/Bytes now return (value, error); the tests used single-value assignment. Updated to capture + assert the error (and dropped a now-redundant `var err error`). - tests/integration/auth_oauth2_test.go: `newFakeOIDCServer` was declared twice with different signatures (redeclaration = build failure). Renamed the config-struct variant to `newFakeOIDCServerWithConfig` and updated its caller; the (sub, oid) variant keeps the original name for its caller. - routers/web/repo/issue_comment.go: removed a redundant `&& statusIDStr != ""` duplicate condition (vet: redundant and). Verified: `go vet ./modules/util` clean; full `go vet ./...` re-run. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 00:23:04 -05:00
jmiller	63f773aa56	Merge pull request 'fix: repair build (renamed org-visibility helper) + gofmt' (#735) from fix/compile-hasorgvisible-and-gofmt into dev	2026-07-05 05:07:58 +00:00
jmiller	125eefc650	fix: repair build (renamed org-visibility helper) + gofmt ... Two pre-existing issues surfaced when the org-governance series was compiled locally with a real Go toolchain (go1.26.3) for the first time: - routers/api/v1/api.go:519 called organization.HasOrgOrUserVisible, which no longer exists — it was renamed to IsOwnerVisibleToDoer (models/organization/ org.go:548, identical signature). This one missed call site meant the whole routers/api/v1 package (and therefore the server binary) failed `go build`. With the rename, `go build ./...` is clean. - gofmt: api.go (a mis-indented commented-out /projects route block) and release.go (import sort: repo before updateserver) were gofmt-dirty. Fixed with gofmt -w on the two files this change already touches. Not part of #727, but blocks building/releasing the fork; found while validating the dev -> main promotion (#733). Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 00:06:48 -05:00
jmiller	d07cfd412b	Merge pull request 'chore: remove stray package-lock.json accidentally committed to dev' (#734) from chore/remove-stray-package-lock into dev	2026-07-05 04:40:58 +00:00
jmiller	bd821e2d44	chore: remove stray package-lock.json accidentally committed to dev ... package-lock.json (13.9k lines of generated npm lockfile) was swept into the org push-policy commit (3aac1b456c, #730) by a `git add -A` during a gofmt-fix restack. It is not tracked on main and is not part of the org-governance work. Removing it so the dev -> main promotion (#733) doesn't introduce it. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 23:40:16 -05:00
jmiller	aeed197ea5	Merge pull request 'feat(org): org-level email domain policy for members (#727)' (#732) from feat/org-email-domain into dev	2026-07-05 04:34:14 +00:00
jmiller	45fc346d52	Merge pull request 'feat(org): org-level repository defaults applied on repo create/transfer (#727)' (#731) from feat/org-repo-defaults into dev	2026-07-05 04:33:25 +00:00
jmiller	02071a23d6	Merge pull request 'feat(org): org-level push policy enforced in the pre-receive hook (#727)' (#730) from feat/org-push-policy into dev	2026-07-05 04:33:09 +00:00
jmiller	3a5c6a37cf	Merge pull request 'feat(org): org-level tag protection, layered with per-repo protected tags (#727)' (#729) from feat/org-tag-protection into dev	2026-07-05 04:32:53 +00:00
jmiller	37fb3703c7	Merge pull request 'fix(org): layer org-level branch protection with repo rules — most-restrictive wins (#727)' (#728) from fix/727-materialize-org-branch-protection into dev	2026-07-05 04:32:24 +00:00
jmiller	6a3db171c1	feat(org): org-level email domain policy for members (#727) ... Restricts which email domains an organization's members may have. When a policy is configured, a user can only be added to the org (via any team) if their primary email matches one of the allowed domain globs. Enforced at the single membership choke point services/org.AddTeamMember, which every add path (API, web, group-sync) funnels through — so one check covers them all. On violation it returns a typed ErrEmailDomainNotAllowed; the API team-add handler maps it to 422. - models/git/org_email_domain.go: OrgEmailDomainPolicy model + EmailAllowed (domain glob match) + OrgEmailDomainAllowed + typed error + CRUD. Migration 366. - API: GET/PATCH/DELETE /orgs/{org}/email_domain_policy. - Enforcement in services/org/team.go; 422 mapping in routers/api/v1/org/team.go. An empty policy imposes no restriction. This is the one bounded piece of the "access/security" tier; org 2FA-required and IP allowlists were deliberately NOT built here — they are cross-cutting enforcement (auth gating / request middleware) that needs a compiler + tests, not a blind stacked PR. Stacked on #731/#730/#729/#728 for migration ordering (this = 366). Swagger omitted. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block), imports (git_model added to the api team handler, gci order), typed-error detection, migration contiguous (366). Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 23:23:11 -05:00
jmiller	d3134b1c53	feat(org): org-level repository defaults applied on repo create/transfer (#727) ... Adds a single per-org repository-defaults config, applied to a repo when it is created in or transferred into the org via a notifier (services/org): - ForcePrivate — force new/transferred repos private (Repository.IsPrivate). - PR defaults (when ApplyPRDefaults) — allowed merge styles, default merge style, and auto-delete-branch-after-merge, written to the repo's pull-requests unit config via repo_service.UpdateRepositoryUnits. Best-effort: the notifier logs and swallows errors, so a defaults bug can never break repository creation or transfer. - models/git/org_repo_defaults.go: OrgRepoDefaults model + CRUD + migration 365. - API: GET/PATCH/DELETE /orgs/{org}/repo_defaults. - services/org/notifier.go: CreateRepository/TransferRepository -> apply defaults; registered from routers/init.go (org_service.Init()). Stacked on #730/#729/#728 for migration ordering (this = 365). Swagger omitted. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block, struct/DTO alignment), imports used, no Init() collision in services/org, migration contiguous (365), notifier signatures match the Notifier interface. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 23:22:38 -05:00
jmiller	3aac1b456c	feat(org): org-level push policy enforced in the pre-receive hook (#727) ... Adds a single per-org push policy that cascades to every repo of the org and is enforced in the pre-receive hook: - Branch/tag name conventions (glob) — a pushed ref name must match. Fail-closed. - Mandatory secret-scanning block-on-push — org can force secret blocking that a repo cannot disable (overrides the per-repo scanner config in the orchestrator). - Max pushed-file size — rejects a tip tree containing a blob over the limit. - Blocked file-path patterns — rejects pushes changing matching paths (reuses pull_service.CheckFileProtection). The two content checks (blocked paths, max size) FAIL OPEN on any error so a policy/parsing bug can never wedge all pushes; naming is fail-closed. - models/git/org_push_policy.go: OrgPushPolicy model + CRUD + matchers + GetOrgPushPolicyForRepo. Migration 364. - API: GET/PATCH/DELETE /orgs/{org}/push_policy (routers/api/v1/org/push_policy.go, DTOs in modules/structs/org_push_policy.go, wired in api.go). - Enforcement: routers/private/hook_pre_receive.go (branch: naming + blocked paths + max size; tag: naming) and services/security/orchestrator.go (secret mandate). Deferred: a repo-facing read-only view of the org push policy (it is an org-wide config, not per-repo overlay rules; readable via the API for now). Stacked on #729/#728 for migration ordering (this = 364). Swagger annotations omitted (can't regenerate without the toolchain). Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block), escape sequences in the ls-tree parser, imports used, migration contiguous (364), fail-open on content checks. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 23:20:39 -05:00
jmiller	b31336d1fe	feat(org): org-level tag protection, layered with per-repo protected tags (#727) ... Adds org-level tag protection as a parallel to org-level branch protection. An org tag rule is {NamePattern, AllowlistTeamIDs}; it cascades to every repo in the org and layers on top of the repo's own protected tags — a tag is controllable (push/delete) only if allowed at BOTH levels (fail-closed). - models/git/org_protected_tag.go: OrgProtectedTag model + CRUD + ToProtectedTag() (reuses the ProtectedTag matcher/allowlist logic) + IsUserAllowedToControlTagInRepo() which ANDs the repo decision with the org decision. Migration 363. - API: /orgs/{org}/tag_protections CRUD (routers/api/v1/org/tag_protection.go, DTOs in modules/structs/org_tag.go, wired in api.go). - Enforcement: the git push/delete hook (hook_pre_receive.go) and the two release paths (release.go create/delete) now call the layered check, so no per-site tag logic changes beyond swapping the helper. - View: the repo Tag settings page lists inherited org tag rules read-only. Stacked on #728 (branch-protection PR) for migration ordering — merge #728 first. Swagger annotations omitted (can't regenerate the swagger JSON without the toolchain); routes still register. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block, struct alignment), template nesting balances, all .Rule fields exist on OrgProtectedTag, all locale keys defined, JSON valid, migration contiguous (363). Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 21:37:18 -05:00
jmiller	4b68853f08	feat(org): add branch-deletion protection + expandable inherited-rule view (#727) ... Two related additions: 1. Branch deletion as an org-level ability. OrgProtectedBranch gained CanDelete / EnableDeleteAllowlist / DeleteAllowlistTeamIDs (migration 362), ToProtectedBranch maps them, and the API (create/edit/response DTOs + handlers) exposes enable_delete / enable_delete_allowlist / delete_allowlist_teams. The layering merge already combined delete fields, so org delete-protection now enforces once ToProtectedBranch populates them. 2. The repo Branch Protection view now renders each inherited org rule as an expandable detail (direct push, force-push, branch deletion, merge, required approvals, status checks, protected files) with team names resolved, instead of three headline badges. Still read-only. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Verified by hand: struct-field gofmt alignment, template block nesting balances, every .Rule field exists on OrgProtectedBranch, and all locale keys referenced in the template are defined. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 21:16:24 -05:00
jmiller	86bd8a2cad	feat(org): show inherited org branch-protection rules in repo settings (#727) ... The org "floor" is enforced implicitly at the choke point, so a repo admin couldn't see which org-level rules apply to their repo. Surface them in the repo's Branch Protection settings page (read-only), the way GitHub shows organization rulesets in a repository. - ProtectedBranchRules handler: when the owner is an org, load FindOrgProtectedBranchRules and expose them as OrgProtectedBranches. - branches.tmpl: new read-only "Organization Branch Protection" section listing each org rule with an "Organization" badge, a lock/read-only marker, and compact indicators (required approvals, signed commits, status checks). No edit/delete controls — these are managed at the org level. - en-US locale strings. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 20:25:24 -05:00
jmiller	24b3516c1d	fix(org): layer org-level branch protection with repo rules, most-restrictive wins (#727) ... Org-level branch protection was already consulted at the single enforcement choke point `GetFirstMatchProtectedBranchRule`, but only as a FALLBACK: if any repo-level rule matched the branch, the org rule was ignored entirely. That let a repo define a looser rule for a pattern and effectively opt out of the org's protection. Make the choke point LAYER the two rules instead: when both an org rule and a repo rule match a branch, return their most-restrictive (fail-closed) combination, so the org rule is a mandatory floor a repo can only tighten. - models/git/protected_branch_merge.go: mergeMostRestrictive + helpers. Allow flags AND'd; gate/require/block flags OR'd; RequiredApprovals max'd; required sets (status contexts, protected files) unioned; allow sets (whitelists, unprotected files) intersected. A disabled allowlist means "everyone", so it only constrains when enabled. - models/git/protected_branch_list.go: GetFirstMatchProtectedBranchRule now fetches both the repo rule and the org rule and merges when both match; returns whichever exists when only one matches. Org lookup factored into getFirstMatchOrgProtectedBranchRule. Supersedes the materialization approach previously proposed for this issue — the org fallback already existed, so only this one function needed to change. Fail-closed by design: any merge edge errs toward MORE protection (over-restrict) rather than less, so it cannot open a hole. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here — relying on CI to validate build, formatting, and tests. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 19:42:08 -05:00
jmiller	377dd019be	chore: sync auto-release.yml from Template-Generic [skip ci]	2026-07-04 23:27:10 +00:00
jmiller	5ffed39449	Merge pull request 'fix: render org teams list and make issue type editable (#720, #721)' (#726) from fix/team-list-and-issue-type-editable into main	2026-07-04 21:31:56 +00:00
jmiller	0cc569aef6	fix: render org teams list and make issue type editable (#720, #721) ... #720: org Teams page wrote ctx.Data["OrgListTeams"] but the template iterates .Teams, so no teams rendered. Use the canonical Teams key (matches org/home.go). #721: issue type sidebar gated editing on a FieldEditFlags data key that no handler sets (always nil -> always read-only). Use HasIssuesOrPullsWritePermission like the priority field; the /custom-type endpoint is already protected by reqRepoIssuesOrPullsWriter.	2026-07-04 16:27:32 -05:00
jmiller	4ed45a5916	chore: sync pr-check.yml from Template-Generic [skip ci]	2026-07-04 20:27:57 +00:00
jmiller	ea87b3db97	chore: sync pr-check.yml from Template-Generic [skip ci]	2026-07-04 20:22:43 +00:00
jmiller	d77b82a8af	chore: sync ci-generic.yml from Template-Generic [skip ci]	2026-07-04 20:22:34 +00:00
jmiller	22b0b14ea8	chore: sync pr-check.yml from Template-Generic [skip ci]	2026-07-04 19:38:21 +00:00
jmiller	1256f57d40	chore: sync ci-generic.yml from Template-Generic [skip ci]	2026-07-04 19:38:11 +00:00
jmiller	05763eb661	chore: sync branch-cleanup.yml from Template-Generic [skip ci]	2026-07-04 19:37:58 +00:00
jmiller	0c45a2fda3	chore: sync sync-on-merge.yml from Template-Generic [skip ci]	2026-07-04 19:05:30 +00:00
jmiller	8680fd1cab	chore: sync pre-release.yml from Template-Generic [skip ci]	2026-07-04 19:05:10 +00:00
jmiller	adf0e923df	chore: sync pr-check.yml from Template-Generic [skip ci]	2026-07-04 19:04:47 +00:00
jmiller	296df7792a	chore: sync notify.yml from Template-Generic [skip ci]	2026-07-04 19:04:37 +00:00
jmiller	51332a587d	chore: sync cleanup.yml from Template-Generic [skip ci]	2026-07-04 19:04:27 +00:00
jmiller	8fc2700c16	chore: sync ci-generic.yml from Template-Generic [skip ci]	2026-07-04 19:04:20 +00:00
jmiller	844b4b6e81	chore: sync auto-release.yml from Template-Generic [skip ci]	2026-07-04 19:04:10 +00:00
jmiller	cb9516b79b	Merge pull request 'fix: support radio inputs in admin system config form' (#724) from fix/admin-config-radio into main	2026-07-04 19:01:33 +00:00
jmiller	aea4370845	ci: no-op PR RC Release when updates.xml is absent ... The RC release workflow drives a Joomla-style updates.xml update stream. On a generic repo with no updates.xml, the Determine RC version step ran sed on a missing file and aborted under set -e (exit 2). Detect updates.xml presence and gate the update-stream steps (edit/create-release/commit) on it so the job succeeds and no-ops when there is nothing to package.	2026-07-04 13:53:15 -05:00
jmiller	fc234bc911	fix: remove dangling mcp-mokogitea-api submodule gitlink ... The tree carried a gitlink at mcp-mokogitea-api (mode 160000) with no .gitmodules entry, so git submodule update --init --recursive failed with exit 128 at checkout, breaking every PR build/release job. mcp-mokogitea-api is a separate repo, not a submodule; remove the gitlink from the index (keeping the local working-tree clone) and gitignore the path so it can't be re-added.	2026-07-04 13:46:35 -05:00
jmiller	b252e9569f	ci: allow fix/patch branches to target main and guard missing manifest ... Branch policy in pr-check.yml only allowed fix/* and patch/* to target dev/rc, blocking fix/* PRs to main despite the documented policy. Allow fix/* -> main and patch/* -> main. Also guard the Detect platform step for a missing .mokogitea/manifest.xml (removed in favor of the metadata API) so it no longer aborts the Validate PR job under set -e.	2026-07-04 13:36:47 -05:00
jmiller	efb0433412	fix: preserve server-rendered radio default when config value is empty ... LandingPageType.Mode defaults to "" (Go zero value), and the template renders the home radio as checked for an empty Mode. The initial radio fill would evaluate home.checked = ("home" === "") = false, unchecking the default on a fresh install. Skip assignment when the config value is empty so the server-rendered selection is preserved. Adds a test for the empty-value case.	2026-07-04 13:15:10 -05:00
jmiller	982e45a56e	fix: support radio inputs in admin system config form ... The system config form JS (config.ts) only mapped checkbox, text, textarea, and datetime-local elements. The fork landing_page.tmpl uses radio inputs for the Mode field, so fillFromSystemConfig() hit unsupportedElement() and threw, aborting all JS init on the admin settings page. Add radio handling in both directions: fill checks the option whose value matches the config value; collect returns the checked option's value and skips/nulls unchecked radios so a group resolves to exactly one value. Adds a radio-group test case.	2026-07-04 01:20:43 -05:00
jmiller	343cba690e	Update .mokogitea/ISSUE_TEMPLATE/feature_request.md	2026-07-01 05:18:57 +00:00
jmiller	78328146e5	Merge pull request 'fix: remove orphaned deploy-manual workflow' (#718) from fix/remove-deploy-manual into main ... fix: remove orphaned deploy-manual workflow [skip ci]	2026-06-30 18:33:36 +00:00
jmiller	84c6a94333	fix: remove orphaned deploy-manual workflow [skip ci]	2026-06-30 18:07:04 +00:00
jmiller	11b2195bdf	chore: sync auto-release.yml from Template-Generic [skip ci]	2026-06-28 20:07:10 +00:00
jmiller	f8a91ed34e	release: code security scanner (#552) ... Code security scanner with 22 OWASP pattern detection rules across 7 CWE categories (SQL injection, XSS, command injection, path traversal, insecure deserialization, hardcoded credentials, weak cryptography). Language-filtered scanning for Go, PHP, Python, JS/TS, Java, C#, Ruby.	2026-06-28 19:00:33 +00:00