fix(org-wiki): also rewrite absolute-form intra-wiki links

Match an optional https://host prefix so wiki links rendered as absolute
URLs (not just root-relative) are rewritten to the /-/wiki/ route too.
Covers nested pages like standards/Wiki-Structure.

Claude-Session: https://claude.ai/code/session_01Bqe7fAuHQeiLueYfeHFrHw

.gitignore

@@ -120,3 +120,6 @@ prime/
 
 # A Makefile for custom make targets
 Makefile.local
+
+# Local clone of the MCP server (separate repo, not a submodule of this project)
+/mcp-mokogitea-api/

.mokogit/workflows/auto-bump.yml

@@ -0,0 +1,66 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGit.Workflow
+# INGROUP: mokocli.Release
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /.mokogit/workflows/auto-bump.yml
+# VERSION: 09.02.00
+# BRIEF: Auto patch-bump version on every push to dev (skips merge commits)
+
+name: "Universal: Auto Version Bump"
+
+on:
+  push:
+    branches:
+      - dev
+      - rc
+      - 'feature/**'
+      - 'patch/**'
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+
+permissions:
+  contents: write
+
+jobs:
+  bump:
+    name: Version Bump
+    runs-on: release
+    if: >-
+      !contains(github.event.head_commit.message, '[skip ci]') &&
+      !contains(github.event.head_commit.message, '[skip bump]') &&
+      !startsWith(github.event.head_commit.message, 'Merge pull request')
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          token: ${{ secrets.MOKOGIT_TOKEN }}
+          fetch-depth: 1
+
+      - name: Setup mokocli tools
+        run: |
+          if ! command -v composer &> /dev/null; then
+            sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
+          fi
+          if [ -d "/opt/mokocli/cli" ]; then
+            echo "MOKO_CLI=/opt/mokocli/cli" >> "$GITHUB_ENV"
+          else
+            git clone --depth 1 --branch main --quiet \
+              "https://x-access-token:${{ secrets.MOKOGIT_TOKEN }}@git.mokoconsulting.tech/MokoConsulting/mokocli.git" \
+              /tmp/mokocli
+            cd /tmp/mokocli && composer install --no-dev --no-interaction --quiet
+            echo "MOKO_CLI=/tmp/mokocli/cli" >> "$GITHUB_ENV"
+          fi
+
+      - name: Bump version
+        run: |
+          php ${MOKO_CLI}/version_auto_bump.php \
+            --path . --branch "${GITHUB_REF_NAME}" \
+            --token "${{ secrets.MOKOGIT_TOKEN }}" \
+            --repo-url "https://x-access-token:${{ secrets.MOKOGIT_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"

.mokogit/workflows/auto-release.yml

@@ -0,0 +1,505 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGit.Workflow
+# INGROUP: mokocli.Release
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
+# PATH: /templates/workflows/universal/auto-release.yml.template
+# VERSION: 05.00.00
+# BRIEF: Universal build & release � detects platform from manifest.xml
+#
+# +=======================================================================+
+# |              UNIVERSAL BUILD & RELEASE PIPELINE                        |
+# +=======================================================================+
+# |                                                                        |
+# |  Reads manifest.xml (joomla|dolibarr|generic) to branch logic.       |
+# |                                                                        |
+# |  Platform-specific:                                                    |
+# |    joomla:   XML manifest, type-prefixed packages                      |
+# |    dolibarr: mod*.class.php, update.txt, dev version reset             |
+# |    generic:  README-only, no update stream                             |
+# |                                                                        |
+# +=======================================================================+
+
+name: "Universal: Build & Release"
+
+on:
+  pull_request:
+    types: [opened, synchronize, closed]
+    branches:
+      - main
+    paths-ignore:
+      - '.mokogit/workflows/**'
+      - '*.md'
+      - 'wiki/**'
+      - '.editorconfig'
+      - '.gitignore'
+      - '.gitattributes'
+      - '.gitmessage'
+      - 'LICENSE' 
+  workflow_dispatch:
+    inputs:
+      action:
+        description: 'Action to perform'
+        required: false
+        type: choice
+        default: release
+        options:
+          - release
+          - promote-rc
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  GIT_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
+  GIT_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
+
+permissions:
+  contents: write
+
+jobs:
+  # ── PR Opened → Rename branch to RC and build RC release ─────────────────────────
+  promote-rc:
+    name: Promote to RC
+    runs-on: release
+    if: >-
+      (github.event.action == 'opened' && github.event.pull_request.merged != true) ||
+      (github.event.action == 'synchronize' && github.event.pull_request.merged != true) ||
+      (github.event_name == 'workflow_dispatch' && inputs.action == 'promote-rc')
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          token: ${{ secrets.MOKOGIT_TOKEN }}
+          fetch-depth: 1
+
+      - name: Setup mokocli tools
+        env:
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
+        run: |
+          if [ -f /opt/mokocli/cli/version_bump.php ] && [ -f /opt/mokocli/vendor/autoload.php ]; then
+            echo Using pre-installed /opt/mokocli
+            echo MOKO_CLI=/opt/mokocli/cli >> $GITHUB_ENV
+          else
+            echo Falling back to fresh clone
+            if ! command -v composer > /dev/null 2>&1; then
+              sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
+            fi
+            rm -rf /tmp/mokocli
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
+            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
+            cd /tmp/mokocli
+            composer install --no-dev --no-interaction --quiet
+            echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
+          fi
+
+      - name: Rename branch to rc
+        run: |
+          API_BASE="${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+          AUTH="Authorization: token ${{ secrets.MOKOGIT_TOKEN }}"
+          FROM="${{ github.event.pull_request.head.ref || 'dev' }}"
+          PR="${{ github.event.pull_request.number }}"
+
+          # Resolve the source branch HEAD commit.
+          SRC_JSON=$(curl -sf -H "$AUTH" "${API_BASE}/branches/${FROM}") \
+            || { echo "::error::Source branch ${FROM} not found"; exit 1; }
+          SRC_SHA=$(printf '%s' "$SRC_JSON" | python3 -c "import sys, json; print(json.load(sys.stdin)['commit']['id'])" 2>/dev/null || true)
+          [ -n "$SRC_SHA" ] || { echo "::error::Could not resolve HEAD of ${FROM}"; exit 1; }
+
+          # Point rc at the source commit via git push. Git's git/refs PATCH API
+          # returns HTTP 405 on ANY protected branch (force or not, even for a user in
+          # the force-push allowlist), so it cannot move a protected rc. git push honors
+          # the push + force-push allowlists and creates rc if it is absent.
+          PUSH_URL="https://x-access-token:${{ secrets.MOKOGIT_TOKEN }}@${MOKOGIT_URL#https://}/${GIT_ORG}/${GIT_REPO}.git"
+          git config --global user.name "mokogit-actions[bot]"
+          git config --global user.email "actions@mokoconsulting.tech"
+          git fetch --no-tags "$PUSH_URL" "${FROM}"
+          git push --force "$PUSH_URL" "FETCH_HEAD:refs/heads/rc" \
+            || { echo "::error::Failed to point rc at ${FROM} (${SRC_SHA}) via git push"; exit 1; }
+          echo "rc set to ${FROM} (${SRC_SHA})"
+
+          # Repoint the PR at rc, then delete the old source branch (non-fatal).
+          if [ -n "$PR" ]; then
+            curl -s -X PATCH -H "$AUTH" -H "Content-Type: application/json" \
+              "${API_BASE}/pulls/${PR}" -d '{"head":"rc"}' >/dev/null || true
+          fi
+          # Never delete permanent branches (dev/main/rc/...); only ephemeral feature branches.
+          case "$FROM" in
+            dev|main|master|rc|stable|production|release|develop|staging|beta|alpha)
+              echo "Keeping permanent branch ${FROM} (not deleting)" ;;
+            *)
+              curl -s -X DELETE -H "$AUTH" "${API_BASE}/branches/${FROM}" >/dev/null || true ;;
+          esac
+          echo "Renamed ${FROM} -> rc"
+
+      - name: Trigger RC deploy
+        run: |
+          # Workflow-token pushes do NOT wake downstream workflows; dispatch deploy-rc explicitly.
+          curl -sf -X POST -H "Authorization: token ${{ secrets.MOKOGIT_TOKEN }}" \n            -H "Content-Type: application/json" \n            "${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}/actions/workflows/deploy-rc.yml/dispatches" \n            -d '{"ref":"rc"}' \n            && echo "Dispatched deploy-rc on rc" \n            || echo "::warning::deploy-rc dispatch failed (no deploy-rc.yml on rc?)"
+
+      - name: Checkout rc and configure git
+        run: |
+          git fetch origin rc
+          git checkout rc
+          git config --local user.email "mokogit-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "mokogit-actions[bot]"
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGIT_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+
+      - name: Publish RC release
+        continue-on-error: true
+        run: |
+          php ${MOKO_CLI}/release_publish.php \
+            --path . --stability rc --bump minor --branch rc \
+            --token "${{ secrets.MOKOGIT_TOKEN }}"
+
+      - name: Update RC release notes from CHANGELOG.md
+        continue-on-error: true
+        run: |
+          API_BASE="${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+          TOKEN="${{ secrets.MOKOGIT_TOKEN }}"
+
+          # Extract [Unreleased] section from changelog
+          NOTES=""
+          if [ -f "CHANGELOG.md" ]; then
+            NOTES=$(awk '/^## \[Unreleased\]/{found=1; next} /^## \[/{if(found) exit} found{print}' CHANGELOG.md)
+          fi
+          [ -z "$NOTES" ] && NOTES="Release candidate"
+
+          # Find the RC release and update its body
+          RELEASE_ID=$(curl -sf -H "Authorization: token ${TOKEN}" \
+            "${API_BASE}/releases/tags/release-candidate" \
+            | python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
+
+          if [ -n "$RELEASE_ID" ]; then
+            python3 -c "
+          import json, urllib.request
+          body = open('/dev/stdin').read()
+          payload = json.dumps({'body': body}).encode()
+          req = urllib.request.Request(
+              '${API_BASE}/releases/${RELEASE_ID}',
+              data=payload, method='PATCH',
+              headers={
+                  'Authorization': 'token ${TOKEN}',
+                  'Content-Type': 'application/json'
+              })
+          urllib.request.urlopen(req)
+          " <<< "$NOTES"
+            echo "RC release notes updated from CHANGELOG.md"
+          fi
+
+      - name: Summary
+        if: always()
+        run: |
+          echo "## Promoted to Release Candidate" >> $GITHUB_STEP_SUMMARY
+          echo "Branch renamed to rc, minor bump, RC release built" >> $GITHUB_STEP_SUMMARY
+
+  # ── Merged PR → Build & Release (or promote RC to stable) ─────────────────────────
+  release:
+    name: Build & Release Pipeline
+    runs-on: release
+    if: >-
+      github.event.pull_request.merged == true ||
+      (github.event_name == 'workflow_dispatch' && inputs.action != 'promote-rc')
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          token: ${{ secrets.MOKOGIT_TOKEN }}
+          fetch-depth: 0
+
+      - name: Configure git for bot pushes
+        run: |
+          git config --local user.email "mokogit-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "mokogit-actions[bot]"
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGIT_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+
+      - name: Check for merge conflict markers
+        run: |
+          CONFLICTS=$(grep -rn '<<<<<<< \|>>>>>>> \|^=======$' --include='*.php' --include='*.xml' --include='*.css' --include='*.js' --include='*.json' --include='*.md' --include='*.yml' --include='*.yaml' --include='*.ini' --include='*.txt' . 2>/dev/null | grep -v '.git/' || true)
+          if [ -n "$CONFLICTS" ]; then
+            echo "::error::Merge conflict markers found — aborting release"
+            echo "## Release Blocked: Conflict Markers" >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+            echo "$CONFLICTS" >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+          echo "No conflict markers found"
+
+      - name: Setup mokocli tools
+        env:
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
+          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_MIRROR_TOKEN }}"}}'
+        run: |
+          if [ -f /opt/mokocli/cli/version_bump.php ] && [ -f /opt/mokocli/vendor/autoload.php ]; then
+            echo Using pre-installed /opt/mokocli
+            echo MOKO_CLI=/opt/mokocli/cli >> $GITHUB_ENV
+          else
+            echo Falling back to fresh clone
+            if ! command -v composer > /dev/null 2>&1; then
+              sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
+            fi
+            rm -rf /tmp/mokocli
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
+            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
+            cd /tmp/mokocli
+            composer install --no-dev --no-interaction --quiet
+            echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
+          fi
+
+      - name: "Detect platform"
+        id: platform
+        run: |
+          php ${MOKO_CLI}/platform_detect.php --path . --github-output 2>/dev/null || true
+          php ${MOKO_CLI}/manifest_read.php --path . --github-output 2>/dev/null || true
+
+      - name: "Determine version bump level"
+        id: bump
+        run: |
+          # Fix/patch branches: version was already bumped by pre-release, just strip suffix
+          # Feature/dev branches: bump minor for the new stable release
+          HEAD_REF="${{ github.event.pull_request.head.ref || 'dev' }}"
+          case "$HEAD_REF" in
+            fix/*|patch/*|hotfix/*|bugfix/*) BUMP="none" ;;
+            *)                               BUMP="minor" ;;
+          esac
+          echo "level=${BUMP}" >> "$GITHUB_OUTPUT"
+          echo "Bump level: ${BUMP} (from branch: ${HEAD_REF})"
+
+      - name: "Publish stable release"
+        run: |
+          BUMP_FLAG=""
+          if [ "${{ steps.bump.outputs.level }}" != "none" ]; then
+            BUMP_FLAG="--bump ${{ steps.bump.outputs.level }}"
+          fi
+          php ${MOKO_CLI}/release_publish.php \
+            --path . --stability stable ${BUMP_FLAG} --branch main \
+            --token "${{ secrets.MOKOGIT_TOKEN }}"
+
+      - name: "Read published version"
+        id: version
+        run: |
+          VERSION=$(php ${MOKO_CLI}/version_read.php --path . 2>/dev/null || echo "")
+          VERSION=$(echo "$VERSION" | sed 's/-\(dev\|alpha\|beta\|rc\)$//')
+          [ -z "$VERSION" ] && VERSION="00.00.00" && echo "skip=true" >> "$GITHUB_OUTPUT"
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          PLATFORM="${{ steps.platform.outputs.platform }}"
+          if [[ "$PLATFORM" == joomla* ]]; then
+            echo "tag=stable" >> "$GITHUB_OUTPUT"
+            echo "release_tag=stable" >> "$GITHUB_OUTPUT"
+          else
+            echo "tag=v${VERSION}" >> "$GITHUB_OUTPUT"
+            echo "release_tag=v${VERSION}" >> "$GITHUB_OUTPUT"
+          fi
+          echo "branch=main" >> "$GITHUB_OUTPUT"
+          echo "Published version: ${VERSION}"
+
+      - name: "Create semver tag for non-Joomla repos"
+        id: semver
+        if: |
+          steps.version.outputs.skip != 'true' &&
+          !startsWith(steps.platform.outputs.platform, 'joomla')
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          API_BASE="${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+          TOKEN="${{ secrets.MOKOGIT_TOKEN }}"
+          SEMVER_TAG="v${VERSION}"
+
+          echo "Creating semver tag: ${SEMVER_TAG}"
+
+          # Create the git tag via API
+          HTTP_CODE=$(curl -sf -o /dev/null -w "%{http_code}" \
+            -X POST -H "Authorization: token ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            "${API_BASE}/tags" \
+            -d "{\"tag_name\":\"${SEMVER_TAG}\",\"target\":\"main\",\"message\":\"Release ${VERSION}\"}" 2>/dev/null || echo "000")
+
+          if [ "$HTTP_CODE" = "201" ] || [ "$HTTP_CODE" = "200" ]; then
+            echo "Created semver tag: ${SEMVER_TAG}"
+          elif [ "$HTTP_CODE" = "409" ]; then
+            echo "Semver tag ${SEMVER_TAG} already exists (skipped)"
+          else
+            echo "::warning::Failed to create semver tag ${SEMVER_TAG} (HTTP ${HTTP_CODE})"
+          fi
+
+          echo "semver_tag=${SEMVER_TAG}" >> "$GITHUB_OUTPUT"
+
+      - name: Update release notes and promote changelog
+        run: |
+          API_BASE="${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+          TOKEN="${{ secrets.MOKOGIT_TOKEN }}"
+
+          # Get the stable release info (version and ID)
+          RELEASE_JSON=$(curl -sf -H "Authorization: token ${TOKEN}" \
+            "${API_BASE}/releases/tags/stable" 2>/dev/null || echo '{}')
+          RELEASE_ID=$(python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" <<< "$RELEASE_JSON" 2>/dev/null || true)
+          # Extract version from release name (e.g. "06.17.00" or "v06.17.00")
+          VERSION=$(python3 -c "
+          import json, sys, re
+          r = json.load(sys.stdin)
+          name = r.get('name', '')
+          m = re.search(r'(\d+\.\d+\.\d+)', name)
+          print(m.group(1) if m else '')
+          " <<< "$RELEASE_JSON" 2>/dev/null || true)
+
+          # Extract [Unreleased] section from changelog
+          NOTES=""
+          if [ -f "CHANGELOG.md" ]; then
+            NOTES=$(awk '/^## \[Unreleased\]/{found=1; next} /^## \[/{if(found) exit} found{print}' CHANGELOG.md)
+          fi
+          [ -z "$NOTES" ] && NOTES="Stable release"
+
+          # Update release body via API
+          if [ -n "$RELEASE_ID" ]; then
+            python3 -c "
+          import json, urllib.request
+          body = open('/dev/stdin').read()
+          payload = json.dumps({'body': body}).encode()
+          req = urllib.request.Request(
+              '${API_BASE}/releases/${RELEASE_ID}',
+              data=payload, method='PATCH',
+              headers={
+                  'Authorization': 'token ${TOKEN}',
+                  'Content-Type': 'application/json'
+              })
+          urllib.request.urlopen(req)
+          " <<< "$NOTES"
+            echo "Release notes updated from CHANGELOG.md"
+          fi
+
+          # Promote [Unreleased] → [version] in CHANGELOG.md and reset
+          if [ -n "$VERSION" ] && [ -f "CHANGELOG.md" ]; then
+            DATE=$(date +%Y-%m-%d)
+            python3 -c "
+          import sys
+          version, date = sys.argv[1], sys.argv[2]
+          content = open('CHANGELOG.md').read()
+          old = '## [Unreleased]'
+          new = f'## [Unreleased]\n\n## [{version}] --- {date}'
+          content = content.replace(old, new, 1)
+          open('CHANGELOG.md', 'w').write(content)
+          " "$VERSION" "$DATE"
+            git add CHANGELOG.md
+            git commit -m "chore: promote changelog [Unreleased] → [${VERSION}]" || true
+            git push origin main || true
+            echo "Changelog promoted: [Unreleased] → [${VERSION}]"
+          fi
+
+      # -- STEP 9: Mirror to GitHub (stable only) --------------------------------
+      - name: "Step 9: Mirror release to GitHub"
+        if: >-
+          steps.version.outputs.skip != 'true' &&
+          secrets.GH_MIRROR_TOKEN != ''
+        continue-on-error: true
+        run: |
+          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
+          RELEASE_TAG="${{ steps.version.outputs.release_tag }}"
+          GH_REPO="${{ vars.GH_MIRROR_REPO || github.repository }}"
+          API_BASE="${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+          php ${MOKO_CLI}/release_mirror.php \
+            --version "$VERSION" --tag "$RELEASE_TAG" \
+            --token "${{ secrets.MOKOGIT_TOKEN }}" --api-base "$API_BASE" \
+            --gh-token "${{ secrets.GH_MIRROR_TOKEN }}" --gh-repo "$GH_REPO" \
+            --branch main 2>&1 || true
+          echo "GitHub mirror updated" >> $GITHUB_STEP_SUMMARY
+
+      # -- STEP 10: Sync main branch to GitHub mirror ----------------------------
+      - name: "Step 10: Push main to GitHub mirror"
+        if: >-
+          steps.version.outputs.skip != 'true' &&
+          secrets.GH_MIRROR_TOKEN != ''
+        continue-on-error: true
+        run: |
+          GH_REPO="${{ vars.GH_MIRROR_REPO || github.repository }}"
+          GH_ORG=$(echo "$GH_REPO" | cut -d/ -f1)
+          GH_NAME=$(echo "$GH_REPO" | cut -d/ -f2)
+          git remote add github "https://x-access-token:${{ secrets.GH_MIRROR_TOKEN }}@github.com/${GH_ORG}/${GH_NAME}.git" 2>/dev/null || \
+            git remote set-url github "https://x-access-token:${{ secrets.GH_MIRROR_TOKEN }}@github.com/${GH_ORG}/${GH_NAME}.git"
+          git fetch origin main --depth=1
+          git push github origin/main:refs/heads/main --force 2>/dev/null \
+            && echo "main branch pushed to GitHub mirror" \
+            || echo "WARNING: GitHub mirror push failed"
+
+      - name: "Step 11: Delete rc branch and recreate dev from main"
+        if: steps.version.outputs.skip != 'true'
+        continue-on-error: true
+        run: |
+          API_BASE="${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+          TOKEN="${{ secrets.MOKOGIT_TOKEN }}"
+
+          # Delete rc branch (ephemeral — created by promote-rc)
+          curl -sf -X DELETE -H "Authorization: token ${TOKEN}" \
+            "${API_BASE}/branches/rc" 2>/dev/null \
+            && echo "Deleted rc branch" || echo "rc branch not found"
+
+          # Delete dev branch
+          curl -sf -X DELETE -H "Authorization: token ${TOKEN}" \
+            "${API_BASE}/branches/dev" 2>/dev/null && echo "Deleted dev branch"
+
+          # Recreate dev from main (now includes version bump + changelog promotion)
+          curl -sf -X POST -H "Authorization: token ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            "${API_BASE}/branches" \
+            -d '{"new_branch_name":"dev","old_branch_name":"main"}' 2>/dev/null && echo "Recreated dev from main"
+
+          echo "Pre-release branches cleaned, dev reset from main" >> $GITHUB_STEP_SUMMARY
+
+      - name: "Step 12: Create version branch from main"
+        if: steps.version.outputs.skip != 'true'
+        continue-on-error: true
+        run: |
+          API_BASE="${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+          TOKEN="${{ secrets.MOKOGIT_TOKEN }}"
+          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
+          BRANCH_NAME="version/${VERSION}"
+          MAIN_SHA=$(git rev-parse HEAD)
+
+          # Delete old version branch if it exists (same version re-release)
+          curl -sf -X DELETE -H "Authorization: token ${TOKEN}"             "${API_BASE}/branches/${BRANCH_NAME}" 2>/dev/null && echo "Deleted old ${BRANCH_NAME}"
+
+          # Create version/XX.YY.ZZ from main
+          curl -sf -X POST -H "Authorization: token ${TOKEN}"             -H "Content-Type: application/json"             "${API_BASE}/branches"             -d "{\"new_branch_name\":\"${BRANCH_NAME}\",\"old_branch_name\":\"main\"}" 2>/dev/null             && echo "Created ${BRANCH_NAME} from main (${MAIN_SHA})"             || echo "WARNING: ${BRANCH_NAME} creation failed"
+
+          echo "Version branch created: ${BRANCH_NAME} (${MAIN_SHA})" >> $GITHUB_STEP_SUMMARY
+
+
+
+      # -- Dolibarr post-release: Reset dev version -----------------------------
+      - name: "Post-release: Reset dev version"
+        if: steps.version.outputs.skip != 'true'
+        continue-on-error: true
+        run: |
+          API_BASE="${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+          php ${MOKO_CLI}/version_reset_dev.php \
+            --token "${{ secrets.MOKOGIT_TOKEN }}" --api-base "${API_BASE}" \
+            --branch dev --path . 2>&1 || true
+
+      # -- Summary --------------------------------------------------------------
+      - name: Pipeline Summary
+        if: always()
+        run: |
+          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
+          PLATFORM="${{ steps.platform.outputs.platform }}"
+          if [ "${{ steps.version.outputs.skip }}" = "true" ]; then
+            echo "## Release Skipped" >> $GITHUB_STEP_SUMMARY
+            echo "No VERSION in README.md" >> $GITHUB_STEP_SUMMARY
+          elif [ "${{ steps.check.outputs.already_released }}" = "true" ]; then
+            echo "## Already Released — ${VERSION}" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "## Build & Release Complete (${PLATFORM})" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "| Step | Result |" >> $GITHUB_STEP_SUMMARY
+            echo "|------|--------|" >> $GITHUB_STEP_SUMMARY
+            echo "| Platform | \`${PLATFORM}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| Version | \`${VERSION}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| Branch | \`${{ steps.version.outputs.branch }}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| Tag | \`${{ steps.version.outputs.tag }}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| Release | [View](${MOKOGIT_URL}/${GIT_ORG}/${GIT_REPO}/releases/tag/${{ steps.version.outputs.tag }}) |" >> $GITHUB_STEP_SUMMARY
+          fi

.mokogit/workflows/branch-cleanup.yml

@@ -0,0 +1,48 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGit.Workflow
+# INGROUP: MokoStandards.Universal
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /.mokogit/workflows/branch-cleanup.yml
+# VERSION: 01.00.00
+# BRIEF: Delete feature branches after PR merge
+
+name: "Branch Cleanup"
+
+on:
+  pull_request:
+    types: [closed]
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  cleanup:
+    name: Delete merged branch
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.pull_request.merged == true &&
+      github.event.pull_request.head.ref != 'dev' &&
+      github.event.pull_request.head.ref != 'main'
+
+    steps:
+      - name: Delete source branch
+        run: |
+          BRANCH="${{ github.event.pull_request.head.ref }}"
+          API="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}/api/v1/repos/${{ github.repository }}/branches"
+          ENCODED=$(php -r "echo rawurlencode('${BRANCH}');")
+
+          STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X DELETE \
+            -H "Authorization: token ${{ secrets.MOKOGIT_TOKEN }}" \
+            "${API}/${ENCODED}" 2>/dev/null || true)
+
+          if [ "$STATUS" = "204" ]; then
+            echo "Deleted branch: ${BRANCH}" >> $GITHUB_STEP_SUMMARY
+          elif [ "$STATUS" = "404" ]; then
+            echo "Branch already deleted: ${BRANCH}" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "::warning::Failed to delete branch ${BRANCH} (HTTP ${STATUS})"
+          fi

.mokogit/workflows/cascade-dev.yml

@@ -0,0 +1,10 @@
+# DISABLED — auto-release Step 11 recreates dev from main after every release.
+# Cascade-dev is redundant and causes version conflicts when both main and dev
+# have different version numbers in templateDetails.xml / manifest.xml.
+name: "Cascade Main → Dev (DISABLED)"
+on: workflow_dispatch
+jobs:
+  noop:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "Cascade disabled — auto-release handles dev recreation"

.mokogit/workflows/ci-generic.yml

@@ -0,0 +1,197 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGit.Workflow
+# INGROUP: MokoStandards.CI
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# PATH: /.gitea/workflows/ci-generic.yml
+# VERSION: 01.00.00
+# BRIEF: CI pipeline — lint, validate, and test for generic projects (PHP + Node.js)
+
+name: "Generic: Project CI"
+
+on:
+  pull_request:
+    branches:
+      - main
+      - dev
+      - dev/**
+      - rc/**
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  # ── Lint & Validate ───────────────────────────────────────────────────
+  lint:
+    name: Lint & Validate
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Detect toolchain
+        id: detect
+        run: |
+          HAS_PHP=false
+          HAS_NODE=false
+          [ -f "composer.json" ] && HAS_PHP=true
+          [ -f "package.json" ] && HAS_NODE=true
+          echo "has_php=$HAS_PHP" >> "$GITHUB_OUTPUT"
+          echo "has_node=$HAS_NODE" >> "$GITHUB_OUTPUT"
+          echo "Toolchain: PHP=$HAS_PHP Node=$HAS_NODE"
+
+      - name: Setup PHP
+        if: steps.detect.outputs.has_php == 'true'
+        run: |
+          if ! command -v php &> /dev/null; then
+            sudo apt-get update -qq
+            sudo apt-get install -y -qq php-cli php-mbstring php-xml >/dev/null 2>&1
+          fi
+          php -v
+
+      - name: Setup Node.js
+        if: steps.detect.outputs.has_node == 'true'
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install PHP dependencies
+        if: steps.detect.outputs.has_php == 'true'
+        run: |
+          if [ -f "composer.json" ]; then
+            composer install --no-interaction --prefer-dist --quiet 2>/dev/null || true
+          fi
+
+      - name: Install Node.js dependencies
+        if: steps.detect.outputs.has_node == 'true'
+        run: |
+          if [ -f "package.json" ]; then
+            npm ci --quiet 2>/dev/null || npm install --quiet 2>/dev/null || true
+          fi
+
+      - name: PHP syntax check
+        if: steps.detect.outputs.has_php == 'true'
+        run: |
+          ERRORS=0
+          while IFS= read -r -d '' file; do
+            if ! php -l "$file" 2>&1 | grep -q "No syntax errors"; then
+              echo "::error file=${file}::PHP syntax error"
+              ERRORS=$((ERRORS + 1))
+            fi
+          done < <(find . -name "*.php" -not -path "./.git/*" -not -path "./vendor/*" -not -path "./node_modules/*" -print0)
+
+          echo "## PHP Lint" >> $GITHUB_STEP_SUMMARY
+          if [ "$ERRORS" -eq 0 ]; then
+            echo "All PHP files passed syntax check." >> $GITHUB_STEP_SUMMARY
+          else
+            echo "${ERRORS} file(s) with syntax errors." >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+
+      - name: TypeScript/JavaScript lint
+        if: steps.detect.outputs.has_node == 'true'
+        run: |
+          if [ -f "node_modules/.bin/eslint" ]; then
+            npx eslint src/ --quiet 2>&1 || { echo "::error::ESLint errors found"; exit 1; }
+            echo "## ESLint" >> $GITHUB_STEP_SUMMARY
+            echo "All files passed ESLint." >> $GITHUB_STEP_SUMMARY
+          elif [ -f ".eslintrc.json" ] || [ -f ".eslintrc.js" ] || [ -f "eslint.config.js" ]; then
+            echo "::warning::ESLint config found but eslint not installed"
+          else
+            echo "No ESLint configured — skipping"
+          fi
+
+      - name: TypeScript compile check
+        if: steps.detect.outputs.has_node == 'true'
+        run: |
+          if [ -f "tsconfig.json" ] && [ -f "node_modules/.bin/tsc" ]; then
+            npx tsc --noEmit 2>&1 || { echo "::error::TypeScript compilation errors"; exit 1; }
+            echo "## TypeScript" >> $GITHUB_STEP_SUMMARY
+            echo "TypeScript compilation passed." >> $GITHUB_STEP_SUMMARY
+          fi
+
+      - name: PHPStan static analysis
+        if: steps.detect.outputs.has_php == 'true'
+        run: |
+          if [ -f "phpstan.neon" ] && [ -f "vendor/bin/phpstan" ]; then
+            vendor/bin/phpstan analyse --no-progress 2>&1 || { echo "::warning::PHPStan found issues"; }
+          fi
+
+  # ── Tests ─────────────────────────────────────────────────────────────
+  test:
+    name: Tests
+    runs-on: ubuntu-latest
+    needs: lint
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Detect toolchain
+        id: detect
+        run: |
+          HAS_PHP=false
+          HAS_NODE=false
+          [ -f "composer.json" ] && HAS_PHP=true
+          [ -f "package.json" ] && HAS_NODE=true
+          echo "has_php=$HAS_PHP" >> "$GITHUB_OUTPUT"
+          echo "has_node=$HAS_NODE" >> "$GITHUB_OUTPUT"
+
+      - name: Setup PHP
+        if: steps.detect.outputs.has_php == 'true'
+        run: |
+          if ! command -v php &> /dev/null; then
+            sudo apt-get update -qq
+            sudo apt-get install -y -qq php-cli php-mbstring php-xml >/dev/null 2>&1
+          fi
+
+      - name: Setup Node.js
+        if: steps.detect.outputs.has_node == 'true'
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Install dependencies
+        run: |
+          [ -f "composer.json" ] && composer install --no-interaction --prefer-dist --quiet 2>/dev/null || true
+          [ -f "package.json" ] && { npm ci --quiet 2>/dev/null || npm install --quiet 2>/dev/null || true; }
+
+      - name: Run PHP tests
+        if: steps.detect.outputs.has_php == 'true'
+        run: |
+          if [ -f "vendor/bin/phpunit" ]; then
+            vendor/bin/phpunit --testdox 2>&1
+            echo "## PHPUnit" >> $GITHUB_STEP_SUMMARY
+            echo "Tests passed." >> $GITHUB_STEP_SUMMARY
+          elif [ -f "phpunit.xml" ] || [ -f "phpunit.xml.dist" ]; then
+            echo "::warning::PHPUnit config found but phpunit not installed"
+          else
+            echo "No PHPUnit configured — skipping"
+          fi
+
+      - name: Run Node.js tests
+        if: steps.detect.outputs.has_node == 'true'
+        run: |
+          if jq -e '.scripts.test' package.json > /dev/null 2>&1; then
+            npm test 2>&1
+            echo "## Node.js Tests" >> $GITHUB_STEP_SUMMARY
+            echo "Tests passed." >> $GITHUB_STEP_SUMMARY
+          else
+            echo "No test script in package.json — skipping"
+          fi
+
+      - name: Build check
+        run: |
+          if [ -f "Makefile" ]; then
+            make build 2>&1 || echo "::warning::Build failed or not configured"
+          elif [ -f "package.json" ] && jq -e '.scripts.build' package.json > /dev/null 2>&1; then
+            npm run build 2>&1 || echo "::warning::Build failed"
+          fi

.mokogit/workflows/ci-issue-reporter.yml

@@ -0,0 +1,68 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGit.Workflow
+# INGROUP: mokocli.Universal
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /.mokogit/workflows/ci-issue-reporter.yml
+# VERSION: 01.00.00
+# BRIEF: Reusable workflow — creates/updates a MokoGit issue when a CI gate fails.
+#        Clones MokoCLI and runs cli/ci_issue_reporter.sh.
+
+name: "Universal: CI Issue Reporter"
+
+on:
+  workflow_call:
+    inputs:
+      gate:
+        description: "CI gate name (e.g. PR Validation, Repository Health)"
+        required: true
+        type: string
+      details:
+        description: "Human-readable failure description"
+        required: true
+        type: string
+      severity:
+        description: "error or warning"
+        required: false
+        type: string
+        default: "error"
+      workflow:
+        description: "Workflow name for the issue title"
+        required: false
+        type: string
+        default: ""
+    secrets:
+      MOKOGIT_TOKEN:
+        required: true
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  report:
+    name: "Report: ${{ inputs.gate }}"
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Clone MokoCLI
+        env:
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+        run: |
+          MOKOGIT_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
+          git clone --depth 1 --filter=blob:none --sparse "${MOKOGIT_URL}/MokoConsulting/MokoCLI.git" /tmp/mokocli
+          cd /tmp/mokocli && git sparse-checkout set cli/ci_issue_reporter.sh
+
+      - name: Report CI failure
+        env:
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+        run: |
+          chmod +x /tmp/mokocli/cli/ci_issue_reporter.sh
+          /tmp/mokocli/cli/ci_issue_reporter.sh \
+            --gate "${{ inputs.gate }}" \
+            --details "${{ inputs.details }}" \
+            --severity "${{ inputs.severity }}" \
+            --workflow "${{ inputs.workflow }}"

.mokogit/workflows/cleanup.yml

@@ -0,0 +1,87 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGit.Workflow
+# INGROUP: MokoStandards.Maintenance
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
+# PATH: /.gitea/workflows/cleanup.yml
+# VERSION: 01.00.00
+# BRIEF: Scheduled cleanup — delete merged branches and old workflow runs
+
+name: "Universal: Repository Cleanup"
+
+on:
+  schedule:
+    - cron: '0 3 * * 0'  # Weekly on Sunday at 03:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+env:
+  MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+
+jobs:
+  cleanup:
+    name: Clean Merged Branches
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.MOKOGIT_TOKEN }}
+
+      - name: Delete merged branches
+        env:
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+        run: |
+          echo "=== Merged Branch Cleanup ==="
+          API="${MOKOGIT_URL}/api/v1/repos/${{ github.repository }}"
+
+          # List branches via API
+          BRANCHES=$(curl -sS -H "Authorization: token ${MOKOGIT_TOKEN}" \
+            "${API}/branches?limit=50" | jq -r '.[].name')
+
+          DELETED=0
+          for BRANCH in $BRANCHES; do
+            # Skip protected branches
+            case "$BRANCH" in
+              main|master|develop|release/*|hotfix/*) continue ;;
+            esac
+
+            # Check if branch is merged into main
+            if git merge-base --is-ancestor "origin/${BRANCH}" origin/main 2>/dev/null; then
+              echo "  Deleting merged branch: ${BRANCH}"
+              curl -sS -X DELETE -H "Authorization: token ${MOKOGIT_TOKEN}" \
+                "${API}/branches/${BRANCH}" 2>/dev/null || true
+              DELETED=$((DELETED + 1))
+            fi
+          done
+
+          echo "Deleted ${DELETED} merged branch(es)"
+
+      - name: Clean old workflow runs
+        env:
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+        run: |
+          echo "=== Workflow Run Cleanup ==="
+          API="${MOKOGIT_URL}/api/v1/repos/${{ github.repository }}"
+          CUTOFF=$(date -d "30 days ago" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -v-30d +%Y-%m-%dT%H:%M:%SZ)
+
+          # Get old completed runs
+          RUNS=$(curl -sS -H "Authorization: token ${MOKOGIT_TOKEN}" \
+            "${API}/actions/runs?status=completed&limit=50" | \
+            jq -r ".workflow_runs[] | select(.created_at < \"${CUTOFF}\") | .id" 2>/dev/null)
+
+          DELETED=0
+          for RUN_ID in $RUNS; do
+            curl -sS -X DELETE -H "Authorization: token ${MOKOGIT_TOKEN}" \
+              "${API}/actions/runs/${RUN_ID}" 2>/dev/null || true
+            DELETED=$((DELETED + 1))
+          done
+
+          echo "Deleted ${DELETED} old workflow run(s)"

.mokogit/workflows/deploy-dev.yml

@@ -0,0 +1,136 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+# BRIEF: Build and deploy to the Dev environment on push to the dev branch.
+#        Portable across Go server repos: ALL deployment config comes from repo
+#        Actions variables (vars.*) and secrets (secrets.*), nothing hardcoded.
+#        The dev branch is the ongoing integration branch.
+# OWNER: Template-Go (canonical source; syncs to the root workflows dir). See Template-Go#3.
+#
+# Required repo VARIABLES (all tier-scoped so each environment is independent —
+# a repo may host its rc/dev/prod tiers on different machines):
+#   DEV_SSH_HOST, DEV_SSH_PORT, DEV_SSH_USERNAME - SSH deploy target for the dev tier
+#   DEV_REGISTRY, DEV_REGISTRY_USER, DEV_IMAGE   - container registry + login user + image
+#   DEV_CONTAINER                              - compose service/container to recreate
+#   DEV_COMPOSE_PROJECT                        - docker compose -p project name
+#   DEV_COMPOSE_DIR                            - dir containing docker-compose.yml on host
+#   DEV_SOURCE_DIR                             - build source checkout on host
+#   DEV_TAG_ENV                                - compose env-var name that pins the image tag
+#   DEV_HEALTH_URL                             - external URL to verify after deploy
+# Required SECRETS (already configured org-wide; reused, not re-set):
+#   DEPLOY_SSH_KEY       - deploy private key (repo/org secret)
+#   MOKOGIT_TOKEN      - registry/API token (org secret)
+
+name: Deploy (Dev)
+
+on:
+  push:
+    branches:
+      - dev
+  # Manual trigger for isolated end-to-end tests.
+  # Runs on the ref it is dispatched from.
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-dev
+  cancel-in-progress: true
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  deploy-dev:
+    name: "Build & Deploy to Dev"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Determine version
+        id: config
+        run: |
+          VERSION=$(git describe --tags --always 2>/dev/null || echo "dev-$(git rev-parse --short HEAD)")
+          echo "tag=${VERSION}-dev" >> $GITHUB_OUTPUT
+          echo "Version: ${VERSION}-dev"
+
+      - name: Write deploy key
+        env:
+          DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$DEPLOY_KEY" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+
+      - name: Build and deploy to RC via SSH
+        env:
+          REGISTRY_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          TAG: ${{ steps.config.outputs.tag }}
+        run: |
+          # Runner-side values (TAG, REGISTRY_TOKEN) are injected into the remote shell
+          # via an env prefix; a *quoted* heredoc keeps every $var expanding once, on the
+          # remote. Repo variables (vars.*) are substituted inline by Actions before ssh.
+          ssh -i ~/.ssh/deploy_key -p ${{ vars.DEV_SSH_PORT }} \
+            -o ConnectTimeout=30 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+            -o ServerAliveInterval=30 -o ServerAliveCountMax=10 \
+            ${{ vars.DEV_SSH_USERNAME }}@${{ vars.DEV_SSH_HOST }} \
+            "TAG='$TAG' REGISTRY_TOKEN='$REGISTRY_TOKEN' bash -s" <<'DEPLOY_EOF'
+          set -e
+          echo 'SSH connected to Dev environment'
+
+          if [ -z "$TAG" ]; then
+            echo 'ERROR: TAG is empty; refusing to build an untagged image' >&2
+            exit 1
+          fi
+
+          HEALTH_FMT='{{.State.Health.Status}}'
+
+          echo 'Cleaning Docker build cache...'
+          docker builder prune -af 2>/dev/null || true
+          docker image prune -af 2>/dev/null || true
+
+          echo 'Pulling source...'
+          SOURCE_DIR='${{ vars.DEV_SOURCE_DIR }}'
+          if [ ! -d "$SOURCE_DIR/.git" ]; then
+            git clone -b dev https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git "$SOURCE_DIR"
+          fi
+          cd "$SOURCE_DIR"
+          git remote set-url origin https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git 2>/dev/null || true
+          git fetch origin dev
+          git reset --hard origin/dev
+
+          echo "Building image: ${{ vars.DEV_REGISTRY }}/${{ vars.DEV_IMAGE }}:$TAG"
+          docker build --no-cache --build-arg GOFLAGS='-p 1' \
+            --tag "${{ vars.DEV_REGISTRY }}/${{ vars.DEV_IMAGE }}:$TAG" \
+            -f Dockerfile .
+
+          echo 'Pushing to registry...'
+          echo "$REGISTRY_TOKEN" | docker login ${{ vars.DEV_REGISTRY }} -u ${{ vars.DEV_REGISTRY_USER }} --password-stdin
+          docker push "${{ vars.DEV_REGISTRY }}/${{ vars.DEV_IMAGE }}:$TAG"
+
+          echo 'Restarting Dev container...'
+          cd '${{ vars.DEV_COMPOSE_DIR }}'
+          # Drive the rc service image tag via its compose env-var (no sed on the shared
+          # file); remove any lingering fixed-name container first, then force-recreate.
+          docker rm -f '${{ vars.DEV_CONTAINER }}' 2>/dev/null || true
+          ${{ vars.DEV_TAG_ENV }}="$TAG" docker compose -p '${{ vars.DEV_COMPOSE_PROJECT }}' up -d --force-recreate '${{ vars.DEV_CONTAINER }}'
+
+          echo 'Health check...'
+          for i in 1 2 3 4 5 6 7 8; do
+            sleep 15
+            if docker inspect --format="$HEALTH_FMT" '${{ vars.DEV_CONTAINER }}' 2>/dev/null | grep -q healthy; then
+              echo 'Dev container healthy!'
+              exit 0
+            fi
+            echo "Waiting... (attempt $i/8)"
+          done
+          echo 'Health check failed'
+          docker logs '${{ vars.DEV_CONTAINER }}' --tail 20
+          exit 1
+          DEPLOY_EOF
+
+      - name: Verify Dev instance
+        continue-on-error: true
+        run: |
+          sleep 5
+          ssh -i ~/.ssh/deploy_key -p ${{ vars.DEV_SSH_PORT }} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ vars.DEV_SSH_USERNAME }}@${{ vars.DEV_SSH_HOST }} "curl -sf '${{ vars.DEV_HEALTH_URL }}'" && echo " Dev API healthy"

.mokogit/workflows/deploy-prod.yml

@@ -0,0 +1,136 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+# BRIEF: Build and deploy to the Prod environment on push to the main branch.
+#        Portable across Go server repos: ALL deployment config comes from repo
+#        Actions variables (vars.*) and secrets (secrets.*), nothing hardcoded.
+#        Prod deploys on merge to main (dev -> rc -> main pipeline).
+# OWNER: Template-Go (canonical source; syncs to the root workflows dir). See Template-Go#3.
+#
+# Required repo VARIABLES (all tier-scoped so each environment is independent —
+# a repo may host its rc/dev/prod tiers on different machines):
+#   PROD_SSH_HOST, PROD_SSH_PORT, PROD_SSH_USERNAME - SSH deploy target for the prod tier
+#   PROD_REGISTRY, PROD_REGISTRY_USER, PROD_IMAGE   - container registry + login user + image
+#   PROD_CONTAINER                              - compose service/container to recreate
+#   PROD_COMPOSE_PROJECT                        - docker compose -p project name
+#   PROD_COMPOSE_DIR                            - dir containing docker-compose.yml on host
+#   PROD_SOURCE_DIR                             - build source checkout on host
+#   PROD_TAG_ENV                                - compose env-var name that pins the image tag
+#   PROD_HEALTH_URL                             - external URL to verify after deploy
+# Required SECRETS (already configured org-wide; reused, not re-set):
+#   DEPLOY_SSH_KEY       - deploy private key (repo/org secret)
+#   MOKOGIT_TOKEN      - registry/API token (org secret)
+
+name: Deploy (Prod)
+
+on:
+  push:
+    branches:
+      - main
+  # Manual trigger for a prod re-deploy.
+  # Runs on the ref it is dispatched from (use main).
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-prod
+  cancel-in-progress: false
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  deploy-prod:
+    name: "Build & Deploy to Prod"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Determine version
+        id: config
+        run: |
+          VERSION=$(git describe --tags --always 2>/dev/null || echo "$(git rev-parse --short HEAD)")
+          echo "tag=${VERSION}" >> $GITHUB_OUTPUT
+          echo "Version: ${VERSION}"
+
+      - name: Write deploy key
+        env:
+          DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$DEPLOY_KEY" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+
+      - name: Build and deploy to RC via SSH
+        env:
+          REGISTRY_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          TAG: ${{ steps.config.outputs.tag }}
+        run: |
+          # Runner-side values (TAG, REGISTRY_TOKEN) are injected into the remote shell
+          # via an env prefix; a *quoted* heredoc keeps every $var expanding once, on the
+          # remote. Repo variables (vars.*) are substituted inline by Actions before ssh.
+          ssh -i ~/.ssh/deploy_key -p ${{ vars.PROD_SSH_PORT }} \
+            -o ConnectTimeout=30 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+            -o ServerAliveInterval=30 -o ServerAliveCountMax=10 \
+            ${{ vars.PROD_SSH_USERNAME }}@${{ vars.PROD_SSH_HOST }} \
+            "TAG='$TAG' REGISTRY_TOKEN='$REGISTRY_TOKEN' bash -s" <<'DEPLOY_EOF'
+          set -e
+          echo 'SSH connected to Prod environment'
+
+          if [ -z "$TAG" ]; then
+            echo 'ERROR: TAG is empty; refusing to build an untagged image' >&2
+            exit 1
+          fi
+
+          HEALTH_FMT='{{.State.Health.Status}}'
+
+          echo 'Cleaning Docker build cache...'
+          docker builder prune -af 2>/dev/null || true
+          docker image prune -af 2>/dev/null || true
+
+          echo 'Pulling source...'
+          SOURCE_DIR='${{ vars.PROD_SOURCE_DIR }}'
+          if [ ! -d "$SOURCE_DIR/.git" ]; then
+            git clone -b main https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git "$SOURCE_DIR"
+          fi
+          cd "$SOURCE_DIR"
+          git remote set-url origin https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git 2>/dev/null || true
+          git fetch origin main
+          git reset --hard origin/main
+
+          echo "Building image: ${{ vars.PROD_REGISTRY }}/${{ vars.PROD_IMAGE }}:$TAG"
+          docker build --no-cache --build-arg GOFLAGS='-p 1' \
+            --tag "${{ vars.PROD_REGISTRY }}/${{ vars.PROD_IMAGE }}:$TAG" \
+            -f Dockerfile .
+
+          echo 'Pushing to registry...'
+          echo "$REGISTRY_TOKEN" | docker login ${{ vars.PROD_REGISTRY }} -u ${{ vars.PROD_REGISTRY_USER }} --password-stdin
+          docker push "${{ vars.PROD_REGISTRY }}/${{ vars.PROD_IMAGE }}:$TAG"
+
+          echo 'Restarting Prod container...'
+          cd '${{ vars.PROD_COMPOSE_DIR }}'
+          # Drive the rc service image tag via its compose env-var (no sed on the shared
+          # file); remove any lingering fixed-name container first, then force-recreate.
+          docker rm -f '${{ vars.PROD_CONTAINER }}' 2>/dev/null || true
+          ${{ vars.PROD_TAG_ENV }}="$TAG" docker compose -p '${{ vars.PROD_COMPOSE_PROJECT }}' up -d --force-recreate '${{ vars.PROD_CONTAINER }}'
+
+          echo 'Health check...'
+          for i in 1 2 3 4 5 6 7 8; do
+            sleep 15
+            if docker inspect --format="$HEALTH_FMT" '${{ vars.PROD_CONTAINER }}' 2>/dev/null | grep -q healthy; then
+              echo 'Prod container healthy!'
+              exit 0
+            fi
+            echo "Waiting... (attempt $i/8)"
+          done
+          echo 'Health check failed'
+          docker logs '${{ vars.PROD_CONTAINER }}' --tail 20
+          exit 1
+          DEPLOY_EOF
+
+      - name: Verify Prod instance
+        continue-on-error: true
+        run: |
+          sleep 5
+          ssh -i ~/.ssh/deploy_key -p ${{ vars.PROD_SSH_PORT }} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ vars.PROD_SSH_USERNAME }}@${{ vars.PROD_SSH_HOST }} "curl -sf '${{ vars.PROD_HEALTH_URL }}'" && echo " Prod API healthy"

.mokogit/workflows/deploy-rc.yml

@@ -0,0 +1,138 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+# BRIEF: Build and deploy to the RC environment on push to the rc branch.
+#        Portable across Go server repos: ALL deployment config comes from repo
+#        Actions variables (vars.*) and secrets (secrets.*), nothing hardcoded.
+#        The rc branch is created by promote-rc when a PR to main opens.
+# OWNER: Template-Go (canonical source; syncs to the root workflows dir). See Template-Go#3.
+#
+# Required repo VARIABLES (all tier-scoped so each environment is independent —
+# a repo may host its rc/dev/prod tiers on different machines):
+#   RC_SSH_HOST, RC_SSH_PORT, RC_SSH_USERNAME - SSH deploy target for the rc tier
+#   RC_REGISTRY, RC_REGISTRY_USER, RC_IMAGE   - container registry + login user + image
+#   RC_CONTAINER                              - compose service/container to recreate
+#   RC_COMPOSE_PROJECT                        - docker compose -p project name
+#   RC_COMPOSE_DIR                            - dir containing docker-compose.yml on host
+#   RC_SOURCE_DIR                             - build source checkout on host
+#   RC_TAG_ENV                                - compose env-var name that pins the image tag
+#   RC_HEALTH_URL                             - external URL to verify after deploy
+# Required SECRETS (already configured org-wide; reused, not re-set):
+#   DEPLOY_SSH_KEY       - deploy private key (repo/org secret)
+#   MOKOGIT_TOKEN      - registry/API token (org secret)
+
+name: Deploy (RC)
+
+on:
+  push:
+    branches:
+      - rc
+  # Manual trigger for isolated end-to-end tests without a full RC promotion.
+  # Runs on the ref it is dispatched from; that ref must carry current source
+  # (>= the RC database migration version) or the rebuilt image will refuse the
+  # newer DB. Dispatch from `rc` once `rc` is current.
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-rc
+  cancel-in-progress: true
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  deploy-rc:
+    name: "Build & Deploy to RC"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Determine version
+        id: config
+        run: |
+          VERSION=$(git describe --tags --always 2>/dev/null || echo "rc-$(git rev-parse --short HEAD)")
+          echo "tag=${VERSION}-rc" >> $GITHUB_OUTPUT
+          echo "Version: ${VERSION}-rc"
+
+      - name: Write deploy key
+        env:
+          DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$DEPLOY_KEY" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+
+      - name: Build and deploy to RC via SSH
+        env:
+          REGISTRY_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          TAG: ${{ steps.config.outputs.tag }}
+        run: |
+          # Runner-side values (TAG, REGISTRY_TOKEN) are injected into the remote shell
+          # via an env prefix; a *quoted* heredoc keeps every $var expanding once, on the
+          # remote. Repo variables (vars.*) are substituted inline by Actions before ssh.
+          ssh -i ~/.ssh/deploy_key -p ${{ vars.RC_SSH_PORT }} \
+            -o ConnectTimeout=30 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+            -o ServerAliveInterval=30 -o ServerAliveCountMax=10 \
+            ${{ vars.RC_SSH_USERNAME }}@${{ vars.RC_SSH_HOST }} \
+            "TAG='$TAG' REGISTRY_TOKEN='$REGISTRY_TOKEN' bash -s" <<'DEPLOY_EOF'
+          set -e
+          echo 'SSH connected to RC environment'
+
+          if [ -z "$TAG" ]; then
+            echo 'ERROR: TAG is empty; refusing to build an untagged image' >&2
+            exit 1
+          fi
+
+          HEALTH_FMT='{{.State.Health.Status}}'
+
+          echo 'Cleaning Docker build cache...'
+          docker builder prune -af 2>/dev/null || true
+          docker image prune -af 2>/dev/null || true
+
+          echo 'Pulling source...'
+          SOURCE_DIR='${{ vars.RC_SOURCE_DIR }}'
+          if [ ! -d "$SOURCE_DIR/.git" ]; then
+            git clone -b rc https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git "$SOURCE_DIR"
+          fi
+          cd "$SOURCE_DIR"
+          git remote set-url origin https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git 2>/dev/null || true
+          git fetch origin rc
+          git reset --hard origin/rc
+
+          echo "Building image: ${{ vars.RC_REGISTRY }}/${{ vars.RC_IMAGE }}:$TAG"
+          docker build --no-cache --build-arg GOFLAGS='-p 1' \
+            --tag "${{ vars.RC_REGISTRY }}/${{ vars.RC_IMAGE }}:$TAG" \
+            -f Dockerfile .
+
+          echo 'Pushing to registry...'
+          echo "$REGISTRY_TOKEN" | docker login ${{ vars.RC_REGISTRY }} -u ${{ vars.RC_REGISTRY_USER }} --password-stdin
+          docker push "${{ vars.RC_REGISTRY }}/${{ vars.RC_IMAGE }}:$TAG"
+
+          echo 'Restarting RC container...'
+          cd '${{ vars.RC_COMPOSE_DIR }}'
+          # Drive the rc service image tag via its compose env-var (no sed on the shared
+          # file); remove any lingering fixed-name container first, then force-recreate.
+          docker rm -f '${{ vars.RC_CONTAINER }}' 2>/dev/null || true
+          ${{ vars.RC_TAG_ENV }}="$TAG" docker compose -p '${{ vars.RC_COMPOSE_PROJECT }}' up -d --force-recreate '${{ vars.RC_CONTAINER }}'
+
+          echo 'Health check...'
+          for i in 1 2 3 4 5 6 7 8; do
+            sleep 15
+            if docker inspect --format="$HEALTH_FMT" '${{ vars.RC_CONTAINER }}' 2>/dev/null | grep -q healthy; then
+              echo 'RC container healthy!'
+              exit 0
+            fi
+            echo "Waiting... (attempt $i/8)"
+          done
+          echo 'Health check failed'
+          docker logs '${{ vars.RC_CONTAINER }}' --tail 20
+          exit 1
+          DEPLOY_EOF
+
+      - name: Verify RC instance
+        continue-on-error: true
+        run: |
+          sleep 5
+          ssh -i ~/.ssh/deploy_key -p ${{ vars.RC_SSH_PORT }} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ vars.RC_SSH_USERNAME }}@${{ vars.RC_SSH_HOST }} "curl -sf '${{ vars.RC_HEALTH_URL }}'" && echo " RC API healthy"

.mokogit/workflows/gitleaks.yml

@@ -0,0 +1,92 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGit.Workflow
+# INGROUP: MokoStandards.Security
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/MokoStandards-API
+# PATH: /templates/workflows/gitleaks.yml.template
+# VERSION: 01.00.00
+# BRIEF: Secret scanning — detect leaked credentials, API keys, and tokens
+#
+# +========================================================================+
+# |                        SECRET SCANNING                                 |
+# +========================================================================+
+# |                                                                        |
+# |  Scans commits for leaked secrets using Gitleaks.                      |
+# |                                                                        |
+# |  - PR scan: only new commits in the PR                                 |
+# |  - Scheduled: full repo scan weekly                                    |
+# |  - Alerts via ntfy on findings                                         |
+# |                                                                        |
+# +========================================================================+
+
+name: "Universal: Secret Scanning"
+
+on:
+  schedule:
+    - cron: '0 5 * * 1'  # Weekly Monday 05:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
+  NTFY_TOPIC: ${{ vars.NTFY_TOPIC || 'git-security' }}
+
+jobs:
+  gitleaks:
+    name: Gitleaks Secret Scan
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install Gitleaks
+        run: |
+          GITLEAKS_VERSION="8.21.2"
+          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            | tar -xz -C /usr/local/bin gitleaks
+          gitleaks version
+
+      - name: Scan for secrets
+        id: scan
+        run: |
+          echo "### Secret Scanning" >> $GITHUB_STEP_SUMMARY
+          ARGS="--source . --verbose --report-format json --report-path /tmp/gitleaks-report.json"
+
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            # Scan only PR commits
+            ARGS="$ARGS --log-opts=${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}"
+            echo "Scanning PR commits only" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "Full repository scan" >> $GITHUB_STEP_SUMMARY
+          fi
+
+          if gitleaks detect $ARGS 2>&1; then
+            echo "result=clean" >> "$GITHUB_OUTPUT"
+            echo "**No secrets detected.**" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "result=found" >> "$GITHUB_OUTPUT"
+            FINDINGS=$(jq length /tmp/gitleaks-report.json 2>/dev/null || echo "unknown")
+            echo "**${FINDINGS} potential secret(s) detected.**" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "Review the findings and rotate any exposed credentials immediately." >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+
+      - name: Notify on findings
+        if: failure() && steps.scan.outputs.result == 'found'
+        run: |
+          REPO="${{ github.event.repository.name }}"
+          curl -sS \
+            -H "Title: ${REPO} — secrets detected in code" \
+            -H "Tags: rotating_light,key" \
+            -H "Priority: urgent" \
+            -d "Gitleaks found potential secrets. Review and rotate credentials immediately." \
+            "${NTFY_URL}/${NTFY_TOPIC}" || true

.mokogit/workflows/issue-branch.yml

@@ -0,0 +1,73 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGit.Workflow
+# INGROUP: mokocli.Automation
+# VERSION: 01.00.00
+# BRIEF: Auto-create feature branch when an issue is opened
+
+name: "Universal: Issue Branch"
+
+on:
+  issues:
+    types: [opened]
+
+permissions:
+  contents: write
+  issues: write
+
+env:
+  MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+
+jobs:
+  create-branch:
+    name: Create feature branch
+    runs-on: ubuntu-latest
+    steps:
+      - name: Create branch and comment
+        run: |
+          TOKEN="${{ secrets.MOKOGIT_TOKEN }}"
+          API="${MOKOGIT_URL}/api/v1/repos/${{ github.repository }}"
+          ISSUE_NUM="${{ github.event.issue.number }}"
+          ISSUE_TITLE="${{ github.event.issue.title }}"
+
+          # Build slug from title: lowercase, replace non-alnum with dash, trim
+          SLUG=$(echo "${ISSUE_TITLE}" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9]/-/g' | sed 's/--*/-/g' | sed 's/^-//;s/-$//' | cut -c1-40)
+          BRANCH="feature/${ISSUE_NUM}-${SLUG}"
+
+          # Check dev branch exists
+          DEV_EXISTS=$(curl -sf -o /dev/null -w '%{http_code}' \
+            -H "Authorization: token ${TOKEN}" \
+            "${API}/branches/dev" 2>/dev/null || echo "000")
+
+          if [ "${DEV_EXISTS}" != "200" ]; then
+            echo "No dev branch -- skipping"
+            exit 0
+          fi
+
+          # Create branch from dev
+          HTTP=$(curl -sf -o /dev/null -w '%{http_code}' -X POST \
+            -H "Authorization: token ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            "${API}/branches" \
+            -d "{\"new_branch_name\":\"${BRANCH}\",\"old_branch_name\":\"dev\"}" 2>/dev/null || echo "000")
+
+          if [ "${HTTP}" = "201" ]; then
+            echo "Created branch: ${BRANCH}"
+
+            # Comment on issue with branch link
+            REPO_URL="${MOKOGIT_URL}/${{ github.repository }}"
+            BODY="Branch created: [\`${BRANCH}\`](${REPO_URL}/src/branch/${BRANCH})\n\n\`\`\`bash\ngit fetch origin\ngit checkout ${BRANCH}\n\`\`\`"
+
+            curl -sf -X POST \
+              -H "Authorization: token ${TOKEN}" \
+              -H "Content-Type: application/json" \
+              "${API}/issues/${ISSUE_NUM}/comments" \
+              -d "{\"body\":\"${BODY}\"}" > /dev/null 2>&1
+
+            echo "Commented on issue #${ISSUE_NUM}"
+          else
+            echo "Failed to create branch (HTTP ${HTTP}) -- may already exist"
+          fi

.mokogit/workflows/notify.yml

@@ -0,0 +1,70 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGit.Workflow
+# INGROUP: MokoStandards.Notifications
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
+# PATH: /.gitea/workflows/notify.yml
+# VERSION: 01.00.00
+# BRIEF: Push notifications via ntfy on release success or workflow failure
+
+name: "Universal: Notifications"
+
+on:
+  workflow_run:
+    workflows:
+      - "Joomla Build & Release"
+      - "Joomla Extension CI"
+      - "Deploy"
+    types:
+      - completed
+
+permissions:
+  contents: read
+
+env:
+  NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
+  NTFY_TOPIC: ${{ vars.NTFY_TOPIC || 'git-releases' }}
+
+jobs:
+  notify:
+    name: Send Notification
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.workflow_run.conclusion == 'success' ||
+      github.event.workflow_run.conclusion == 'failure'
+
+    steps:
+      - name: Notify on success (releases only)
+        if: >-
+          github.event.workflow_run.conclusion == 'success' &&
+          contains(github.event.workflow_run.name, 'Release')
+        run: |
+          REPO="${{ github.event.repository.name }}"
+          WORKFLOW="${{ github.event.workflow_run.name }}"
+          URL="${{ github.event.workflow_run.html_url }}"
+
+          curl -sS \
+            -H "Title: ${REPO} released" \
+            -H "Tags: white_check_mark,package" \
+            -H "Priority: default" \
+            -H "Click: ${URL}" \
+            -d "${WORKFLOW} completed successfully." \
+            "${NTFY_URL}/${NTFY_TOPIC}"
+
+      - name: Notify on failure
+        if: github.event.workflow_run.conclusion == 'failure'
+        run: |
+          REPO="${{ github.event.repository.name }}"
+          WORKFLOW="${{ github.event.workflow_run.name }}"
+          URL="${{ github.event.workflow_run.html_url }}"
+
+          curl -sS \
+            -H "Title: ${REPO} workflow failed" \
+            -H "Tags: x,warning" \
+            -H "Priority: high" \
+            -H "Click: ${URL}" \
+            -d "${WORKFLOW} failed. Check the run for details." \
+            "${NTFY_URL}/${NTFY_TOPIC}"

.mokogit/workflows/pr-check.yml

@@ -0,0 +1,522 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGit.Workflow
+# INGROUP: mokocli.CI
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
+# PATH: /templates/workflows/universal/pr-check.yml.template
+# VERSION: 09.23.00
+# BRIEF: PR gate — branch policy + code validation before merge
+
+name: "Universal: PR Check"
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  # ── Branch Policy ──────────────────────────────────────────────────────
+  branch-policy:
+    name: Branch Policy
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check branch merge target
+        run: |
+          HEAD="${{ github.head_ref }}"
+          BASE="${{ github.base_ref }}"
+
+          echo "PR: ${HEAD} → ${BASE}"
+
+          ALLOWED=true
+          REASON=""
+
+          case "$HEAD" in
+            feature/*|feat/*)
+              if [ "$BASE" != "dev" ]; then
+                ALLOWED=false
+                REASON="Feature branches must target 'dev', not '${BASE}'"
+              fi
+              ;;
+            fix/*|bugfix/*)
+              if [ "$BASE" != "dev" ]; then
+                ALLOWED=false
+                REASON="Fix branches must target 'dev', not '${BASE}'"
+              fi
+              ;;
+            patch/*)
+              if [ "$BASE" != "dev" ] && [ "$BASE" != "rc" ]; then
+                ALLOWED=false
+                REASON="Patch branches must target 'dev' or 'rc', not '${BASE}'"
+              fi
+              ;;
+            hotfix/*)
+              if [ "$BASE" != "dev" ] && [ "$BASE" != "main" ]; then
+                ALLOWED=false
+                REASON="Hotfix branches can only target 'dev' or 'main', not '${BASE}'"
+              fi
+              ;;
+            rc)
+              if [ "$BASE" != "main" ]; then
+                ALLOWED=false
+                REASON="RC branch can only merge into 'main', not '${BASE}'"
+              fi
+              ;;
+            dev)
+              if [ "$BASE" != "main" ]; then
+                ALLOWED=false
+                REASON="Dev branch can only merge into 'main', not '${BASE}'"
+              fi
+              ;;
+          esac
+
+          if [ "$ALLOWED" = false ]; then
+            echo "::error::${REASON}"
+            echo "## Branch Policy Violation" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "${REASON}" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "### Allowed merge paths:" >> $GITHUB_STEP_SUMMARY
+            echo "- \`feature/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`fix/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`hotfix/*\` → \`dev\` or \`main\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`dev\` → \`main\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`rc/*\` → \`main\`" >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+
+          echo "Branch policy: OK (${HEAD} → ${BASE})"
+          echo "## Branch Policy: Passed" >> $GITHUB_STEP_SUMMARY
+
+  # ── Secret Scanning ──────────────────────────────────────────────────
+  gitleaks:
+    name: Secret Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install Gitleaks
+        run: |
+          GITLEAKS_VERSION="8.21.2"
+          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            | tar -xz -C /usr/local/bin gitleaks
+
+      - name: Scan PR commits for secrets
+        run: |
+          if gitleaks detect --source . --verbose \
+            --log-opts=${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }} 2>&1; then
+            echo "**No secrets detected.**" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "::error::Potential secrets detected in PR commits"
+            exit 1
+          fi
+
+  # ── Code Validation ────────────────────────────────────────────────────
+  validate:
+    name: Validate PR
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Check for merge conflict markers
+        run: |
+          CONFLICTS=$(grep -rn '<<<<<<< \|>>>>>>> \|^=======$' --include='*.php' --include='*.xml' --include='*.css' --include='*.js' --include='*.json' --include='*.md' --include='*.yml' --include='*.yaml' --include='*.ini' --include='*.txt' . 2>/dev/null | grep -v '.git/' || true)
+          if [ -n "$CONFLICTS" ]; then
+            echo "::error::Merge conflict markers found in source files"
+            echo "## Conflict Markers Found" >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+            echo "$CONFLICTS" >> $GITHUB_STEP_SUMMARY
+            echo '```' >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+          echo "No conflict markers found"
+
+      - name: Detect platform
+        id: platform
+        run: |
+          # Platform comes from the MokoGit metadata API (public GET).
+          API="${GITHUB_SERVER_URL:-https://git.mokoconsulting.tech}/api/v1/repos/${GITHUB_REPOSITORY}/metadata"
+          PLATFORM="$(curl -sf "$API" 2>/dev/null | python3 -c "import sys, json; print(json.load(sys.stdin).get('platform') or '')" 2>/dev/null || true)"
+          [ -z "$PLATFORM" ] && PLATFORM="generic"
+          echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
+          echo "Detected platform: $PLATFORM"
+
+      - name: Setup PHP
+        if: steps.platform.outputs.platform == 'joomla' || steps.platform.outputs.platform == 'dolibarr'
+        run: |
+          if ! command -v php &> /dev/null; then
+            sudo apt-get update -qq
+            sudo apt-get install -y -qq php-cli php-mbstring php-xml >/dev/null 2>&1
+          fi
+
+      - name: PHP syntax check
+        if: steps.platform.outputs.platform == 'joomla' || steps.platform.outputs.platform == 'dolibarr'
+        run: |
+          ERRORS=0
+          while IFS= read -r -d '' file; do
+            if ! php -l "$file" 2>&1 | grep -q "No syntax errors"; then
+              ERRORS=$((ERRORS + 1))
+            fi
+          done < <(find . -name "*.php" -not -path "./.git/*" -not -path "./vendor/*" -print0)
+          echo "PHP lint: ${ERRORS} error(s)"
+          [ "$ERRORS" -eq 0 ] || { echo "::error::PHP syntax errors found"; exit 1; }
+
+      - name: Joomla JEXEC guard check
+        if: steps.platform.outputs.platform == 'joomla'
+        run: |
+          ERRORS=0
+          while IFS= read -r -d '' file; do
+            # Skip vendor, node_modules, and index.html stub files
+            case "$file" in ./vendor/*|./node_modules/*) continue ;; esac
+            # Check first 10 lines for JEXEC or JPATH guard
+            if ! head -20 "$file" | grep -qE "defined\s*\(\s*['\"](_JEXEC|JPATH_BASE|\\\\JPATH_PLATFORM)['\"]"; then
+              echo "::error file=${file}::Missing JEXEC guard: ${file}"
+              ERRORS=$((ERRORS + 1))
+            fi
+          done < <(find . -name "*.php" -path "*/src/*" -not -path "./.git/*" -not -path "./vendor/*" -print0)
+          if [ "$ERRORS" -gt 0 ]; then
+            echo "::error::${ERRORS} PHP file(s) missing defined('_JEXEC') or die guard"
+            echo "## JEXEC Guard Check: Failed" >> $GITHUB_STEP_SUMMARY
+            echo "${ERRORS} file(s) in src/ are missing the Joomla execution guard." >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+          echo "JEXEC guard: OK"
+
+      - name: Joomla directory listing protection
+        if: steps.platform.outputs.platform == 'joomla'
+        run: |
+          MISSING=0
+          SOURCE_DIR="src"
+          [ ! -d "$SOURCE_DIR" ] && exit 0
+          while IFS= read -r dir; do
+            if [ ! -f "${dir}/index.html" ]; then
+              echo "::warning::Missing index.html in ${dir} (directory listing protection)"
+              MISSING=$((MISSING + 1))
+            fi
+          done < <(find "$SOURCE_DIR" -type d -not -path "./.git/*" -not -path "*/vendor/*" -not -path "*/node_modules/*")
+          if [ "$MISSING" -gt 0 ]; then
+            echo "## Directory Protection" >> $GITHUB_STEP_SUMMARY
+            echo "${MISSING} director(ies) missing index.html" >> $GITHUB_STEP_SUMMARY
+          fi
+          echo "Directory protection: ${MISSING} missing (advisory)"
+
+      - name: Joomla script file and asset checks
+        if: steps.platform.outputs.platform == 'joomla'
+        run: |
+          ERRORS=0
+          MANIFEST=$(find . -maxdepth 3 -name "*.xml" ! -path "./.git/*" -exec grep -l '<extension' {} \; 2>/dev/null | head -1)
+          [ -z "$MANIFEST" ] && exit 0
+          MANIFEST_DIR=$(dirname "$MANIFEST")
+
+          # Check scriptfile exists if declared
+          SCRIPTFILE=$(sed -n 's/.*<scriptfile>\([^<]*\)<\/scriptfile>.*/\1/p' "$MANIFEST" 2>/dev/null)
+          if [ -n "$SCRIPTFILE" ]; then
+            if [ ! -f "${MANIFEST_DIR}/${SCRIPTFILE}" ]; then
+              echo "::error::Manifest declares <scriptfile>${SCRIPTFILE}</scriptfile> but file not found at ${MANIFEST_DIR}/${SCRIPTFILE}"
+              ERRORS=$((ERRORS + 1))
+            else
+              echo "Script file: ${MANIFEST_DIR}/${SCRIPTFILE} (OK)"
+            fi
+          fi
+
+          # Require joomla.asset.json and validate it
+          ASSET_JSON=$(find "$MANIFEST_DIR" -name "joomla.asset.json" -not -path "./.git/*" 2>/dev/null | head -1)
+          if [ -z "$ASSET_JSON" ]; then
+            echo "::error::joomla.asset.json not found — Joomla asset system is required"
+            ERRORS=$((ERRORS + 1))
+          else
+            if command -v php &> /dev/null; then
+              php -r "json_decode(file_get_contents('$ASSET_JSON')); if(json_last_error()!==JSON_ERROR_NONE){echo json_last_error_msg();exit(1);}" 2>&1 || {
+                echo "::error::joomla.asset.json is not valid JSON"
+                ERRORS=$((ERRORS + 1))
+              }
+            fi
+            echo "joomla.asset.json: valid"
+          fi
+
+          # Validate all XML files in src/ are well-formed
+          XML_ERRORS=0
+          if command -v php &> /dev/null; then
+            while IFS= read -r -d '' xmlfile; do
+              if ! php -r "libxml_use_internal_errors(true); \$x = simplexml_load_file('$xmlfile'); if(!\$x){foreach(libxml_get_errors() as \$e) echo trim(\$e->message) . ' in $xmlfile'; exit(1);}" 2>&1; then
+                XML_ERRORS=$((XML_ERRORS + 1))
+              fi
+            done < <(find "$MANIFEST_DIR" -name "*.xml" -not -path "./.git/*" -print0)
+          fi
+          if [ "$XML_ERRORS" -gt 0 ]; then
+            echo "::error::${XML_ERRORS} XML file(s) are malformed"
+            ERRORS=$((ERRORS + 1))
+          else
+            echo "XML well-formedness: OK"
+          fi
+
+          [ "$ERRORS" -gt 0 ] && exit 1
+          echo "Joomla asset checks: OK"
+
+      - name: Validate platform manifest
+        run: |
+          PLATFORM="${{ steps.platform.outputs.platform }}"
+          case "$PLATFORM" in
+            joomla)
+              MANIFEST=$(find . -maxdepth 3 -name "*.xml" ! -path "./.git/*" -exec grep -l '<extension' {} \; 2>/dev/null | head -1)
+              if [ -z "$MANIFEST" ]; then
+                echo "::warning::No Joomla manifest found (WaaS site)"
+                exit 0
+              fi
+              echo "Manifest: ${MANIFEST}"
+              if command -v php &> /dev/null; then
+                php -r "libxml_use_internal_errors(true); \$x = simplexml_load_file('$MANIFEST'); if(!\$x){foreach(libxml_get_errors() as \$e) echo \$e->message; exit(1);}" || { echo "::error::Manifest XML is malformed"; exit 1; }
+              fi
+              for ELEMENT in name version description; do
+                grep -q "<${ELEMENT}>" "$MANIFEST" || { echo "::error::Missing <${ELEMENT}> in manifest"; exit 1; }
+              done
+              # Block legacy raw/branch update server URLs on MokoGit
+              RAW_URLS=$(grep -n 'raw/branch' "$MANIFEST" | grep -i 'mokoconsulting\|mokogit\|git\.mokoconsulting\.tech' || true)
+              if [ -n "$RAW_URLS" ]; then
+                echo "::error::Manifest contains legacy raw/branch update server URL on MokoGit. Use the MokoGit Pages URL instead (e.g. /{REPO}/updates.xml not /{REPO}/raw/branch/main/updates.xml)"
+                echo "$RAW_URLS"
+                exit 1
+              fi
+              echo "Joomla manifest valid"
+              ;;
+            dolibarr)
+              MOD_FILE=$(find . -maxdepth 4 -name "mod*.class.php" ! -path "./.git/*" -exec grep -l 'extends DolibarrModules' {} \; 2>/dev/null | head -1)
+              if [ -z "$MOD_FILE" ]; then
+                echo "::error::No mod*.class.php found"
+                exit 1
+              fi
+              echo "Dolibarr module: ${MOD_FILE}"
+              ;;
+            *)
+              echo "Generic platform — no manifest validation"
+              ;;
+          esac
+
+      - name: Check update stream format
+        run: |
+          PLATFORM="${{ steps.platform.outputs.platform }}"
+          case "$PLATFORM" in
+            joomla)
+              if [ -f "updates.xml" ]; then
+                if command -v php &> /dev/null; then
+                  php -r "libxml_use_internal_errors(true); \$x = simplexml_load_file('updates.xml'); if(!\$x){foreach(libxml_get_errors() as \$e) echo \$e->message; exit(1);}" || { echo "::error::updates.xml is malformed"; exit 1; }
+                fi
+                echo "updates.xml valid"
+              fi
+              ;;
+            dolibarr)
+              [ -f "update.txt" ] && echo "update.txt present" || echo "::warning::No update.txt"
+              ;;
+          esac
+
+      - name: Validate Joomla language files
+        if: steps.platform.outputs.platform == 'joomla'
+        run: |
+          ERRORS=0
+          WARNINGS=0
+
+          # Require both en-GB and en-US language directories
+          LANG_ROOT=$(find . -path "*/language" -type d -not -path "./.git/*" 2>/dev/null | head -1)
+          if [ -z "$LANG_ROOT" ]; then
+            echo "No language/ directory found — skipping"
+            exit 0
+          fi
+
+          if [ ! -d "$LANG_ROOT/en-GB" ]; then
+            echo "::error::Missing en-GB language directory (${LANG_ROOT}/en-GB)"
+            ERRORS=$((ERRORS + 1))
+          fi
+          if [ ! -d "$LANG_ROOT/en-US" ]; then
+            echo "::error::Missing en-US language directory (${LANG_ROOT}/en-US)"
+            ERRORS=$((ERRORS + 1))
+          fi
+
+          # Check that en-GB and en-US have matching .ini files
+          if [ -d "$LANG_ROOT/en-GB" ] && [ -d "$LANG_ROOT/en-US" ]; then
+            for GB_INI in "$LANG_ROOT/en-GB"/*.ini; do
+              [ ! -f "$GB_INI" ] && continue
+              US_INI="$LANG_ROOT/en-US/$(basename "$GB_INI")"
+              if [ ! -f "$US_INI" ]; then
+                echo "::error::$(basename "$GB_INI") exists in en-GB but missing from en-US"
+                ERRORS=$((ERRORS + 1))
+              fi
+            done
+            for US_INI in "$LANG_ROOT/en-US"/*.ini; do
+              [ ! -f "$US_INI" ] && continue
+              GB_INI="$LANG_ROOT/en-GB/$(basename "$US_INI")"
+              if [ ! -f "$GB_INI" ]; then
+                echo "::error::$(basename "$US_INI") exists in en-US but missing from en-GB"
+                ERRORS=$((ERRORS + 1))
+              fi
+            done
+          fi
+
+          # Find all .ini language files
+          INI_FILES=$(find . -path "*/language/*/*.ini" -not -path "./.git/*" 2>/dev/null)
+          if [ -z "$INI_FILES" ]; then
+            echo "No .ini language files found"
+            [ "$ERRORS" -gt 0 ] && exit 1
+            exit 0
+          fi
+
+          echo "Found $(echo "$INI_FILES" | wc -l) language file(s)"
+
+          for FILE in $INI_FILES; do
+            FNAME=$(basename "$FILE")
+            LINENUM=0
+            SEEN_KEYS=""
+
+            while IFS= read -r line || [ -n "$line" ]; do
+              LINENUM=$((LINENUM + 1))
+
+              # Skip empty lines and comments
+              [ -z "$line" ] && continue
+              echo "$line" | grep -qE '^\s*;' && continue
+              echo "$line" | grep -qE '^\s*$' && continue
+
+              # Must match KEY="VALUE" format
+              if ! echo "$line" | grep -qE '^[A-Z_][A-Z0-9_]*=".*"$'; then
+                echo "::error file=${FILE},line=${LINENUM}::Malformed line: ${line}"
+                ERRORS=$((ERRORS + 1))
+                continue
+              fi
+
+              # Extract key and check for duplicates
+              KEY=$(echo "$line" | sed 's/=.*//')
+              if echo "$SEEN_KEYS" | grep -qx "$KEY"; then
+                echo "::error file=${FILE},line=${LINENUM}::Duplicate key: ${KEY}"
+                ERRORS=$((ERRORS + 1))
+              fi
+              SEEN_KEYS="${SEEN_KEYS}
+          ${KEY}"
+            done < "$FILE"
+
+            echo "  ${FILE}: checked ${LINENUM} lines"
+          done
+
+          # Cross-check en-GB vs en-US key consistency
+          GB_DIR=$(find . -path "*/language/en-GB" -type d -not -path "./.git/*" 2>/dev/null | head -1)
+          US_DIR=$(find . -path "*/language/en-US" -type d -not -path "./.git/*" 2>/dev/null | head -1)
+
+          if [ -n "$GB_DIR" ] && [ -n "$US_DIR" ]; then
+            for GB_FILE in "$GB_DIR"/*.ini; do
+              [ ! -f "$GB_FILE" ] && continue
+              FNAME=$(basename "$GB_FILE")
+              US_FILE="$US_DIR/$FNAME"
+              [ ! -f "$US_FILE" ] && continue
+
+              GB_KEYS=$(grep -oP '^[A-Z_][A-Z0-9_]*(?==)' "$GB_FILE" 2>/dev/null | sort)
+              US_KEYS=$(grep -oP '^[A-Z_][A-Z0-9_]*(?==)' "$US_FILE" 2>/dev/null | sort)
+
+              # Keys in en-GB but not en-US
+              MISSING_US=$(comm -23 <(echo "$GB_KEYS") <(echo "$US_KEYS"))
+              if [ -n "$MISSING_US" ]; then
+                echo "::warning::Keys in en-GB/$FNAME but missing from en-US/$FNAME:"
+                echo "$MISSING_US" | while read -r k; do echo "  - $k"; done
+                WARNINGS=$((WARNINGS + 1))
+              fi
+
+              # Keys in en-US but not en-GB
+              MISSING_GB=$(comm -13 <(echo "$GB_KEYS") <(echo "$US_KEYS"))
+              if [ -n "$MISSING_GB" ]; then
+                echo "::warning::Keys in en-US/$FNAME but missing from en-GB/$FNAME:"
+                echo "$MISSING_GB" | while read -r k; do echo "  - $k"; done
+                WARNINGS=$((WARNINGS + 1))
+              fi
+            done
+          fi
+
+          {
+            echo "### Language File Validation"
+            echo "| Metric | Count |"
+            echo "|---|---|"
+            echo "| Files checked | $(echo "$INI_FILES" | wc -l) |"
+            echo "| Errors | ${ERRORS} |"
+            echo "| Warnings | ${WARNINGS} |"
+          } >> $GITHUB_STEP_SUMMARY
+
+          if [ "$ERRORS" -gt 0 ]; then
+            echo "::error::Language validation failed with ${ERRORS} error(s)"
+            exit 1
+          fi
+          echo "Language files: OK (${WARNINGS} warning(s))"
+
+      - name: Check changelog has unreleased entry
+        run: |
+          if [ ! -f "CHANGELOG.md" ]; then
+            echo "::warning::No CHANGELOG.md found"
+            exit 0
+          fi
+          # Check for content under [Unreleased] section
+          if ! grep -q "## \[Unreleased\]" CHANGELOG.md; then
+            echo "::error::CHANGELOG.md missing [Unreleased] section"
+            exit 1
+          fi
+          # Check there's at least one entry (Added/Changed/Fixed/Removed) under Unreleased
+          UNRELEASED_CONTENT=$(sed -n '/## \[Unreleased\]/,/## \[/p' CHANGELOG.md | grep -cE '^\s*-\s' || true)
+          if [ "$UNRELEASED_CONTENT" -eq 0 ]; then
+            echo "::error::CHANGELOG.md [Unreleased] section has no entries. Add a changelog entry describing your changes."
+            echo "## Changelog Check: Failed" >> $GITHUB_STEP_SUMMARY
+            echo "The \`[Unreleased]\` section in CHANGELOG.md has no entries." >> $GITHUB_STEP_SUMMARY
+            echo "Add a line like \`- Description of your change\` under a heading (\`### Added\`, \`### Changed\`, \`### Fixed\`, etc.)" >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+          echo "Changelog: ${UNRELEASED_CONTENT} entry/entries in [Unreleased]"
+
+      - name: Verify package source
+        run: |
+          SOURCE_DIR="src"
+          [ ! -d "$SOURCE_DIR" ] && SOURCE_DIR="htdocs"
+          if [ ! -d "$SOURCE_DIR" ]; then
+            echo "::warning::No src/ or htdocs/ directory"
+            exit 0
+          fi
+          FILE_COUNT=$(find "$SOURCE_DIR" -type f | wc -l)
+          echo "Source: ${FILE_COUNT} files"
+          [ "$FILE_COUNT" -gt 0 ] || { echo "::error::Source directory is empty"; exit 1; }
+
+  # ── Pre-Release RC Build ─────────────────────────────────────────────────
+  pre-release:
+    name: Build RC Package
+    runs-on: ubuntu-latest
+    needs: [branch-policy, validate]
+
+    steps:
+      - name: Trigger RC pre-release
+        env:
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          REPO: ${{ github.repository }}
+          BRANCH: ${{ github.head_ref }}
+          MOKOGIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+        run: |
+          curl -s -X POST             "${MOKOGIT_URL}/api/v1/repos/${REPO}/actions/workflows/pre-release.yml/dispatches"             -H "Authorization: token ${MOKOGIT_TOKEN}"             -H "Content-Type: application/json"             -d "{\"ref\":\"${BRANCH}\",\"inputs\":{\"stability\":\"release-candidate\"}}"
+          echo "### Pre-Release" >> $GITHUB_STEP_SUMMARY
+          echo "Triggered RC build on branch \`${BRANCH}\`" >> $GITHUB_STEP_SUMMARY
+
+  # ── Issue Reporter ──────────────────────────────────────────────────────
+  report-issues:
+    name: Report Issues
+    needs: [branch-policy, validate]
+    if: >-
+      always() &&
+      needs.validate.result == 'failure'
+    uses: ./.mokogit/workflows/ci-issue-reporter.yml
+    with:
+      gate: "PR Validation"
+      workflow: "PR Check"
+      severity: error
+      details: "PR validation failed (syntax, manifest, changelog, or source checks). See the CI run for the specific check that failed."
+    secrets: inherit

.mokogit/workflows/pre-release.yml

@@ -0,0 +1,273 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGit.Workflow
+# INGROUP: mokocli.Release
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /templates/workflows/universal/pre-release.yml.template
+# VERSION: 05.02.00
+# BRIEF: Auto pre-release on push to dev/alpha/beta/rc branches
+
+name: "Universal: Pre-Release"
+
+on:
+  push:
+    branches:
+      - dev
+      - 'fix/**'
+      - 'patch/**'
+      - 'hotfix/**'
+      - 'bugfix/**'
+      - 'chore/**'
+      - alpha
+      - beta
+      - rc
+  workflow_dispatch:
+    inputs:
+      stability:
+        description: 'Pre-release channel'
+        required: true
+        type: choice
+        options:
+          - development
+          - alpha
+          - beta
+          - release-candidate
+
+permissions:
+  contents: write
+
+env:
+  GIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  GIT_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
+  GIT_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
+
+jobs:
+  build:
+    name: "Build Pre-Release (${{ inputs.stability || github.ref_name }})"
+    runs-on: release
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      github.event_name == 'push'
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.MOKOGIT_TOKEN }}
+          ref: ${{ github.ref_name }}
+          submodules: recursive
+
+      - name: Update submodules to main
+        run: |
+          git submodule foreach --quiet 'git checkout main && git pull --quiet origin main' 2>/dev/null || true
+
+      - name: Setup mokocli tools
+        env:
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
+        run: |
+          # Use pre-installed /opt/mokocli if available (updated by cron every 6h)
+          if [ -f /opt/mokocli/cli/version_bump.php ] && [ -f /opt/mokocli/cli/manifest_element.php ] && [ -f /opt/mokocli/vendor/autoload.php ]; then
+            echo Using pre-installed /opt/mokocli
+            echo MOKO_CLI=/opt/mokocli/cli >> $GITHUB_ENV
+          else
+            echo Falling back to fresh clone
+            if ! command -v composer > /dev/null 2>&1; then
+              sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
+            fi
+            rm -rf /tmp/mokocli
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
+            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
+            cd /tmp/mokocli && composer install --no-dev --no-interaction --quiet
+            echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
+          fi
+
+      - name: Detect platform
+        id: platform
+        run: |
+          # Auto-detect and update platform if not set in manifest
+          php ${MOKO_CLI}/platform_detect.php --path . --github-output 2>/dev/null || true
+          php ${MOKO_CLI}/manifest_read.php --path . --github-output
+
+      - name: Check platform eligibility (Joomla only)
+        id: eligibility
+        run: |
+          PLATFORM="${{ steps.platform.outputs.platform }}"
+          if [[ "$PLATFORM" == joomla* ]] || [[ "$PLATFORM" == "joomla" ]]; then
+            echo "proceed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "proceed=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::Platform '$PLATFORM' — non-Joomla, skipping pre-release auto-bump"
+          fi
+
+      - name: Resolve metadata and bump version
+        id: meta
+        if: steps.eligibility.outputs.proceed == 'true'
+        run: |
+          # Auto-detect stability from branch name on push, or use input on dispatch
+          if [ "${{ github.event_name }}" = "push" ]; then
+            case "${{ github.ref_name }}" in
+              rc)    STABILITY="release-candidate" ;;
+              alpha) STABILITY="alpha" ;;
+              beta)  STABILITY="beta" ;;
+              *)     STABILITY="development" ;;
+            esac
+          else
+            STABILITY="${{ inputs.stability || 'development' }}"
+          fi
+
+          case "$STABILITY" in
+            development)        SUFFIX="-dev";   TAG="development" ;;
+            alpha)              SUFFIX="-alpha"; TAG="alpha" ;;
+            beta)               SUFFIX="-beta";  TAG="beta" ;;
+            release-candidate)  SUFFIX="-rc";    TAG="release-candidate" ;;
+          esac
+
+          # Bump version via CLI: patch for dev/alpha/beta, minor for RC
+          case "$STABILITY" in
+            release-candidate) BUMP="minor" ;;
+            *)                 BUMP="patch" ;;
+          esac
+
+          php ${MOKO_CLI}/version_bump.php --path . $([ "$BUMP" = "minor" ] && echo "--minor") 2>/dev/null || true
+
+          # Set stability suffix and verify consistency
+          VERSION=$(php ${MOKO_CLI}/version_read.php --path . 2>/dev/null || echo "00.00.01")
+          VERSION=$(echo "$VERSION" | sed 's/-\(dev\|alpha\|beta\|rc\)$//')
+
+          php ${MOKO_CLI}/version_set_platform.php \
+            --path . --version "$VERSION" --branch "${{ github.ref_name }}" --stability "$STABILITY" 2>/dev/null || true
+          php ${MOKO_CLI}/version_check.php --path . --fix 2>/dev/null || true
+
+          # Ensure licensing tags (updateservers, dlid) if enabled in manifest.xml
+          php ${MOKO_CLI}/manifest_licensing.php --path . --fix 2>/dev/null || true
+
+          # Append suffix for output
+          if [ -n "$SUFFIX" ]; then
+            VERSION="${VERSION}${SUFFIX}"
+          fi
+
+          # Commit version bump
+          git config --local user.email "mokogit-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "mokogit-actions[bot]"
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGIT_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+          git add -A
+          git diff --cached --quiet || {
+            git commit -m "chore(version): pre-release bump to ${VERSION} [skip ci]"
+            git push origin HEAD 2>&1
+          }
+
+          # Auto-detect element via manifest_element.php
+          php ${MOKO_CLI}/manifest_element.php \
+            --path . --version "$VERSION" --stability "$STABILITY" \
+            --repo "${GIT_REPO}" --github-output
+
+          # Read back element outputs
+          EXT_ELEMENT=$(grep '^ext_element=' "$GITHUB_OUTPUT" | tail -1 | cut -d= -f2)
+          ZIP_NAME=$(grep '^zip_name=' "$GITHUB_OUTPUT" | tail -1 | cut -d= -f2)
+          [ -z "$EXT_ELEMENT" ] && EXT_ELEMENT=$(echo "${GIT_REPO}" | tr '[:upper:]' '[:lower:]' | tr -d ' -')
+          [ -z "$ZIP_NAME" ] && ZIP_NAME="${EXT_ELEMENT}-${VERSION}.zip"
+
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "stability=${STABILITY}" >> "$GITHUB_OUTPUT"
+          echo "suffix=${SUFFIX}" >> "$GITHUB_OUTPUT"
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+          echo "zip_name=${ZIP_NAME}" >> "$GITHUB_OUTPUT"
+          echo "ext_element=${EXT_ELEMENT}" >> "$GITHUB_OUTPUT"
+
+          echo "=== Pre-Release: ${EXT_ELEMENT} ${VERSION}${SUFFIX} ==="
+
+      - name: Create release
+        id: release
+        if: steps.eligibility.outputs.proceed == 'true'
+        run: |
+          TAG="${{ steps.meta.outputs.tag }}"
+          VERSION="${{ steps.meta.outputs.version }}"
+          API_BASE="${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+          php ${MOKO_CLI}/release_create.php \
+            --path . --version "$VERSION" --tag "$TAG" \
+            --token "${{ secrets.MOKOGIT_TOKEN }}" --api-base "$API_BASE" \
+            --repo "${GIT_REPO}" --branch "${{ github.ref_name }}" --prerelease
+
+      - name: Update release notes from CHANGELOG.md
+        if: steps.eligibility.outputs.proceed == 'true'
+        run: |
+          TAG="${{ steps.meta.outputs.tag }}"
+          VERSION="${{ steps.meta.outputs.version }}"
+          API_BASE="${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+
+          # Extract [Unreleased] section from changelog (everything between [Unreleased] and next ## heading)
+          if [ -f "CHANGELOG.md" ]; then
+            NOTES=$(awk '/^## \[Unreleased\]/{found=1; next} /^## \[/{if(found) exit} found{print}' CHANGELOG.md)
+            [ -z "$NOTES" ] && NOTES="Release ${VERSION}"
+          else
+            NOTES="Release ${VERSION}"
+          fi
+
+          # Update release body via API
+          RELEASE_ID=$(curl -sf -H "Authorization: token ${{ secrets.MOKOGIT_TOKEN }}" \
+            "${API_BASE}/releases/tags/${TAG}" | python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
+
+          if [ -n "$RELEASE_ID" ]; then
+            python3 -c "
+          import json, urllib.request
+          body = open('/dev/stdin').read()
+          payload = json.dumps({'body': body}).encode()
+          req = urllib.request.Request(
+              '${API_BASE}/releases/${RELEASE_ID}',
+              data=payload, method='PATCH',
+              headers={
+                  'Authorization': 'token ${{ secrets.MOKOGIT_TOKEN }}',
+                  'Content-Type': 'application/json'
+              })
+          urllib.request.urlopen(req)
+          " <<< "$NOTES"
+            echo "Release notes updated from CHANGELOG.md"
+          fi
+
+      - name: Build package and upload
+        id: package
+        if: steps.eligibility.outputs.proceed == 'true'
+        run: |
+          VERSION="${{ steps.meta.outputs.version }}"
+          TAG="${{ steps.meta.outputs.tag }}"
+          API_BASE="${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+          php ${MOKO_CLI}/release_package.php \
+            --path . --version "$VERSION" --tag "$TAG" \
+            --token "${{ secrets.MOKOGIT_TOKEN }}" --api-base "$API_BASE" \
+            --repo "${GIT_REPO}" --output /tmp || true
+
+      # updates.xml is generated dynamically by MokoGit license server
+      # No need to build, commit, or sync updates.xml from workflows
+
+      - name: "Delete lesser pre-release channels (cascade)"
+        if: steps.eligibility.outputs.proceed == 'true'
+        continue-on-error: true
+        run: |
+          API_BASE="${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+          TOKEN="${{ secrets.MOKOGIT_TOKEN }}"
+
+          php ${MOKO_CLI}/release_cascade.php \
+            --stability "${{ steps.meta.outputs.stability }}" \
+            --token "${TOKEN}" \
+            --api-base "${API_BASE}"
+
+      - name: Summary
+        if: always()
+        run: |
+          VERSION="${{ steps.meta.outputs.version }}"
+          STABILITY="${{ steps.meta.outputs.stability }}"
+          ZIP_NAME="${{ steps.meta.outputs.zip_name }}"
+          SHA256="${{ steps.package.outputs.sha256_zip }}"
+          echo "## Pre-Release Complete" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY
+          echo "|-------|-------|" >> $GITHUB_STEP_SUMMARY
+          echo "| Version | \`${VERSION}\` |" >> $GITHUB_STEP_SUMMARY
+          echo "| Channel | ${STABILITY} |" >> $GITHUB_STEP_SUMMARY
+          echo "| Package | \`${ZIP_NAME}\` |" >> $GITHUB_STEP_SUMMARY
+          echo "| SHA-256 | \`${SHA256:-n/a}\` |" >> $GITHUB_STEP_SUMMARY

.mokogit/workflows/rc-revert.yml

@@ -0,0 +1,71 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGit.Workflow
+# INGROUP: mokocli.Universal
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /.mokogit/workflows/rc-revert.yml
+# VERSION: 09.23.00
+# BRIEF: Rename rc/ branch back to dev/ when PR is closed without merge
+
+name: "RC Revert"
+
+on:
+  pull_request:
+    types: [closed]
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  revert:
+    name: Rename rc/ back to dev/
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.pull_request.merged == false &&
+      startsWith(github.event.pull_request.head.ref, 'rc/')
+
+    steps:
+      - name: Rename branch
+        env:
+          BRANCH: ${{ github.event.pull_request.head.ref }}
+          REPO: ${{ github.repository }}
+          GIT_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+        run: |
+          set -euo pipefail
+          # BRANCH is attacker-controlled (PR head ref). Strict allowlist before ANY use.
+          if ! printf '%s' "$BRANCH" | grep -Eq '^rc/[A-Za-z0-9._/-]+$'; then
+            echo "::error::Refusing unsafe branch name: $BRANCH"; exit 1
+          fi
+          SUFFIX="${BRANCH#rc/}"
+          DEV_BRANCH="dev/${SUFFIX}"
+          API="${GIT_URL}/api/v1/repos/${REPO}/branches"
+
+          # Create dev/ branch from rc/ branch
+          STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X POST \
+            -H "Authorization: token ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "{\"new_branch_name\": \"${DEV_BRANCH}\", \"old_branch_name\": \"${BRANCH}\"}" \
+            "${API}" 2>/dev/null || true)
+          if [ "$STATUS" = "201" ]; then
+            echo "Created branch: ${DEV_BRANCH}" >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo "::error::Failed to create ${DEV_BRANCH} from ${BRANCH} (HTTP ${STATUS})"; exit 1
+          fi
+
+          # Read BRANCH from the environment inside PHP (getenv, no string interpolation -> no PHP injection)
+          ENCODED=$(php -r 'echo rawurlencode(getenv("BRANCH"));')
+          STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X DELETE \
+            -H "Authorization: token ${TOKEN}" \
+            "${API}/${ENCODED}" 2>/dev/null || true)
+          if [ "$STATUS" = "204" ]; then
+            echo "Deleted branch: ${BRANCH}" >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo "::warning::Failed to delete ${BRANCH} (HTTP ${STATUS})"
+          fi
+
+          echo "### RC Reverted" >> "$GITHUB_STEP_SUMMARY"
+          echo "${BRANCH} → ${DEV_BRANCH}" >> "$GITHUB_STEP_SUMMARY"

.mokogit/workflows/repo-health.yml

@@ -0,0 +1,700 @@
+# ============================================================================
+# Copyright (C) 2025 Moko Consulting <hello@mokoconsulting.tech>
+#
+# This file is part of a Moko Consulting project.
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGit.Workflow
+# INGROUP: mokocli.Validation
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
+# PATH: /templates/workflows/joomla/repo_health.yml.template
+# VERSION: 09.23.00
+# BRIEF: Enforces repository guardrails by validating scripts governance, tooling availability, and core repository health artifacts.
+# ============================================================================
+
+name: "Generic: Repo Health"
+
+defaults:
+  run:
+    shell: bash
+
+on:
+  workflow_dispatch:
+    inputs:
+      profile:
+        description: 'Validation profile: all, scripts, or repo'
+        required: true
+        default: all
+        type: choice
+        options:
+          - all
+          - scripts
+          - repo
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+env:
+  # Scripts governance policy
+  SCRIPTS_REQUIRED_DIRS:
+  SCRIPTS_ALLOWED_DIRS: scripts,scripts/fix,scripts/lib,scripts/release,scripts/run,scripts/validate
+
+  # Repo health policy
+  REPO_REQUIRED_ARTIFACTS: README.md,LICENSE,CHANGELOG.md,CONTRIBUTING.md,CODE_OF_CONDUCT.md,.mokogit/workflows/
+  REPO_OPTIONAL_FILES: SECURITY.md,GOVERNANCE.md,.editorconfig,.gitattributes,.gitignore,README.md,docs/
+  REPO_DISALLOWED_DIRS:
+  REPO_DISALLOWED_FILES: TODO.md,todo.md
+
+  # Extended checks toggles
+  EXTENDED_CHECKS: "true"
+
+  # File / directory variables
+  DOCS_INDEX: docs/docs-index.md
+  SCRIPT_DIR: scripts
+  WORKFLOWS_DIR: .mokogit/workflows
+  SHELLCHECK_PATTERN: '*.sh'
+  SPDX_FILE_GLOBS: '*.sh,*.php,*.js,*.ts,*.css,*.xml,*.yml,*.yaml'
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  access_check:
+    name: Access control
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+
+    outputs:
+      allowed: ${{ steps.perm.outputs.allowed }}
+      permission: ${{ steps.perm.outputs.permission }}
+
+    steps:
+      - name: Check actor permission (admin only)
+        id: perm
+        env:
+          TOKEN: ${{ secrets.MOKOGIT_TOKEN || github.token }}
+          REPO: ${{ github.repository }}
+          ACTOR: ${{ github.actor }}
+        run: |
+          set -euo pipefail
+          ALLOWED=false
+          PERMISSION=unknown
+          METHOD=""
+
+          # Hardcoded authorized users — always allowed
+          case "$ACTOR" in
+            jmiller|mokogit-actions[bot])
+              ALLOWED=true
+              PERMISSION=admin
+              METHOD="hardcoded allowlist"
+              ;;
+            *)
+              # Detect platform and check permissions via API
+              API_BASE="${GITHUB_API_URL:-${GIT_API_URL:-https://api.github.com}}"
+              RESP=$(curl -sf -H "Authorization: token ${TOKEN}" \
+                "${API_BASE}/repos/${REPO}/collaborators/${ACTOR}/permission" 2>/dev/null || echo '{}')
+              PERMISSION=$(echo "$RESP" | grep -oP '"permission"\s*:\s*"\K[^"]+' || echo "unknown")
+              if [ "$PERMISSION" = "admin" ] || [ "$PERMISSION" = "maintain" ] || [ "$PERMISSION" = "owner" ]; then
+                ALLOWED=true
+              fi
+              METHOD="collaborator API"
+              ;;
+          esac
+
+          echo "permission=${PERMISSION}" >> "$GITHUB_OUTPUT"
+          echo "allowed=${ALLOWED}" >> "$GITHUB_OUTPUT"
+
+          {
+            echo "## Access Authorization"
+            echo ""
+            echo "| Field | Value |"
+            echo "|-------|-------|"
+            echo "| **Actor** | \`${ACTOR}\` |"
+            echo "| **Repository** | \`${REPO}\` |"
+            echo "| **Permission** | \`${PERMISSION}\` |"
+            echo "| **Method** | ${METHOD} |"
+            echo "| **Authorized** | ${ALLOWED} |"
+            echo ""
+            if [ "$ALLOWED" = "true" ]; then
+              echo "${ACTOR} authorized (${METHOD})"
+            else
+              echo "${ACTOR} is NOT authorized. Requires admin or maintain role."
+            fi
+          } >> "${GITHUB_STEP_SUMMARY}"
+
+      - name: Deny execution when not permitted
+        if: ${{ steps.perm.outputs.allowed != 'true' }}
+        run: |
+          set -euo pipefail
+          printf '%s\n' 'ERROR: Access denied. Admin permission required.' >> "${GITHUB_STEP_SUMMARY}"
+          exit 1
+
+  scripts_governance:
+    name: Scripts governance
+    needs: access_check
+    if: ${{ needs.access_check.outputs.allowed == 'true' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          fetch-depth: 0
+
+      - name: Scripts folder checks
+        env:
+          PROFILE_RAW: ${{ github.event.inputs.profile }}
+        run: |
+          set -euo pipefail
+
+          profile="${PROFILE_RAW:-all}"
+          case "${profile}" in
+            all|scripts|repo) ;;
+            *)
+              printf '%s\n' "ERROR: Unknown profile: ${profile}" >> "${GITHUB_STEP_SUMMARY}"
+              exit 1
+              ;;
+          esac
+
+          if [ "${profile}" = 'repo' ]; then
+            {
+              printf '%s\n' '### Scripts governance'
+              printf '%s\n' "Profile: ${profile}"
+              printf '%s\n' 'Status: SKIPPED'
+              printf '%s\n' 'Reason: profile excludes scripts governance'
+              printf '\n'
+            } >> "${GITHUB_STEP_SUMMARY}"
+            exit 0
+          fi
+
+          if [ ! -d "${SCRIPT_DIR}" ]; then
+            {
+              printf '%s\n' '### Scripts governance'
+              printf '%s\n' 'Status: OK (advisory)'
+              printf '%s\n' 'scripts/ directory not present. No scripts governance enforced.'
+              printf '\n'
+            } >> "${GITHUB_STEP_SUMMARY}"
+            exit 0
+          fi
+
+          if [ -n "${SCRIPTS_REQUIRED_DIRS:-}" ]; then IFS=',' read -r -a required_dirs <<< "${SCRIPTS_REQUIRED_DIRS}"; else required_dirs=(); fi
+          IFS=',' read -r -a allowed_dirs <<< "${SCRIPTS_ALLOWED_DIRS}"
+
+          missing_dirs=()
+          unapproved_dirs=()
+
+          for d in "${required_dirs[@]}"; do
+            req="${d%/}"
+            [ ! -d "${req}" ] && missing_dirs+=("${req}/")
+          done
+
+          while IFS= read -r d; do
+            allowed=false
+            for a in "${allowed_dirs[@]}"; do
+              a_norm="${a%/}"
+              [ "${d%/}" = "${a_norm}" ] && allowed=true
+            done
+            [ "${allowed}" = false ] && unapproved_dirs+=("${d%/}/")
+          done < <(find "${SCRIPT_DIR}" -maxdepth 1 -mindepth 1 -type d 2>/dev/null | sed 's#^\./##')
+
+          {
+            printf '%s\n' '### Scripts governance'
+            printf '%s\n' "Profile: ${profile}"
+            printf '%s\n' '| Area | Status | Notes |'
+            printf '%s\n' '|---|---|---|'
+
+            if [ "${#missing_dirs[@]}" -gt 0 ]; then
+              printf '%s\n' '| Required directories | Warning | Missing required subfolders |'
+            else
+              printf '%s\n' '| Required directories | OK | All required subfolders present |'
+            fi
+
+            if [ "${#unapproved_dirs[@]}" -gt 0 ]; then
+              printf '%s\n' '| Directory policy | Warning | Unapproved directories detected |'
+            else
+              printf '%s\n' '| Directory policy | OK | No unapproved directories |'
+            fi
+
+            printf '%s\n' '| Enforcement mode | Advisory | scripts folder is optional |'
+            printf '\n'
+
+            if [ "${#missing_dirs[@]}" -gt 0 ]; then
+              printf '%s\n' 'Missing required script directories:'
+              for m in "${missing_dirs[@]}"; do printf '%s\n' "- ${m}"; done
+              printf '\n'
+            else
+              printf '%s\n' 'Missing required script directories: none.'
+              printf '\n'
+            fi
+
+            if [ "${#unapproved_dirs[@]}" -gt 0 ]; then
+              printf '%s\n' 'Unapproved script directories detected:'
+              for m in "${unapproved_dirs[@]}"; do printf '%s\n' "- ${m}"; done
+              printf '\n'
+            else
+              printf '%s\n' 'Unapproved script directories detected: none.'
+              printf '\n'
+            fi
+
+            printf '%s\n' 'Scripts governance completed in advisory mode.'
+            printf '\n'
+          } >> "${GITHUB_STEP_SUMMARY}"
+
+  repo_health:
+    name: Repository health
+    needs: access_check
+    if: ${{ needs.access_check.outputs.allowed == 'true' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          fetch-depth: 0
+
+      - name: Repository health checks
+        env:
+          PROFILE_RAW: ${{ github.event.inputs.profile }}
+        run: |
+          set -euo pipefail
+
+          profile="${PROFILE_RAW:-all}"
+          case "${profile}" in
+            all|scripts|repo) ;;
+            *)
+              printf '%s\n' "ERROR: Unknown profile: ${profile}" >> "${GITHUB_STEP_SUMMARY}"
+              exit 1
+              ;;
+          esac
+
+          if [ "${profile}" = 'scripts' ]; then
+            {
+              printf '%s\n' '### Repository health'
+              printf '%s\n' "Profile: ${profile}"
+              printf '%s\n' 'Status: SKIPPED'
+              printf '%s\n' 'Reason: profile excludes repository health'
+              printf '\n'
+            } >> "${GITHUB_STEP_SUMMARY}"
+            exit 0
+          fi
+
+          IFS=',' read -r -a required_artifacts <<< "${REPO_REQUIRED_ARTIFACTS}"
+          IFS=',' read -r -a optional_files <<< "${REPO_OPTIONAL_FILES}"
+          if [ -n "${REPO_DISALLOWED_DIRS:-}" ]; then IFS=',' read -r -a disallowed_dirs <<< "${REPO_DISALLOWED_DIRS}"; else disallowed_dirs=(); fi
+          IFS=',' read -r -a disallowed_files <<< "${REPO_DISALLOWED_FILES:-}"
+
+          missing_required=()
+          missing_optional=()
+
+          # Source directory: src/ or htdocs/ (either is valid for extension repos)
+          SOURCE_DIR=""
+          if [ -d "src" ]; then
+            SOURCE_DIR="src"
+          elif [ -d "htdocs" ]; then
+            SOURCE_DIR="htdocs"
+          elif [ -d "deploy" ] || [ -d "cli" ] || [ -d "monitoring" ]; then
+            # Platform/tooling repos don't need src/
+            SOURCE_DIR=""
+          else
+            missing_required+=("src/ or htdocs/ (source directory required)")
+          fi
+
+          for item in "${required_artifacts[@]}"; do
+            if printf '%s' "${item}" | grep -q '/$'; then
+              d="${item%/}"
+              [ ! -d "${d}" ] && missing_required+=("${item}")
+            else
+              [ ! -f "${item}" ] && missing_required+=("${item}")
+            fi
+          done
+
+          for f in "${optional_files[@]}"; do
+            if printf '%s' "${f}" | grep -q '/$'; then
+              d="${f%/}"
+              [ ! -d "${d}" ] && missing_optional+=("${f}")
+            else
+              [ ! -f "${f}" ] && missing_optional+=("${f}")
+            fi
+          done
+
+          for d in "${disallowed_dirs[@]}"; do
+            d_norm="${d%/}"
+            [ -d "${d_norm}" ] && missing_required+=("${d_norm}/ (disallowed)")
+          done
+
+          for f in "${disallowed_files[@]}"; do
+            [ -f "${f}" ] && missing_required+=("${f} (disallowed)")
+          done
+
+          git fetch origin --prune
+
+          dev_paths=()
+          dev_branches=()
+
+          while IFS= read -r b; do
+            name="${b#origin/}"
+            if [ "${name}" = 'dev' ]; then
+              dev_branches+=("${name}")
+            else
+              dev_paths+=("${name}")
+            fi
+          done < <(git branch -r --list 'origin/dev*' | sed 's/^ *//')
+
+          if [ "${#dev_paths[@]}" -eq 0 ] && [ "${#dev_branches[@]}" -eq 0 ]; then
+            missing_required+=("dev or dev/* branch")
+          fi
+
+          content_warnings=()
+
+          if [ -f 'CHANGELOG.md' ] && ! grep -Eq '^# Changelog' CHANGELOG.md; then
+            content_warnings+=("CHANGELOG.md missing '# Changelog' header")
+          fi
+
+          if [ -f 'CHANGELOG.md' ] && grep -Eq '^[# ]*Unreleased' CHANGELOG.md; then
+            content_warnings+=("CHANGELOG.md contains Unreleased section (review release readiness)")
+          fi
+
+          if [ -f 'LICENSE' ] && ! grep -qiE 'GNU GENERAL PUBLIC LICENSE|GPL' LICENSE; then
+            content_warnings+=("LICENSE does not look like a GPL text")
+          fi
+
+          if [ -f 'README.md' ] && ! grep -qiE 'moko|Moko' README.md; then
+            content_warnings+=("README.md missing expected brand keyword")
+          fi
+
+          export PROFILE_RAW="${profile}"
+          export MISSING_REQUIRED="$(printf '%s\n' "${missing_required[@]:-}")"
+          export MISSING_OPTIONAL="$(printf '%s\n' "${missing_optional[@]:-}")"
+          export CONTENT_WARNINGS="$(printf '%s\n' "${content_warnings[@]:-}")"
+
+          report_json=$(printf '{"profile":"%s","missing_required":%d,"missing_optional":%d,"content_warnings":%d}'             "$profile" "${#missing_required[@]}" "${#missing_optional[@]}" "${#content_warnings[@]}")
+
+          {
+            printf '%s\n' '### Repository health'
+            printf '%s\n' "Profile: ${profile}"
+            printf '%s\n' '| Metric | Value |'
+            printf '%s\n' '|---|---|'
+            printf '%s\n' "| Missing required | ${#missing_required[@]} |"
+            printf '%s\n' "| Missing optional | ${#missing_optional[@]} |"
+            printf '%s\n' "| Content warnings | ${#content_warnings[@]} |"
+            printf '\n'
+
+            printf '%s\n' '### Guardrails report (JSON)'
+            printf '%s\n' '```json'
+            printf '%s\n' "${report_json}"
+            printf '%s\n' '```'
+            printf '\n'
+          } >> "${GITHUB_STEP_SUMMARY}"
+
+          if [ "${#missing_required[@]}" -gt 0 ]; then
+            {
+              printf '%s\n' '### Missing required repo artifacts'
+              for m in "${missing_required[@]}"; do printf '%s\n' "- ${m}"; done
+              printf '%s\n' 'ERROR: Guardrails failed. Missing required repository artifacts.'
+              printf '\n'
+            } >> "${GITHUB_STEP_SUMMARY}"
+            exit 1
+          fi
+
+          if [ "${#missing_optional[@]}" -gt 0 ]; then
+            {
+              printf '%s\n' '### Missing optional repo artifacts'
+              for m in "${missing_optional[@]}"; do printf '%s\n' "- ${m}"; done
+              printf '\n'
+            } >> "${GITHUB_STEP_SUMMARY}"
+          fi
+
+          if [ "${#content_warnings[@]}" -gt 0 ]; then
+            {
+              printf '%s\n' '### Repo content warnings'
+              for m in "${content_warnings[@]}"; do printf '%s\n' "- ${m}"; done
+              printf '\n'
+            } >> "${GITHUB_STEP_SUMMARY}"
+          fi
+
+          # -- Joomla-specific checks --
+          joomla_findings=()
+
+          MANIFEST="$(find . -maxdepth 2 -name '*.xml' -exec grep -l '<extension' {} \; 2>/dev/null | head -1 || true)"
+          if [ -z "${MANIFEST}" ]; then
+            joomla_findings+=("Joomla XML manifest not found (no *.xml with <extension> tag)")
+          else
+            if ! grep -qP '<version>' "${MANIFEST}"; then
+              joomla_findings+=("XML manifest: <version> tag missing")
+            fi
+            if ! grep -qP 'type="(component|module|plugin|library|package|template|language)"' "${MANIFEST}"; then
+              joomla_findings+=("XML manifest: type attribute missing or invalid")
+            fi
+            if ! grep -qP '<name>' "${MANIFEST}"; then
+              joomla_findings+=("XML manifest: <name> tag missing")
+            fi
+            if ! grep -qP '<author>' "${MANIFEST}"; then
+              joomla_findings+=("XML manifest: <author> tag missing")
+            fi
+            if ! grep -qP '<namespace' "${MANIFEST}"; then
+              joomla_findings+=("XML manifest: <namespace> missing (required for Joomla 5+)")
+            fi
+          fi
+
+          INI_COUNT="$(find . -name '*.ini' -type f 2>/dev/null | wc -l)"
+          if [ "${INI_COUNT}" -eq 0 ]; then
+            joomla_findings+=("No .ini language files found")
+          fi
+
+          if [ ! -f 'updates.xml' ]; then
+            joomla_findings+=("updates.xml missing in root (required for Joomla update server)")
+          fi
+
+          if [ -n "${SOURCE_DIR}" ]; then
+            INDEX_DIRS=("${SOURCE_DIR}" "${SOURCE_DIR}/admin" "${SOURCE_DIR}/site")
+            for dir in "${INDEX_DIRS[@]}"; do
+              if [ -d "${dir}" ] && [ ! -f "${dir}/index.html" ]; then
+                joomla_findings+=("${dir}/index.html missing (directory listing protection)")
+              fi
+            done
+          fi
+
+          if [ "${#joomla_findings[@]}" -gt 0 ]; then
+            {
+              printf '%s\n' '### Joomla extension checks'
+              printf '%s\n' '| Check | Status |'
+              printf '%s\n' '|---|---|'
+              for f in "${joomla_findings[@]}"; do
+                printf '%s\n' "| ${f} | Warning |"
+              done
+              printf '\n'
+            } >> "${GITHUB_STEP_SUMMARY}"
+          else
+            {
+              printf '%s\n' '### Joomla extension checks'
+              printf '%s\n' 'All Joomla-specific checks passed.'
+              printf '\n'
+            } >> "${GITHUB_STEP_SUMMARY}"
+          fi
+
+          extended_enabled="${EXTENDED_CHECKS:-true}"
+          extended_findings=()
+
+          if [ "${extended_enabled}" = 'true' ]; then
+            if [ -f '.github/CODEOWNERS' ] || [ -f 'CODEOWNERS' ] || [ -f 'docs/CODEOWNERS' ]; then
+              :
+            else
+              extended_findings+=("CODEOWNERS not found (.github/CODEOWNERS preferred)")
+            fi
+
+            if ls "${WORKFLOWS_DIR}"/*.yml >/dev/null 2>&1 || ls "${WORKFLOWS_DIR}"/*.yaml >/dev/null 2>&1; then
+              bad_refs="$(grep -RIn --include='*.yml' --include='*.yaml' -E '^[[:space:]]*uses:[[:space:]]*[^#]+@(main|master)\b' "${WORKFLOWS_DIR}" 2>/dev/null || true)"
+              if [ -n "${bad_refs}" ]; then
+                extended_findings+=("Workflows reference actions @main/@master (pin versions): see log excerpt")
+                {
+                  printf '%s\n' '### Workflow pinning advisory'
+                  printf '%s\n' 'Found uses: entries pinned to main/master:'
+                  printf '%s\n' '```'
+                  printf '%s\n' "${bad_refs}"
+                  printf '%s\n' '```'
+                  printf '\n'
+                } >> "${GITHUB_STEP_SUMMARY}"
+              fi
+            fi
+
+            if [ -f "${DOCS_INDEX}" ]; then
+              missing_links=""
+              while IFS= read -r docline; do
+                for link in $(echo "$docline" | grep -oE '\]\([^)]+\)' | sed 's/\](//' | sed 's/)$//' || true); do
+                  case "$link" in http://*|https://*|"#"*|mailto:*) continue ;; esac
+                  linkpath="${link%%#*}"
+                  linkpath="${linkpath%%\?*}"
+                  [ -z "$linkpath" ] && continue
+                  if [ "${linkpath:0:1}" = "/" ]; then
+                    testpath="${linkpath#/}"
+                  else
+                    testpath="$(dirname "${DOCS_INDEX}")/${linkpath}"
+                  fi
+                  [ ! -e "$testpath" ] && missing_links="${missing_links}${testpath} "
+                done
+              done < "${DOCS_INDEX}"
+              if [ -n "${missing_links}" ]; then
+                extended_findings+=("docs/docs-index.md contains broken relative links")
+                {
+                  printf '%s\n' '### Docs index link integrity'
+                  printf '%s\n' 'Broken relative links:'
+                  for bl in ${missing_links}; do
+                    printf '%s\n' "- ${bl}"
+                  done
+                  printf '\n'
+                } >> "${GITHUB_STEP_SUMMARY}"
+              fi
+            fi
+
+            if [ -d "${SCRIPT_DIR}" ]; then
+              if ! command -v shellcheck >/dev/null 2>&1; then
+                sudo apt-get update -qq
+                sudo apt-get install -y shellcheck >/dev/null
+              fi
+
+              sc_out=''
+              while IFS= read -r shf; do
+                [ -z "${shf}" ] && continue
+                out_one="$(shellcheck -S warning -x "${shf}" 2>/dev/null || true)"
+                if [ -n "${out_one}" ]; then
+                  sc_out="${sc_out}${out_one}\n"
+                fi
+              done < <(find "${SCRIPT_DIR}" -type f -name "${SHELLCHECK_PATTERN}" 2>/dev/null | sort)
+
+              if [ -n "${sc_out}" ]; then
+                extended_findings+=("ShellCheck warnings detected (advisory)")
+                sc_head="$(printf '%s' "${sc_out}" | head -n 200)"
+                {
+                  printf '%s\n' '### ShellCheck (advisory)'
+                  printf '%s\n' '```'
+                  printf '%s\n' "${sc_head}"
+                  printf '%s\n' '```'
+                  printf '\n'
+                } >> "${GITHUB_STEP_SUMMARY}"
+              fi
+            fi
+
+            spdx_missing=()
+            IFS=',' read -r -a spdx_globs <<< "${SPDX_FILE_GLOBS}"
+            spdx_args=()
+            for g in "${spdx_globs[@]}"; do spdx_args+=("${g}"); done
+
+            while IFS= read -r f; do
+              [ -z "${f}" ] && continue
+              if ! head -n 40 "${f}" | grep -q 'SPDX-License-Identifier:'; then
+                spdx_missing+=("${f}")
+              fi
+            done < <(git ls-files "${spdx_args[@]}" 2>/dev/null || true)
+
+            if [ "${#spdx_missing[@]}" -gt 0 ]; then
+              extended_findings+=("SPDX header missing in some tracked files (advisory)")
+              {
+                printf '%s\n' '### SPDX header advisory'
+                printf '%s\n' 'Files missing SPDX-License-Identifier (first 40 lines scan):'
+                for f in "${spdx_missing[@]}"; do printf '%s\n' "- ${f}"; done
+                printf '\n'
+              } >> "${GITHUB_STEP_SUMMARY}"
+            fi
+
+            stale_cutoff_days=180
+            stale_branches="$(git for-each-ref --format='%(refname:short) %(committerdate:unix)' refs/remotes/origin 2>/dev/null | awk -v now="$(date +%s)" -v days="${stale_cutoff_days}" '{if (now-$2 > days*86400) print $1}' | head -50)"
+            if [ -n "${stale_branches}" ]; then
+              extended_findings+=("Stale remote branches detected (advisory)")
+              {
+                printf '%s\n' '### Git hygiene advisory'
+                printf '%s\n' "Branches with last commit older than ${stale_cutoff_days} days (sample up to 50):"
+                while IFS= read -r b; do [ -n "${b}" ] && printf '%s\n' "- ${b}"; done <<< "${stale_branches}"
+                printf '\n'
+              } >> "${GITHUB_STEP_SUMMARY}"
+            fi
+          fi
+
+          {
+            printf '%s\n' '### Guardrails coverage matrix'
+            printf '%s\n' '| Domain | Status | Notes |'
+            printf '%s\n' '|---|---|---|'
+            printf '%s\n' '| Access control | OK | Admin-only execution gate |'
+            printf '%s\n' '| Release policy | N/A | Releases handled by MokoGit |'
+            printf '%s\n' '| Scripts governance | OK | Directory policy and advisory reporting |'
+            printf '%s\n' '| Repo required artifacts | OK | Required, optional, disallowed enforcement |'
+            printf '%s\n' '| Repo content heuristics | OK | Brand, license, changelog structure |'
+            if [ "${extended_enabled}" = 'true' ]; then
+              if [ "${#extended_findings[@]}" -gt 0 ]; then
+                printf '%s\n' '| Extended checks | Warning | See extended findings below |'
+              else
+                printf '%s\n' '| Extended checks | OK | No findings |'
+              fi
+            else
+              printf '%s\n' '| Extended checks | SKIPPED | EXTENDED_CHECKS disabled |'
+            fi
+            printf '\n'
+          } >> "${GITHUB_STEP_SUMMARY}"
+
+          if [ "${extended_enabled}" = 'true' ] && [ "${#extended_findings[@]}" -gt 0 ]; then
+            {
+              printf '%s\n' '### Extended findings (advisory)'
+              for f in "${extended_findings[@]}"; do printf '%s\n' "- ${f}"; done
+              printf '\n'
+            } >> "${GITHUB_STEP_SUMMARY}"
+          fi
+
+          printf '%s\n' 'Repository health guardrails passed.' >> "${GITHUB_STEP_SUMMARY}"
+
+
+  site-health:
+    name: Site Health
+    runs-on: ubuntu-latest
+    if: github.event_name == 'workflow_dispatch'
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+
+      - name: Uptime check
+        if: env.URLS != ''
+        run: |
+          echo "$URLS" > /tmp/urls.txt
+          php monitoring/uptime-probe.php --urls /tmp/urls.txt --timeout 15 || echo "::warning::Some sites are down"
+          rm -f /tmp/urls.txt
+        env:
+          URLS: ${{ vars.MONITORED_URLS }}
+
+      - name: SSL certificate check
+        if: env.DOMAINS != ''
+        run: |
+          echo "$DOMAINS" > /tmp/domains.txt
+          php monitoring/ssl-check.php --domains /tmp/domains.txt --warn-days 30 || echo "::warning::SSL certificates expiring soon"
+          rm -f /tmp/domains.txt
+        env:
+          DOMAINS: ${{ vars.MONITORED_DOMAINS }}
+
+      - name: Summary
+        if: always()
+        run: |
+          echo "### Site Health" >> $GITHUB_STEP_SUMMARY
+          echo "Uptime and SSL checks completed." >> $GITHUB_STEP_SUMMARY
+
+  # ═══════════════════════════════════════════════════════════════════════
+  # Issue Reporter — file issues for failed gates
+  # ═══════════════════════════════════════════════════════════════════════
+  report-scripts:
+    name: "Report: Scripts Governance"
+    needs: [access_check, scripts_governance]
+    if: >-
+      always() &&
+      needs.scripts_governance.result == 'failure'
+    uses: ./.mokogit/workflows/ci-issue-reporter.yml
+    with:
+      gate: "Scripts Governance"
+      workflow: "Repo Health"
+      severity: error
+      details: "Scripts directory policy violations detected. Review required and allowed directories."
+    secrets: inherit
+
+  report-health:
+    name: "Report: Repository Health"
+    needs: [access_check, repo_health]
+    if: >-
+      always() &&
+      needs.repo_health.result == 'failure'
+    uses: ./.mokogit/workflows/ci-issue-reporter.yml
+    with:
+      gate: "Repository Health"
+      workflow: "Repo Health"
+      severity: error
+      details: "Repository health checks failed — missing required artifacts, disallowed files, or content warnings. Check the CI run summary."
+    secrets: inherit

.mokogit/workflows/version-set.yml

@@ -0,0 +1,130 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGit.Workflow.Template
+# INGROUP: MokoStandards.CI
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Joomla
+# PATH: /.mokogit/workflows/version-set.yml
+# VERSION: 01.00.00
+# BRIEF: Set or reset the extension version across all version-bearing files
+
+name: "Joomla: Set Version"
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version number (e.g. 01.00.00)"
+        required: true
+        type: string
+      branch:
+        description: "Branch to update (default: current)"
+        required: false
+        type: string
+
+permissions:
+  contents: write
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  set-version:
+    name: Set Version to ${{ inputs.version }}
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Validate version format
+        run: |
+          VERSION="${{ inputs.version }}"
+          if ! echo "$VERSION" | grep -qP '^\d{2}\.\d{2}\.\d{2}$'; then
+            echo "::error::Invalid version format '${VERSION}' — expected XX.YY.ZZ (e.g. 01.00.00)"
+            exit 1
+          fi
+          echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.MOKOGIT_TOKEN || github.token }}
+          ref: ${{ inputs.branch || github.ref }}
+          fetch-depth: 1
+
+      - name: Update manifest version
+        run: |
+          MANIFEST=""
+          for XML_FILE in $(find . -maxdepth 3 -name "*.xml" -not -path "./.git/*" -not -path "./vendor/*"); do
+            if grep -q "<extension" "$XML_FILE" 2>/dev/null; then
+              MANIFEST="$XML_FILE"
+              break
+            fi
+          done
+
+          if [ -z "$MANIFEST" ]; then
+            echo "::warning::No Joomla extension manifest found — skipping manifest update"
+          else
+            OLD_VER=$(grep -oP '<version>\K[^<]+' "$MANIFEST" | head -1)
+            sed -i "s|<version>${OLD_VER}</version>|<version>${VERSION}</version>|" "$MANIFEST"
+            echo "Manifest: ${OLD_VER} → ${VERSION} (${MANIFEST})"
+          fi
+
+      - name: Update README.md version
+        run: |
+          if [ -f "README.md" ]; then
+            if grep -qP '^\s*VERSION:\s*\d' README.md; then
+              sed -i -E "s/(VERSION:\s*)[0-9]{2}\.[0-9]{2}\.[0-9]{2}/\1${VERSION}/" README.md
+              echo "README.md version updated to ${VERSION}"
+            else
+              echo "::warning::No VERSION line found in README.md — skipping"
+            fi
+          fi
+
+      - name: Update CHANGELOG.md
+        run: |
+          if [ -f "CHANGELOG.md" ]; then
+            DATE=$(date +%Y-%m-%d)
+            # Check if this version already has an entry
+            if grep -q "^\#\# \[${VERSION}\]" CHANGELOG.md; then
+              echo "CHANGELOG.md already has entry for ${VERSION} — skipping"
+            else
+              # Insert new version entry after [Unreleased] or at the top after header
+              if grep -q '^\#\# \[Unreleased\]' CHANGELOG.md; then
+                sed -i "/^\#\# \[Unreleased\]/a\\\\n## [${VERSION}] --- ${DATE}" CHANGELOG.md
+              else
+                sed -i "/^\# Changelog/a\\\\n## [Unreleased]\n\n## [${VERSION}] --- ${DATE}" CHANGELOG.md
+              fi
+              echo "CHANGELOG.md: added entry for ${VERSION}"
+            fi
+          else
+            echo "::warning::No CHANGELOG.md found — skipping"
+          fi
+
+      - name: Update FILE INFORMATION blocks
+        run: |
+          # Update VERSION in file header blocks (# VERSION: XX.YY.ZZ)
+          find . -maxdepth 1 -type f \( -name "*.yml" -o -name "*.yaml" -o -name "*.php" -o -name "*.md" \) \
+            -not -path "./.git/*" -not -path "./vendor/*" -print0 2>/dev/null | \
+          while IFS= read -r -d '' FILE; do
+            if head -20 "$FILE" | grep -qP '^\s*#?\s*VERSION:\s*\d{2}\.\d{2}\.\d{2}'; then
+              sed -i -E "s/(#?\s*VERSION:\s*)[0-9]{2}\.[0-9]{2}\.[0-9]{2}/\1${VERSION}/" "$FILE"
+              echo "Updated FILE INFORMATION VERSION in ${FILE}"
+            fi
+          done
+
+      - name: Commit and push
+        run: |
+          git config user.name "Moko Consulting [bot]"
+          git config user.email "hello@mokoconsulting.tech"
+          git add -A
+          if git diff --cached --quiet; then
+            echo "No version changes detected — nothing to commit"
+          else
+            git commit -m "chore: set version to ${VERSION} [skip bump]
+
+Authored-by: Moko Consulting"
+            git push
+            echo "### Version Set" >> $GITHUB_STEP_SUMMARY
+            echo "Version updated to \`${VERSION}\` on branch \`${GITHUB_REF_NAME}\`" >> $GITHUB_STEP_SUMMARY
+          fi

.mokogitea/ISSUE_TEMPLATE/feature_request.md

@@ -1,7 +1,7 @@
 ---
 name: Feature Request
 about: Suggest a new feature or enhancement
-title: '[FEATURE] '
+title: '(feat) '
 labels: 'enhancement'
 assignees: ''
 

.mokogitea/workflows/auto-bump.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Release
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /.mokogitea/workflows/auto-bump.yml

.mokogitea/workflows/auto-release.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Release
 # REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
 # PATH: /templates/workflows/universal/auto-release.yml.template
@@ -99,27 +99,65 @@ jobs:
 
       - name: Rename branch to rc
         run: |
-          php ${MOKO_CLI}/branch_rename.php \
-            --from "${{ github.event.pull_request.head.ref || 'dev' }}" --to rc \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
-            --api-base "${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}" \
-            --pr "${{ github.event.pull_request.number }}"
+          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          AUTH="Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}"
+          FROM="${{ github.event.pull_request.head.ref || 'dev' }}"
+          PR="${{ github.event.pull_request.number }}"
+
+          # Resolve the source branch HEAD commit.
+          SRC_JSON=$(curl -sf -H "$AUTH" "${API_BASE}/branches/${FROM}") \
+            || { echo "::error::Source branch ${FROM} not found"; exit 1; }
+          SRC_SHA=$(printf '%s' "$SRC_JSON" | python3 -c "import sys, json; print(json.load(sys.stdin)['commit']['id'])" 2>/dev/null || true)
+          [ -n "$SRC_SHA" ] || { echo "::error::Could not resolve HEAD of ${FROM}"; exit 1; }
+
+          # Point rc at the source commit via git push. Gitea's git/refs PATCH API
+          # returns HTTP 405 on ANY protected branch (force or not, even for a user in
+          # the force-push allowlist), so it cannot move a protected rc. git push honors
+          # the push + force-push allowlists and creates rc if it is absent.
+          PUSH_URL="https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@${MOKOGITEA_URL#https://}/${GITEA_ORG}/${GITEA_REPO}.git"
+          git config --global user.name "mokogitea-actions[bot]"
+          git config --global user.email "actions@mokoconsulting.tech"
+          git fetch --no-tags "$PUSH_URL" "${FROM}"
+          git push --force "$PUSH_URL" "FETCH_HEAD:refs/heads/rc" \
+            || { echo "::error::Failed to point rc at ${FROM} (${SRC_SHA}) via git push"; exit 1; }
+          echo "rc set to ${FROM} (${SRC_SHA})"
+
+          # Repoint the PR at rc, then delete the old source branch (non-fatal).
+          if [ -n "$PR" ]; then
+            curl -s -X PATCH -H "$AUTH" -H "Content-Type: application/json" \
+              "${API_BASE}/pulls/${PR}" -d '{"head":"rc"}' >/dev/null || true
+          fi
+          # Never delete permanent branches (dev/main/rc/...); only ephemeral feature branches.
+          case "$FROM" in
+            dev|main|master|rc|stable|production|release|develop|staging|beta|alpha)
+              echo "Keeping permanent branch ${FROM} (not deleting)" ;;
+            *)
+              curl -s -X DELETE -H "$AUTH" "${API_BASE}/branches/${FROM}" >/dev/null || true ;;
+          esac
+          echo "Renamed ${FROM} -> rc"
+
+      - name: Trigger RC deploy
+        run: |
+          # Workflow-token pushes do NOT wake downstream workflows; dispatch deploy-rc explicitly.
+          curl -sf -X POST -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \n            -H "Content-Type: application/json" \n            "${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}/actions/workflows/deploy-rc.yml/dispatches" \n            -d '{"ref":"rc"}' \n            && echo "Dispatched deploy-rc on rc" \n            || echo "::warning::deploy-rc dispatch failed (no deploy-rc.yml on rc?)"
 
       - name: Checkout rc and configure git
         run: |
           git fetch origin rc
           git checkout rc
-          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "gitea-actions[bot]"
+          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "mokogitea-actions[bot]"
           git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
 
       - name: Publish RC release
+        continue-on-error: true
         run: |
           php ${MOKO_CLI}/release_publish.php \
             --path . --stability rc --bump minor --branch rc \
             --token "${{ secrets.MOKOGITEA_TOKEN }}"
 
       - name: Update RC release notes from CHANGELOG.md
+        continue-on-error: true
         run: |
           API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
           TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
@@ -176,8 +214,8 @@ jobs:
 
       - name: Configure git for bot pushes
         run: |
-          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "gitea-actions[bot]"
+          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "mokogitea-actions[bot]"
           git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
 
       - name: Check for merge conflict markers

.mokogitea/workflows/branch-cleanup.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: MokoStandards.Universal
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /.mokogitea/workflows/branch-cleanup.yml

.mokogitea/workflows/cascade-dev.yml

@@ -0,0 +1,10 @@
+# DISABLED — auto-release Step 11 recreates dev from main after every release.
+# Cascade-dev is redundant and causes version conflicts when both main and dev
+# have different version numbers in templateDetails.xml / manifest.xml.
+name: "Cascade Main → Dev (DISABLED)"
+on: workflow_dispatch
+jobs:
+  noop:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "Cascade disabled — auto-release handles dev recreation"

.mokogitea/workflows/ci-generic.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: MokoStandards.CI
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.gitea/workflows/ci-generic.yml

.mokogitea/workflows/ci-issue-reporter.yml

@@ -3,12 +3,12 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Universal
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /.mokogitea/workflows/ci-issue-reporter.yml
 # VERSION: 01.00.00
-# BRIEF: Reusable workflow — creates/updates a Gitea issue when a CI gate fails.
+# BRIEF: Reusable workflow — creates/updates a MokoGitea issue when a CI gate fails.
 #        Clones MokoCLI and runs cli/ci_issue_reporter.sh.
 
 name: "Universal: CI Issue Reporter"

.mokogitea/workflows/cleanup.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: MokoStandards.Maintenance
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
 # PATH: /.gitea/workflows/cleanup.yml

.mokogitea/workflows/custom/deploy-dev.yml

@@ -1,109 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-# SPDX-License-Identifier: GPL-3.0-or-later
-# BRIEF: Build and deploy MokoGitea to dev environment on push to dev branch.
-#        Production deploy (deploy-mokogitea.yml) only succeeds if dev is healthy.
-
-name: Deploy MokoGitea (Dev)
-
-on:
-  push:
-    branches:
-      - dev
-
-concurrency:
-  group: deploy-mokogitea-dev
-  cancel-in-progress: true
-
-env:
-  REGISTRY: git.mokoconsulting.tech
-  IMAGE: mokoconsulting/mokogitea
-  DEPLOY_HOST: git.mokoconsulting.tech
-  DEPLOY_PORT: 2918
-  DEPLOY_USER: mokoconsulting
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-jobs:
-  deploy-dev:
-    name: "Build & Deploy to Dev"
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout source
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Determine version
-        id: config
-        run: |
-          VERSION=$(git describe --tags --always 2>/dev/null || echo "dev-$(git rev-parse --short HEAD)")
-          echo "tag=${VERSION}-dev" >> $GITHUB_OUTPUT
-          echo "Version: ${VERSION}-dev"
-
-      - name: Write deploy key
-        env:
-          DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
-        run: |
-          mkdir -p ~/.ssh
-          echo "$DEPLOY_KEY" > ~/.ssh/deploy_key
-          chmod 600 ~/.ssh/deploy_key
-
-      - name: Build and deploy to dev via SSH
-        env:
-          REGISTRY_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-          TAG: ${{ steps.config.outputs.tag }}
-        run: |
-          HEALTH_FMT='${{ '{{' }}.State.Health.Status${{ '}}' }}'
-
-          ssh -i ~/.ssh/deploy_key -p ${{ env.DEPLOY_PORT }} \
-            -o ConnectTimeout=30 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
-            -o ServerAliveInterval=30 -o ServerAliveCountMax=10 \
-            ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }} bash -s <<DEPLOY_EOF
-          set -e
-          echo 'SSH connected to dev environment'
-
-          echo 'Cleaning Docker build cache...'
-          docker builder prune -af 2>/dev/null || true
-          docker image prune -af 2>/dev/null || true
-
-          echo 'Pulling source...'
-          SOURCE_DIR=/opt/gitea-dev/source
-          if [ ! -d \$SOURCE_DIR/.git ]; then
-            git clone -b dev https://git.mokoconsulting.tech/MokoConsulting/MokoGitea-Fork.git \$SOURCE_DIR
-          fi
-          cd \$SOURCE_DIR
-          git remote set-url origin https://git.mokoconsulting.tech/MokoConsulting/MokoGitea-Fork.git 2>/dev/null || true
-          git fetch origin dev
-          git reset --hard origin/dev
-
-          echo 'Building Docker image...'
-          docker build --no-cache --build-arg GOFLAGS='-p 1' \
-            --tag ${{ env.REGISTRY }}/${{ env.IMAGE }}:\$TAG \
-            -f Dockerfile .
-
-          echo 'Pushing to registry...'
-          echo '\$REGISTRY_TOKEN' | docker login ${{ env.REGISTRY }} -u ${{ env.DEPLOY_USER }} --password-stdin
-          docker push ${{ env.REGISTRY }}/${{ env.IMAGE }}:\$TAG
-
-          echo 'Restarting dev container...'
-          cd /opt/gitea-dev
-          sed -i "s|${{ env.IMAGE }}:[^ ]*|${{ env.IMAGE }}:\$TAG|" docker-compose.yml
-          docker compose up -d mokogitea-dev
-
-          echo 'Health check...'
-          for i in 1 2 3 4 5 6 7 8; do
-            sleep 15
-            if docker inspect --format='\$HEALTH_FMT' mokogitea-dev 2>/dev/null | grep -q healthy; then
-              echo 'Dev container healthy!'
-              exit 0
-            fi
-            echo "Waiting... (attempt \$i/8)"
-          done
-          echo 'Health check failed'
-          docker logs mokogitea-dev --tail 20
-          exit 1
-          DEPLOY_EOF
-
-      - name: Verify dev instance
-        run: |
-          sleep 5
-          curl -sf https://git.dev.mokoconsulting.tech/api/healthz && echo " Dev API healthy"

.mokogitea/workflows/custom/deploy-mokogitea.yml

@@ -1,162 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-# SPDX-License-Identifier: GPL-3.0-or-later
-# BRIEF: Build MokoGitea Docker image, push to registry, and deploy
-
-name: Deploy MokoGitea
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Version tag'
-        required: true
-        default: 'latest'
-      environment:
-        description: 'Target environment'
-        required: true
-        default: 'dev'
-        type: choice
-        options:
-          - dev
-          - production
-
-concurrency:
-  group: deploy-mokogitea
-  cancel-in-progress: false
-
-env:
-  REGISTRY: git.mokoconsulting.tech
-  IMAGE: mokoconsulting/mokogitea
-  DEPLOY_HOST: git.mokoconsulting.tech
-  DEPLOY_PORT: 2918
-  DEPLOY_USER: mokoconsulting
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Verify dev environment is healthy
-        run: |
-          echo "Checking git.dev.mokoconsulting.tech health..."
-          if curl -sf --max-time 10 https://git.dev.mokoconsulting.tech/api/healthz; then
-            echo " Dev environment is healthy — proceeding with production deploy"
-          else
-            echo "::error::Dev environment is NOT healthy — blocking production deploy"
-            echo "Deploy to dev first (push to dev branch) and verify it passes before merging to main."
-            exit 1
-          fi
-
-      - name: Checkout source (for version detection)
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Determine settings
-        id: config
-        run: |
-          if [ "${{ github.event_name }}" = "push" ]; then
-            VERSION=$(git describe --tags --always 2>/dev/null || echo "dev-$(git rev-parse --short HEAD)")
-            ENV="production"
-          else
-            VERSION="${{ github.event.inputs.version }}"
-            ENV="${{ github.event.inputs.environment }}"
-          fi
-          if [ "$ENV" = "production" ]; then
-            echo "compose_dir=/opt/gitea" >> $GITHUB_OUTPUT
-            echo "container=mokogitea" >> $GITHUB_OUTPUT
-            echo "source_dir=/opt/gitea/source" >> $GITHUB_OUTPUT
-            echo "branch=main" >> $GITHUB_OUTPUT
-            echo "tag=$VERSION" >> $GITHUB_OUTPUT
-          else
-            echo "compose_dir=/opt/gitea-dev" >> $GITHUB_OUTPUT
-            echo "container=mokogitea-dev" >> $GITHUB_OUTPUT
-            echo "source_dir=/opt/gitea-dev/source" >> $GITHUB_OUTPUT
-            echo "branch=dev" >> $GITHUB_OUTPUT
-            echo "tag=$VERSION-dev" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Write deploy key
-        env:
-          DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
-        run: |
-          mkdir -p ~/.ssh
-          echo "$DEPLOY_KEY" > ~/.ssh/deploy_key
-          chmod 600 ~/.ssh/deploy_key
-
-      - name: Build and deploy via SSH
-        env:
-          REGISTRY_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-          TAG: ${{ steps.config.outputs.tag }}
-          BRANCH: ${{ steps.config.outputs.branch }}
-          SOURCE_DIR: ${{ steps.config.outputs.source_dir }}
-          COMPOSE_DIR: ${{ steps.config.outputs.compose_dir }}
-          CONTAINER: ${{ steps.config.outputs.container }}
-        run: |
-          HEALTH_FMT='${{ '{{' }}.State.Health.Status${{ '}}' }}'
-          IMAGE_FMT='Image: ${{ '{{' }}.Config.Image${{ '}}' }}'
-
-          ssh -i ~/.ssh/deploy_key -p ${{ env.DEPLOY_PORT }} \
-            -o ConnectTimeout=30 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
-            -o ServerAliveInterval=30 -o ServerAliveCountMax=10 \
-            ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }} bash -s <<DEPLOY_EOF
-          set -e
-          echo 'SSH connected'
-
-          echo 'Cleaning Docker build cache...'
-          docker builder prune -af 2>/dev/null || true
-          docker image prune -af 2>/dev/null || true
-          free -m | head -3
-
-          echo 'Pulling source...'
-          if [ ! -d $SOURCE_DIR/.git ]; then
-            git clone -b $BRANCH https://git.mokoconsulting.tech/MokoConsulting/MokoGitea-Fork.git $SOURCE_DIR
-          fi
-          cd $SOURCE_DIR
-          # Ensure remote points to MokoGitea-Fork (not the upstream fork)
-          git remote set-url origin https://git.mokoconsulting.tech/MokoConsulting/MokoGitea-Fork.git 2>/dev/null || true
-          git fetch origin $BRANCH
-          git reset --hard origin/$BRANCH
-
-          echo 'Building Docker image...'
-          docker build --no-cache --build-arg GOFLAGS='-p 1' \
-            --tag ${{ env.REGISTRY }}/${{ env.IMAGE }}:$TAG \
-            --tag ${{ env.REGISTRY }}/${{ env.IMAGE }}:latest \
-            -f Dockerfile .
-
-          echo 'Pushing to registry...'
-          echo '$REGISTRY_TOKEN' | docker login ${{ env.REGISTRY }} -u ${{ env.DEPLOY_USER }} --password-stdin
-          docker push ${{ env.REGISTRY }}/${{ env.IMAGE }}:$TAG
-          docker push ${{ env.REGISTRY }}/${{ env.IMAGE }}:latest
-
-          echo 'Restarting container...'
-          cd $COMPOSE_DIR
-          sed -i 's|${{ env.IMAGE }}:[^ ]*|${{ env.IMAGE }}:$TAG|' docker-compose.yml
-          docker compose up -d $CONTAINER
-
-          echo 'Health check...'
-          for i in 1 2 3 4 5 6 7 8; do
-            sleep 15
-            if docker inspect --format='$HEALTH_FMT' $CONTAINER 2>/dev/null | grep -q healthy; then
-              echo 'Container healthy!'
-              docker inspect --format='$IMAGE_FMT' $CONTAINER
-              exit 0
-            fi
-            echo "Waiting... (attempt \$i/8)"
-          done
-          echo 'Health check failed'
-          docker logs $CONTAINER --tail 20
-          exit 1
-          DEPLOY_EOF
-
-      - name: Verify
-        run: |
-          sleep 5
-          curl -sf https://${{ env.DEPLOY_HOST }}/api/healthz && echo " API healthy"
-
-      - name: Notify on failure
-        if: failure()
-        run: echo "::error::Deploy failed for ${{ steps.config.outputs.tag }}"

.mokogitea/workflows/custom/pr-rc-release.yml

@@ -47,6 +47,15 @@ jobs:
         env:
           PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
+          # This RC flow drives a Joomla-style update stream (updates.xml). Repos that don't ship
+          # one (e.g. generic Go/TS) have nothing to package here, so no-op cleanly instead of
+          # aborting under `set -e` when the file is absent.
+          if [ ! -f updates.xml ]; then
+            echo "has_updates=false" >> "$GITHUB_OUTPUT"
+            echo "No updates.xml in this repo — skipping RC update-stream packaging"
+            exit 0
+          fi
+          echo "has_updates=true" >> "$GITHUB_OUTPUT"
           BASE_VERSION=$(sed -n 's/.*<version>\(.*\)<\/version>.*/\1/p' updates.xml | head -1)
           [ -z "$BASE_VERSION" ] && BASE_VERSION="04.00.00"
           RC_VERSION="${BASE_VERSION}-rc.${PR_NUMBER}"
@@ -56,7 +65,7 @@ jobs:
           echo "RC version: $RC_VERSION (tag: $RC_TAG)"
 
       - name: Update updates.xml RC channel
-        if: steps.guard.outputs.skip != 'true'
+        if: steps.guard.outputs.skip != 'true' && steps.version.outputs.has_updates == 'true'
         env:
           RC_VERSION: ${{ steps.version.outputs.version }}
           RC_TAG: ${{ steps.version.outputs.tag }}
@@ -106,7 +115,7 @@ jobs:
           PYEOF
 
       - name: Create RC release
-        if: steps.guard.outputs.skip != 'true'
+        if: steps.guard.outputs.skip != 'true' && steps.version.outputs.has_updates == 'true'
         env:
           GITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
           RC_TAG: ${{ steps.version.outputs.tag }}
@@ -153,7 +162,7 @@ jobs:
           PYEOF
 
       - name: Commit updates.xml
-        if: steps.guard.outputs.skip != 'true'
+        if: steps.guard.outputs.skip != 'true' && steps.version.outputs.has_updates == 'true'
         env:
           GITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
           HEAD_REF: ${{ github.event.pull_request.head.ref }}

.mokogitea/workflows/deploy-dev.yml

@@ -0,0 +1,136 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+# BRIEF: Build and deploy to the Dev environment on push to the dev branch.
+#        Portable across Go server repos: ALL deployment config comes from repo
+#        Actions variables (vars.*) and secrets (secrets.*), nothing hardcoded.
+#        The dev branch is the ongoing integration branch.
+# OWNER: Template-Go (canonical source; syncs to the root workflows dir). See Template-Go#3.
+#
+# Required repo VARIABLES (all tier-scoped so each environment is independent —
+# a repo may host its rc/dev/prod tiers on different machines):
+#   DEV_SSH_HOST, DEV_SSH_PORT, DEV_SSH_USERNAME - SSH deploy target for the dev tier
+#   DEV_REGISTRY, DEV_REGISTRY_USER, DEV_IMAGE   - container registry + login user + image
+#   DEV_CONTAINER                              - compose service/container to recreate
+#   DEV_COMPOSE_PROJECT                        - docker compose -p project name
+#   DEV_COMPOSE_DIR                            - dir containing docker-compose.yml on host
+#   DEV_SOURCE_DIR                             - build source checkout on host
+#   DEV_TAG_ENV                                - compose env-var name that pins the image tag
+#   DEV_HEALTH_URL                             - external URL to verify after deploy
+# Required SECRETS (already configured org-wide; reused, not re-set):
+#   DEPLOY_SSH_KEY       - deploy private key (repo/org secret)
+#   MOKOGITEA_TOKEN      - registry/API token (org secret)
+
+name: Deploy (Dev)
+
+on:
+  push:
+    branches:
+      - dev
+  # Manual trigger for isolated end-to-end tests.
+  # Runs on the ref it is dispatched from.
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-dev
+  cancel-in-progress: true
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  deploy-dev:
+    name: "Build & Deploy to Dev"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Determine version
+        id: config
+        run: |
+          VERSION=$(git describe --tags --always 2>/dev/null || echo "dev-$(git rev-parse --short HEAD)")
+          echo "tag=${VERSION}-dev" >> $GITHUB_OUTPUT
+          echo "Version: ${VERSION}-dev"
+
+      - name: Write deploy key
+        env:
+          DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$DEPLOY_KEY" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+
+      - name: Build and deploy to RC via SSH
+        env:
+          REGISTRY_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          TAG: ${{ steps.config.outputs.tag }}
+        run: |
+          # Runner-side values (TAG, REGISTRY_TOKEN) are injected into the remote shell
+          # via an env prefix; a *quoted* heredoc keeps every $var expanding once, on the
+          # remote. Repo variables (vars.*) are substituted inline by Actions before ssh.
+          ssh -i ~/.ssh/deploy_key -p ${{ vars.DEV_SSH_PORT }} \
+            -o ConnectTimeout=30 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+            -o ServerAliveInterval=30 -o ServerAliveCountMax=10 \
+            ${{ vars.DEV_SSH_USERNAME }}@${{ vars.DEV_SSH_HOST }} \
+            "TAG='$TAG' REGISTRY_TOKEN='$REGISTRY_TOKEN' bash -s" <<'DEPLOY_EOF'
+          set -e
+          echo 'SSH connected to Dev environment'
+
+          if [ -z "$TAG" ]; then
+            echo 'ERROR: TAG is empty; refusing to build an untagged image' >&2
+            exit 1
+          fi
+
+          HEALTH_FMT='{{.State.Health.Status}}'
+
+          echo 'Cleaning Docker build cache...'
+          docker builder prune -af 2>/dev/null || true
+          docker image prune -af 2>/dev/null || true
+
+          echo 'Pulling source...'
+          SOURCE_DIR='${{ vars.DEV_SOURCE_DIR }}'
+          if [ ! -d "$SOURCE_DIR/.git" ]; then
+            git clone -b dev https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git "$SOURCE_DIR"
+          fi
+          cd "$SOURCE_DIR"
+          git remote set-url origin https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git 2>/dev/null || true
+          git fetch origin dev
+          git reset --hard origin/dev
+
+          echo "Building image: ${{ vars.DEV_REGISTRY }}/${{ vars.DEV_IMAGE }}:$TAG"
+          docker build --no-cache --build-arg GOFLAGS='-p 1' \
+            --tag "${{ vars.DEV_REGISTRY }}/${{ vars.DEV_IMAGE }}:$TAG" \
+            -f Dockerfile .
+
+          echo 'Pushing to registry...'
+          echo "$REGISTRY_TOKEN" | docker login ${{ vars.DEV_REGISTRY }} -u ${{ vars.DEV_REGISTRY_USER }} --password-stdin
+          docker push "${{ vars.DEV_REGISTRY }}/${{ vars.DEV_IMAGE }}:$TAG"
+
+          echo 'Restarting Dev container...'
+          cd '${{ vars.DEV_COMPOSE_DIR }}'
+          # Drive the rc service image tag via its compose env-var (no sed on the shared
+          # file); remove any lingering fixed-name container first, then force-recreate.
+          docker rm -f '${{ vars.DEV_CONTAINER }}' 2>/dev/null || true
+          ${{ vars.DEV_TAG_ENV }}="$TAG" docker compose -p '${{ vars.DEV_COMPOSE_PROJECT }}' up -d --force-recreate '${{ vars.DEV_CONTAINER }}'
+
+          echo 'Health check...'
+          for i in 1 2 3 4 5 6 7 8; do
+            sleep 15
+            if docker inspect --format="$HEALTH_FMT" '${{ vars.DEV_CONTAINER }}' 2>/dev/null | grep -q healthy; then
+              echo 'Dev container healthy!'
+              exit 0
+            fi
+            echo "Waiting... (attempt $i/8)"
+          done
+          echo 'Health check failed'
+          docker logs '${{ vars.DEV_CONTAINER }}' --tail 20
+          exit 1
+          DEPLOY_EOF
+
+      - name: Verify Dev instance
+        continue-on-error: true
+        run: |
+          sleep 5
+          ssh -i ~/.ssh/deploy_key -p ${{ vars.DEV_SSH_PORT }} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ vars.DEV_SSH_USERNAME }}@${{ vars.DEV_SSH_HOST }} "curl -sf '${{ vars.DEV_HEALTH_URL }}'" && echo " Dev API healthy"

.mokogitea/workflows/deploy-manual.yml

@@ -1,126 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
-# INGROUP: MokoStandards.Deploy
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards-API
-# PATH: /templates/workflows/joomla/deploy-manual.yml.template
-# VERSION: 04.07.00
-# BRIEF: Manual SFTP deploy to dev server for Joomla repos
-
-name: "Universal: Deploy to Dev (Manual)"
-
-on:
-  workflow_dispatch:
-    inputs:
-      clear_remote:
-        description: 'Delete all remote files before uploading'
-        required: false
-        default: 'false'
-        type: boolean
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-permissions:
-  contents: read
-
-jobs:
-  deploy:
-    name: SFTP Deploy to Dev
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-
-      - name: Setup PHP
-        run: |
-          php -v && composer --version
-
-      - name: Setup MokoStandards tools
-        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN || github.token }}
-          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN || github.token }}
-          MOKO_CLONE_HOST: ${{ secrets.MOKOGITEA_TOKEN && 'git.mokoconsulting.tech/MokoConsulting' || 'github.com/mokoconsulting-tech' }}
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.MOKOGITEA_TOKEN || github.token }}"}}'
-        run: |
-          git clone --depth 1 --branch main --quiet \
-            "https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoStandards-API.git" \
-            /tmp/mokostandards-api 2>/dev/null || true
-          if [ -d "/tmp/mokostandards-api" ] && [ -f "/tmp/mokostandards-api/composer.json" ]; then
-            cd /tmp/mokostandards-api && composer install --no-dev --no-interaction --quiet 2>/dev/null || true
-          fi
-
-      - name: Check FTP configuration
-        id: check
-        env:
-          HOST: ${{ vars.DEV_FTP_HOST }}
-          PATH_VAR: ${{ vars.DEV_FTP_PATH }}
-          PORT: ${{ vars.DEV_FTP_PORT }}
-        run: |
-          if [ -z "$HOST" ] || [ -z "$PATH_VAR" ]; then
-            echo "DEV_FTP_HOST or DEV_FTP_PATH not configured -- cannot deploy"
-            echo "skip=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          echo "skip=false" >> "$GITHUB_OUTPUT"
-          echo "host=$HOST" >> "$GITHUB_OUTPUT"
-
-          REMOTE="${PATH_VAR%/}"
-          echo "remote=$REMOTE" >> "$GITHUB_OUTPUT"
-
-          [ -z "$PORT" ] && PORT="22"
-          echo "port=$PORT" >> "$GITHUB_OUTPUT"
-
-      - name: Deploy via SFTP
-        if: steps.check.outputs.skip != 'true'
-        env:
-          SFTP_KEY: ${{ secrets.DEV_FTP_KEY }}
-          SFTP_PASS: ${{ secrets.DEV_FTP_PASSWORD }}
-          SFTP_USER: ${{ vars.DEV_FTP_USERNAME }}
-        run: |
-          SOURCE_DIR="src"
-          [ ! -d "$SOURCE_DIR" ] && SOURCE_DIR="htdocs"
-          [ ! -d "$SOURCE_DIR" ] && { echo "No src/ or htdocs/ -- nothing to deploy"; exit 0; }
-
-          printf '{"host":"%s","port":%s,"username":"%s","remotePath":"%s"' \
-            "${{ steps.check.outputs.host }}" "${{ steps.check.outputs.port }}" "$SFTP_USER" "${{ steps.check.outputs.remote }}" \
-            > /tmp/sftp-config.json
-
-          if [ -n "$SFTP_KEY" ]; then
-            echo "$SFTP_KEY" > /tmp/deploy_key
-            chmod 600 /tmp/deploy_key
-            printf ',"privateKeyPath":"/tmp/deploy_key"}' >> /tmp/sftp-config.json
-          else
-            printf ',"password":"%s"}' "$SFTP_PASS" >> /tmp/sftp-config.json
-          fi
-
-          DEPLOY_ARGS=(--path . --src-dir "$SOURCE_DIR" --config /tmp/sftp-config.json)
-          [ "${{ inputs.clear_remote }}" = "true" ] && DEPLOY_ARGS+=(--clear-remote)
-
-          PLATFORM=$(php /tmp/mokostandards-api/cli/platform_detect.php --path . 2>/dev/null || true)
-          if [ "$PLATFORM" = "waas-component" ] && [ -f "/tmp/mokostandards-api/deploy/deploy-joomla.php" ]; then
-            php /tmp/mokostandards-api/deploy/deploy-joomla.php "${DEPLOY_ARGS[@]}"
-          else
-            php /tmp/mokostandards-api/deploy/deploy-sftp.php "${DEPLOY_ARGS[@]}"
-          fi
-
-          rm -f /tmp/deploy_key /tmp/sftp-config.json
-
-      - name: Summary
-        if: always()
-        run: |
-          if [ "${{ steps.check.outputs.skip }}" = "true" ]; then
-            echo "### Deploy Skipped -- FTP not configured" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "### Manual Dev Deploy Complete" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY
-            echo "|-------|-------|" >> $GITHUB_STEP_SUMMARY
-            echo "| Host | \`${{ steps.check.outputs.host }}\` |" >> $GITHUB_STEP_SUMMARY
-            echo "| Remote | \`${{ steps.check.outputs.remote }}\` |" >> $GITHUB_STEP_SUMMARY
-            echo "| Clear | ${{ inputs.clear_remote }} |" >> $GITHUB_STEP_SUMMARY
-          fi

.mokogitea/workflows/deploy-prod.yml

@@ -0,0 +1,136 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+# BRIEF: Build and deploy to the Prod environment on push to the main branch.
+#        Portable across Go server repos: ALL deployment config comes from repo
+#        Actions variables (vars.*) and secrets (secrets.*), nothing hardcoded.
+#        Prod deploys on merge to main (dev -> rc -> main pipeline).
+# OWNER: Template-Go (canonical source; syncs to the root workflows dir). See Template-Go#3.
+#
+# Required repo VARIABLES (all tier-scoped so each environment is independent —
+# a repo may host its rc/dev/prod tiers on different machines):
+#   PROD_SSH_HOST, PROD_SSH_PORT, PROD_SSH_USERNAME - SSH deploy target for the prod tier
+#   PROD_REGISTRY, PROD_REGISTRY_USER, PROD_IMAGE   - container registry + login user + image
+#   PROD_CONTAINER                              - compose service/container to recreate
+#   PROD_COMPOSE_PROJECT                        - docker compose -p project name
+#   PROD_COMPOSE_DIR                            - dir containing docker-compose.yml on host
+#   PROD_SOURCE_DIR                             - build source checkout on host
+#   PROD_TAG_ENV                                - compose env-var name that pins the image tag
+#   PROD_HEALTH_URL                             - external URL to verify after deploy
+# Required SECRETS (already configured org-wide; reused, not re-set):
+#   DEPLOY_SSH_KEY       - deploy private key (repo/org secret)
+#   MOKOGITEA_TOKEN      - registry/API token (org secret)
+
+name: Deploy (Prod)
+
+on:
+  push:
+    branches:
+      - main
+  # Manual trigger for a prod re-deploy.
+  # Runs on the ref it is dispatched from (use main).
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-prod
+  cancel-in-progress: false
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  deploy-prod:
+    name: "Build & Deploy to Prod"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Determine version
+        id: config
+        run: |
+          VERSION=$(git describe --tags --always 2>/dev/null || echo "$(git rev-parse --short HEAD)")
+          echo "tag=${VERSION}" >> $GITHUB_OUTPUT
+          echo "Version: ${VERSION}"
+
+      - name: Write deploy key
+        env:
+          DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$DEPLOY_KEY" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+
+      - name: Build and deploy to RC via SSH
+        env:
+          REGISTRY_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          TAG: ${{ steps.config.outputs.tag }}
+        run: |
+          # Runner-side values (TAG, REGISTRY_TOKEN) are injected into the remote shell
+          # via an env prefix; a *quoted* heredoc keeps every $var expanding once, on the
+          # remote. Repo variables (vars.*) are substituted inline by Actions before ssh.
+          ssh -i ~/.ssh/deploy_key -p ${{ vars.PROD_SSH_PORT }} \
+            -o ConnectTimeout=30 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+            -o ServerAliveInterval=30 -o ServerAliveCountMax=10 \
+            ${{ vars.PROD_SSH_USERNAME }}@${{ vars.PROD_SSH_HOST }} \
+            "TAG='$TAG' REGISTRY_TOKEN='$REGISTRY_TOKEN' bash -s" <<'DEPLOY_EOF'
+          set -e
+          echo 'SSH connected to Prod environment'
+
+          if [ -z "$TAG" ]; then
+            echo 'ERROR: TAG is empty; refusing to build an untagged image' >&2
+            exit 1
+          fi
+
+          HEALTH_FMT='{{.State.Health.Status}}'
+
+          echo 'Cleaning Docker build cache...'
+          docker builder prune -af 2>/dev/null || true
+          docker image prune -af 2>/dev/null || true
+
+          echo 'Pulling source...'
+          SOURCE_DIR='${{ vars.PROD_SOURCE_DIR }}'
+          if [ ! -d "$SOURCE_DIR/.git" ]; then
+            git clone -b main https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git "$SOURCE_DIR"
+          fi
+          cd "$SOURCE_DIR"
+          git remote set-url origin https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git 2>/dev/null || true
+          git fetch origin main
+          git reset --hard origin/main
+
+          echo "Building image: ${{ vars.PROD_REGISTRY }}/${{ vars.PROD_IMAGE }}:$TAG"
+          docker build --no-cache --build-arg GOFLAGS='-p 1' \
+            --tag "${{ vars.PROD_REGISTRY }}/${{ vars.PROD_IMAGE }}:$TAG" \
+            -f Dockerfile .
+
+          echo 'Pushing to registry...'
+          echo "$REGISTRY_TOKEN" | docker login ${{ vars.PROD_REGISTRY }} -u ${{ vars.PROD_REGISTRY_USER }} --password-stdin
+          docker push "${{ vars.PROD_REGISTRY }}/${{ vars.PROD_IMAGE }}:$TAG"
+
+          echo 'Restarting Prod container...'
+          cd '${{ vars.PROD_COMPOSE_DIR }}'
+          # Drive the rc service image tag via its compose env-var (no sed on the shared
+          # file); remove any lingering fixed-name container first, then force-recreate.
+          docker rm -f '${{ vars.PROD_CONTAINER }}' 2>/dev/null || true
+          ${{ vars.PROD_TAG_ENV }}="$TAG" docker compose -p '${{ vars.PROD_COMPOSE_PROJECT }}' up -d --force-recreate '${{ vars.PROD_CONTAINER }}'
+
+          echo 'Health check...'
+          for i in 1 2 3 4 5 6 7 8; do
+            sleep 15
+            if docker inspect --format="$HEALTH_FMT" '${{ vars.PROD_CONTAINER }}' 2>/dev/null | grep -q healthy; then
+              echo 'Prod container healthy!'
+              exit 0
+            fi
+            echo "Waiting... (attempt $i/8)"
+          done
+          echo 'Health check failed'
+          docker logs '${{ vars.PROD_CONTAINER }}' --tail 20
+          exit 1
+          DEPLOY_EOF
+
+      - name: Verify Prod instance
+        continue-on-error: true
+        run: |
+          sleep 5
+          ssh -i ~/.ssh/deploy_key -p ${{ vars.PROD_SSH_PORT }} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ vars.PROD_SSH_USERNAME }}@${{ vars.PROD_SSH_HOST }} "curl -sf '${{ vars.PROD_HEALTH_URL }}'" && echo " Prod API healthy"

.mokogitea/workflows/deploy-rc.yml

@@ -0,0 +1,138 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+# BRIEF: Build and deploy to the RC environment on push to the rc branch.
+#        Portable across Go server repos: ALL deployment config comes from repo
+#        Actions variables (vars.*) and secrets (secrets.*), nothing hardcoded.
+#        The rc branch is created by promote-rc when a PR to main opens.
+# OWNER: Template-Go (canonical source; syncs to the root workflows dir). See Template-Go#3.
+#
+# Required repo VARIABLES (all tier-scoped so each environment is independent —
+# a repo may host its rc/dev/prod tiers on different machines):
+#   RC_SSH_HOST, RC_SSH_PORT, RC_SSH_USERNAME - SSH deploy target for the rc tier
+#   RC_REGISTRY, RC_REGISTRY_USER, RC_IMAGE   - container registry + login user + image
+#   RC_CONTAINER                              - compose service/container to recreate
+#   RC_COMPOSE_PROJECT                        - docker compose -p project name
+#   RC_COMPOSE_DIR                            - dir containing docker-compose.yml on host
+#   RC_SOURCE_DIR                             - build source checkout on host
+#   RC_TAG_ENV                                - compose env-var name that pins the image tag
+#   RC_HEALTH_URL                             - external URL to verify after deploy
+# Required SECRETS (already configured org-wide; reused, not re-set):
+#   DEPLOY_SSH_KEY       - deploy private key (repo/org secret)
+#   MOKOGITEA_TOKEN      - registry/API token (org secret)
+
+name: Deploy (RC)
+
+on:
+  push:
+    branches:
+      - rc
+  # Manual trigger for isolated end-to-end tests without a full RC promotion.
+  # Runs on the ref it is dispatched from; that ref must carry current source
+  # (>= the RC database migration version) or the rebuilt image will refuse the
+  # newer DB. Dispatch from `rc` once `rc` is current.
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-rc
+  cancel-in-progress: true
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  deploy-rc:
+    name: "Build & Deploy to RC"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Determine version
+        id: config
+        run: |
+          VERSION=$(git describe --tags --always 2>/dev/null || echo "rc-$(git rev-parse --short HEAD)")
+          echo "tag=${VERSION}-rc" >> $GITHUB_OUTPUT
+          echo "Version: ${VERSION}-rc"
+
+      - name: Write deploy key
+        env:
+          DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$DEPLOY_KEY" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+
+      - name: Build and deploy to RC via SSH
+        env:
+          REGISTRY_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          TAG: ${{ steps.config.outputs.tag }}
+        run: |
+          # Runner-side values (TAG, REGISTRY_TOKEN) are injected into the remote shell
+          # via an env prefix; a *quoted* heredoc keeps every $var expanding once, on the
+          # remote. Repo variables (vars.*) are substituted inline by Actions before ssh.
+          ssh -i ~/.ssh/deploy_key -p ${{ vars.RC_SSH_PORT }} \
+            -o ConnectTimeout=30 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+            -o ServerAliveInterval=30 -o ServerAliveCountMax=10 \
+            ${{ vars.RC_SSH_USERNAME }}@${{ vars.RC_SSH_HOST }} \
+            "TAG='$TAG' REGISTRY_TOKEN='$REGISTRY_TOKEN' bash -s" <<'DEPLOY_EOF'
+          set -e
+          echo 'SSH connected to RC environment'
+
+          if [ -z "$TAG" ]; then
+            echo 'ERROR: TAG is empty; refusing to build an untagged image' >&2
+            exit 1
+          fi
+
+          HEALTH_FMT='{{.State.Health.Status}}'
+
+          echo 'Cleaning Docker build cache...'
+          docker builder prune -af 2>/dev/null || true
+          docker image prune -af 2>/dev/null || true
+
+          echo 'Pulling source...'
+          SOURCE_DIR='${{ vars.RC_SOURCE_DIR }}'
+          if [ ! -d "$SOURCE_DIR/.git" ]; then
+            git clone -b rc https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git "$SOURCE_DIR"
+          fi
+          cd "$SOURCE_DIR"
+          git remote set-url origin https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git 2>/dev/null || true
+          git fetch origin rc
+          git reset --hard origin/rc
+
+          echo "Building image: ${{ vars.RC_REGISTRY }}/${{ vars.RC_IMAGE }}:$TAG"
+          docker build --no-cache --build-arg GOFLAGS='-p 1' \
+            --tag "${{ vars.RC_REGISTRY }}/${{ vars.RC_IMAGE }}:$TAG" \
+            -f Dockerfile .
+
+          echo 'Pushing to registry...'
+          echo "$REGISTRY_TOKEN" | docker login ${{ vars.RC_REGISTRY }} -u ${{ vars.RC_REGISTRY_USER }} --password-stdin
+          docker push "${{ vars.RC_REGISTRY }}/${{ vars.RC_IMAGE }}:$TAG"
+
+          echo 'Restarting RC container...'
+          cd '${{ vars.RC_COMPOSE_DIR }}'
+          # Drive the rc service image tag via its compose env-var (no sed on the shared
+          # file); remove any lingering fixed-name container first, then force-recreate.
+          docker rm -f '${{ vars.RC_CONTAINER }}' 2>/dev/null || true
+          ${{ vars.RC_TAG_ENV }}="$TAG" docker compose -p '${{ vars.RC_COMPOSE_PROJECT }}' up -d --force-recreate '${{ vars.RC_CONTAINER }}'
+
+          echo 'Health check...'
+          for i in 1 2 3 4 5 6 7 8; do
+            sleep 15
+            if docker inspect --format="$HEALTH_FMT" '${{ vars.RC_CONTAINER }}' 2>/dev/null | grep -q healthy; then
+              echo 'RC container healthy!'
+              exit 0
+            fi
+            echo "Waiting... (attempt $i/8)"
+          done
+          echo 'Health check failed'
+          docker logs '${{ vars.RC_CONTAINER }}' --tail 20
+          exit 1
+          DEPLOY_EOF
+
+      - name: Verify RC instance
+        continue-on-error: true
+        run: |
+          sleep 5
+          ssh -i ~/.ssh/deploy_key -p ${{ vars.RC_SSH_PORT }} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ vars.RC_SSH_USERNAME }}@${{ vars.RC_SSH_HOST }} "curl -sf '${{ vars.RC_HEALTH_URL }}'" && echo " RC API healthy"

.mokogitea/workflows/gitleaks.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: MokoStandards.Security
 # REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/MokoStandards-API
 # PATH: /templates/workflows/gitleaks.yml.template

.mokogitea/workflows/issue-branch.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Automation
 # VERSION: 01.00.00
 # BRIEF: Auto-create feature branch when an issue is opened

.mokogitea/workflows/notify.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: MokoStandards.Notifications
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
 # PATH: /.gitea/workflows/notify.yml

.mokogitea/workflows/pr-check.yml

@@ -3,9 +3,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
-# INGROUP: moko-platform.CI
-# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/moko-platform
+# DEFGROUP: MokoGitea.Workflow
+# INGROUP: mokocli.CI
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
 # PATH: /templates/workflows/universal/pr-check.yml.template
 # VERSION: 09.23.00
 # BRIEF: PR gate — branch policy + code validation before merge
@@ -147,11 +147,12 @@ jobs:
       - name: Detect platform
         id: platform
         run: |
-          # Read platform from XML manifest (<platform> tag) or plain text fallback
-          PLATFORM=$(sed -n 's/.*<platform>\([^<]*\)<\/platform>.*/\1/p' .mokogitea/manifest.xml 2>/dev/null | head -1)
-          [ -z "$PLATFORM" ] && PLATFORM=$(cat .mokogitea/manifest.xml 2>/dev/null | tr -d '[:space:]')
+          # Platform comes from the MokoGitea metadata API (public GET).
+          API="${GITHUB_SERVER_URL:-https://git.mokoconsulting.tech}/api/v1/repos/${GITHUB_REPOSITORY}/metadata"
+          PLATFORM="$(curl -sf "$API" 2>/dev/null | python3 -c "import sys, json; print(json.load(sys.stdin).get('platform') or '')" 2>/dev/null || true)"
           [ -z "$PLATFORM" ] && PLATFORM="generic"
           echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
+          echo "Detected platform: $PLATFORM"
 
       - name: Setup PHP
         if: steps.platform.outputs.platform == 'joomla' || steps.platform.outputs.platform == 'dolibarr'
@@ -285,7 +286,7 @@ jobs:
               # Block legacy raw/branch update server URLs on MokoGitea
               RAW_URLS=$(grep -n 'raw/branch' "$MANIFEST" | grep -i 'mokoconsulting\|mokogitea\|git\.mokoconsulting\.tech' || true)
               if [ -n "$RAW_URLS" ]; then
-                echo "::error::Manifest contains legacy raw/branch update server URL on MokoGitea. Use the Gitea Pages URL instead (e.g. /{REPO}/updates.xml not /{REPO}/raw/branch/main/updates.xml)"
+                echo "::error::Manifest contains legacy raw/branch update server URL on MokoGitea. Use the MokoGitea Pages URL instead (e.g. /{REPO}/updates.xml not /{REPO}/raw/branch/main/updates.xml)"
                 echo "$RAW_URLS"
                 exit 1
               fi

.mokogitea/workflows/pre-release.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Release
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /templates/workflows/universal/pre-release.yml.template
@@ -152,8 +152,8 @@ jobs:
           fi
 
           # Commit version bump
-          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "gitea-actions[bot]"
+          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "mokogitea-actions[bot]"
           git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
           git add -A
           git diff --cached --quiet || {

.mokogitea/workflows/rc-revert.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Universal
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /.mokogitea/workflows/rc-revert.yml

.mokogitea/workflows/repo-health.yml

@@ -6,7 +6,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Validation
 # REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
 # PATH: /templates/workflows/joomla/repo_health.yml.template
@@ -88,7 +88,7 @@ jobs:
 
           # Hardcoded authorized users — always allowed
           case "$ACTOR" in
-            jmiller|gitea-actions[bot])
+            jmiller|mokogitea-actions[bot])
               ALLOWED=true
               PERMISSION=admin
               METHOD="hardcoded allowlist"

.mokogitea/workflows/version-set.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow.Template
+# DEFGROUP: MokoGitea.Workflow.Template
 # INGROUP: MokoStandards.CI
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Joomla
 # PATH: /.mokogitea/workflows/version-set.yml

.mokogitea/workflows/workflow-sync-trigger.yml

@@ -1,81 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
-# INGROUP: mokocli.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
-# PATH: /.mokogitea/workflows/workflow-sync-trigger.yml
-# VERSION: 01.01.00
-# BRIEF: Trigger workflow sync to live repos when a PR is merged to main
-
-name: "Universal: Workflow Sync Trigger"
-
-on:
-  workflow_dispatch:
-  pull_request:
-    types: [closed]
-    branches:
-      - main
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-jobs:
-  sync:
-    name: Sync workflows to live repos
-    runs-on: ubuntu-latest
-    if: >-
-      github.event_name == 'workflow_dispatch' ||
-      (github.event.pull_request.merged == true &&
-      !contains(github.event.pull_request.title, '[skip sync]'))
-
-    steps:
-      - name: Determine platform from repo name
-        id: platform
-        run: |
-          REPO="${{ github.event.repository.name }}"
-          case "$REPO" in
-            Template-Joomla)   PLATFORM="joomla" ;;
-            Template-Dolibarr) PLATFORM="dolibarr" ;;
-            Template-Go)       PLATFORM="go" ;;
-            Template-MCP)      PLATFORM="mcp" ;;
-            Template-Generic)  PLATFORM="" ;;
-            *)                 PLATFORM="" ;;
-          esac
-          echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
-          echo "Platform: ${PLATFORM:-all}"
-
-      - name: Clone mokocli
-        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-        run: |
-          MOKOGITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
-          git clone --depth 1 "${MOKOGITEA_URL}/MokoConsulting/mokocli.git" /tmp/mokocli
-
-      - name: Install PHP
-        run: |
-          if ! command -v php &> /dev/null; then
-            apt-get update -qq && apt-get install -y -qq php-cli php-json php-curl > /dev/null 2>&1
-          fi
-
-      - name: Install dependencies
-        run: |
-          cd /tmp/mokocli
-          composer install --no-dev --no-interaction --quiet 2>/dev/null || true
-
-      - name: Run workflow sync
-        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-        run: |
-          ARGS="--token ${MOKOGITEA_TOKEN}"
-          ARGS="${ARGS} --org ${{ vars.GITEA_ORG || github.repository_owner }}"
-          ARGS="${ARGS} --phase repos"
-
-          PLATFORM="${{ steps.platform.outputs.platform }}"
-          if [ -n "$PLATFORM" ]; then
-            ARGS="${ARGS} --platform-filter ${PLATFORM}"
-          fi
-
-          php /tmp/mokocli/cli/workflow_sync.php ${ARGS}

CHANGELOG.md

@@ -3,6 +3,14 @@
 ## [Unreleased]
 
 ### Added
+- Metadata platform options are now **admin-configurable** instead of hardcoded: a new **Admin → Metadata** page edits the allowed `platform` values (persisted to `app.ini` `[metadata] PLATFORM_OPTIONS`, default `joomla,dolibarr,go,npm,generic`), and the repo Settings → Metadata platform dropdown reads from it. Changing the taxonomy no longer needs a code change/redeploy. A repo's existing platform value stays selectable even if later removed from the list (#777)
+- Org branch protection: repositories now show the inherited organization rules read-only in their Branch Protection settings, with an expandable detail (direct push, force-push, branch deletion, merge restrictions, required approvals, status checks, protected files, and whitelisted teams) — like GitHub surfaces org rulesets in a repo (#727)
+- Org branch protection: org-level rules can now also protect against branch deletion (`enable_delete` + delete allowlist teams), mirroring the per-repo delete allowlist (#727)
+- Org-level tag protection: protect tag patterns org-wide (e.g. `v*`) with a team allowlist, layered on top of each repo's own protected tags — a tag is controllable only if allowed at both levels (fail-closed). API at `/orgs/{org}/tag_protections`; enforced at the git push/delete hook and the release create/delete paths; shown read-only in the repo Tag settings (#727)
+- Org-level push policy: one policy per org, enforced in the pre-receive hook across all its repositories — branch/tag name conventions (glob), a mandatory secret-scanning block-on-push that repos cannot disable, a max pushed-file size, and blocked file-path patterns. API at `/orgs/{org}/push_policy`. Naming is fail-closed; the content checks (blocked paths, max size) fail open on error so a policy bug can never block every push (#727)
+- Org-level repository defaults: an org can force new/transferred repositories private and set default pull-request settings (allowed merge styles, default merge style, auto-delete branch after merge), applied via a notifier when a repo is created in or transferred into the org (best-effort — never blocks repo creation). API at `/orgs/{org}/repo_defaults` (#727)
+- Org-level email domain policy: restrict which email domains an organization's members may have — a user can only be added to the org (via any team) if their primary email matches one of the allowed domain globs. Enforced at the single membership-add choke point (`AddTeamMember`); API at `/orgs/{org}/email_domain_policy` (#727)
+- Code security scanner: pattern-based detection of SQL injection, XSS, command injection, path traversal, insecure deserialization, hardcoded credentials, and weak cryptography across Go/PHP/Python/JS/TS (#552)
 - Cascade merge: auto-create PRs to downstream branches after merge with configurable rules per repo (#460)
 - Issue status presets: 4 built-in templates (default, software-development, support-tickets, bug-tracking) with API + web UI (#507)
 - Cross-org status migration: copy status definitions from one org to another via API (#507)
@@ -40,7 +48,37 @@
 - Wiki recent changes page: cross-page edit activity with pagination (#670)
 - Wiki page rename with automatic redirects via YAML frontmatter (#672)
 
+### Security
+- Cherry-pick upstream v1.26.3: LFS reject unknown SSH sub-verbs to prevent auth bypass (#38015)
+- Cherry-pick upstream v1.26.3: bound CODEOWNERS regex match time — ReDoS prevention (#38025)
+- Cherry-pick upstream v1.26.3: require merged PR to bypass fork PR approval gate (#38041)
+- Cherry-pick upstream v1.26.3: LFS require Code-unit access for cross-repo object reuse (#38050)
+- Cherry-pick upstream v1.26.3: hostmatcher block reserved IP ranges — SSRF prevention (#38059)
+- Cherry-pick upstream v1.26.3: bound debian ParseControlFile — DoS prevention (#38055)
+- Cherry-pick upstream v1.26.3: feed token scope, migration SSRF, notification redaction (#38147)
+- Cherry-pick upstream v1.26.3: OIDC ignore stale external login links to organizations (#38141)
+- Cherry-pick upstream v1.26.3: 2FA timing, branch delete auth, org labels visibility, merge upstream auth (#38151)
+- Cherry-pick upstream v1.26.3: allow git clone of private repos with anonymous code access (#38146)
+- Cherry-pick upstream v1.26.3: hostmatcher patch incorrect private IP list (#38173)
+- Cherry-pick upstream v1.26.4: do not auto-reactivate disabled users on OAuth2 callback (#38183)
+- Cherry-pick upstream v1.26.4: walk git log context error handling — regression fix (#38185)
+
 ### Fixed
+- Repo metadata `org` is now **derived from the org profile** (the repository owner) instead of being stored/editable, so it can never drift when an organization is renamed. The `org` column is dropped from `repo_manifest` (migration #368) and the field is derived on read via `Repository.DerivedOrgName` (owner display name, falling back to the handle) across the metadata API, the Settings → Metadata page (now read-only), and the Joomla update-server feed. The API `PUT` and MCP `metadata_update` now ignore `org` (read-only, like the already-derived `display_name`) (#771)
+- Admin Branding: uploading a custom **Nav Icon** now also sets the **app icon** (`logo.png`, the PWA / web-manifest icon and navbar fallback), so a branded instance shows its own installable app icon instead of the shipped default; resetting the Nav Icon reverts both (#773)
+- Fork server binary now compiles: `routers/api/v1/api.go` called `organization.HasOrgOrUserVisible`, which had been renamed to `IsOwnerVisibleToDoer`; the one missed call site broke `go build` of the entire `routers/api/v1` package (CI's Lint & Validate does not run a full build, so it went unnoticed) (#735)
+- Dev deploy workflow: the build/deploy step referenced runner-side values as `\$TAG` / `\$REGISTRY_TOKEN` inside an unquoted SSH heredoc, deferring expansion to the remote shell where those names are unset — the Docker tag collapsed to an empty `mokogitea:` and every dev deploy failed with `invalid reference format`. Runner values are now injected via an ssh env-prefix and the heredoc is quoted so each `$var` expands in exactly one place (#737)
+- Repaired unit-test compile and `go vet` failures: `CryptoRandomInt/String/Bytes` now return two values (updated `modules/util/util_test.go`), removed a redundant `&&` condition in `issue_comment.go`, and cleaned up isolated integration-test compile errors (#736)
+- Removed a stray `package-lock.json` (13.9k lines) that a `git add -A` had accidentally swept into the org-push-policy branch (#734)
+- Org-level branch protection now **layers** with per-repo rules instead of being ignored whenever a repo rule exists. When both an org rule and a repo rule match a branch, the effective rule is the most-restrictive (fail-closed) combination — the org rule is a mandatory floor a repo cannot weaken: allow flags AND'd, gate/require/block flags OR'd, required approvals max'd, status checks and protected-file patterns unioned, whitelists intersected. Previously a repo rule shadowed the org rule entirely at the enforcement choke point (`GetFirstMatchProtectedBranchRule`), letting a repo opt out of org protection (#727)
+- Org Teams page: list now renders — the handler wrote `ctx.Data["OrgListTeams"]` but the template reads `.Teams`, so the page showed header/nav but no teams (#720)
+- Issue type: now editable after creation for users with issue write permission — the sidebar gated editing on a `FieldEditFlags` data key that was never populated (always read-only); now uses `HasIssuesOrPullsWritePermission` like the priority field (#721)
+- Admin config form: radio inputs (e.g. instance landing page Mode) no longer throw "Unsupported config form value mapping", which had aborted all JS init on the admin settings page
+- PR check branch policy: allow `fix/*` → `main` and `patch/*` → `main` to match documented policy (was rejecting fix/patch PRs to main)
+- PR check platform detection: guard for missing `.mokogitea/manifest.xml` so the Validate PR job no longer aborts under `set -e` (manifest replaced by metadata API)
+- Remove dangling `mcp-mokogitea-api` submodule gitlink (no `.gitmodules` entry) that broke `submodule update --init` at checkout, failing all PR build/release jobs; ignore the local clone path
+- PR RC Release workflow: no-op cleanly when `updates.xml` is absent (generic repos) instead of aborting the "Determine RC version" step under `set -e`
+- PR check: platform detection now queries metadata API instead of removed manifest.xml
 - Cherry-pick upstream v1.26.2: handle empty pull request files view to allow reviews (#37783)
 - Cherry-pick upstream v1.26.2: fix "run as root" check with snap container detection (#37622)
 - Cherry-pick upstream: ack re-sent UpdateLog finalize idempotently (#37885)

README.md

@@ -1,6 +1,6 @@
 # MokoGitea
 
-Custom Gitea fork with enhanced wiki system, DLID licensing, issue statuses, org metadata, CI standardization, and project board API.
+Custom Gitea fork with enhanced wiki system, DLID licensing, issue statuses, cascade merge, security scanning, org-level governance, org metadata, CI standardization, and project board API.
 
 ![Language](https://img.shields.io/badge/Go-00ADD8?style=flat-square&logo=go&logoColor=white) ![License](https://img.shields.io/badge/license-GPL--3.0--or--later-green?style=flat-square)
 
@@ -11,8 +11,13 @@ Custom Gitea fork with enhanced wiki system, DLID licensing, issue statuses, org
 - **Wiki System** -- wikilinks, categories, backlinks, template transclusion, revision diffs, rename redirects, folder ACL, enhanced ToC, print view, ZIP export ([details](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki/standards/Wiki-Features))
 - **DLID Licensing** -- license management, entitlements, domain activations, ed25519-signed downloads
 - **API Token Scope Editing** -- edit token scopes via API (PATCH) or web UI after creation
-- **Issue Statuses** -- custom workflow statuses per org with required baseline protection
+- **Issue Statuses** -- custom workflow statuses per org with required baseline protection, presets, cross-org migration
+- **Cascade Merge** -- auto-create PRs to downstream branches after merge with configurable rules per repo
+- **Security Scanning** -- secret detection (pre-receive blocking) + code analysis (SQL injection, XSS, command injection, path traversal, and more) with REST API for alerts, config, and on-demand scans
+- **Default Org Teams** -- auto-create Developers, Reviewers, and CI/CD teams on org creation
 - **Org Metadata** -- per-repo metadata API (public GET, admin PUT), platform detection for versioning
+- **Branch Protection** -- delete allowlist for protected branches (per-user/team/deploy-key)
+- **Org Governance** -- organization-wide rules that layer onto every repository: branch protection as a most-restrictive floor a repo cannot weaken, tag protection (team allowlist), push policy (branch/tag naming, mandatory secret-block, max file size, blocked paths), repository defaults (force-private, PR merge settings), and member email-domain allowlists
 - **Project Board API** -- REST endpoints for project columns and cards
 - **CI Infrastructure** -- reusable workflows, centralized ci-issue-reporter, standardized MOKOGITEA_TOKEN naming
 - **Dev Deploy Gate** -- builds deploy to dev environment first, production checks dev health

cmd/serv.go

@@ -113,23 +113,25 @@ func handleCliResponseExtra(extra private.ResponseExtra) error {
 	return nil
 }
 
-func getAccessMode(verb, lfsVerb string) perm.AccessMode {
+// getAccessMode maps an SSH git/LFS verb to the access mode it requires, with
+// ok=false for an unrecognised verb. Callers MUST reject the request when ok is
+// false: AccessModeNone would otherwise pass the `userMode < mode` permission
+// check in routers/private/serv.go and grant access.
+func getAccessMode(verb, lfsVerb string) (mode perm.AccessMode, ok bool) {
 	switch verb {
 	case git.CmdVerbUploadPack, git.CmdVerbUploadArchive:
-		return perm.AccessModeRead
+		return perm.AccessModeRead, true
 	case git.CmdVerbReceivePack:
-		return perm.AccessModeWrite
+		return perm.AccessModeWrite, true
 	case git.CmdVerbLfsAuthenticate, git.CmdVerbLfsTransfer:
 		switch lfsVerb {
 		case git.CmdSubVerbLfsUpload:
-			return perm.AccessModeWrite
+			return perm.AccessModeWrite, true
 		case git.CmdSubVerbLfsDownload:
-			return perm.AccessModeRead
+			return perm.AccessModeRead, true
 		}
 	}
-	// should be unreachable
-	setting.PanicInDevOrTesting("unknown verb: %s %s", verb, lfsVerb)
-	return perm.AccessModeNone
+	return perm.AccessModeNone, false
 }
 
 func runServ(ctx context.Context, c *cli.Command) error {
@@ -247,7 +249,10 @@ func runServ(ctx context.Context, c *cli.Command) error {
 		}
 	}
 
-	requestedMode := getAccessMode(verb, lfsVerb)
+	requestedMode, ok := getAccessMode(verb, lfsVerb)
+	if !ok {
+		return fail(ctx, "Unknown git command", "Unknown git command %s %s", verb, lfsVerb)
+	}
 
 	results, extra := private.ServCommand(ctx, keyID, username, reponame, requestedMode, verb, lfsVerb)
 	if extra.HasError() {

cmd/serv_test.go

@@ -0,0 +1,56 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"testing"
+
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/perm"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/git"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestGetAccessMode(t *testing.T) {
+	cases := []struct {
+		verb, lfsVerb string
+		expected      perm.AccessMode
+	}{
+		{git.CmdVerbUploadPack, "", perm.AccessModeRead},
+		{git.CmdVerbUploadArchive, "", perm.AccessModeRead},
+		{git.CmdVerbReceivePack, "", perm.AccessModeWrite},
+		{git.CmdVerbLfsAuthenticate, git.CmdSubVerbLfsUpload, perm.AccessModeWrite},
+		{git.CmdVerbLfsAuthenticate, git.CmdSubVerbLfsDownload, perm.AccessModeRead},
+		{git.CmdVerbLfsTransfer, git.CmdSubVerbLfsUpload, perm.AccessModeWrite},
+		{git.CmdVerbLfsTransfer, git.CmdSubVerbLfsDownload, perm.AccessModeRead},
+	}
+	for _, tc := range cases {
+		t.Run(tc.verb+"/"+tc.lfsVerb, func(t *testing.T) {
+			mode, ok := getAccessMode(tc.verb, tc.lfsVerb)
+			assert.True(t, ok)
+			assert.Equal(t, tc.expected, mode)
+		})
+	}
+}
+
+// TestGetAccessModeUnknownVerb locks in the invariant that getAccessMode reports
+// ok=false for unrecognised verbs and LFS sub-verbs, so runServ rejects them. An
+// unknown verb has no valid access mode; if it were treated as AccessModeNone (0)
+// it would pass the `userMode < mode` permission check in routers/private/serv.go
+// and hand out valid LFS JWTs for any private repository.
+func TestGetAccessModeUnknownVerb(t *testing.T) {
+	cases := []struct{ verb, lfsVerb string }{
+		{git.CmdVerbLfsAuthenticate, ""},
+		{git.CmdVerbLfsAuthenticate, "badverb"},
+		{git.CmdVerbLfsTransfer, "badverb"},
+		{"git-unknown-verb", ""},
+	}
+	for _, tc := range cases {
+		t.Run(tc.verb+"/"+tc.lfsVerb, func(t *testing.T) {
+			mode, ok := getAccessMode(tc.verb, tc.lfsVerb)
+			assert.False(t, ok)
+			assert.Equal(t, perm.AccessModeNone, mode)
+		})
+	}
+}

docker/root/etc/templates/app.ini

@@ -51,8 +51,6 @@ ROOT_PATH = /data/gitea/log
 [security]
 INSTALL_LOCK = $INSTALL_LOCK
 SECRET_KEY   = $SECRET_KEY
-REVERSE_PROXY_LIMIT = 1
-REVERSE_PROXY_TRUSTED_PROXIES = *
 
 [service]
 DISABLE_REGISTRATION = $DISABLE_REGISTRATION

docker/rootless/etc/templates/app.ini

@@ -48,8 +48,6 @@ ROOT_PATH = $GITEA_WORK_DIR/data/log
 [security]
 INSTALL_LOCK = $INSTALL_LOCK
 SECRET_KEY   = $SECRET_KEY
-REVERSE_PROXY_LIMIT = 1
-REVERSE_PROXY_TRUSTED_PROXIES = *
 
 [service]
 DISABLE_REGISTRATION = $DISABLE_REGISTRATION

models/actions/run_list.go

@@ -64,7 +64,6 @@ type FindRunOptions struct {
 	Ref              string // the commit/tag/… that caused this workflow
 	TriggerUserID    int64
 	TriggerEvent     webhook_module.HookEventType
-	Approved         bool // not util.OptionalBool, it works only when it's true
 	Status           []Status
 	ConcurrencyGroup string
 	CommitSHA        string
@@ -81,9 +80,6 @@ func (opts FindRunOptions) ToConds() builder.Cond {
 	if opts.TriggerUserID > 0 {
 		cond = cond.And(builder.Eq{"`action_run`.trigger_user_id": opts.TriggerUserID})
 	}
-	if opts.Approved {
-		cond = cond.And(builder.Gt{"`action_run`.approved_by": 0})
-	}
 	if len(opts.Status) > 0 {
 		cond = cond.And(builder.In("`action_run`.status", opts.Status))
 	}

models/auth/twofactor.go

@@ -21,6 +21,7 @@ import (
 
 	"github.com/pquerna/otp/totp"
 	"golang.org/x/crypto/pbkdf2"
+	"xorm.io/builder"
 )
 
 //
@@ -104,20 +105,43 @@ func (t *TwoFactor) SetSecret(secretString string) error {
 	return nil
 }
 
-// ValidateTOTP validates the provided passcode.
-func (t *TwoFactor) ValidateTOTP(passcode string) (bool, error) {
+// validateTOTP validates the provided passcode. It does not consume the passcode; all login
+// surfaces must go through ValidateAndConsumeTOTP so that a passcode cannot be redeemed twice.
+func (t *TwoFactor) validateTOTP(passcode string) (bool, error) {
 	decodedStoredSecret, err := base64.StdEncoding.DecodeString(t.Secret)
 	if err != nil {
-		return false, fmt.Errorf("ValidateTOTP invalid base64: %w", err)
+		return false, fmt.Errorf("validateTOTP invalid base64: %w", err)
 	}
 	secretBytes, err := secret.AesDecrypt(t.getEncryptionKey(), decodedStoredSecret)
 	if err != nil {
-		return false, fmt.Errorf("ValidateTOTP unable to decrypt (maybe SECRET_KEY is wrong): %w", err)
+		return false, fmt.Errorf("validateTOTP unable to decrypt (maybe SECRET_KEY is wrong): %w", err)
 	}
 	secretStr := string(secretBytes)
 	return totp.Validate(passcode, secretStr), nil
 }
 
+// ValidateAndConsumeTOTP validates the passcode and atomically records it as used so that the
+// same passcode cannot be redeemed more than once (RFC 6238 §5.2). It returns false for an
+// invalid passcode as well as for a replay, including the case where a concurrent request with
+// the same passcode won the race first. All TOTP login surfaces must go through this helper.
+func (t *TwoFactor) ValidateAndConsumeTOTP(ctx context.Context, passcode string) (bool, error) {
+	ok, err := t.validateTOTP(passcode)
+	if err != nil || !ok {
+		return false, err
+	}
+	// Conditional update: only a row whose stored passcode differs from this one is updated, so a
+	// replay (or a concurrent duplicate) matches zero rows and is rejected. The row lock taken by
+	// the UPDATE serializes racing requests, closing the read-validate-write TOCTOU window.
+	t.LastUsedPasscode = passcode
+	n, err := db.GetEngine(ctx).ID(t.ID).
+		Where(builder.Or(builder.IsNull{"last_used_passcode"}, builder.Neq{"last_used_passcode": passcode})).
+		Cols("last_used_passcode").Update(t)
+	if err != nil {
+		return false, err
+	}
+	return n == 1, nil
+}
+
 // NewTwoFactor creates a new two-factor authentication token.
 func NewTwoFactor(ctx context.Context, t *TwoFactor) error {
 	_, err := db.GetEngine(ctx).Insert(t)

models/auth/twofactor_test.go

@@ -0,0 +1,47 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package auth_test
+
+import (
+	"testing"
+	"time"
+
+	auth_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/auth"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/unittest"
+
+	"github.com/pquerna/otp/totp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestTwoFactorValidateAndConsumeTOTP(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+
+	key, err := totp.Generate(totp.GenerateOpts{SecretSize: 40, Issuer: "gitea-test", AccountName: "consume"})
+	require.NoError(t, err)
+
+	tfa := &auth_model.TwoFactor{UID: 1}
+	require.NoError(t, tfa.SetSecret(key.Secret()))
+	require.NoError(t, auth_model.NewTwoFactor(t.Context(), tfa))
+
+	passcode, err := totp.GenerateCode(key.Secret(), time.Now())
+	require.NoError(t, err)
+
+	// first use of a valid passcode succeeds
+	ok, err := tfa.ValidateAndConsumeTOTP(t.Context(), passcode)
+	require.NoError(t, err)
+	assert.True(t, ok)
+
+	// replaying the same passcode is refused, even when still inside the TOTP validity window
+	reloaded, err := auth_model.GetTwoFactorByUID(t.Context(), tfa.UID)
+	require.NoError(t, err)
+	ok, err = reloaded.ValidateAndConsumeTOTP(t.Context(), passcode)
+	require.NoError(t, err)
+	assert.False(t, ok)
+
+	// an invalid passcode is rejected without consuming anything
+	ok, err = reloaded.ValidateAndConsumeTOTP(t.Context(), "000000")
+	require.NoError(t, err)
+	assert.False(t, ok)
+}

models/git/lfs.go

@@ -196,7 +196,10 @@ func LFSObjectAccessible(ctx context.Context, user *user_model.User, oid string)
 		count, err := db.GetEngine(ctx).Count(&LFSMetaObject{Pointer: lfs.Pointer{Oid: oid}})
 		return count > 0, err
 	}
-	cond := repo_model.AccessibleRepositoryCondition(user, unit.TypeInvalid)
+	// LFS objects are repository code content, so authorization must require
+	// Code-unit access; other unit accesses (e.g. Issues) must not authorize
+	// reuse of an existing LFS object across repositories.
+	cond := repo_model.AccessibleRepositoryCondition(user, unit.TypeCode)
 	count, err := db.GetEngine(ctx).Where(cond).Join("INNER", "repository", "`lfs_meta_object`.repository_id = `repository`.id").Count(&LFSMetaObject{Pointer: lfs.Pointer{Oid: oid}})
 	return count > 0, err
 }
@@ -220,7 +223,7 @@ func LFSAutoAssociate(ctx context.Context, metas []*LFSMetaObject, user *user_mo
 			newMetas := make([]*LFSMetaObject, 0, len(metas))
 			cond := builder.In(
 				"`lfs_meta_object`.repository_id",
-				builder.Select("`repository`.id").From("repository").Where(repo_model.AccessibleRepositoryCondition(user, unit.TypeInvalid)),
+				builder.Select("`repository`.id").From("repository").Where(repo_model.AccessibleRepositoryCondition(user, unit.TypeCode)),
 			)
 			if err := db.GetEngine(ctx).Cols("oid").Where(cond).In("oid", oids...).GroupBy("oid").Find(&newMetas); err != nil {
 				return err

models/git/org_email_domain.go

@@ -0,0 +1,134 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package git
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/db"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/glob"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/log"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/timeutil"
+
+	"xorm.io/builder"
+)
+
+// OrgEmailDomainPolicy restricts which email domains an organization's members may
+// have. When configured, a user can only be added to the org if their primary email
+// matches one of the allowed domain globs. At most one row per org. See issue #727.
+type OrgEmailDomainPolicy struct {
+	ID             int64              `xorm:"pk autoincr"`
+	OrgID          int64              `xorm:"UNIQUE NOT NULL"`
+	AllowedDomains string             `xorm:"TEXT"`
+	CreatedUnix    timeutil.TimeStamp `xorm:"created"`
+	UpdatedUnix    timeutil.TimeStamp `xorm:"updated"`
+}
+
+func init() {
+	db.RegisterModel(new(OrgEmailDomainPolicy))
+}
+
+// ErrEmailDomainNotAllowed is returned when a user's email domain is not permitted
+// by the organization's email domain policy.
+type ErrEmailDomainNotAllowed struct {
+	Email string
+	OrgID int64
+}
+
+func (e ErrEmailDomainNotAllowed) Error() string {
+	return fmt.Sprintf("email %q is not in an allowed domain for organization %d", e.Email, e.OrgID)
+}
+
+// IsErrEmailDomainNotAllowed reports whether err is an ErrEmailDomainNotAllowed.
+func IsErrEmailDomainNotAllowed(err error) bool {
+	_, ok := err.(ErrEmailDomainNotAllowed)
+	return ok
+}
+
+func (p *OrgEmailDomainPolicy) domainGlobs() []glob.Glob {
+	var out []glob.Glob
+	for _, d := range strings.Split(p.AllowedDomains, ";") {
+		d = strings.TrimSpace(strings.ToLower(d))
+		if d == "" {
+			continue
+		}
+		if g, err := glob.Compile(d); err == nil {
+			out = append(out, g)
+		} else {
+			log.Warn("Invalid org email domain glob %q: %v", d, err)
+		}
+	}
+	return out
+}
+
+// EmailAllowed reports whether email's domain satisfies the policy. An empty policy
+// (no configured domains) allows any email.
+func (p *OrgEmailDomainPolicy) EmailAllowed(email string) bool {
+	globs := p.domainGlobs()
+	if len(globs) == 0 {
+		return true
+	}
+	at := strings.LastIndexByte(email, '@')
+	if at < 0 {
+		return false
+	}
+	domain := strings.ToLower(email[at+1:])
+	for _, g := range globs {
+		if g.Match(domain) {
+			return true
+		}
+	}
+	return false
+}
+
+// GetOrgEmailDomainPolicy returns the org's email domain policy, or nil if none.
+func GetOrgEmailDomainPolicy(ctx context.Context, orgID int64) (*OrgEmailDomainPolicy, error) {
+	policy, exist, err := db.Get[OrgEmailDomainPolicy](ctx, builder.Eq{"org_id": orgID})
+	if err != nil {
+		return nil, err
+	} else if !exist {
+		return nil, nil //nolint:nilnil
+	}
+	return policy, nil
+}
+
+// OrgEmailDomainAllowed reports whether email is permitted for the org. It returns
+// true when the org has no policy configured.
+func OrgEmailDomainAllowed(ctx context.Context, orgID int64, email string) (bool, error) {
+	policy, err := GetOrgEmailDomainPolicy(ctx, orgID)
+	if err != nil {
+		return false, err
+	}
+	if policy == nil {
+		return true, nil
+	}
+	return policy.EmailAllowed(email), nil
+}
+
+// UpsertOrgEmailDomainPolicy creates or updates the single policy row for an org.
+func UpsertOrgEmailDomainPolicy(ctx context.Context, policy *OrgEmailDomainPolicy) error {
+	existing, err := GetOrgEmailDomainPolicy(ctx, policy.OrgID)
+	if err != nil {
+		return err
+	}
+	if existing == nil {
+		if _, err := db.GetEngine(ctx).Insert(policy); err != nil {
+			return fmt.Errorf("Insert OrgEmailDomainPolicy: %v", err)
+		}
+		return nil
+	}
+	policy.ID = existing.ID
+	if _, err := db.GetEngine(ctx).ID(existing.ID).AllCols().Update(policy); err != nil {
+		return fmt.Errorf("Update OrgEmailDomainPolicy: %v", err)
+	}
+	return nil
+}
+
+// DeleteOrgEmailDomainPolicy removes an org's email domain policy.
+func DeleteOrgEmailDomainPolicy(ctx context.Context, orgID int64) error {
+	_, err := db.GetEngine(ctx).Where("org_id = ?", orgID).Delete(new(OrgEmailDomainPolicy))
+	return err
+}

models/git/org_protected_branch.go

@@ -28,16 +28,28 @@ type OrgProtectedBranch struct {
 	CanPush                       bool               `xorm:"NOT NULL DEFAULT false"`
 	EnableWhitelist               bool               `xorm:"NOT NULL DEFAULT false"`
 	WhitelistTeamIDs              []int64            `xorm:"JSON TEXT"`
+	WhitelistUserIDs              []int64            `xorm:"JSON TEXT"`
+	WhitelistActionsUser          bool               `xorm:"NOT NULL DEFAULT false"`
 	EnableMergeWhitelist          bool               `xorm:"NOT NULL DEFAULT false"`
 	MergeWhitelistTeamIDs         []int64            `xorm:"JSON TEXT"`
+	MergeWhitelistUserIDs         []int64            `xorm:"JSON TEXT"`
+	MergeWhitelistActionsUser     bool               `xorm:"NOT NULL DEFAULT false"`
 	CanForcePush                  bool               `xorm:"NOT NULL DEFAULT false"`
 	EnableForcePushAllowlist      bool               `xorm:"NOT NULL DEFAULT false"`
 	ForcePushAllowlistTeamIDs     []int64            `xorm:"JSON TEXT"`
+	ForcePushAllowlistUserIDs     []int64            `xorm:"JSON TEXT"`
+	ForcePushAllowlistActionsUser bool               `xorm:"NOT NULL DEFAULT false"`
+	CanDelete                     bool               `xorm:"NOT NULL DEFAULT false"`
+	EnableDeleteAllowlist         bool               `xorm:"NOT NULL DEFAULT false"`
+	DeleteAllowlistTeamIDs        []int64            `xorm:"JSON TEXT"`
+	DeleteAllowlistUserIDs        []int64            `xorm:"JSON TEXT"`
+	DeleteAllowlistActionsUser    bool               `xorm:"NOT NULL DEFAULT false"`
 	EnableStatusCheck             bool               `xorm:"NOT NULL DEFAULT false"`
 	StatusCheckContexts           []string           `xorm:"JSON TEXT"`
 	RequiredApprovals             int64              `xorm:"NOT NULL DEFAULT 0"`
 	EnableApprovalsWhitelist      bool               `xorm:"NOT NULL DEFAULT false"`
 	ApprovalsWhitelistTeamIDs     []int64            `xorm:"JSON TEXT"`
+	ApprovalsWhitelistUserIDs     []int64            `xorm:"JSON TEXT"`
 	BlockOnRejectedReviews        bool               `xorm:"NOT NULL DEFAULT false"`
 	BlockOnOfficialReviewRequests bool               `xorm:"NOT NULL DEFAULT false"`
 	BlockOnOutdatedBranch         bool               `xorm:"NOT NULL DEFAULT false"`
@@ -81,8 +93,9 @@ func (o *OrgProtectedBranch) Match(branchName string) bool {
 }
 
 // ToProtectedBranch converts an org-level rule to a ProtectedBranch for use
-// in the standard enforcement path. Fields that are user-scoped (WhitelistUserIDs etc.)
-// are left empty because org rules only reference teams.
+// in the standard enforcement path. Both team-scoped and user-scoped allowlists
+// (plus the Actions-bot toggles) are carried across; deploy-key allowances remain
+// repo-only because an org rule cannot express them.
 func (o *OrgProtectedBranch) ToProtectedBranch() *ProtectedBranch {
 	return &ProtectedBranch{
 		ID:                            o.ID,
@@ -91,16 +104,28 @@ func (o *OrgProtectedBranch) ToProtectedBranch() *ProtectedBranch {
 		CanPush:                       o.CanPush,
 		EnableWhitelist:               o.EnableWhitelist,
 		WhitelistTeamIDs:              o.WhitelistTeamIDs,
+		WhitelistUserIDs:              o.WhitelistUserIDs,
+		WhitelistActionsUser:          o.WhitelistActionsUser,
 		EnableMergeWhitelist:          o.EnableMergeWhitelist,
 		MergeWhitelistTeamIDs:         o.MergeWhitelistTeamIDs,
+		MergeWhitelistUserIDs:         o.MergeWhitelistUserIDs,
+		MergeWhitelistActionsUser:     o.MergeWhitelistActionsUser,
 		CanForcePush:                  o.CanForcePush,
 		EnableForcePushAllowlist:      o.EnableForcePushAllowlist,
 		ForcePushAllowlistTeamIDs:     o.ForcePushAllowlistTeamIDs,
+		ForcePushAllowlistUserIDs:     o.ForcePushAllowlistUserIDs,
+		ForcePushAllowlistActionsUser: o.ForcePushAllowlistActionsUser,
+		CanDelete:                     o.CanDelete,
+		EnableDeleteAllowlist:         o.EnableDeleteAllowlist,
+		DeleteAllowlistTeamIDs:        o.DeleteAllowlistTeamIDs,
+		DeleteAllowlistUserIDs:        o.DeleteAllowlistUserIDs,
+		DeleteAllowlistActionsUser:    o.DeleteAllowlistActionsUser,
 		EnableStatusCheck:             o.EnableStatusCheck,
 		StatusCheckContexts:           o.StatusCheckContexts,
 		RequiredApprovals:             o.RequiredApprovals,
 		EnableApprovalsWhitelist:      o.EnableApprovalsWhitelist,
 		ApprovalsWhitelistTeamIDs:     o.ApprovalsWhitelistTeamIDs,
+		ApprovalsWhitelistUserIDs:     o.ApprovalsWhitelistUserIDs,
 		BlockOnRejectedReviews:        o.BlockOnRejectedReviews,
 		BlockOnOfficialReviewRequests: o.BlockOnOfficialReviewRequests,
 		BlockOnOutdatedBranch:         o.BlockOnOutdatedBranch,

models/git/org_protected_tag.go

@@ -0,0 +1,133 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package git
+
+import (
+	"context"
+	"fmt"
+
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/db"
+	repo_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
+	user_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/user"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/timeutil"
+
+	"xorm.io/builder"
+)
+
+// OrgProtectedTag represents an org-level tag protection rule. It cascades to all
+// repositories in the organization and layers on top of each repo's own protected
+// tags (a tag is controllable only if allowed at both levels). Org rules reference
+// teams only (like OrgProtectedBranch). See issue #727.
+type OrgProtectedTag struct {
+	ID               int64              `xorm:"pk autoincr"`
+	OrgID            int64              `xorm:"UNIQUE(s) index"`
+	NamePattern      string             `xorm:"UNIQUE(s)"`
+	AllowlistTeamIDs []int64            `xorm:"JSON TEXT"`
+	CreatedUnix      timeutil.TimeStamp `xorm:"created"`
+	UpdatedUnix      timeutil.TimeStamp `xorm:"updated"`
+}
+
+func init() {
+	db.RegisterModel(new(OrgProtectedTag))
+}
+
+// ToProtectedTag converts an org-level tag rule into a repo-scoped ProtectedTag so
+// the standard name-matching and allowlist logic can be reused. Org rules are
+// team-only, so the user allowlist is left empty.
+func (o *OrgProtectedTag) ToProtectedTag() *ProtectedTag {
+	return &ProtectedTag{
+		NamePattern:      o.NamePattern,
+		AllowlistTeamIDs: o.AllowlistTeamIDs,
+	}
+}
+
+// GetOrgProtectedTagByID retrieves a single org tag rule by org ID and rule ID.
+func GetOrgProtectedTagByID(ctx context.Context, orgID, id int64) (*OrgProtectedTag, error) {
+	rule, exist, err := db.Get[OrgProtectedTag](ctx, builder.Eq{"org_id": orgID, "id": id})
+	if err != nil {
+		return nil, err
+	} else if !exist {
+		return nil, nil //nolint:nilnil
+	}
+	return rule, nil
+}
+
+// GetOrgProtectedTagByNamePattern retrieves a single org tag rule by its pattern.
+func GetOrgProtectedTagByNamePattern(ctx context.Context, orgID int64, pattern string) (*OrgProtectedTag, error) {
+	rule, exist, err := db.Get[OrgProtectedTag](ctx, builder.Eq{"org_id": orgID, "name_pattern": pattern})
+	if err != nil {
+		return nil, err
+	} else if !exist {
+		return nil, nil //nolint:nilnil
+	}
+	return rule, nil
+}
+
+// FindOrgProtectedTags loads all org-level tag protection rules for an organization.
+func FindOrgProtectedTags(ctx context.Context, orgID int64) ([]*OrgProtectedTag, error) {
+	var rules []*OrgProtectedTag
+	err := db.GetEngine(ctx).Where("org_id = ?", orgID).Asc("created_unix").Find(&rules)
+	return rules, err
+}
+
+// CreateOrgProtectedTag creates a new org-level tag protection rule.
+func CreateOrgProtectedTag(ctx context.Context, rule *OrgProtectedTag) error {
+	if _, err := db.GetEngine(ctx).Insert(rule); err != nil {
+		return fmt.Errorf("Insert OrgProtectedTag: %v", err)
+	}
+	return nil
+}
+
+// UpdateOrgProtectedTag updates an existing org-level tag protection rule.
+func UpdateOrgProtectedTag(ctx context.Context, rule *OrgProtectedTag) error {
+	if _, err := db.GetEngine(ctx).ID(rule.ID).AllCols().Update(rule); err != nil {
+		return fmt.Errorf("Update OrgProtectedTag: %v", err)
+	}
+	return nil
+}
+
+// DeleteOrgProtectedTag deletes an org-level tag protection rule.
+func DeleteOrgProtectedTag(ctx context.Context, orgID, id int64) error {
+	affected, err := db.GetEngine(ctx).Where("org_id = ? AND id = ?", orgID, id).Delete(new(OrgProtectedTag))
+	if err != nil {
+		return err
+	}
+	if affected == 0 {
+		return fmt.Errorf("org tag protection rule ID(%d) not found", id)
+	}
+	return nil
+}
+
+// IsUserAllowedToControlTagInRepo layers org-level tag rules on top of a repo's own
+// protected tags: the user must be allowed by BOTH levels (most-restrictive). The
+// repo decision is evaluated first (using the already-loaded repoTags); if it
+// allows and the owner is an organization, the org-level rules must also allow.
+func IsUserAllowedToControlTagInRepo(ctx context.Context, repoTags []*ProtectedTag, repo *repo_model.Repository, tagName string, userID int64) (bool, error) {
+	allowed, err := IsUserAllowedToControlTag(ctx, repoTags, tagName, userID)
+	if err != nil || !allowed {
+		return allowed, err
+	}
+
+	owner, err := user_model.GetUserByID(ctx, repo.OwnerID)
+	if err != nil {
+		return false, err
+	}
+	if !owner.IsOrganization() {
+		return true, nil
+	}
+
+	orgRules, err := FindOrgProtectedTags(ctx, owner.ID)
+	if err != nil {
+		return false, err
+	}
+	if len(orgRules) == 0 {
+		return true, nil
+	}
+
+	orgTags := make([]*ProtectedTag, len(orgRules))
+	for i, r := range orgRules {
+		orgTags[i] = r.ToProtectedTag()
+	}
+	return IsUserAllowedToControlTag(ctx, orgTags, tagName, userID)
+}

models/git/org_push_policy.go

@@ -0,0 +1,130 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package git
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/db"
+	repo_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
+	user_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/user"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/glob"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/log"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/timeutil"
+
+	"xorm.io/builder"
+)
+
+// OrgPushPolicy is a single org-wide policy enforced in the pre-receive hook on
+// every repository of the organization. Unlike the branch/tag rulesets there is at
+// most one policy per org. Empty pattern / zero fields mean "no constraint". See #727.
+type OrgPushPolicy struct {
+	ID                  int64              `xorm:"pk autoincr"`
+	OrgID               int64              `xorm:"UNIQUE NOT NULL"`
+	BranchNamePattern   string             `xorm:"TEXT"`
+	TagNamePattern      string             `xorm:"TEXT"`
+	RequireSecretBlock  bool               `xorm:"NOT NULL DEFAULT false"`
+	MaxFileSize         int64              `xorm:"NOT NULL DEFAULT 0"`
+	BlockedFilePatterns string             `xorm:"TEXT"`
+	CreatedUnix         timeutil.TimeStamp `xorm:"created"`
+	UpdatedUnix         timeutil.TimeStamp `xorm:"updated"`
+}
+
+func init() {
+	db.RegisterModel(new(OrgPushPolicy))
+}
+
+// nameMatchesPattern reports whether name satisfies a glob pattern. An empty pattern
+// imposes no constraint; an invalid pattern fails open (no constraint) so a
+// misconfigured policy never blocks all pushes.
+func nameMatchesPattern(pattern, name string) bool {
+	pattern = strings.TrimSpace(pattern)
+	if pattern == "" {
+		return true
+	}
+	g, err := glob.Compile(pattern, '/')
+	if err != nil {
+		log.Warn("Invalid org push policy name pattern %q: %v", pattern, err)
+		return true
+	}
+	return g.Match(name)
+}
+
+// BranchNameAllowed reports whether a branch name satisfies the naming policy.
+func (p *OrgPushPolicy) BranchNameAllowed(name string) bool {
+	return nameMatchesPattern(p.BranchNamePattern, name)
+}
+
+// TagNameAllowed reports whether a tag name satisfies the naming policy.
+func (p *OrgPushPolicy) TagNameAllowed(name string) bool {
+	return nameMatchesPattern(p.TagNamePattern, name)
+}
+
+// BlockedFileGlobs parses the ';'-separated blocked file pattern list.
+func (p *OrgPushPolicy) BlockedFileGlobs() []glob.Glob {
+	var out []glob.Glob
+	for _, expr := range strings.Split(p.BlockedFilePatterns, ";") {
+		expr = strings.TrimSpace(strings.ToLower(expr))
+		if expr == "" {
+			continue
+		}
+		if g, err := glob.Compile(expr, '.', '/'); err == nil {
+			out = append(out, g)
+		} else {
+			log.Warn("Invalid org push policy blocked file pattern %q: %v", expr, err)
+		}
+	}
+	return out
+}
+
+// GetOrgPushPolicy returns the org's push policy, or nil if none is configured.
+func GetOrgPushPolicy(ctx context.Context, orgID int64) (*OrgPushPolicy, error) {
+	policy, exist, err := db.Get[OrgPushPolicy](ctx, builder.Eq{"org_id": orgID})
+	if err != nil {
+		return nil, err
+	} else if !exist {
+		return nil, nil //nolint:nilnil
+	}
+	return policy, nil
+}
+
+// GetOrgPushPolicyForRepo returns the push policy of the repo's owning organization,
+// or nil if the owner is not an organization or has no policy.
+func GetOrgPushPolicyForRepo(ctx context.Context, repo *repo_model.Repository) (*OrgPushPolicy, error) {
+	owner, err := user_model.GetUserByID(ctx, repo.OwnerID)
+	if err != nil {
+		return nil, err
+	}
+	if !owner.IsOrganization() {
+		return nil, nil //nolint:nilnil
+	}
+	return GetOrgPushPolicy(ctx, owner.ID)
+}
+
+// UpsertOrgPushPolicy creates or updates the single push policy for an org.
+func UpsertOrgPushPolicy(ctx context.Context, policy *OrgPushPolicy) error {
+	existing, err := GetOrgPushPolicy(ctx, policy.OrgID)
+	if err != nil {
+		return err
+	}
+	if existing == nil {
+		if _, err := db.GetEngine(ctx).Insert(policy); err != nil {
+			return fmt.Errorf("Insert OrgPushPolicy: %v", err)
+		}
+		return nil
+	}
+	policy.ID = existing.ID
+	if _, err := db.GetEngine(ctx).ID(existing.ID).AllCols().Update(policy); err != nil {
+		return fmt.Errorf("Update OrgPushPolicy: %v", err)
+	}
+	return nil
+}
+
+// DeleteOrgPushPolicy removes an org's push policy.
+func DeleteOrgPushPolicy(ctx context.Context, orgID int64) error {
+	_, err := db.GetEngine(ctx).Where("org_id = ?", orgID).Delete(new(OrgPushPolicy))
+	return err
+}

models/git/org_repo_defaults.go

@@ -0,0 +1,88 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package git
+
+import (
+	"context"
+	"fmt"
+
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/db"
+	repo_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
+	user_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/user"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/timeutil"
+
+	"xorm.io/builder"
+)
+
+// OrgRepoDefaults holds an organization's default repository settings, applied to a
+// repository when it is created in or transferred into the org (via a notifier).
+// There is at most one row per org. See issue #727.
+type OrgRepoDefaults struct {
+	ID                     int64              `xorm:"pk autoincr"`
+	OrgID                  int64              `xorm:"UNIQUE NOT NULL"`
+	ForcePrivate           bool               `xorm:"NOT NULL DEFAULT false"`
+	ApplyPRDefaults        bool               `xorm:"NOT NULL DEFAULT false"`
+	AllowMerge             bool               `xorm:"NOT NULL DEFAULT true"`
+	AllowRebase            bool               `xorm:"NOT NULL DEFAULT true"`
+	AllowRebaseMerge       bool               `xorm:"NOT NULL DEFAULT true"`
+	AllowSquash            bool               `xorm:"NOT NULL DEFAULT true"`
+	AllowFastForwardOnly   bool               `xorm:"NOT NULL DEFAULT true"`
+	DefaultMergeStyle      string             `xorm:"TEXT"`
+	DeleteBranchAfterMerge bool               `xorm:"NOT NULL DEFAULT false"`
+	CreatedUnix            timeutil.TimeStamp `xorm:"created"`
+	UpdatedUnix            timeutil.TimeStamp `xorm:"updated"`
+}
+
+func init() {
+	db.RegisterModel(new(OrgRepoDefaults))
+}
+
+// GetOrgRepoDefaults returns the org's repo defaults, or nil if none are configured.
+func GetOrgRepoDefaults(ctx context.Context, orgID int64) (*OrgRepoDefaults, error) {
+	defaults, exist, err := db.Get[OrgRepoDefaults](ctx, builder.Eq{"org_id": orgID})
+	if err != nil {
+		return nil, err
+	} else if !exist {
+		return nil, nil //nolint:nilnil
+	}
+	return defaults, nil
+}
+
+// GetOrgRepoDefaultsForRepo returns the repo-defaults of the repo's owning org, or
+// nil if the owner is not an organization or has none configured.
+func GetOrgRepoDefaultsForRepo(ctx context.Context, repo *repo_model.Repository) (*OrgRepoDefaults, error) {
+	owner, err := user_model.GetUserByID(ctx, repo.OwnerID)
+	if err != nil {
+		return nil, err
+	}
+	if !owner.IsOrganization() {
+		return nil, nil //nolint:nilnil
+	}
+	return GetOrgRepoDefaults(ctx, owner.ID)
+}
+
+// UpsertOrgRepoDefaults creates or updates the single repo-defaults row for an org.
+func UpsertOrgRepoDefaults(ctx context.Context, defaults *OrgRepoDefaults) error {
+	existing, err := GetOrgRepoDefaults(ctx, defaults.OrgID)
+	if err != nil {
+		return err
+	}
+	if existing == nil {
+		if _, err := db.GetEngine(ctx).Insert(defaults); err != nil {
+			return fmt.Errorf("Insert OrgRepoDefaults: %v", err)
+		}
+		return nil
+	}
+	defaults.ID = existing.ID
+	if _, err := db.GetEngine(ctx).ID(existing.ID).AllCols().Update(defaults); err != nil {
+		return fmt.Errorf("Update OrgRepoDefaults: %v", err)
+	}
+	return nil
+}
+
+// DeleteOrgRepoDefaults removes an org's repo defaults.
+func DeleteOrgRepoDefaults(ctx context.Context, orgID int64) error {
+	_, err := db.GetEngine(ctx).Where("org_id = ?", orgID).Delete(new(OrgRepoDefaults))
+	return err
+}

models/git/protected_branch_list.go

@@ -85,19 +85,40 @@ func FindAllMatchedBranches(ctx context.Context, repoID int64, ruleName string)
 	return results, nil
 }
 
-// GetFirstMatchProtectedBranchRule returns the first matched rule.
-// It checks repo-level rules first; if none match, it falls back to org-level rules
-// (if the repo belongs to an organization).
+// GetFirstMatchProtectedBranchRule returns the effective protected-branch rule for a
+// branch. It combines the matching repo-level rule with the matching org-level rule
+// (when the repo belongs to an organization): if both match they are layered with
+// mergeMostRestrictive so the org rule acts as a floor the repo cannot weaken; if
+// only one matches that one is returned; if neither matches, nil.
 func GetFirstMatchProtectedBranchRule(ctx context.Context, repoID int64, branchName string) (*ProtectedBranch, error) {
 	rules, err := FindRepoProtectedBranchRules(ctx, repoID)
 	if err != nil {
 		return nil, err
 	}
-	if matched := rules.GetFirstMatched(branchName); matched != nil {
-		return matched, nil
+	repoRule := rules.GetFirstMatched(branchName)
+
+	orgRule, err := getFirstMatchOrgProtectedBranchRule(ctx, repoID, branchName)
+	if err != nil {
+		return nil, err
 	}
 
-	// Fall back to org-level rules
+	switch {
+	case repoRule == nil && orgRule == nil:
+		return nil, nil
+	case orgRule == nil:
+		return repoRule, nil
+	case repoRule == nil:
+		return orgRule, nil
+	default:
+		return mergeMostRestrictive(repoRule, orgRule), nil
+	}
+}
+
+// getFirstMatchOrgProtectedBranchRule returns the matching org-level rule for a
+// branch expressed as a repo-scoped ProtectedBranch (RepoID set so downstream
+// permission checks work), or nil if the repo's owner is not an organization or no
+// org rule matches.
+func getFirstMatchOrgProtectedBranchRule(ctx context.Context, repoID int64, branchName string) (*ProtectedBranch, error) {
 	repo, err := repo_model.GetRepositoryByID(ctx, repoID)
 	if err != nil {
 		return nil, err
@@ -112,14 +133,16 @@ func GetFirstMatchProtectedBranchRule(ctx context.Context, repoID int64, branchN
 
 	orgRule, err := FindOrgBranchRuleForBranch(ctx, owner.ID, branchName)
 	if err != nil {
+		// Fail closed: propagate the error so callers keep the org floor in force
+		// rather than silently falling back to the repo rule on a transient error.
 		log.Error("FindOrgBranchRuleForBranch: %v", err)
-		return nil, nil
+		return nil, err
 	}
 	if orgRule == nil {
 		return nil, nil
 	}
 
-	// Convert org rule to a ProtectedBranch with RepoID set so callers work correctly
+	// Convert org rule to a ProtectedBranch with RepoID set so callers work correctly.
 	pb := orgRule.ToProtectedBranch()
 	pb.RepoID = repoID
 	return pb, nil

models/git/protected_branch_merge.go

@@ -0,0 +1,202 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package git
+
+import "strings"
+
+// mergeMostRestrictive combines a repo-level and an org-level protected-branch rule
+// that both match the same branch into a single effective rule, always applying the
+// STRICTER constraint from each side (fail-closed). This makes an org-level rule a
+// mandatory floor that a repo rule can only tighten, never weaken. See issue #727.
+//
+// Combination directions:
+//   - "Can*" / allow booleans   -> AND  (an action is allowed only if both allow it)
+//   - "Enable*/Block*/Require*"  -> OR   (a gate is on if either side turns it on)
+//   - RequiredApprovals          -> max
+//   - required-set lists         -> union        (status contexts, protected files)
+//   - allow-set lists            -> intersection (whitelists, unprotected files)
+//
+// Identity (ID, RepoID, RuleName, Priority) is taken from the repo rule so that
+// downstream permission checks (which LoadRepo via RepoID) keep working.
+func mergeMostRestrictive(repoRule, orgRule *ProtectedBranch) *ProtectedBranch {
+	eff := *repoRule
+
+	// Direct push.
+	eff.CanPush = repoRule.CanPush && orgRule.CanPush
+	eff.EnableWhitelist, eff.WhitelistUserIDs = mergeAllowlist(repoRule.EnableWhitelist, repoRule.WhitelistUserIDs, orgRule.EnableWhitelist, orgRule.WhitelistUserIDs)
+	_, eff.WhitelistTeamIDs = mergeAllowlist(repoRule.EnableWhitelist, repoRule.WhitelistTeamIDs, orgRule.EnableWhitelist, orgRule.WhitelistTeamIDs)
+	// Deploy-key allowances are still not expressible in an OrgProtectedBranch, so the
+	// org rule imposes no constraint on them; carry the repo value through unchanged.
+	// ANDing against the org side's always-false zero value would silently lock out
+	// every deploy-key push in any org that has a matching branch rule (see #727 review).
+	// The Actions-bot toggle IS now expressible org-side, so merge it most-restrictively.
+	eff.WhitelistDeployKeys = repoRule.WhitelistDeployKeys
+	eff.WhitelistActionsUser = mergeAllowFlag(repoRule.EnableWhitelist, repoRule.WhitelistActionsUser, orgRule.EnableWhitelist, orgRule.WhitelistActionsUser)
+
+	// Force push.
+	eff.CanForcePush = repoRule.CanForcePush && orgRule.CanForcePush
+	eff.EnableForcePushAllowlist, eff.ForcePushAllowlistUserIDs = mergeAllowlist(repoRule.EnableForcePushAllowlist, repoRule.ForcePushAllowlistUserIDs, orgRule.EnableForcePushAllowlist, orgRule.ForcePushAllowlistUserIDs)
+	_, eff.ForcePushAllowlistTeamIDs = mergeAllowlist(repoRule.EnableForcePushAllowlist, repoRule.ForcePushAllowlistTeamIDs, orgRule.EnableForcePushAllowlist, orgRule.ForcePushAllowlistTeamIDs)
+	eff.ForcePushAllowlistDeployKeys = repoRule.ForcePushAllowlistDeployKeys
+	eff.ForcePushAllowlistActionsUser = mergeAllowFlag(repoRule.EnableForcePushAllowlist, repoRule.ForcePushAllowlistActionsUser, orgRule.EnableForcePushAllowlist, orgRule.ForcePushAllowlistActionsUser)
+
+	// Delete.
+	eff.CanDelete = repoRule.CanDelete && orgRule.CanDelete
+	eff.EnableDeleteAllowlist, eff.DeleteAllowlistUserIDs = mergeAllowlist(repoRule.EnableDeleteAllowlist, repoRule.DeleteAllowlistUserIDs, orgRule.EnableDeleteAllowlist, orgRule.DeleteAllowlistUserIDs)
+	_, eff.DeleteAllowlistTeamIDs = mergeAllowlist(repoRule.EnableDeleteAllowlist, repoRule.DeleteAllowlistTeamIDs, orgRule.EnableDeleteAllowlist, orgRule.DeleteAllowlistTeamIDs)
+	eff.DeleteAllowlistDeployKeys = repoRule.DeleteAllowlistDeployKeys
+	eff.DeleteAllowlistActionsUser = mergeAllowFlag(repoRule.EnableDeleteAllowlist, repoRule.DeleteAllowlistActionsUser, orgRule.EnableDeleteAllowlist, orgRule.DeleteAllowlistActionsUser)
+
+	// Merge whitelist.
+	eff.EnableMergeWhitelist, eff.MergeWhitelistUserIDs = mergeAllowlist(repoRule.EnableMergeWhitelist, repoRule.MergeWhitelistUserIDs, orgRule.EnableMergeWhitelist, orgRule.MergeWhitelistUserIDs)
+	_, eff.MergeWhitelistTeamIDs = mergeAllowlist(repoRule.EnableMergeWhitelist, repoRule.MergeWhitelistTeamIDs, orgRule.EnableMergeWhitelist, orgRule.MergeWhitelistTeamIDs)
+	eff.MergeWhitelistActionsUser = mergeAllowFlag(repoRule.EnableMergeWhitelist, repoRule.MergeWhitelistActionsUser, orgRule.EnableMergeWhitelist, orgRule.MergeWhitelistActionsUser)
+
+	// Status checks.
+	eff.EnableStatusCheck = repoRule.EnableStatusCheck || orgRule.EnableStatusCheck
+	eff.StatusCheckContexts = unionStrings(repoRule.StatusCheckContexts, orgRule.StatusCheckContexts)
+
+	// Approvals and reviews.
+	eff.RequiredApprovals = maxInt64(repoRule.RequiredApprovals, orgRule.RequiredApprovals)
+	eff.EnableApprovalsWhitelist, eff.ApprovalsWhitelistUserIDs = mergeAllowlist(repoRule.EnableApprovalsWhitelist, repoRule.ApprovalsWhitelistUserIDs, orgRule.EnableApprovalsWhitelist, orgRule.ApprovalsWhitelistUserIDs)
+	_, eff.ApprovalsWhitelistTeamIDs = mergeAllowlist(repoRule.EnableApprovalsWhitelist, repoRule.ApprovalsWhitelistTeamIDs, orgRule.EnableApprovalsWhitelist, orgRule.ApprovalsWhitelistTeamIDs)
+	eff.BlockOnRejectedReviews = repoRule.BlockOnRejectedReviews || orgRule.BlockOnRejectedReviews
+	eff.BlockOnOfficialReviewRequests = repoRule.BlockOnOfficialReviewRequests || orgRule.BlockOnOfficialReviewRequests
+	eff.BlockOnOutdatedBranch = repoRule.BlockOnOutdatedBranch || orgRule.BlockOnOutdatedBranch
+	eff.DismissStaleApprovals = repoRule.DismissStaleApprovals || orgRule.DismissStaleApprovals
+	eff.IgnoreStaleApprovals = repoRule.IgnoreStaleApprovals || orgRule.IgnoreStaleApprovals
+
+	// Commits, files, admin override.
+	eff.RequireSignedCommits = repoRule.RequireSignedCommits || orgRule.RequireSignedCommits
+	eff.ProtectedFilePatterns = unionPatterns(repoRule.ProtectedFilePatterns, orgRule.ProtectedFilePatterns)
+	eff.UnprotectedFilePatterns = intersectPatterns(repoRule.UnprotectedFilePatterns, orgRule.UnprotectedFilePatterns)
+	eff.BlockAdminMergeOverride = repoRule.BlockAdminMergeOverride || orgRule.BlockAdminMergeOverride
+
+	return &eff
+}
+
+// mergeAllowlist combines two allow-lists under most-restrictive semantics. An
+// allow-list only narrows access when its Enable flag is set; a disabled list means
+// "everyone", so it imposes no constraint. Therefore: if both are enabled the result
+// is the intersection (a principal must be allowed by both); if only one is enabled
+// its list is used as-is; if neither is enabled the list is irrelevant.
+func mergeAllowlist(aEnabled bool, aIDs []int64, bEnabled bool, bIDs []int64) (bool, []int64) {
+	switch {
+	case aEnabled && bEnabled:
+		return true, intersectInt64(aIDs, bIDs)
+	case aEnabled:
+		return true, aIDs
+	case bEnabled:
+		return true, bIDs
+	default:
+		return false, nil
+	}
+}
+
+// mergeAllowFlag combines two "allow the Actions bot" toggles under most-restrictive
+// semantics, mirroring mergeAllowlist. A toggle only grants access when its Enable flag
+// is set; a disabled allowlist means "everyone", so it imposes no constraint. Therefore:
+// if both allowlists are enabled the bot is allowed only when BOTH sides allow it; if
+// only one is enabled that side's flag governs; if neither is enabled the flag is
+// irrelevant (fall back to the repo/a value).
+func mergeAllowFlag(aEnabled, aFlag, bEnabled, bFlag bool) bool {
+	switch {
+	case aEnabled && bEnabled:
+		return aFlag && bFlag
+	case aEnabled:
+		return aFlag
+	case bEnabled:
+		return bFlag
+	default:
+		return aFlag
+	}
+}
+
+func intersectInt64(a, b []int64) []int64 {
+	if len(a) == 0 || len(b) == 0 {
+		return nil
+	}
+	set := make(map[int64]struct{}, len(a))
+	for _, x := range a {
+		set[x] = struct{}{}
+	}
+	var out []int64
+	for _, x := range b {
+		if _, ok := set[x]; ok {
+			out = append(out, x)
+		}
+	}
+	return out
+}
+
+func unionStrings(a, b []string) []string {
+	if len(a) == 0 {
+		return b
+	}
+	if len(b) == 0 {
+		return a
+	}
+	seen := make(map[string]struct{}, len(a)+len(b))
+	out := make([]string, 0, len(a)+len(b))
+	for _, s := range a {
+		if _, ok := seen[s]; !ok {
+			seen[s] = struct{}{}
+			out = append(out, s)
+		}
+	}
+	for _, s := range b {
+		if _, ok := seen[s]; !ok {
+			seen[s] = struct{}{}
+			out = append(out, s)
+		}
+	}
+	return out
+}
+
+// unionPatterns unions two ';'-separated file-pattern lists (more patterns protected
+// = more restrictive).
+func unionPatterns(a, b string) string {
+	return strings.Join(unionStrings(splitPatterns(a), splitPatterns(b)), ";")
+}
+
+// intersectPatterns intersects two ';'-separated file-pattern lists. Unprotected
+// patterns are carve-outs that REDUCE protection, so the restrictive combination
+// keeps only the exemptions present in both.
+func intersectPatterns(a, b string) string {
+	as, bs := splitPatterns(a), splitPatterns(b)
+	set := make(map[string]struct{}, len(as))
+	for _, s := range as {
+		set[s] = struct{}{}
+	}
+	seen := make(map[string]struct{}, len(bs))
+	var out []string
+	for _, s := range bs {
+		if _, ok := set[s]; !ok {
+			continue
+		}
+		if _, dup := seen[s]; dup {
+			continue
+		}
+		seen[s] = struct{}{}
+		out = append(out, s)
+	}
+	return strings.Join(out, ";")
+}
+
+func splitPatterns(s string) []string {
+	var out []string
+	for _, p := range strings.Split(s, ";") {
+		if p = strings.TrimSpace(p); p != "" {
+			out = append(out, p)
+		}
+	}
+	return out
+}
+
+func maxInt64(a, b int64) int64 {
+	if a > b {
+		return a
+	}
+	return b
+}

models/git/protected_branch_merge_test.go

@@ -0,0 +1,100 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package git
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestMergeAllowFlag(t *testing.T) {
+	cases := []struct {
+		name     string
+		aEnabled bool
+		aFlag    bool
+		bEnabled bool
+		bFlag    bool
+		expected bool
+	}{
+		// Both allowlists enabled: bot allowed only when BOTH allow it.
+		{"both enabled, both allow", true, true, true, true, true},
+		{"both enabled, a denies", true, false, true, true, false},
+		{"both enabled, b denies", true, true, true, false, false},
+		{"both enabled, both deny", true, false, true, false, false},
+		// Only one side enabled: that side governs.
+		{"only a enabled, a allows", true, true, false, false, true},
+		{"only a enabled, a denies", true, false, false, true, false},
+		{"only b enabled, b allows", false, false, true, true, true},
+		{"only b enabled, b denies", false, true, true, false, false},
+		// Neither enabled: flag irrelevant, falls back to a's flag.
+		{"neither enabled, a true", false, true, false, false, true},
+		{"neither enabled, a false", false, false, false, true, false},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			assert.Equal(t, c.expected, mergeAllowFlag(c.aEnabled, c.aFlag, c.bEnabled, c.bFlag))
+		})
+	}
+}
+
+func TestMergeMostRestrictiveUserIDsIntersect(t *testing.T) {
+	repoRule := &ProtectedBranch{
+		EnableWhitelist:  true,
+		WhitelistUserIDs: []int64{1, 2, 3},
+		// Deploy keys are repo-only and must always pass through unchanged.
+		WhitelistDeployKeys:          true,
+		ForcePushAllowlistDeployKeys: true,
+		DeleteAllowlistDeployKeys:    true,
+	}
+	orgRule := &ProtectedBranch{
+		EnableWhitelist:  true,
+		WhitelistUserIDs: []int64{2, 3, 4},
+		// Org rule cannot express deploy keys; these zero values must NOT override repo.
+	}
+
+	eff := mergeMostRestrictive(repoRule, orgRule)
+
+	// User IDs are intersected when both allowlists are enabled.
+	assert.True(t, eff.EnableWhitelist)
+	assert.ElementsMatch(t, []int64{2, 3}, eff.WhitelistUserIDs)
+
+	// Deploy-key allowances still pass through from the repo rule.
+	assert.True(t, eff.WhitelistDeployKeys)
+	assert.True(t, eff.ForcePushAllowlistDeployKeys)
+	assert.True(t, eff.DeleteAllowlistDeployKeys)
+}
+
+func TestMergeMostRestrictiveActionsUserFlags(t *testing.T) {
+	// Both sides enable their allowlist and both allow the bot -> allowed.
+	repoRule := &ProtectedBranch{
+		EnableWhitelist:          true,
+		WhitelistActionsUser:     true,
+		EnableForcePushAllowlist: true,
+		// force-push: org denies -> effective deny.
+		ForcePushAllowlistActionsUser: true,
+		EnableDeleteAllowlist:         true,
+		DeleteAllowlistActionsUser:    true,
+		// merge: repo allowlist disabled, org enabled+denies -> org governs (deny).
+		EnableMergeWhitelist:      false,
+		MergeWhitelistActionsUser: true,
+	}
+	orgRule := &ProtectedBranch{
+		EnableWhitelist:               true,
+		WhitelistActionsUser:          true,
+		EnableForcePushAllowlist:      true,
+		ForcePushAllowlistActionsUser: false,
+		EnableDeleteAllowlist:         true,
+		DeleteAllowlistActionsUser:    true,
+		EnableMergeWhitelist:          true,
+		MergeWhitelistActionsUser:     false,
+	}
+
+	eff := mergeMostRestrictive(repoRule, orgRule)
+
+	assert.True(t, eff.WhitelistActionsUser, "push: both allow")
+	assert.False(t, eff.ForcePushAllowlistActionsUser, "force-push: org denies")
+	assert.True(t, eff.DeleteAllowlistActionsUser, "delete: both allow")
+	assert.False(t, eff.MergeWhitelistActionsUser, "merge: org enabled and denies")
+}

models/issues/pull.go

@@ -10,6 +10,7 @@ import (
 	"fmt"
 	"io"
 	"strings"
+	"time"
 
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/db"
 	git_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/git"
@@ -860,6 +861,11 @@ func GetCodeOwnersFromContent(ctx context.Context, data string) ([]*CodeOwnerRul
 	return rules, warnings
 }
 
+// codeOwnerMatchTimeout bounds a single pattern match so a crafted pattern
+// cannot stall via catastrophic backtracking. See also the aggregate budget
+// enforced by the caller across the whole rules×files match loop.
+const codeOwnerMatchTimeout = 150 * time.Millisecond
+
 type CodeOwnerRule struct {
 	Rule     *regexp2.Regexp // it supports negative lookahead, does better for end users
 	Negative bool
@@ -888,6 +894,8 @@ func ParseCodeOwnersLine(ctx context.Context, tokens []string) (*CodeOwnerRule,
 		warnings = append(warnings, fmt.Sprintf("incorrect codeowner regexp: %s", err))
 		return nil, warnings
 	}
+	// Bound matching time so user-supplied patterns cannot stall PR creation via catastrophic backtracking.
+	rule.Rule.MatchTimeout = codeOwnerMatchTimeout
 
 	for _, user := range tokens[1:] {
 		user = strings.TrimPrefix(user, "@")

models/issues/pull_test.go

@@ -4,7 +4,9 @@
 package issues_test
 
 import (
+	"strings"
 	"testing"
+	"time"
 
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/db"
 	issues_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/issues"
@@ -39,6 +41,7 @@ func TestPullRequest(t *testing.T) {
 	t.Run("DeleteOrphanedObjects", testDeleteOrphanedObjects)
 	t.Run("ParseCodeOwnersLine", testParseCodeOwnersLine)
 	t.Run("CodeOwnerAbsolutePathPatterns", testCodeOwnerAbsolutePathPatterns)
+	t.Run("CodeOwnerPatternMatchTimeout", testCodeOwnerPatternMatchTimeout)
 	t.Run("GetApprovers", testGetApprovers)
 	t.Run("GetPullRequestByMergedCommit", testGetPullRequestByMergedCommit)
 	t.Run("Migrate_InsertPullRequests", testMigrateInsertPullRequests)
@@ -370,6 +373,22 @@ func testCodeOwnerAbsolutePathPatterns(t *testing.T) {
 	}
 }
 
+// testCodeOwnerPatternMatchTimeout ensures user-supplied CODEOWNERS patterns
+// cannot stall pull request processing through catastrophic regex backtracking:
+// each compiled rule must enforce a bounded match time.
+func testCodeOwnerPatternMatchTimeout(t *testing.T) {
+	rules, _ := issues_model.GetCodeOwnersFromContent(t.Context(), "(a+)+ @user5\n")
+	require.Len(t, rules, 1)
+
+	maliciousInput := strings.Repeat("a", 30) + "X"
+	start := time.Now()
+	_, err := rules[0].Rule.MatchString(maliciousInput)
+	elapsed := time.Since(start)
+
+	require.Error(t, err, "expected MatchTimeout error on pathological input")
+	assert.Less(t, elapsed, time.Second, "match timeout did not bound regex evaluation; took %s", elapsed)
+}
+
 func testGetApprovers(t *testing.T) {
 	pr := unittest.AssertExistsAndLoadBean(t, &issues_model.PullRequest{ID: 5})
 	// Official reviews are already deduplicated. Allow unofficial reviews

models/migrations/migrations.go

@@ -439,6 +439,13 @@ func prepareMigrationTasks() []*migration {
 		newMigration(359, "Add deploy fields to repo manifest", v1_27.AddDeployFieldsToRepoManifest),
 		newMigration(360, "Add delete allowlist to protected branch", v1_27.AddDeleteAllowlistToProtectedBranch),
 		newMigration(361, "Add cascade merge rule table", v1_27.AddCascadeMergeRuleTable),
+		newMigration(362, "Add delete allowlist to org protected branch", v1_27.AddDeleteAllowlistToOrgProtectedBranch),
+		newMigration(363, "Add org protected tag table", v1_27.AddOrgProtectedTagTable),
+		newMigration(364, "Add org push policy table", v1_27.AddOrgPushPolicyTable),
+		newMigration(365, "Add org repo defaults table", v1_27.AddOrgRepoDefaultsTable),
+		newMigration(366, "Add org email domain policy table", v1_27.AddOrgEmailDomainPolicyTable),
+		newMigration(367, "Add user allowlists to org protected branch", v1_27.AddUserAllowlistsToOrgProtectedBranch),
+		newMigration(368, "Drop org from repo manifest (derived from org profile)", v1_27.DropOrgFromRepoManifest),
 	}
 	return preparedMigrations
 }

models/migrations/v1_27/v347.go

@@ -8,7 +8,7 @@ import (
 )
 
 // AddRepoManifestTable creates the repo_manifest table for storing
-// mokoplatform manifest settings per repository.
+// mokocli manifest settings per repository.
 func AddRepoManifestTable(x *xorm.Engine) error {
 	type RepoManifest struct {
 		ID               int64  `xorm:"pk autoincr"`

models/migrations/v1_27/v363.go

@@ -0,0 +1,18 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package v1_27
+
+import "xorm.io/xorm"
+
+// AddDeleteAllowlistToOrgProtectedBranch adds branch-deletion protection columns to
+// org-level branch protection rules, mirroring the per-repo delete allowlist so an
+// org rule can also protect branches from deletion. See issue #727.
+func AddDeleteAllowlistToOrgProtectedBranch(x *xorm.Engine) error {
+	type OrgProtectedBranch struct {
+		CanDelete              bool    `xorm:"NOT NULL DEFAULT false"`
+		EnableDeleteAllowlist  bool    `xorm:"NOT NULL DEFAULT false"`
+		DeleteAllowlistTeamIDs []int64 `xorm:"JSON TEXT"`
+	}
+	return x.Sync(new(OrgProtectedBranch))
+}

models/migrations/v1_27/v364.go

@@ -0,0 +1,25 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package v1_27
+
+import (
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/timeutil"
+
+	"xorm.io/xorm"
+)
+
+// AddOrgProtectedTagTable creates the org-level tag protection table. Org tag rules
+// cascade to all repositories in the organization and layer on top of each repo's
+// own protected tags. See issue #727.
+func AddOrgProtectedTagTable(x *xorm.Engine) error {
+	type OrgProtectedTag struct {
+		ID               int64              `xorm:"pk autoincr"`
+		OrgID            int64              `xorm:"UNIQUE(s) index"`
+		NamePattern      string             `xorm:"UNIQUE(s)"`
+		AllowlistTeamIDs []int64            `xorm:"JSON TEXT"`
+		CreatedUnix      timeutil.TimeStamp `xorm:"created"`
+		UpdatedUnix      timeutil.TimeStamp `xorm:"updated"`
+	}
+	return x.Sync(new(OrgProtectedTag))
+}

models/migrations/v1_27/v365.go

@@ -0,0 +1,27 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package v1_27
+
+import (
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/timeutil"
+
+	"xorm.io/xorm"
+)
+
+// AddOrgPushPolicyTable creates the org-level push policy table (one row per org),
+// enforced in the pre-receive hook across all repositories of the org. See #727.
+func AddOrgPushPolicyTable(x *xorm.Engine) error {
+	type OrgPushPolicy struct {
+		ID                  int64              `xorm:"pk autoincr"`
+		OrgID               int64              `xorm:"UNIQUE NOT NULL"`
+		BranchNamePattern   string             `xorm:"TEXT"`
+		TagNamePattern      string             `xorm:"TEXT"`
+		RequireSecretBlock  bool               `xorm:"NOT NULL DEFAULT false"`
+		MaxFileSize         int64              `xorm:"NOT NULL DEFAULT 0"`
+		BlockedFilePatterns string             `xorm:"TEXT"`
+		CreatedUnix         timeutil.TimeStamp `xorm:"created"`
+		UpdatedUnix         timeutil.TimeStamp `xorm:"updated"`
+	}
+	return x.Sync(new(OrgPushPolicy))
+}

models/migrations/v1_27/v366.go

@@ -0,0 +1,31 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package v1_27
+
+import (
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/timeutil"
+
+	"xorm.io/xorm"
+)
+
+// AddOrgRepoDefaultsTable creates the org repository-defaults table (one row per
+// org), applied to repositories created in or transferred into the org. See #727.
+func AddOrgRepoDefaultsTable(x *xorm.Engine) error {
+	type OrgRepoDefaults struct {
+		ID                     int64              `xorm:"pk autoincr"`
+		OrgID                  int64              `xorm:"UNIQUE NOT NULL"`
+		ForcePrivate           bool               `xorm:"NOT NULL DEFAULT false"`
+		ApplyPRDefaults        bool               `xorm:"NOT NULL DEFAULT false"`
+		AllowMerge             bool               `xorm:"NOT NULL DEFAULT true"`
+		AllowRebase            bool               `xorm:"NOT NULL DEFAULT true"`
+		AllowRebaseMerge       bool               `xorm:"NOT NULL DEFAULT true"`
+		AllowSquash            bool               `xorm:"NOT NULL DEFAULT true"`
+		AllowFastForwardOnly   bool               `xorm:"NOT NULL DEFAULT true"`
+		DefaultMergeStyle      string             `xorm:"TEXT"`
+		DeleteBranchAfterMerge bool               `xorm:"NOT NULL DEFAULT false"`
+		CreatedUnix            timeutil.TimeStamp `xorm:"created"`
+		UpdatedUnix            timeutil.TimeStamp `xorm:"updated"`
+	}
+	return x.Sync(new(OrgRepoDefaults))
+}

models/migrations/v1_27/v367.go

@@ -0,0 +1,23 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package v1_27
+
+import (
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/timeutil"
+
+	"xorm.io/xorm"
+)
+
+// AddOrgEmailDomainPolicyTable creates the org email-domain policy table (one row
+// per org) restricting the email domains of members added to the org. See #727.
+func AddOrgEmailDomainPolicyTable(x *xorm.Engine) error {
+	type OrgEmailDomainPolicy struct {
+		ID             int64              `xorm:"pk autoincr"`
+		OrgID          int64              `xorm:"UNIQUE NOT NULL"`
+		AllowedDomains string             `xorm:"TEXT"`
+		CreatedUnix    timeutil.TimeStamp `xorm:"created"`
+		UpdatedUnix    timeutil.TimeStamp `xorm:"updated"`
+	}
+	return x.Sync(new(OrgEmailDomainPolicy))
+}

models/migrations/v1_27/v368.go

@@ -0,0 +1,26 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package v1_27
+
+import "xorm.io/xorm"
+
+// AddUserAllowlistsToOrgProtectedBranch adds per-user allowlist columns (username or
+// email resolved to user IDs) plus the "allow Actions bot" toggles to org-level branch
+// protection rules for the push, merge, force-push and delete categories, mirroring the
+// per-repo user allowlists so an org rule can also grant access to individual users and
+// the Actions bot. See issue #727.
+func AddUserAllowlistsToOrgProtectedBranch(x *xorm.Engine) error {
+	type OrgProtectedBranch struct {
+		WhitelistUserIDs              []int64 `xorm:"JSON TEXT"`
+		WhitelistActionsUser          bool    `xorm:"NOT NULL DEFAULT false"`
+		MergeWhitelistUserIDs         []int64 `xorm:"JSON TEXT"`
+		MergeWhitelistActionsUser     bool    `xorm:"NOT NULL DEFAULT false"`
+		ForcePushAllowlistUserIDs     []int64 `xorm:"JSON TEXT"`
+		ForcePushAllowlistActionsUser bool    `xorm:"NOT NULL DEFAULT false"`
+		DeleteAllowlistUserIDs        []int64 `xorm:"JSON TEXT"`
+		DeleteAllowlistActionsUser    bool    `xorm:"NOT NULL DEFAULT false"`
+		ApprovalsWhitelistUserIDs     []int64 `xorm:"JSON TEXT"`
+	}
+	return x.Sync(new(OrgProtectedBranch))
+}

models/migrations/v1_27/v369.go

@@ -0,0 +1,19 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package v1_27
+
+import (
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/migrations/base"
+
+	"xorm.io/xorm"
+)
+
+// DropOrgFromRepoManifest removes the org column from repo_manifest. The
+// organization is now derived from the org profile (repository owner) on read
+// rather than stored, so it never drifts on rename. See issue #771.
+func DropOrgFromRepoManifest(x *xorm.Engine) error {
+	sess := x.NewSession()
+	defer sess.Close()
+	return base.DropTableColumns(sess, "repo_manifest", "org")
+}

models/repo/repo.go

@@ -486,6 +486,23 @@ func (repo *Repository) LoadOwner(ctx context.Context) (err error) {
 	return err
 }
 
+// DerivedOrgName returns the organization name derived from the org profile
+// (the repository owner). It prefers the owner's display name (FullName) and
+// falls back to the owner handle (Name / OwnerName). The organization is always
+// derived from the profile rather than stored, so it never drifts on rename.
+func (repo *Repository) DerivedOrgName(ctx context.Context) string {
+	if err := repo.LoadOwner(ctx); err != nil || repo.Owner == nil {
+		return repo.OwnerName
+	}
+	if repo.Owner.FullName != "" {
+		return repo.Owner.FullName
+	}
+	if repo.Owner.Name != "" {
+		return repo.Owner.Name
+	}
+	return repo.OwnerName
+}
+
 // MustOwner always returns a valid *user_model.User object to avoid
 // conceptually impossible error handling.
 // It creates a fake object that contains error details

models/repo/repo_manifest.go

@@ -15,50 +15,52 @@ func init() {
 	db.RegisterModel(new(RepoMetadata))
 }
 
-// RepoMetadata stores mokoplatform metadata settings for a repository.
-// These fields correspond to the .mokogitea/manifest.xml schema and are
-// exposed via API for use by Actions workflows and the mokoplatform CLI.
+// RepoMetadata stores mokocli metadata settings for a repository.
+// These first-class fields are the authoritative repository metadata,
+// exposed via API for use by Actions workflows and mokocli.
 type RepoMetadata struct {
-	ID        int64              `xorm:"pk autoincr"`
-	RepoID    int64              `xorm:"UNIQUE INDEX NOT NULL 'repo_id'"`
+	ID     int64 `xorm:"pk autoincr"`
+	RepoID int64 `xorm:"UNIQUE INDEX NOT NULL 'repo_id'"`
 
 	// identity section
-	Name        string `xorm:"TEXT 'name'"`         // project name
-	Org         string `xorm:"TEXT 'org'"`           // organization name
-	Description string `xorm:"TEXT 'description'"`   // project description
+	// NOTE: organization is intentionally NOT stored here. It is derived from
+	// the org profile (repository owner) on read via Repository.DerivedOrgName,
+	// so it can never drift from the owner on rename. See issue #771.
+	Name        string `xorm:"TEXT 'name'"`                // project name
+	Description string `xorm:"TEXT 'description'"`         // project description
 	LicenseSPDX string `xorm:"VARCHAR(50) 'license_spdx'"` // SPDX identifier, e.g. "GPL-3.0-or-later"
-	LicenseName string `xorm:"TEXT 'license_name'"`  // human-readable license name
+	LicenseName string `xorm:"TEXT 'license_name'"`        // human-readable license name
 
 	// governance section
 	Platform         string `xorm:"VARCHAR(50) 'platform'"`          // go, php, node, python, etc.
-	StandardsVersion string `xorm:"VARCHAR(20) 'standards_version'"` // mokoplatform standards version
-	StandardsSource  string `xorm:"TEXT 'standards_source'"`          // URL to standards repo
+	StandardsVersion string `xorm:"VARCHAR(20) 'standards_version'"` // mokocli standards version
+	StandardsSource  string `xorm:"TEXT 'standards_source'"`         // URL to standards repo
 
 	// versioning
-	VersionPrefix string `xorm:"TEXT 'version_prefix'"`  // tag prefix stripped for version display, e.g. "v1.26.1-moko."
-	ElementName   string `xorm:"TEXT 'element_name'"`    // full element name override, e.g. "pkg_mokowaas" (auto-constructed if empty)
+	VersionPrefix string `xorm:"TEXT 'version_prefix'"` // tag prefix stripped for version display, e.g. "v1.26.1-moko."
+	ElementName   string `xorm:"TEXT 'element_name'"`   // full element name override, e.g. "pkg_mokowaas" (auto-constructed if empty)
 
 	// distribution metadata (used by update server feed generation)
-	Maintainer    string `xorm:"TEXT 'maintainer'"`      // maintainer/author name
-	MaintainerURL string `xorm:"TEXT 'maintainer_url'"`  // maintainer website
-	InfoURL       string `xorm:"TEXT 'info_url'"`        // extension info/product page URL
-	TargetVersion string `xorm:"TEXT 'target_version'"`  // target platform version regex, e.g. "(5|6)\..*"
+	Maintainer    string `xorm:"TEXT 'maintainer'"`         // maintainer/author name
+	MaintainerURL string `xorm:"TEXT 'maintainer_url'"`     // maintainer website
+	InfoURL       string `xorm:"TEXT 'info_url'"`           // extension info/product page URL
+	TargetVersion string `xorm:"TEXT 'target_version'"`     // target platform version regex, e.g. "(5|6)\..*"
 	PHPMinimum    string `xorm:"VARCHAR(20) 'php_minimum'"` // minimum PHP version, e.g. "8.1"
 
 	// build section
-	Language    string `xorm:"VARCHAR(50) 'language'"`     // Go, PHP, TypeScript, etc.
+	Language      string `xorm:"VARCHAR(50) 'language'"`       // Go, PHP, TypeScript, etc.
 	ExtensionType string `xorm:"VARCHAR(50) 'extension_type'"` // component, module, plugin, package, template, library, file
-	EntryPoint  string `xorm:"TEXT 'entry_point'"`          // build entry point path
+	EntryPoint    string `xorm:"TEXT 'entry_point'"`           // build entry point path
 
 	// deploy section
 	DeployHost     string `xorm:"VARCHAR(255) 'deploy_host'"`     // SSH host for deploy
 	DeployPort     string `xorm:"VARCHAR(10) 'deploy_port'"`      // SSH port (default 2918)
 	DeployUser     string `xorm:"VARCHAR(100) 'deploy_user'"`     // SSH user
-	DeployPath     string `xorm:"TEXT 'deploy_path'"`              // remote path for source/compose
+	DeployPath     string `xorm:"TEXT 'deploy_path'"`             // remote path for source/compose
 	DockerImage    string `xorm:"VARCHAR(255) 'docker_image'"`    // e.g. mokoconsulting/mokogitea
 	DockerRegistry string `xorm:"VARCHAR(255) 'docker_registry'"` // e.g. git.mokoconsulting.tech
 	ContainerName  string `xorm:"VARCHAR(100) 'container_name'"`  // Docker container name
-	HealthURL      string `xorm:"TEXT 'health_url'"`               // health check URL after deploy
+	HealthURL      string `xorm:"TEXT 'health_url'"`              // health check URL after deploy
 
 	CreatedUnix timeutil.TimeStamp `xorm:"INDEX CREATED 'created_unix'"`
 	UpdatedUnix timeutil.TimeStamp `xorm:"UPDATED 'updated_unix'"`

models/unittest/unit_tests.go

@@ -47,7 +47,7 @@ func OrderBy(orderBy string) any {
 }
 
 func whereOrderConditions(e db.Engine, conditions []any) db.Engine {
-	orderBy := "id" // query must have the "ORDER BY", otherwise the result is not deterministic
+	orderBy := "id" // query must have the "ORDER BY", otherwise the result is not deterministic. FIXME: some tables do not have "id" column
 	for _, condition := range conditions {
 		switch cond := condition.(type) {
 		case *testCond:

models/user/external_login_user.go

@@ -80,8 +80,11 @@ func init() {
 }
 
 // GetExternalLogin checks if a externalID in loginSourceID scope already exists
-func GetExternalLogin(ctx context.Context, externalLoginUser *ExternalLoginUser) (bool, error) {
-	return db.GetEngine(ctx).Get(externalLoginUser)
+func GetExternalLogin(ctx context.Context, loginSourceID int64, externalID string) (*ExternalLoginUser, bool, error) {
+	return db.Get[ExternalLoginUser](ctx, builder.Eq{
+		"external_id":     externalID,
+		"login_source_id": loginSourceID,
+	})
 }
 
 // LinkExternalToUser link the external user to the user
@@ -118,6 +121,12 @@ func RemoveAllAccountLinks(ctx context.Context, user *User) error {
 	return err
 }
 
+// RemoveExternalLoginByExternalID removes a specific external login link by its provider-side identifier.
+func RemoveExternalLoginByExternalID(ctx context.Context, loginSourceID int64, externalID string) error {
+	_, err := db.GetEngine(ctx).Where("external_id=? AND login_source_id=?", externalID, loginSourceID).Delete(new(ExternalLoginUser))
+	return err
+}
+
 // GetUserIDByExternalUserID get user id according to provider and userID
 func GetUserIDByExternalUserID(ctx context.Context, provider, userID string) (int64, error) {
 	var id int64

modules/git/commit_info_nogogit.go

@@ -106,7 +106,7 @@ func getLastCommitForPathsByCache(commitID, treePath string, paths []string, cac
 // GetLastCommitForPaths returns last commit information
 func GetLastCommitForPaths(ctx context.Context, commit *Commit, treePath string, paths []string) (map[string]*Commit, error) {
 	// We read backwards from the commit to obtain all of the commits
-	revs, err := WalkGitLog(ctx, commit.repo, commit, treePath, paths...)
+	revs, err := walkGitLog(ctx, commit.repo, commit, treePath, paths...)
 	if err != nil {
 		return nil, err
 	}

modules/git/commit_info_nogogit_test.go

@@ -0,0 +1,54 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+//go:build !gogit
+
+package git
+
+import (
+	"context"
+	"path/filepath"
+	"testing"
+
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/test"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/util"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestEntries_GetCommitsInfo_ContextErr(t *testing.T) {
+	repo, err := OpenRepository(t.Context(), filepath.Join(testReposDir, "repo1_bare"))
+	require.NoError(t, err)
+	defer repo.Close()
+
+	commit, err := repo.GetCommit("feaf4ba6bc635fec442f46ddd4512416ec43c2c2")
+	require.NoError(t, err)
+	entries, err := commit.Tree.ListEntries()
+	require.NoError(t, err)
+
+	countCommitInfosCommit := func(infos []CommitInfo) (nilCommits, nonNilCommits int) {
+		for _, info := range infos {
+			nilCommits += util.Iif(info.Commit == nil, 1, 0)
+			nonNilCommits += util.Iif(info.Commit != nil, 1, 0)
+		}
+		return nilCommits, nonNilCommits
+	}
+
+	ctx, cancel := context.WithCancel(t.Context())
+	defer test.MockVariableValue(&walkGitLogDebugBeforeNext)()
+
+	walkGitLogDebugBeforeNext = cancel
+	commitInfos, _, err := entries.GetCommitsInfo(ctx, "/any/repo-link", commit, "")
+	assert.NoError(t, err)
+	nilCommits, nonNilCommits := countCommitInfosCommit(commitInfos)
+	assert.Equal(t, 0, nonNilCommits) // no commit info due to canceled (or deadline-exceeded) context
+	assert.Equal(t, 3, nilCommits)
+
+	walkGitLogDebugBeforeNext = nil
+	commitInfos, _, err = entries.GetCommitsInfo(t.Context(), "/any/repo-link", commit, "")
+	assert.NoError(t, err)
+	nilCommits, nonNilCommits = countCommitInfosCommit(commitInfos)
+	assert.Equal(t, 3, nonNilCommits)
+	assert.Equal(t, 0, nilCommits)
+}

modules/git/last_commit_cache_nogogit.go

@@ -32,7 +32,7 @@ func (c *Commit) recursiveCache(ctx context.Context, tree *Tree, treePath string
 		entryPaths[i] = entry.Name()
 	}
 
-	_, err = WalkGitLog(ctx, c.repo, c, treePath, entryPaths...)
+	_, err = walkGitLog(ctx, c.repo, c, treePath, entryPaths...)
 	if err != nil {
 		return err
 	}

modules/git/log_name_status_nogogit.go

@@ -1,6 +1,8 @@
 // Copyright 2021 The Gitea Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
+//go:build !gogit
+
 package git
 
 import (
@@ -18,10 +20,8 @@ import (
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/log"
 )
 
-// LogNameStatusRepo opens git log --raw in the provided repo and returns a stdin pipe, a stdout reader and cancel function
-func LogNameStatusRepo(ctx context.Context, repository, head, treepath string, paths ...string) (*bufio.Reader, func()) {
-	// Lets also create a context so that we can absolutely ensure that the command should die when we're done
-
+// logNameStatusRepo opens git log --raw in the provided repo and returns a parser
+func logNameStatusRepo(ctx context.Context, repository, head, treepath string, paths ...string) *logNameStatusRepoParser {
 	cmd := gitcmd.NewCommand()
 	cmd.AddArguments("log", "--name-status", "-c", "--format=commit%x00%H %P%x00", "--parents", "--no-renames", "-t", "-z").AddDynamicArguments(head)
 
@@ -54,77 +54,62 @@ func LogNameStatusRepo(ctx context.Context, repository, head, treepath string, p
 	ctx, ctxCancel := context.WithCancel(ctx)
 	go func() {
 		err := cmd.WithDir(repository).RunWithStderr(ctx)
-		if err != nil && !errors.Is(err, context.Canceled) {
+		if err != nil && !errors.Is(err, context.Canceled) && !errors.Is(err, context.DeadlineExceeded) {
 			log.Error("Unable to run git command %v: %v", cmd.LogString(), err)
 		}
 	}()
 
 	bufReader := bufio.NewReaderSize(stdoutReader, 32*1024)
-
-	return bufReader, func() {
-		ctxCancel()
-		stdoutReaderClose()
+	return &logNameStatusRepoParser{
+		treepath: treepath,
+		paths:    paths,
+		rd:       bufReader,
+		close: func() {
+			ctxCancel()
+			stdoutReaderClose()
+		},
 	}
 }
 
-// LogNameStatusRepoParser parses a git log raw output from LogRawRepo
-type LogNameStatusRepoParser struct {
+// logNameStatusRepoParser parses a git log raw output from LogRawRepo
+type logNameStatusRepoParser struct {
 	treepath string
 	paths    []string
 	next     []byte
 	buffull  bool
 	rd       *bufio.Reader
-	cancel   func()
+	close    func()
 }
 
-// NewLogNameStatusRepoParser returns a new parser for a git log raw output
-func NewLogNameStatusRepoParser(ctx context.Context, repository, head, treepath string, paths ...string) *LogNameStatusRepoParser {
-	rd, cancel := LogNameStatusRepo(ctx, repository, head, treepath, paths...)
-	return &LogNameStatusRepoParser{
-		treepath: treepath,
-		paths:    paths,
-		rd:       rd,
-		cancel:   cancel,
-	}
-}
-
-// LogNameStatusCommitData represents a commit artefact from git log raw
-type LogNameStatusCommitData struct {
+// logNameStatusCommitData represents a commit artifact from git log raw
+type logNameStatusCommitData struct {
 	CommitID  string
 	ParentIDs []string
 	Paths     []bool
 }
 
-// Next returns the next LogStatusCommitData
-func (g *LogNameStatusRepoParser) Next(treepath string, paths2ids map[string]int, changed []bool, maxpathlen int) (*LogNameStatusCommitData, error) {
+// walkNext returns the next LogStatusCommitData
+func (g *logNameStatusRepoParser) walkNext(treepath string, paths2ids map[string]int, changed []bool, maxpathlen int) (*logNameStatusCommitData, error) {
 	var err error
 	if len(g.next) == 0 {
 		g.buffull = false
 		g.next, err = g.rd.ReadSlice('\x00')
-		if err != nil {
-			switch err {
-			case bufio.ErrBufferFull:
-				g.buffull = true
-			case io.EOF:
-				return nil, nil //nolint:nilnil // return nil to signal EOF
-			default:
-				return nil, err
-			}
+		switch {
+		case errors.Is(err, bufio.ErrBufferFull):
+			g.buffull = true
+		case err != nil:
+			return nil, err
 		}
 	}
 
-	ret := LogNameStatusCommitData{}
+	ret := logNameStatusCommitData{}
 	if bytes.Equal(g.next, []byte("commit\000")) {
 		g.next, err = g.rd.ReadSlice('\x00')
-		if err != nil {
-			switch err {
-			case bufio.ErrBufferFull:
-				g.buffull = true
-			case io.EOF:
-				return nil, nil //nolint:nilnil // return nil to signal EOF
-			default:
-				return nil, err
-			}
+		switch {
+		case errors.Is(err, bufio.ErrBufferFull):
+			g.buffull = true
+		case err != nil:
+			return nil, err
 		}
 	}
 
@@ -273,13 +258,10 @@ diffloop:
 	}
 }
 
-// Close closes the parser
-func (g *LogNameStatusRepoParser) Close() {
-	g.cancel()
-}
+var walkGitLogDebugBeforeNext func() // is used to simulate various edge git process cases
 
-// WalkGitLog walks the git log --name-status for the head commit in the provided treepath and files
-func WalkGitLog(ctx context.Context, repo *Repository, head *Commit, treepath string, paths ...string) (map[string]string, error) {
+// walkGitLog walks the git log --name-status for the head commit in the provided treepath and files
+func walkGitLog(ctx context.Context, repo *Repository, head *Commit, treepath string, paths ...string) (map[string]string, error) {
 	headRef := head.ID.String()
 
 	tree, err := head.SubTree(treepath)
@@ -322,11 +304,9 @@ func WalkGitLog(ctx context.Context, repo *Repository, head *Commit, treepath st
 		}
 	}
 
-	g := NewLogNameStatusRepoParser(ctx, repo.Path, head.ID.String(), treepath, paths...)
-	// don't use defer g.Close() here as g may change its value - instead wrap in a func
-	defer func() {
-		g.Close()
-	}()
+	g := logNameStatusRepo(ctx, repo.Path, head.ID.String(), treepath, paths...)
+	// don't use defer g.cancel() here as g may change its value - instead wrap in a func
+	defer func() { g.close() }()
 
 	results := make([]string, len(paths))
 	remaining := len(paths)
@@ -340,25 +320,16 @@ func WalkGitLog(ctx context.Context, repo *Repository, head *Commit, treepath st
 
 heaploop:
 	for {
-		select {
-		case <-ctx.Done():
-			if ctx.Err() == context.DeadlineExceeded {
-				break heaploop
-			}
-			g.Close()
-			return nil, ctx.Err()
-		default:
+		if walkGitLogDebugBeforeNext != nil {
+			walkGitLogDebugBeforeNext()
 		}
-		current, err := g.Next(treepath, path2idx, changed, maxpathlen)
-		if err != nil {
-			if errors.Is(err, context.DeadlineExceeded) {
-				break heaploop
-			}
-			g.Close()
-			return nil, err
-		}
-		if current == nil {
-			break heaploop
+		current, err := g.walkNext(treepath, path2idx, changed, maxpathlen)
+		if ctx.Err() != nil {
+			break heaploop // context is either canceled or deadline exceeded - break the loop and return what we have so far
+		} else if errors.Is(err, io.EOF) {
+			break heaploop // reached to the end of log output
+		} else if err != nil {
+			return nil, err // other unknown errors
 		}
 		parentRemaining.Remove(current.CommitID)
 		for i, found := range current.Paths {
@@ -395,14 +366,14 @@ heaploop:
 		if remaining <= nextRestart {
 			commitSinceNextRestart++
 			if 4*commitSinceNextRestart > 3*commitSinceLastEmptyParent {
-				g.Close()
 				remainingPaths := make([]string, 0, len(paths))
 				for i, pth := range paths {
 					if results[i] == "" {
 						remainingPaths = append(remainingPaths, pth)
 					}
 				}
-				g = NewLogNameStatusRepoParser(ctx, repo.Path, lastEmptyParent, treepath, remainingPaths...)
+				g.close()
+				g = logNameStatusRepo(ctx, repo.Path, lastEmptyParent, treepath, remainingPaths...)
 				parentRemaining = make(container.Set[string])
 				nextRestart = (remaining * 3) / 4
 				continue heaploop
@@ -410,7 +381,6 @@ heaploop:
 		}
 		parentRemaining.AddMultiple(current.ParentIDs...)
 	}
-	g.Close()
 
 	resultsMap := map[string]string{}
 	for i, pth := range paths {

modules/git/repo.go

@@ -121,6 +121,9 @@ func Clone(ctx context.Context, from, to string, opts CloneRepoOptions) error {
 	}
 
 	cmd := gitcmd.NewCommand().AddArguments("clone")
+	// Never follow HTTP redirects: no clone caller needs them, and a remote redirecting to an
+	// otherwise-blocked address would be an SSRF vector (e.g. migrating from an attacker URL).
+	cmd.AddArguments("-c", "http.followRedirects=false")
 	if opts.SkipTLSVerify {
 		cmd.AddArguments("-c", "http.sslVerify=false")
 	}

modules/git/repo_test.go

@@ -4,7 +4,10 @@
 package git
 
 import (
+	"net/http"
+	"net/http/httptest"
 	"path/filepath"
+	"sync/atomic"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -19,3 +22,23 @@ func TestRepoIsEmpty(t *testing.T) {
 	assert.NoError(t, err)
 	assert.True(t, isEmpty)
 }
+
+// TestCloneRefusesRedirects ensures Clone never follows HTTP redirects, so a remote
+// cannot redirect to an otherwise-blocked address (SSRF, e.g. during migration).
+func TestCloneRefusesRedirects(t *testing.T) {
+	var targetHit atomic.Bool
+	target := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		targetHit.Store(true)
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer target.Close()
+
+	redirect := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Redirect(w, r, target.URL+r.URL.Path, http.StatusFound)
+	}))
+	defer redirect.Close()
+
+	err := Clone(t.Context(), redirect.URL, filepath.Join(t.TempDir(), "dst"), CloneRepoOptions{})
+	assert.Error(t, err)
+	assert.False(t, targetHit.Load(), "git must not follow the redirect to the target")
+}

modules/hostmatcher/hostmatcher.go

@@ -8,6 +8,7 @@ import (
 	"path/filepath"
 	"slices"
 	"strings"
+	"sync"
 )
 
 // HostMatchList is used to check if a host or IP is in a list.
@@ -23,10 +24,61 @@ type HostMatchList struct {
 	ipNets []*net.IPNet
 }
 
-// MatchBuiltinExternal A valid non-private unicast IP, all hosts on public internet are matched
+// MatchBuiltinExternal A valid global-unicast IP that is neither private (see MatchBuiltinPrivate)
+// nor a reserved special-purpose range (see reservedIPNets); i.e. a routable host on the public internet.
 const MatchBuiltinExternal = "external"
 
-// MatchBuiltinPrivate RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and RFC 4193 (FC00::/7). Also called LAN/Intranet.
+// reservedIPNets are special-purpose ranges that net.IP.IsPrivate omits but that must not be
+// treated as public/external destinations (CGNAT, cloud metadata, IPv6 transition, etc.). We layer
+// these on top of net.IP.IsPrivate (RFC 1918 / RFC 4193) so future additions to Go's IsPrivate are
+// picked up automatically, while still covering the ranges it leaves out; otherwise the default
+// allow-list would let authenticated users reach cloud metadata, internal, and IPv6 transition
+// endpoints (SSRF), and a "private" block-list would fail to catch them.
+var reservedIPNets = sync.OnceValue(func() []*net.IPNet {
+	var nets []*net.IPNet
+	for _, cidr := range []string{
+		// IPv4
+		"100.64.0.0/10",    // RFC 6598 Carrier-Grade NAT
+		"168.63.129.16/32", // Azure WireServer metadata endpoint
+		"192.0.0.0/24",     // RFC 6890 IETF protocol assignments
+		"192.0.2.0/24",     // RFC 5737 TEST-NET-1
+		"192.88.99.0/24",   // RFC 7526 6to4 relay anycast (deprecated)
+		"198.18.0.0/15",    // RFC 2544 benchmarking
+		"198.51.100.0/24",  // RFC 5737 TEST-NET-2
+		"203.0.113.0/24",   // RFC 5737 TEST-NET-3
+		// IPv6
+		"100::/64",       // RFC 6666 discard-only
+		"64:ff9b::/96",   // RFC 6052 NAT64 (can embed IPv4 such as 169.254.169.254)
+		"64:ff9b:1::/48", // RFC 8215 local-use NAT64
+		"2001::/32",      // RFC 4380 Teredo tunneling (embeds IPv4)
+		"2001:10::/28",   // RFC 4843 ORCHID (deprecated)
+		"2001:20::/28",   // RFC 7343 ORCHIDv2
+		"2001:db8::/32",  // RFC 3849 documentation
+		"2002::/16",      // RFC 3056 6to4 (embeds IPv4)
+	} {
+		_, ipNet, err := net.ParseCIDR(cidr)
+		if err != nil {
+			panic("hostmatcher: invalid reserved CIDR " + cidr + ": " + err.Error())
+		}
+		nets = append(nets, ipNet)
+	}
+	return nets
+})
+
+// isReservedIP reports whether ip falls in reserved special-purpose
+// range (see reservedIPNets) that must not be considered a public/external destination.
+func isReservedIP(ip net.IP) bool {
+	for _, ipNet := range reservedIPNets() {
+		if ipNet.Contains(ip) {
+			return true
+		}
+	}
+	return false
+}
+
+// MatchBuiltinPrivate RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and RFC 4193 (FC00::/7),
+// plus the reserved special-purpose ranges in reservedIPNets (CGNAT, NAT64, cloud metadata, etc.).
+// Also called LAN/Intranet.
 const MatchBuiltinPrivate = "private"
 
 // MatchBuiltinLoopback 127.0.0.0/8 for IPv4 and ::1/128 for IPv6, localhost is included.
@@ -93,18 +145,22 @@ func (hl *HostMatchList) checkPattern(host string) bool {
 	return false
 }
 
-func (hl *HostMatchList) checkIP(ip net.IP) bool {
+// matchesIP determines if the given IP matches any of the configured rules
+func (hl *HostMatchList) matchesIP(ip net.IP) bool {
 	if slices.Contains(hl.patterns, "*") {
 		return true
 	}
 	for _, builtin := range hl.builtins {
 		switch builtin {
 		case MatchBuiltinExternal:
-			if ip.IsGlobalUnicast() && !ip.IsPrivate() {
+			// External address must be a global unicast, must not be in reserved range and must not be in private range
+			if ip.IsGlobalUnicast() && !isReservedIP(ip) && !ip.IsPrivate() {
 				return true
 			}
 		case MatchBuiltinPrivate:
-			if ip.IsPrivate() {
+			// Private address must be global unicast, must not be in range we explicitly exclude for security reasons
+			// and must be in private range
+			if ip.IsGlobalUnicast() && !isReservedIP(ip) && ip.IsPrivate() {
 				return true
 			}
 		case MatchBuiltinLoopback:
@@ -135,7 +191,7 @@ func (hl *HostMatchList) MatchHostName(host string) bool {
 		return true
 	}
 	if ip := net.ParseIP(hostname); ip != nil {
-		return hl.checkIP(ip)
+		return hl.matchesIP(ip)
 	}
 	return false
 }
@@ -146,7 +202,7 @@ func (hl *HostMatchList) MatchIPAddr(ip net.IP) bool {
 		return false
 	}
 	host := ip.String() // nil-safe, we will get "<nil>" if ip is nil
-	return hl.checkPattern(host) || hl.checkIP(ip)
+	return hl.checkPattern(host) || hl.matchesIP(ip)
 }
 
 // MatchHostOrIP checks if the host or IP matches an allow/deny(block) list

modules/hostmatcher/hostmatcher_test.go

@@ -159,3 +159,60 @@ func TestHostOrIPMatchesList(t *testing.T) {
 	}
 	test(cases)
 }
+
+// TestReservedRanges ensures special-purpose ranges that net.IP.IsPrivate misses are kept out of the
+// "external" allow-list (the default for webhook delivery and repository migrations) and folded into
+// the "private" block-list, so they cannot be used for SSRF to metadata/internal endpoints.
+func TestReservedRanges(t *testing.T) {
+	external := ParseHostMatchList("", "external")
+	private := ParseHostMatchList("", "private")
+
+	// legitimate public destinations: external, not private
+	for _, ip := range []string{"8.8.8.8", "1.1.1.1", "2001:4860:4860::8888", "1000::1"} {
+		addr := net.ParseIP(ip)
+		assert.Truef(t, external.MatchIPAddr(addr), "public ip %s should be external", ip)
+		assert.Falsef(t, private.MatchIPAddr(addr), "public ip %s should not be private", ip)
+	}
+
+	// RFC 1918 / RFC 4193 private ranges (now folded into privateIPNets instead of net.IP.IsPrivate):
+	// not external, blockable as private. Includes range edges to guard the CIDR boundaries.
+	for _, ip := range []string{
+		"10.0.0.0", "10.255.255.255", // 10.0.0.0/8
+		"172.16.0.0", "172.31.255.255", // 172.16.0.0/12
+		"192.168.0.0", "192.168.255.255", // 192.168.0.0/16
+		"fc00::", "fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff", // fc00::/7
+	} {
+		addr := net.ParseIP(ip)
+		assert.Falsef(t, external.MatchIPAddr(addr), "private ip %s must not be external", ip)
+		assert.Truef(t, private.MatchIPAddr(addr), "private ip %s should match private block-list", ip)
+	}
+
+	// 172.32.0.0 is just outside 172.16.0.0/12: a public destination, not private
+	if addr := net.ParseIP("172.32.0.0"); assert.NotNil(t, addr) {
+		assert.True(t, external.MatchIPAddr(addr), "172.32.0.0 should be external")
+		assert.False(t, private.MatchIPAddr(addr), "172.32.0.0 should not be private")
+	}
+
+	// reserved ranges that IsPrivate does not cover: not external, but blockable as private
+	for _, ip := range []string{
+		"100.64.0.1",         // CGNAT
+		"100.127.255.254",    // CGNAT
+		"168.63.129.16",      // Azure WireServer
+		"192.0.2.1",          // TEST-NET-1
+		"198.18.0.1",         // benchmarking
+		"198.51.100.1",       // TEST-NET-2
+		"203.0.113.1",        // TEST-NET-3
+		"169.254.169.254",    // Cloud metadata
+		"192.88.99.1",        // 6to4 relay anycast
+		"64:ff9b::1",         // NAT64
+		"64:ff9b::a9fe:a9fe", // NAT64 embedding 169.254.169.254
+		"2001::1",            // Teredo
+		"2002::1",            // 6to4
+		"2001:db8::1",        // documentation
+		"fe80::1",            // link local address
+	} {
+		addr := net.ParseIP(ip)
+		assert.Falsef(t, external.MatchIPAddr(addr), "reserved ip %s must not be external", ip)
+		assert.Falsef(t, private.MatchIPAddr(addr), "reserved ip %s should match private block-list", ip)
+	}
+}

modules/packages/debian/metadata.go

@@ -146,15 +146,26 @@ func ParseControlFile(r io.Reader) (*Package, error) {
 	var depends strings.Builder
 	var control strings.Builder
 
-	s := bufio.NewScanner(io.TeeReader(r, &control))
+	// https://www.debian.org/doc/debian-policy/ch-controlfields.html#syntax-of-control-files
+	s := bufio.NewScanner(r)
 	for s.Scan() {
 		line := s.Text()
 
 		trimmed := strings.TrimSpace(line)
 		if trimmed == "" {
-			continue
+			// A binary package control file holds exactly one stanza. Stop at the
+			// blank line that terminates it, otherwise a crafted control file could
+			// smuggle additional stanzas (with attacker-chosen Filename/Package
+			// fields) into the generated repository "Packages" index.
+			if control.Len() == 0 {
+				continue
+			}
+			break
 		}
 
+		control.WriteString(line)
+		control.WriteByte('\n')
+
 		if line[0] == ' ' || line[0] == '\t' {
 			switch key {
 			case "Description":

modules/packages/debian/metadata_test.go

@@ -184,4 +184,19 @@ func TestParseControlFile(t *testing.T) {
 			assert.NotNil(t, p)
 		}
 	})
+
+	t.Run("SingleStanzaOnly", func(t *testing.T) {
+		// A control file with a trailing stanza must not leak the extra fields into
+		// p.Control, otherwise buildPackagesIndices would emit a second package entry
+		// with an attacker-chosen Filename into the repository "Packages" index.
+		content := bytes.NewBufferString("Package: realpkg\nVersion: 1.0.0\nArchitecture: amd64\nMaintainer: a <a@b.c>\nDescription: real\n\nPackage: openssl\nVersion: 99.0\nArchitecture: amd64\nFilename: pool/main/o/openssl/evil.deb\nDescription: spoofed\n")
+
+		p, err := ParseControlFile(content)
+		assert.NoError(t, err)
+		assert.NotNil(t, p)
+		assert.Equal(t, "realpkg", p.Name)
+		assert.Equal(t, "1.0.0", p.Version)
+		assert.NotContains(t, p.Control, "openssl")
+		assert.NotContains(t, p.Control, "evil.deb")
+	})
 }

modules/setting/metadata.go

@@ -0,0 +1,22 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package setting
+
+// Metadata holds instance-level settings for the repository metadata feature.
+var Metadata = struct {
+	// PlatformOptions is the admin-configurable list of allowed values for the
+	// repo metadata "platform" field. Editable via Admin -> Metadata (persisted
+	// to app.ini [metadata] PLATFORM_OPTIONS) so changing the taxonomy needs no
+	// code change or redeploy. See issue #777.
+	PlatformOptions []string
+}{
+	PlatformOptions: []string{"joomla", "dolibarr", "go", "npm", "generic"},
+}
+
+func loadMetadataFrom(rootCfg ConfigProvider) {
+	sec := rootCfg.Section("metadata")
+	if opts := sec.Key("PLATFORM_OPTIONS").Strings(","); len(opts) > 0 {
+		Metadata.PlatformOptions = opts
+	}
+}

modules/setting/setting.go

@@ -168,6 +168,7 @@ func loadCommonSettingsFrom(cfg ConfigProvider) error {
 	}
 	loadUIFrom(cfg)
 	loadAdminFrom(cfg)
+	loadMetadataFrom(cfg)
 	loadAPIFrom(cfg)
 	loadMetricsFrom(cfg)
 	loadCamoFrom(cfg)

modules/structs/org_branch.go

@@ -14,16 +14,28 @@ type OrgBranchProtection struct {
 	EnablePush                    bool     `json:"enable_push"`
 	EnablePushWhitelist           bool     `json:"enable_push_whitelist"`
 	PushWhitelistTeams            []string `json:"push_whitelist_teams"`
+	PushWhitelistUsernames        []string `json:"push_whitelist_usernames"`
+	PushWhitelistActionsUser      bool     `json:"push_whitelist_actions_user"`
 	EnableForcePush               bool     `json:"enable_force_push"`
 	EnableForcePushAllowlist      bool     `json:"enable_force_push_allowlist"`
 	ForcePushAllowlistTeams       []string `json:"force_push_allowlist_teams"`
+	ForcePushAllowlistUsernames   []string `json:"force_push_allowlist_usernames"`
+	ForcePushAllowlistActionsUser bool     `json:"force_push_allowlist_actions_user"`
+	EnableDelete                  bool     `json:"enable_delete"`
+	EnableDeleteAllowlist         bool     `json:"enable_delete_allowlist"`
+	DeleteAllowlistTeams          []string `json:"delete_allowlist_teams"`
+	DeleteAllowlistUsernames      []string `json:"delete_allowlist_usernames"`
+	DeleteAllowlistActionsUser    bool     `json:"delete_allowlist_actions_user"`
 	EnableMergeWhitelist          bool     `json:"enable_merge_whitelist"`
 	MergeWhitelistTeams           []string `json:"merge_whitelist_teams"`
+	MergeWhitelistUsernames       []string `json:"merge_whitelist_usernames"`
+	MergeWhitelistActionsUser     bool     `json:"merge_whitelist_actions_user"`
 	EnableStatusCheck             bool     `json:"enable_status_check"`
 	StatusCheckContexts           []string `json:"status_check_contexts"`
 	RequiredApprovals             int64    `json:"required_approvals"`
 	EnableApprovalsWhitelist      bool     `json:"enable_approvals_whitelist"`
 	ApprovalsWhitelistTeams       []string `json:"approvals_whitelist_teams"`
+	ApprovalsWhitelistUsernames   []string `json:"approvals_whitelist_username"`
 	BlockOnRejectedReviews        bool     `json:"block_on_rejected_reviews"`
 	BlockOnOfficialReviewRequests bool     `json:"block_on_official_review_requests"`
 	BlockOnOutdatedBranch         bool     `json:"block_on_outdated_branch"`
@@ -46,16 +58,28 @@ type CreateOrgBranchProtectionOption struct {
 	EnablePush                    bool     `json:"enable_push"`
 	EnablePushWhitelist           bool     `json:"enable_push_whitelist"`
 	PushWhitelistTeams            []string `json:"push_whitelist_teams"`
+	PushWhitelistUsernames        []string `json:"push_whitelist_usernames"`
+	PushWhitelistActionsUser      bool     `json:"push_whitelist_actions_user"`
 	EnableForcePush               bool     `json:"enable_force_push"`
 	EnableForcePushAllowlist      bool     `json:"enable_force_push_allowlist"`
 	ForcePushAllowlistTeams       []string `json:"force_push_allowlist_teams"`
+	ForcePushAllowlistUsernames   []string `json:"force_push_allowlist_usernames"`
+	ForcePushAllowlistActionsUser bool     `json:"force_push_allowlist_actions_user"`
+	EnableDelete                  bool     `json:"enable_delete"`
+	EnableDeleteAllowlist         bool     `json:"enable_delete_allowlist"`
+	DeleteAllowlistTeams          []string `json:"delete_allowlist_teams"`
+	DeleteAllowlistUsernames      []string `json:"delete_allowlist_usernames"`
+	DeleteAllowlistActionsUser    bool     `json:"delete_allowlist_actions_user"`
 	EnableMergeWhitelist          bool     `json:"enable_merge_whitelist"`
 	MergeWhitelistTeams           []string `json:"merge_whitelist_teams"`
+	MergeWhitelistUsernames       []string `json:"merge_whitelist_usernames"`
+	MergeWhitelistActionsUser     bool     `json:"merge_whitelist_actions_user"`
 	EnableStatusCheck             bool     `json:"enable_status_check"`
 	StatusCheckContexts           []string `json:"status_check_contexts"`
 	RequiredApprovals             int64    `json:"required_approvals"`
 	EnableApprovalsWhitelist      bool     `json:"enable_approvals_whitelist"`
 	ApprovalsWhitelistTeams       []string `json:"approvals_whitelist_teams"`
+	ApprovalsWhitelistUsernames   []string `json:"approvals_whitelist_username"`
 	BlockOnRejectedReviews        bool     `json:"block_on_rejected_reviews"`
 	BlockOnOfficialReviewRequests bool     `json:"block_on_official_review_requests"`
 	BlockOnOutdatedBranch         bool     `json:"block_on_outdated_branch"`
@@ -73,16 +97,28 @@ type EditOrgBranchProtectionOption struct {
 	EnablePush                    *bool    `json:"enable_push"`
 	EnablePushWhitelist           *bool    `json:"enable_push_whitelist"`
 	PushWhitelistTeams            []string `json:"push_whitelist_teams"`
+	PushWhitelistUsernames        []string `json:"push_whitelist_usernames"`
+	PushWhitelistActionsUser      *bool    `json:"push_whitelist_actions_user"`
 	EnableForcePush               *bool    `json:"enable_force_push"`
 	EnableForcePushAllowlist      *bool    `json:"enable_force_push_allowlist"`
 	ForcePushAllowlistTeams       []string `json:"force_push_allowlist_teams"`
+	ForcePushAllowlistUsernames   []string `json:"force_push_allowlist_usernames"`
+	ForcePushAllowlistActionsUser *bool    `json:"force_push_allowlist_actions_user"`
+	EnableDelete                  *bool    `json:"enable_delete"`
+	EnableDeleteAllowlist         *bool    `json:"enable_delete_allowlist"`
+	DeleteAllowlistTeams          []string `json:"delete_allowlist_teams"`
+	DeleteAllowlistUsernames      []string `json:"delete_allowlist_usernames"`
+	DeleteAllowlistActionsUser    *bool    `json:"delete_allowlist_actions_user"`
 	EnableMergeWhitelist          *bool    `json:"enable_merge_whitelist"`
 	MergeWhitelistTeams           []string `json:"merge_whitelist_teams"`
+	MergeWhitelistUsernames       []string `json:"merge_whitelist_usernames"`
+	MergeWhitelistActionsUser     *bool    `json:"merge_whitelist_actions_user"`
 	EnableStatusCheck             *bool    `json:"enable_status_check"`
 	StatusCheckContexts           []string `json:"status_check_contexts"`
 	RequiredApprovals             *int64   `json:"required_approvals"`
 	EnableApprovalsWhitelist      *bool    `json:"enable_approvals_whitelist"`
 	ApprovalsWhitelistTeams       []string `json:"approvals_whitelist_teams"`
+	ApprovalsWhitelistUsernames   []string `json:"approvals_whitelist_username"`
 	BlockOnRejectedReviews        *bool    `json:"block_on_rejected_reviews"`
 	BlockOnOfficialReviewRequests *bool    `json:"block_on_official_review_requests"`
 	BlockOnOutdatedBranch         *bool    `json:"block_on_outdated_branch"`

modules/structs/org_email_domain.go

@@ -0,0 +1,15 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package structs
+
+// OrgEmailDomainPolicy represents an organization's email domain policy
+type OrgEmailDomainPolicy struct {
+	OrgID          int64  `json:"org_id"`
+	AllowedDomains string `json:"allowed_domains"`
+}
+
+// EditOrgEmailDomainPolicyOption options for editing an org's email domain policy
+type EditOrgEmailDomainPolicyOption struct {
+	AllowedDomains *string `json:"allowed_domains"`
+}

modules/structs/org_push_policy.go

@@ -0,0 +1,30 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package structs
+
+import "time"
+
+// OrgPushPolicy represents an organization's push policy (one per org)
+type OrgPushPolicy struct {
+	OrgID               int64  `json:"org_id"`
+	BranchNamePattern   string `json:"branch_name_pattern"`
+	TagNamePattern      string `json:"tag_name_pattern"`
+	RequireSecretBlock  bool   `json:"require_secret_block"`
+	MaxFileSize         int64  `json:"max_file_size"`
+	BlockedFilePatterns string `json:"blocked_file_patterns"`
+	// swagger:strfmt date-time
+	Created time.Time `json:"created_at"`
+	// swagger:strfmt date-time
+	Updated time.Time `json:"updated_at"`
+}
+
+// EditOrgPushPolicyOption options for editing an organization's push policy. Only
+// fields that are set will be changed.
+type EditOrgPushPolicyOption struct {
+	BranchNamePattern   *string `json:"branch_name_pattern"`
+	TagNamePattern      *string `json:"tag_name_pattern"`
+	RequireSecretBlock  *bool   `json:"require_secret_block"`
+	MaxFileSize         *int64  `json:"max_file_size"`
+	BlockedFilePatterns *string `json:"blocked_file_patterns"`
+}

modules/structs/org_repo_defaults.go

@@ -0,0 +1,32 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package structs
+
+// OrgRepoDefaults represents an organization's default repository settings
+type OrgRepoDefaults struct {
+	OrgID                  int64  `json:"org_id"`
+	ForcePrivate           bool   `json:"force_private"`
+	ApplyPRDefaults        bool   `json:"apply_pr_defaults"`
+	AllowMerge             bool   `json:"allow_merge"`
+	AllowRebase            bool   `json:"allow_rebase"`
+	AllowRebaseMerge       bool   `json:"allow_rebase_merge"`
+	AllowSquash            bool   `json:"allow_squash"`
+	AllowFastForwardOnly   bool   `json:"allow_fast_forward_only"`
+	DefaultMergeStyle      string `json:"default_merge_style"`
+	DeleteBranchAfterMerge bool   `json:"delete_branch_after_merge"`
+}
+
+// EditOrgRepoDefaultsOption options for editing an org's repo defaults. Only fields
+// that are set will be changed.
+type EditOrgRepoDefaultsOption struct {
+	ForcePrivate           *bool   `json:"force_private"`
+	ApplyPRDefaults        *bool   `json:"apply_pr_defaults"`
+	AllowMerge             *bool   `json:"allow_merge"`
+	AllowRebase            *bool   `json:"allow_rebase"`
+	AllowRebaseMerge       *bool   `json:"allow_rebase_merge"`
+	AllowSquash            *bool   `json:"allow_squash"`
+	AllowFastForwardOnly   *bool   `json:"allow_fast_forward_only"`
+	DefaultMergeStyle      *string `json:"default_merge_style"`
+	DeleteBranchAfterMerge *bool   `json:"delete_branch_after_merge"`
+}

modules/structs/org_tag.go

@@ -0,0 +1,30 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package structs
+
+import "time"
+
+// OrgTagProtection represents an org-level tag protection rule
+type OrgTagProtection struct {
+	ID             int64    `json:"id"`
+	OrgID          int64    `json:"org_id"`
+	NamePattern    string   `json:"name_pattern"`
+	WhitelistTeams []string `json:"whitelist_teams"`
+	// swagger:strfmt date-time
+	Created time.Time `json:"created_at"`
+	// swagger:strfmt date-time
+	Updated time.Time `json:"updated_at"`
+}
+
+// CreateOrgTagProtectionOption options for creating an org-level tag protection
+type CreateOrgTagProtectionOption struct {
+	NamePattern    string   `json:"name_pattern" binding:"Required"`
+	WhitelistTeams []string `json:"whitelist_teams"`
+}
+
+// EditOrgTagProtectionOption options for editing an org-level tag protection
+type EditOrgTagProtectionOption struct {
+	NamePattern    *string  `json:"name_pattern"`
+	WhitelistTeams []string `json:"whitelist_teams"`
+}

modules/util/util_test.go

@@ -86,31 +86,35 @@ func Test_NormalizeEOL(t *testing.T) {
 }
 
 func Test_RandomInt(t *testing.T) {
-	randInt := CryptoRandomInt(255)
+	randInt, err := CryptoRandomInt(255)
+	assert.NoError(t, err)
 	assert.GreaterOrEqual(t, randInt, int64(0))
 	assert.LessOrEqual(t, randInt, int64(255))
 }
 
 func Test_RandomString(t *testing.T) {
-	str1 := CryptoRandomString(32)
-	var err error
+	str1, err := CryptoRandomString(32)
+	assert.NoError(t, err)
 	matches, err := regexp.MatchString(`^[a-zA-Z0-9]{32}$`, str1)
 	assert.NoError(t, err)
 	assert.True(t, matches)
 
-	str2 := CryptoRandomString(32)
+	str2, err := CryptoRandomString(32)
+	assert.NoError(t, err)
 	matches, err = regexp.MatchString(`^[a-zA-Z0-9]{32}$`, str1)
 	assert.NoError(t, err)
 	assert.True(t, matches)
 
 	assert.NotEqual(t, str1, str2)
 
-	str3 := CryptoRandomString(256)
+	str3, err := CryptoRandomString(256)
+	assert.NoError(t, err)
 	matches, err = regexp.MatchString(`^[a-zA-Z0-9]{256}$`, str3)
 	assert.NoError(t, err)
 	assert.True(t, matches)
 
-	str4 := CryptoRandomString(256)
+	str4, err := CryptoRandomString(256)
+	assert.NoError(t, err)
 	matches, err = regexp.MatchString(`^[a-zA-Z0-9]{256}$`, str4)
 	assert.NoError(t, err)
 	assert.True(t, matches)
@@ -119,15 +123,19 @@ func Test_RandomString(t *testing.T) {
 }
 
 func Test_RandomBytes(t *testing.T) {
-	bytes1 := CryptoRandomBytes(32)
+	bytes1, err := CryptoRandomBytes(32)
+	assert.NoError(t, err)
 
-	bytes2 := CryptoRandomBytes(32)
+	bytes2, err := CryptoRandomBytes(32)
+	assert.NoError(t, err)
 
 	assert.NotEqual(t, bytes1, bytes2)
 
-	bytes3 := CryptoRandomBytes(256)
+	bytes3, err := CryptoRandomBytes(256)
+	assert.NoError(t, err)
 
-	bytes4 := CryptoRandomBytes(256)
+	bytes4, err := CryptoRandomBytes(256)
+	assert.NoError(t, err)
 
 	assert.NotEqual(t, bytes3, bytes4)
 }

options/locale/locale_en-US.json

@@ -2411,6 +2411,31 @@
   "repo.settings.protected_branch": "Branch Protection",
   "repo.settings.protected_branch.save_rule": "Save Rule",
   "repo.settings.protected_branch.delete_rule": "Delete Rule",
+  "repo.settings.org_protected_branch": "Organization Branch Protection",
+  "repo.settings.org_protected_branch_desc": "These rules are defined by the organization and are enforced on top of this repository's own rules — the stricter of the two applies. They cannot be edited here.",
+  "repo.settings.org_protected_branch.inherited": "Organization",
+  "repo.settings.org_protected_branch.read_only": "Read-only",
+  "repo.settings.org_protected_branch.approvals": "Required approvals",
+  "repo.settings.org_protected_branch.signed": "Signed commits",
+  "repo.settings.org_protected_branch.status_check": "Required status checks",
+  "repo.settings.org_protected_branch.direct_push": "Direct push",
+  "repo.settings.org_protected_branch.force_push": "Force push",
+  "repo.settings.org_protected_branch.deletion": "Branch deletion",
+  "repo.settings.org_protected_branch.merge": "Merge restricted to",
+  "repo.settings.org_protected_branch.protected_files": "Protected files",
+  "repo.settings.org_protected_branch.also": "Also enforces",
+  "repo.settings.org_protected_branch.blocked": "Blocked",
+  "repo.settings.org_protected_branch.allowed": "Allowed",
+  "repo.settings.org_protected_branch.restricted": "Restricted to specific teams",
+  "repo.settings.org_protected_branch.write_access": "Anyone with write access",
+  "repo.settings.org_protected_branch.teams": "Teams: %s",
+  "repo.settings.org_protected_branch.any": "Any configured checks",
+  "repo.settings.org_protected_branch.block_outdated": "Block on outdated branch",
+  "repo.settings.org_protected_branch.block_rejected": "Block on rejected reviews",
+  "repo.settings.org_protected_branch.block_admin": "Block admin merge override",
+  "repo.settings.org_protected_tag": "Organization Tag Protection",
+  "repo.settings.org_protected_tag_desc": "These tag protection rules are defined by the organization and are enforced on top of this repository's own rules. They cannot be edited here.",
+  "repo.settings.org_protected_tag.read_only": "Read-only",
   "repo.settings.protected_branch_can_push": "Allow push?",
   "repo.settings.protected_branch_can_push_yes": "You can push",
   "repo.settings.protected_branch_can_push_no": "You cannot push",
@@ -2439,7 +2464,7 @@
   "repo.settings.protect_force_push_allowlist_teams": "Allowlisted teams for force pushing:",
   "repo.settings.protect_force_push_allowlist_deploy_keys": "Allowlist deploy keys with push access to force push.",
   "repo.settings.protect_force_push_allowlist_actions_user": "Allowlist actions bot user to force push.",
-  "repo.settings.event_delete": "Branch Deletion",
+  "repo.settings.protect_branch_deletion": "Branch Deletion",
   "repo.settings.protect_disable_delete": "Disable Deletion",
   "repo.settings.protect_disable_delete_desc": "This branch cannot be deleted.",
   "repo.settings.protect_enable_delete_all": "Enable Deletion",
@@ -2747,7 +2772,7 @@
   "repo.settings.support_url_help": "Shown when downloads are gated. Can point to your wiki, product page, or external support site.",
   "repo.settings.custom_fields": "Custom Fields",
   "repo.settings.manifest": "Manifest",
-  "repo.settings.manifest_desc": "Project identity, governance, and build settings from the MokoPlatform manifest. These are accessible via API for Actions workflows and the MokoPlatform CLI.",
+  "repo.settings.manifest_desc": "Project identity, governance, and build settings for the repository. These are accessible via API for Actions workflows and MokoCLI.",
   "repo.settings.manifest_identity": "Identity",
   "repo.settings.manifest_name": "Project Name",
   "repo.settings.manifest_element_name": "Element Name",

routers/api/v1/api.go

@@ -508,41 +508,79 @@ func reqOrgOwnership() func(ctx *context.APIContext) {
 	}
 }
 
-// reqTeamMembership user should be an team member, or a site admin
+// reqOrgVisible requires the organization to be visible to the doer, or a site admin
+func reqOrgVisible() func(ctx *context.APIContext) {
+	return func(ctx *context.APIContext) {
+		if ctx.Org.Organization == nil {
+			setting.PanicInDevOrTesting("reqOrgVisible: unprepared context")
+			ctx.APIErrorInternal(errors.New("reqOrgVisible: unprepared context"))
+			return
+		}
+		if !organization.IsOwnerVisibleToDoer(ctx, ctx.Org.Organization.AsUser(), ctx.Doer) {
+			ctx.APIErrorNotFound()
+			return
+		}
+	}
+}
+
+func teamAccessPrivileged(ctx *context.APIContext) (orgID int64, privileged, ok bool) {
+	if ctx.IsUserSiteAdmin() {
+		return 0, true, true
+	}
+	if ctx.Org.Team == nil {
+		setting.PanicInDevOrTesting("teamAccess: unprepared context")
+		ctx.APIErrorInternal(errors.New("teamAccess: unprepared context"))
+		return 0, false, false
+	}
+
+	orgID = ctx.Org.Team.OrgID
+	isOwner, err := organization.IsOrganizationOwner(ctx, orgID, ctx.Doer.ID)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return 0, false, false
+	} else if isOwner {
+		return orgID, true, true
+	}
+
+	isTeamMember, err := organization.IsTeamMember(ctx, orgID, ctx.Org.Team.ID, ctx.Doer.ID)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return 0, false, false
+	}
+	return orgID, isTeamMember, true
+}
+
+func denyNonTeamMember(ctx *context.APIContext, orgID int64) {
+	isOrgMember, err := organization.IsOrganizationMember(ctx, orgID, ctx.Doer.ID)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+	} else if isOrgMember {
+		ctx.APIError(http.StatusForbidden, "Must be a team member")
+	} else {
+		ctx.APIErrorNotFound()
+	}
+}
+
+// reqTeamReadAccess allows callers who can list the team to read its metadata.
+// Not sufficient for mutations — use reqOrgOwnership() or reqTeamMembership() for those.
+func reqTeamReadAccess() func(ctx *context.APIContext) {
+	return func(ctx *context.APIContext) {
+		orgID, privileged, ok := teamAccessPrivileged(ctx)
+		if !ok || privileged {
+			return
+		}
+		denyNonTeamMember(ctx, orgID)
+	}
+}
+
+// reqTeamMembership user should be a team member, or a site admin
 func reqTeamMembership() func(ctx *context.APIContext) {
 	return func(ctx *context.APIContext) {
-		if ctx.IsUserSiteAdmin() {
-			return
-		}
-		if ctx.Org.Team == nil {
-			setting.PanicInDevOrTesting("reqTeamMembership: unprepared context")
-			ctx.APIErrorInternal(errors.New("reqTeamMembership: unprepared context"))
-			return
-		}
-
-		orgID := ctx.Org.Team.OrgID
-		isOwner, err := organization.IsOrganizationOwner(ctx, orgID, ctx.Doer.ID)
-		if err != nil {
-			ctx.APIErrorInternal(err)
-			return
-		} else if isOwner {
-			return
-		}
-
-		if isTeamMember, err := organization.IsTeamMember(ctx, orgID, ctx.Org.Team.ID, ctx.Doer.ID); err != nil {
-			ctx.APIErrorInternal(err)
-			return
-		} else if !isTeamMember {
-			isOrgMember, err := organization.IsOrganizationMember(ctx, orgID, ctx.Doer.ID)
-			if err != nil {
-				ctx.APIErrorInternal(err)
-			} else if isOrgMember {
-				ctx.APIError(http.StatusForbidden, "Must be a team member")
-			} else {
-				ctx.APIErrorNotFound()
-			}
+		orgID, privileged, ok := teamAccessPrivileged(ctx)
+		if !ok || privileged {
 			return
 		}
+		denyNonTeamMember(ctx, orgID)
 	}
 }
 
@@ -1505,8 +1543,6 @@ func Routes() *web.Router {
 				}, reqAnyRepoReader())
 				m.Get("/metadata", repo.GetRepoMetadata)
 				m.Put("/metadata", reqToken(), reqAdmin(), repo.UpdateRepoMetadata)
-				m.Get("/manifest", repo.GetRepoMetadata) // backward compat
-				m.Put("/manifest", reqToken(), reqAdmin(), repo.UpdateRepoMetadata)
 				// MokoGitea badge engine
 				m.Get("/badge/{type}.svg", repo.GetRepoBadge)
 				m.Get("/issue_templates", reqRepoReader(unit.TypeCode), context.ReferencesGitRepo(), repo.GetIssueTemplates)
@@ -1660,29 +1696,29 @@ func Routes() *web.Router {
 						Patch(reqToken(), reqRepoWriter(unit.TypeIssues, unit.TypePullRequests), bind(api.EditMilestoneOption{}), repo.EditMilestone).
 						Delete(reqToken(), reqRepoWriter(unit.TypeIssues, unit.TypePullRequests), repo.DeleteMilestone)
 				})
-//				m.Group("/projects", func() {
-//					m.Combo("").Get(repo.ListProjects).
-//						Post(reqToken(), reqRepoWriter(unit.TypeProjects), bind(api.CreateProjectOption{}), repo.CreateProject)
-//					m.Group("/{id}", func() {
-//						m.Combo("").Get(repo.GetProject).
-//							Patch(reqToken(), reqRepoWriter(unit.TypeProjects), bind(api.EditProjectOption{}), repo.EditProject).
-//							Delete(reqToken(), reqRepoWriter(unit.TypeProjects), repo.DeleteProject)
-//						m.Post("/{action}", reqToken(), reqRepoWriter(unit.TypeProjects), repo.ChangeProjectStatus)
-//						m.Group("/columns", func() {
-//							m.Combo("").Get(repo.ListProjectColumns).
-//								Post(reqToken(), reqRepoWriter(unit.TypeProjects), bind(api.CreateProjectColumnOption{}), repo.CreateProjectColumn)
-//							m.Group("/{columnId}", func() {
-//								m.Delete("", reqToken(), reqRepoWriter(unit.TypeProjects), repo.DeleteProjectColumn)
-//								m.Combo("/issues").Get(repo.ListProjectColumnIssues).
-//									Post(reqToken(), reqRepoWriter(unit.TypeProjects), bind(api.AddProjectColumnIssueOption{}), repo.AddIssueToColumn)
-//							})
-//						})
-//						m.Group("/issues/{issueId}", func() {
-//							m.Patch("/move", reqToken(), reqRepoWriter(unit.TypeProjects), bind(api.MoveProjectColumnIssueOption{}), repo.MoveIssueOnColumn)
-//							m.Delete("", reqToken(), reqRepoWriter(unit.TypeProjects), repo.RemoveIssueFromProject)
-//						})
-//					})
-//				})
+				//				m.Group("/projects", func() {
+				//					m.Combo("").Get(repo.ListProjects).
+				//						Post(reqToken(), reqRepoWriter(unit.TypeProjects), bind(api.CreateProjectOption{}), repo.CreateProject)
+				//					m.Group("/{id}", func() {
+				//						m.Combo("").Get(repo.GetProject).
+				//							Patch(reqToken(), reqRepoWriter(unit.TypeProjects), bind(api.EditProjectOption{}), repo.EditProject).
+				//							Delete(reqToken(), reqRepoWriter(unit.TypeProjects), repo.DeleteProject)
+				//						m.Post("/{action}", reqToken(), reqRepoWriter(unit.TypeProjects), repo.ChangeProjectStatus)
+				//						m.Group("/columns", func() {
+				//							m.Combo("").Get(repo.ListProjectColumns).
+				//								Post(reqToken(), reqRepoWriter(unit.TypeProjects), bind(api.CreateProjectColumnOption{}), repo.CreateProjectColumn)
+				//							m.Group("/{columnId}", func() {
+				//								m.Delete("", reqToken(), reqRepoWriter(unit.TypeProjects), repo.DeleteProjectColumn)
+				//								m.Combo("/issues").Get(repo.ListProjectColumnIssues).
+				//									Post(reqToken(), reqRepoWriter(unit.TypeProjects), bind(api.AddProjectColumnIssueOption{}), repo.AddIssueToColumn)
+				//							})
+				//						})
+				//						m.Group("/issues/{issueId}", func() {
+				//							m.Patch("/move", reqToken(), reqRepoWriter(unit.TypeProjects), bind(api.MoveProjectColumnIssueOption{}), repo.MoveIssueOnColumn)
+				//							m.Delete("", reqToken(), reqRepoWriter(unit.TypeProjects), repo.RemoveIssueFromProject)
+				//						})
+				//					})
+				//				})
 				// Repo custom fields (repo-scoped key-value metadata)
 				m.Group("/custom-fields", func() {
 					m.Get("", repo.GetRepoCustomFields)
@@ -1762,7 +1798,7 @@ func Routes() *web.Router {
 				m.Combo("/{id}").Get(reqToken(), org.GetLabel).
 					Patch(reqToken(), reqOrgOwnership(), bind(api.EditLabelOption{}), org.EditLabel).
 					Delete(reqToken(), reqOrgOwnership(), org.DeleteLabel)
-			})
+			}, reqOrgVisible())
 			m.Group("/hooks", func() {
 				m.Combo("").Get(org.ListHooks).
 					Post(bind(api.CreateHookOption{}), org.CreateHook)
@@ -1785,6 +1821,34 @@ func Routes() *web.Router {
 				})
 			}, reqToken(), reqOrgOwnership())
 
+			m.Group("/tag_protections", func() {
+				m.Combo("").Get(org.ListOrgTagProtections).
+					Post(bind(api.CreateOrgTagProtectionOption{}), org.CreateOrgTagProtection)
+				m.Group("/{id}", func() {
+					m.Get("", org.GetOrgTagProtection)
+					m.Patch("", bind(api.EditOrgTagProtectionOption{}), org.EditOrgTagProtection)
+					m.Delete("", org.DeleteOrgTagProtection)
+				})
+			}, reqToken(), reqOrgOwnership())
+
+			m.Group("/push_policy", func() {
+				m.Combo("").Get(org.GetOrgPushPolicy).
+					Patch(bind(api.EditOrgPushPolicyOption{}), org.EditOrgPushPolicy).
+					Delete(org.DeleteOrgPushPolicy)
+			}, reqToken(), reqOrgOwnership())
+
+			m.Group("/repo_defaults", func() {
+				m.Combo("").Get(org.GetOrgRepoDefaults).
+					Patch(bind(api.EditOrgRepoDefaultsOption{}), org.EditOrgRepoDefaults).
+					Delete(org.DeleteOrgRepoDefaults)
+			}, reqToken(), reqOrgOwnership())
+
+			m.Group("/email_domain_policy", func() {
+				m.Combo("").Get(org.GetOrgEmailDomainPolicy).
+					Patch(bind(api.EditOrgEmailDomainPolicyOption{}), org.EditOrgEmailDomainPolicy).
+					Delete(org.DeleteOrgEmailDomainPolicy)
+			}, reqToken(), reqOrgOwnership())
+
 			m.Group("/blocks", func() {
 				m.Get("", org.ListBlocks)
 				m.Group("/{username}", func() {
@@ -1821,12 +1885,12 @@ func Routes() *web.Router {
 			m.Group("/repos", func() {
 				m.Get("", reqToken(), org.GetTeamRepos)
 				m.Combo("/{org}/{reponame}").
-					Put(reqToken(), org.AddTeamRepository).
-					Delete(reqToken(), org.RemoveTeamRepository).
+					Put(reqToken(), reqTeamMembership(), org.AddTeamRepository).
+					Delete(reqToken(), reqTeamMembership(), org.RemoveTeamRepository).
 					Get(reqToken(), org.GetTeamRepo)
 			})
 			m.Get("/activities/feeds", org.ListTeamActivityFeeds)
-		}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryOrganization), orgAssignment(false, true), reqToken(), reqTeamMembership(), checkTokenPublicOnly())
+		}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryOrganization), orgAssignment(false, true), reqToken(), reqTeamReadAccess(), checkTokenPublicOnly())
 
 		m.Group("/admin", func() {
 			m.Group("/cron", func() {

routers/api/v1/org/branch_protection.go

@@ -8,6 +8,7 @@ import (
 
 	git_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/git"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/organization"
+	user_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/user"
 	api "code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/structs"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/web"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
@@ -36,6 +37,18 @@ func toAPIOrgBranchProtection(ctx *context.APIContext, rule *git_model.OrgProtec
 		return names
 	}
 
+	resolveUserNames := func(ids []int64) []string {
+		names := make([]string, 0, len(ids))
+		for _, id := range ids {
+			u, err := user_model.GetUserByID(ctx, id)
+			if err != nil {
+				continue
+			}
+			names = append(names, u.Name)
+		}
+		return names
+	}
+
 	return &api.OrgBranchProtection{
 		ID:                            rule.ID,
 		OrgID:                         rule.OrgID,
@@ -44,16 +57,28 @@ func toAPIOrgBranchProtection(ctx *context.APIContext, rule *git_model.OrgProtec
 		EnablePush:                    rule.CanPush,
 		EnablePushWhitelist:           rule.EnableWhitelist,
 		PushWhitelistTeams:            resolveTeamNames(rule.WhitelistTeamIDs),
+		PushWhitelistUsernames:        resolveUserNames(rule.WhitelistUserIDs),
+		PushWhitelistActionsUser:      rule.WhitelistActionsUser,
 		EnableForcePush:               rule.CanForcePush,
 		EnableForcePushAllowlist:      rule.EnableForcePushAllowlist,
 		ForcePushAllowlistTeams:       resolveTeamNames(rule.ForcePushAllowlistTeamIDs),
+		ForcePushAllowlistUsernames:   resolveUserNames(rule.ForcePushAllowlistUserIDs),
+		ForcePushAllowlistActionsUser: rule.ForcePushAllowlistActionsUser,
+		EnableDelete:                  rule.CanDelete,
+		EnableDeleteAllowlist:         rule.EnableDeleteAllowlist,
+		DeleteAllowlistTeams:          resolveTeamNames(rule.DeleteAllowlistTeamIDs),
+		DeleteAllowlistUsernames:      resolveUserNames(rule.DeleteAllowlistUserIDs),
+		DeleteAllowlistActionsUser:    rule.DeleteAllowlistActionsUser,
 		EnableMergeWhitelist:          rule.EnableMergeWhitelist,
 		MergeWhitelistTeams:           resolveTeamNames(rule.MergeWhitelistTeamIDs),
+		MergeWhitelistUsernames:       resolveUserNames(rule.MergeWhitelistUserIDs),
+		MergeWhitelistActionsUser:     rule.MergeWhitelistActionsUser,
 		EnableStatusCheck:             rule.EnableStatusCheck,
 		StatusCheckContexts:           rule.StatusCheckContexts,
 		RequiredApprovals:             rule.RequiredApprovals,
 		EnableApprovalsWhitelist:      rule.EnableApprovalsWhitelist,
 		ApprovalsWhitelistTeams:       resolveTeamNames(rule.ApprovalsWhitelistTeamIDs),
+		ApprovalsWhitelistUsernames:   resolveUserNames(rule.ApprovalsWhitelistUserIDs),
 		BlockOnRejectedReviews:        rule.BlockOnRejectedReviews,
 		BlockOnOfficialReviewRequests: rule.BlockOnOfficialReviewRequests,
 		BlockOnOutdatedBranch:         rule.BlockOnOutdatedBranch,
@@ -85,6 +110,41 @@ func resolveTeamIDs(ctx *context.APIContext, orgID int64, names []string) ([]int
 	return ids, true
 }
 
+// resolveUserIDs converts a list of user identifiers (each a username or an email
+// address) to deduped user IDs, returning 422 on the first unknown identifier. Each
+// entry is looked up by username first, then falls back to an activated email address.
+func resolveUserIDs(ctx *context.APIContext, names []string) ([]int64, bool) {
+	if len(names) == 0 {
+		return nil, true
+	}
+	seen := make(map[int64]struct{}, len(names))
+	ids := make([]int64, 0, len(names))
+	for _, name := range names {
+		u, err := user_model.GetUserByName(ctx, name)
+		if err != nil {
+			if !user_model.IsErrUserNotExist(err) {
+				ctx.APIErrorInternal(err)
+				return nil, false
+			}
+			u, err = user_model.GetUserByEmail(ctx, name)
+			if err != nil {
+				if user_model.IsErrUserNotExist(err) {
+					ctx.APIError(http.StatusUnprocessableEntity, "unknown user: "+name)
+				} else {
+					ctx.APIErrorInternal(err)
+				}
+				return nil, false
+			}
+		}
+		if _, dup := seen[u.ID]; dup {
+			continue
+		}
+		seen[u.ID] = struct{}{}
+		ids = append(ids, u.ID)
+	}
+	return ids, true
+}
+
 // ListOrgBranchProtections list org-level branch protection rules
 func ListOrgBranchProtections(ctx *context.APIContext) {
 	// swagger:operation GET /orgs/{org}/branch_protections organization orgListBranchProtections
@@ -211,6 +271,30 @@ func CreateOrgBranchProtection(ctx *context.APIContext) {
 	if !ok {
 		return
 	}
+	deleteTeams, ok := resolveTeamIDs(ctx, orgID, form.DeleteAllowlistTeams)
+	if !ok {
+		return
+	}
+	pushUsers, ok := resolveUserIDs(ctx, form.PushWhitelistUsernames)
+	if !ok {
+		return
+	}
+	forcePushUsers, ok := resolveUserIDs(ctx, form.ForcePushAllowlistUsernames)
+	if !ok {
+		return
+	}
+	mergeUsers, ok := resolveUserIDs(ctx, form.MergeWhitelistUsernames)
+	if !ok {
+		return
+	}
+	approvalsUsers, ok := resolveUserIDs(ctx, form.ApprovalsWhitelistUsernames)
+	if !ok {
+		return
+	}
+	deleteUsers, ok := resolveUserIDs(ctx, form.DeleteAllowlistUsernames)
+	if !ok {
+		return
+	}
 
 	rule := &git_model.OrgProtectedBranch{
 		OrgID:                         orgID,
@@ -219,16 +303,28 @@ func CreateOrgBranchProtection(ctx *context.APIContext) {
 		CanPush:                       form.EnablePush,
 		EnableWhitelist:               form.EnablePush && form.EnablePushWhitelist,
 		WhitelistTeamIDs:              pushTeams,
+		WhitelistUserIDs:              pushUsers,
+		WhitelistActionsUser:          form.EnablePush && form.EnablePushWhitelist && form.PushWhitelistActionsUser,
 		CanForcePush:                  form.EnablePush && form.EnableForcePush,
 		EnableForcePushAllowlist:      form.EnablePush && form.EnableForcePush && form.EnableForcePushAllowlist,
 		ForcePushAllowlistTeamIDs:     forcePushTeams,
+		ForcePushAllowlistUserIDs:     forcePushUsers,
+		ForcePushAllowlistActionsUser: form.EnablePush && form.EnableForcePush && form.EnableForcePushAllowlist && form.ForcePushAllowlistActionsUser,
+		CanDelete:                     form.EnableDelete,
+		EnableDeleteAllowlist:         form.EnableDelete && form.EnableDeleteAllowlist,
+		DeleteAllowlistTeamIDs:        deleteTeams,
+		DeleteAllowlistUserIDs:        deleteUsers,
+		DeleteAllowlistActionsUser:    form.EnableDelete && form.EnableDeleteAllowlist && form.DeleteAllowlistActionsUser,
 		EnableMergeWhitelist:          form.EnableMergeWhitelist,
 		MergeWhitelistTeamIDs:         mergeTeams,
+		MergeWhitelistUserIDs:         mergeUsers,
+		MergeWhitelistActionsUser:     form.EnableMergeWhitelist && form.MergeWhitelistActionsUser,
 		EnableStatusCheck:             form.EnableStatusCheck,
 		StatusCheckContexts:           form.StatusCheckContexts,
 		RequiredApprovals:             form.RequiredApprovals,
 		EnableApprovalsWhitelist:      form.EnableApprovalsWhitelist,
 		ApprovalsWhitelistTeamIDs:     approvalsTeams,
+		ApprovalsWhitelistUserIDs:     approvalsUsers,
 		BlockOnRejectedReviews:        form.BlockOnRejectedReviews,
 		BlockOnOfficialReviewRequests: form.BlockOnOfficialReviewRequests,
 		BlockOnOutdatedBranch:         form.BlockOnOutdatedBranch,
@@ -310,6 +406,16 @@ func EditOrgBranchProtection(ctx *context.APIContext) {
 		}
 		rule.WhitelistTeamIDs = ids
 	}
+	if form.PushWhitelistUsernames != nil {
+		ids, ok := resolveUserIDs(ctx, form.PushWhitelistUsernames)
+		if !ok {
+			return
+		}
+		rule.WhitelistUserIDs = ids
+	}
+	if form.PushWhitelistActionsUser != nil {
+		rule.WhitelistActionsUser = *form.PushWhitelistActionsUser
+	}
 	if form.EnableForcePush != nil {
 		rule.CanForcePush = *form.EnableForcePush
 	}
@@ -323,6 +429,39 @@ func EditOrgBranchProtection(ctx *context.APIContext) {
 		}
 		rule.ForcePushAllowlistTeamIDs = ids
 	}
+	if form.ForcePushAllowlistUsernames != nil {
+		ids, ok := resolveUserIDs(ctx, form.ForcePushAllowlistUsernames)
+		if !ok {
+			return
+		}
+		rule.ForcePushAllowlistUserIDs = ids
+	}
+	if form.ForcePushAllowlistActionsUser != nil {
+		rule.ForcePushAllowlistActionsUser = *form.ForcePushAllowlistActionsUser
+	}
+	if form.EnableDelete != nil {
+		rule.CanDelete = *form.EnableDelete
+	}
+	if form.EnableDeleteAllowlist != nil {
+		rule.EnableDeleteAllowlist = *form.EnableDeleteAllowlist
+	}
+	if form.DeleteAllowlistTeams != nil {
+		ids, ok := resolveTeamIDs(ctx, orgID, form.DeleteAllowlistTeams)
+		if !ok {
+			return
+		}
+		rule.DeleteAllowlistTeamIDs = ids
+	}
+	if form.DeleteAllowlistUsernames != nil {
+		ids, ok := resolveUserIDs(ctx, form.DeleteAllowlistUsernames)
+		if !ok {
+			return
+		}
+		rule.DeleteAllowlistUserIDs = ids
+	}
+	if form.DeleteAllowlistActionsUser != nil {
+		rule.DeleteAllowlistActionsUser = *form.DeleteAllowlistActionsUser
+	}
 	if form.EnableMergeWhitelist != nil {
 		rule.EnableMergeWhitelist = *form.EnableMergeWhitelist
 	}
@@ -333,6 +472,16 @@ func EditOrgBranchProtection(ctx *context.APIContext) {
 		}
 		rule.MergeWhitelistTeamIDs = ids
 	}
+	if form.MergeWhitelistUsernames != nil {
+		ids, ok := resolveUserIDs(ctx, form.MergeWhitelistUsernames)
+		if !ok {
+			return
+		}
+		rule.MergeWhitelistUserIDs = ids
+	}
+	if form.MergeWhitelistActionsUser != nil {
+		rule.MergeWhitelistActionsUser = *form.MergeWhitelistActionsUser
+	}
 	if form.EnableStatusCheck != nil {
 		rule.EnableStatusCheck = *form.EnableStatusCheck
 	}
@@ -352,6 +501,13 @@ func EditOrgBranchProtection(ctx *context.APIContext) {
 		}
 		rule.ApprovalsWhitelistTeamIDs = ids
 	}
+	if form.ApprovalsWhitelistUsernames != nil {
+		ids, ok := resolveUserIDs(ctx, form.ApprovalsWhitelistUsernames)
+		if !ok {
+			return
+		}
+		rule.ApprovalsWhitelistUserIDs = ids
+	}
 	if form.BlockOnRejectedReviews != nil {
 		rule.BlockOnRejectedReviews = *form.BlockOnRejectedReviews
 	}