Release: org-wide governance series (#727) — dev → main #733

Open

jmiller wants to merge 42 commits from dev into main

pull from: dev

merge into: :main

:main

:dev

:rc

:feature/752-chore-deploy-rebuild-redeploy-for-moko-p

:worktree-agent-a5b50d10bab2beaac

:feature/749-release-notes-from-a-curated-release-not

:fix/rebrand-wiki-docs

:worktree-agent-acb0cede999748165

:feature/744-feat-let-issue-templates-set-mokogitea-f

:feature/745-org-default-teams-add-protected-option-b

:feature/746-auto-add-the-actions-bot-to-the-ci-cd-te

:feature/747-add-a-dedicated-system-api-automation-bo

:feature/738-expand-openapi-spec-mcp-tooling-for-org-

:feature/722-cleanup-and-standardization-of-issue-tem

:feature/723-feat-issue-and-pull-request-voting-upvot

:feature/725-enforce-dot-prefixed-repositories-are-al

:feature/727-org-level-branch-protection-is-stored-bu

:feature/secret-scanning

:rc/v1.26.1-moko.06.07.02

:rc/v1.26.1-moko.06.07.03

:rc/v1.26.1-moko.06.07.01

:rc/v1.26.1-moko.06.07

:rc/v1.26.1-moko.06.06.02

:rc/v1.26.1-moko.06.06.01

:rc/v1.26.1-moko.06.06

:rc/v1.26.1-moko.06.05.01

:rc/v1.26.1-moko.06.05

:rc/v1.26.1-moko.06.04

:rc/v1.26.1-moko.06.03

:rc/05.06.00

:rc/05.03.03

:rc/04.01.00

:rc/05.03.02

:rc/05.03.01

:rc/05.03.00

:rc/05.01.00

:rc/05.02.02

:rc/05.02.01

:rc/05.01.01

:rc/05.02.00

:rc/05.01.02

:rc/05.03.04

:rc/05.03.05

:rc/05.03.06

:rc/05.03.08

:rc/05.04.00

:rc/05.05.00

Conversation 3 Commits 42 Files Changed 55

+8456 -94

42 Commits

Author	SHA1	Message	Date
jmiller	c74173bb86	ci(deploy-rc): add workflow_dispatch for isolated manual tests ... Lets deploy-rc be run on demand (from a ref carrying current source) to verify the RC pipeline end-to-end without a full rc promotion + pre-release. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 19:15:55 -05:00
jmiller	b2447da3dd	Merge pull request 'feat(ci): deploy-rc.yml — auto-deploy rc branch to the new RC environment' (#751) from feat/deploy-rc-workflow into dev	2026-07-06 00:03:55 +00:00
jmiller	7be712571c	refactor(ci): tier-scope deploy-rc variables (RC_SSH_*, RC_REGISTRY*, RC_IMAGE) ... Shared DEPLOY_HOST/PORT/USER assumed all tiers live on one host. Scope every deploy variable to the rc tier (mirrors the org's DEV_SSH_* convention) so a repo inheriting this template can host rc/dev/prod on separate machines independently. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 19:01:38 -05:00
jmiller	6634b049ab	fix(ci): deploy-rc reuses existing DEPLOY_SSH_KEY + MOKOGITEA_TOKEN secrets ... The registry token is the org-wide MOKOGITEA_TOKEN secret (already configured, used by deploy-dev/deploy-mokogitea), not a new DEPLOY_REGISTRY_TOKEN. Reuse the existing secret names so no new secret values are needed; only the non-sensitive tier variables get set per-repo. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 18:54:27 -05:00
jmiller	5c62cefcd3	refactor(ci): deploy-rc.yml -> root workflows, fully parameterized via repo vars/secrets ... - Moved from custom/ to the root .mokogitea/workflows/ (synced/template-owned area). - All deployment config now comes from repo Actions variables (DEPLOY_HOST/PORT/USER, DEPLOY_REGISTRY/IMAGE, RC_CONTAINER/COMPOSE_PROJECT/COMPOSE_DIR/SOURCE_DIR/TAG_ENV/ HEALTH_URL) and secrets (DEPLOY_SSH_KEY, DEPLOY_REGISTRY_TOKEN) — nothing hardcoded, so it works across Go server repos. Clone URL derived from github.server_url/repository. - To become Template-Go-owned (Template-Go#3). Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 18:37:33 -05:00
jmiller	f2ca569906	feat(ci): deploy-rc.yml — auto-deploy the rc branch to the RC environment ... Adds a custom deploy workflow that builds and deploys the release candidate to rc.git.mokoconsulting.tech (mokogitea-rc container, port 3110, DB mokogitea_rc) on push to the rc branch — the branch promote-rc creates when a PR to main is opened. Mirrors the fixed deploy-dev.yml: env-var image tag (MOKOGITEA_RC_TAG) driving the shared compose file (no sed), rm -f before force-recreate, quoted-heredoc remote expansion, health check + external verify. Gives a real release-candidate environment to validate before prod. Intended to move to Template-Go as the canonical synced source once validated (kept in custom/ for now so it isn't overwritten by workflow sync). Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 18:31:51 -05:00
jmiller	b9301a8f31	Merge pull request 'feat: org branch protection per-user (username/email) allowlists + actions-bot toggle (#727)' (#750) from feature/org-branch-protection-user-allowlists into dev	2026-07-05 22:54:30 +00:00
jmiller	cac06c2ac7	feat: org branch protection per-user allowlists + Actions-bot toggle (#727) ... Extend org-level branch protection to support per-user allowlists (resolved from username OR email) and an "allow Actions bot" toggle, alongside the existing team allowlists, for all five categories (push, merge, force-push, delete, approvals). - models/git/org_protected_branch.go: add WhitelistUserIDs, MergeWhitelistUserIDs, ForcePushAllowlistUserIDs, DeleteAllowlistUserIDs, ApprovalsWhitelistUserIDs ([]int64) plus WhitelistActionsUser, MergeWhitelistActionsUser, ForcePushAllowlistActionsUser, DeleteAllowlistActionsUser (bool); copy all 9 into ProtectedBranch in ToProtectedBranch(). - models/migrations/v1_27/v368.go: migration 367 adds the 9 columns. - modules/structs/org_branch.go: add *Usernames []string and *ActionsUser bool to Create/Edit options and the response, matching repo-level json names. - routers/api/v1/org/branch_protection.go: resolveUserIDs (username then email, dedupe, 422 on unknown); wire into Create + Edit and toAPIOrgBranchProtection. - models/git/protected_branch_merge.go: add mergeAllowFlag and merge the four Actions-user flags most-restrictively (org can now express them); deploy-key flags stay repo-only pass-through. - models/git/protected_branch_merge_test.go: mergeAllowFlag truth table, user-ID intersection, deploy-key pass-through. - regenerate swagger v1 + openapi3 specs. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 17:48:47 -05:00
jmiller	6c0c2c3f1f	Merge pull request 'chore(sync): cascade main -> dev' (#748) from main into dev	2026-07-05 22:03:31 +00:00
jmiller	3efbab985b	Merge pull request 'fix(locale): duplicate en-US key crashes boot under jsonv2 (#696/#728)' (#743) from fix/locale-dup-key-jsonv2 into dev	2026-07-05 20:32:07 +00:00
jmiller	98b1ed2f7b	fix(locale): duplicate en-US key crashes server boot under jsonv2 ... The branch-protection delete feature (#696/#728) added a second "repo.settings.event_delete" entry ("Branch Deletion") to locale_en-US.json, reusing the existing webhook-event key (value "Delete"). The old JSON decoder silently kept the last value; Go 1.26's jsonv2 decoder rejects duplicate object keys, so InitLocales fails ("duplicate object member name repo.settings.event_delete") and the server crash-loops at startup. Like the code-scanner regexp panic, this only surfaces on a fresh boot, which is why it shipped unnoticed. Give the branch-protection section header its own key "repo.settings.protect_branch_deletion" and point protected_branch.tmpl at it, so the webhook "Delete" label and the branch-protection "Branch Deletion" header both render correctly and the JSON has no duplicate. Verified: no duplicate keys remain in any options/locale/*.json. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 15:21:31 -05:00
jmiller	ccfc9a604b	Merge pull request 'fix(security): code scanner RE2 lookahead panics server at startup (#552)' (#742) from fix/code-scanner-re2-panic into dev	2026-07-05 20:07:45 +00:00
jmiller	2f119fbd95	fix(security): code scanner panics at startup on RE2-incompatible regexp ... The "deserialize-yaml-py" rule in services/security/code_scanner.go used a negative lookahead `(?!\s*#)` in regexp.MustCompile. Go's regexp engine is RE2, which has no lookahead/lookbehind, so MustCompile panics during the package init() — crash-looping the entire server at startup. `go build` and `go vet` do not execute init(), and CI never boots the binary, so this shipped to main via #552 undetected; the running instances survived only because they predate that image. Replace the pattern with an RE2-safe equivalent `(?i)yaml\.load\s*\(`, which matches the rule's stated intent (flag yaml.load() without SafeLoader, CWE-502). Add a regression test that forces the package init and asserts every DefaultCodeRules pattern compiled, so a future RE2-incompatible pattern fails in CI here instead of on a live deploy. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 15:06:57 -05:00
jmiller	7f229ba01c	Merge pull request 'fix: org-governance release review findings + dev deploy targeting (#727, #733)' (#741) from fix/org-governance-review into dev	2026-07-05 19:51:06 +00:00
jmiller	e98fca780e	fix: address org-governance release review (#727, #733) + dev deploy targeting ... Code-review findings on the org-governance release: - Fail closed on org-rule lookup error: getFirstMatchProtectedBranchRule swallowed FindOrgBranchRuleForBranch errors (returned nil,nil), silently dropping the org floor and falling back to the repo rule on a transient DB error. Propagate the error so the org rule stays enforced. - Stop the org rule locking out deploy-key and Actions-bot pushes: OrgProtectedBranch is team-only, so mergeMostRestrictive was ANDing the repo's WhitelistDeployKeys / WhitelistActionsUser (and the force-push, delete and merge counterparts) against the org side's always-false zero value, blocking every deploy-key and Actions push in any org with a matching branch rule. Carry those org-unmanaged fields through from the repo rule unchanged. - Org push-policy max-file-size now inspects only the pushed delta (diff-tree + cat-file --batch-check) instead of the full tip tree via ls-tree, so a pre-existing oversized file can no longer permanently block unrelated pushes. New branches (no base commit) still scan the full tree. Dev deploy targeting: - deploy-dev.yml drove the dev container image via `sed` on the SHARED compose file, but the pattern matched the *prod* service line (container_name: mokogitea) — leaving the dev service pinned to a stale image (so every "green" deploy recreated old code) while corrupting the prod image pin. Drive the dev service image from ${MOKOGITEA_DEV_TAG} instead; the env-var only affects the dev service. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 14:46:01 -05:00
jmiller	7a4dc5e809	Merge pull request 'docs(api): OpenAPI spec + README/CHANGELOG for org-governance (#727, #738)' (#739) from feat/org-governance-openapi into dev	2026-07-05 15:19:08 +00:00
jmiller	8c63b00953	Merge pull request 'fix(ci): recreate dev container to avoid name conflict on deploy' (#740) from fix/deploy-dev-container-conflict into dev	2026-07-05 15:18:53 +00:00
jmiller	6b81922c47	fix(ci): recreate dev container to avoid name conflict on deploy ... After the tag fix (#737) the dev deploy builds and pushes the image fine but fails at `docker compose up -d` with: Conflict. The container name "/mokogitea-dev" is already in use The dev service uses a fixed container_name, and the symlinked /opt/gitea-dev path makes compose's derived project name unstable, so an existing container is not recognized as the project's and `up` tries to create rather than recreate. Remove any lingering fixed-name container first, pin the compose project name, and force a fresh recreate so migrations run against the new image. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 10:17:08 -05:00
jmiller	93365cdd95	docs(api): swagger annotations + response models for org-governance endpoints (#727, #738) ... Annotate the four previously undocumented org-governance API handlers (tag_protection, push_policy, repo_defaults, email_domain) with swagger:operation blocks, and register the swagger:response models the branch_protection operations already referenced. Register the org option DTOs in the parameterBodies hack so their definitions are emitted. Also fix pre-existing spec-generation blockers surfaced once the spec became regenerable: a stray comment glued to the repoUpdateManifest swagger block (broke YAML parsing), missing owner/repo path params on the manifest operations, a Manifest response registration, and missing definitions for EditAccessTokenOption, the IssueBulk* options, and the Issue{Priority,Status,Type}Def types. Regenerated v1_json.tmpl and v1_openapi3_json.tmpl; spec now validates cleanly against Swagger 2.0. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 01:58:08 -05:00
jmiller	81ea2fcb05	docs: README org-governance feature + CHANGELOG CI fixes (#727) ... Add an Org Governance entry to the README key-features list (org-wide branch/tag protection, push policy, repo defaults, email-domain allowlist) and record the recent build/CI fixes (#734, #735, #736, #737) under CHANGELOG [Unreleased]. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 01:28:36 -05:00
jmiller	2713c49aec	Merge pull request 'fix(ci): pass TAG/REGISTRY_TOKEN into remote shell in dev deploy' (#737) from fix/deploy-dev-var-expansion into dev	2026-07-05 06:15:01 +00:00
jmiller	3917bf6a29	fix(ci): pass TAG/REGISTRY_TOKEN into remote shell in dev deploy ... The dev deploy step used an unquoted SSH heredoc and referenced runner-side values as \$TAG / \$REGISTRY_TOKEN, deferring their expansion to the remote shell where those names are unset. The Docker build tag collapsed to "mokogitea:" and every dev deploy failed with `invalid tag ... invalid reference format` before any migration or server boot could run. Inject TAG and REGISTRY_TOKEN as an env prefix on the ssh command (`TAG='...' REGISTRY_TOKEN='...' bash -s`) and switch to a quoted heredoc so every $var expands in exactly one place: the remote host. Also fixes HEALTH_FMT (was defined on the runner but referenced remotely) and adds an explicit empty-TAG guard so a future regression fails loudly instead of building an untagged image. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 01:08:32 -05:00
jmiller	89ed32e961	Merge pull request 'fix: repair unit-test compile + vet failures (partial integration cleanup)' (#736) from fix/vet-test-suite-blockers into dev	2026-07-05 05:58:38 +00:00
jmiller	948e7bcd21	fix: partial repair of tests/integration compile errors (license test) ... api_license_keys_test.go used the outdated NewRequestWithBody signature (passing []byte where io.Reader is now required) — wrapped the string bodies in strings.NewReader. Note: tests/integration remains broadly pre-existing-broken across multiple other fork-added files (api_packages_composer type mismatch, etc.); those are a separate dedicated cleanup, not part of #727. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 00:27:30 -05:00
jmiller	5d797431f0	fix: repair pre-existing test-suite compile/vet failures ... `go vet ./...` (finally runnable with a local Go toolchain) surfaced three pre-existing failures that prevented the whole test tree from compiling — which is very likely why the "Project CI / Tests" job never went green. None relate to #727; all pre-existing on main. - modules/util/util_test.go: CryptoRandomInt/String/Bytes now return (value, error); the tests used single-value assignment. Updated to capture + assert the error (and dropped a now-redundant `var err error`). - tests/integration/auth_oauth2_test.go: `newFakeOIDCServer` was declared twice with different signatures (redeclaration = build failure). Renamed the config-struct variant to `newFakeOIDCServerWithConfig` and updated its caller; the (sub, oid) variant keeps the original name for its caller. - routers/web/repo/issue_comment.go: removed a redundant `&& statusIDStr != ""` duplicate condition (vet: redundant and). Verified: `go vet ./modules/util` clean; full `go vet ./...` re-run. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 00:23:04 -05:00
jmiller	63f773aa56	Merge pull request 'fix: repair build (renamed org-visibility helper) + gofmt' (#735) from fix/compile-hasorgvisible-and-gofmt into dev	2026-07-05 05:07:58 +00:00
jmiller	125eefc650	fix: repair build (renamed org-visibility helper) + gofmt ... Two pre-existing issues surfaced when the org-governance series was compiled locally with a real Go toolchain (go1.26.3) for the first time: - routers/api/v1/api.go:519 called organization.HasOrgOrUserVisible, which no longer exists — it was renamed to IsOwnerVisibleToDoer (models/organization/ org.go:548, identical signature). This one missed call site meant the whole routers/api/v1 package (and therefore the server binary) failed `go build`. With the rename, `go build ./...` is clean. - gofmt: api.go (a mis-indented commented-out /projects route block) and release.go (import sort: repo before updateserver) were gofmt-dirty. Fixed with gofmt -w on the two files this change already touches. Not part of #727, but blocks building/releasing the fork; found while validating the dev -> main promotion (#733). Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-05 00:06:48 -05:00
jmiller	d07cfd412b	Merge pull request 'chore: remove stray package-lock.json accidentally committed to dev' (#734) from chore/remove-stray-package-lock into dev	2026-07-05 04:40:58 +00:00
jmiller	bd821e2d44	chore: remove stray package-lock.json accidentally committed to dev ... package-lock.json (13.9k lines of generated npm lockfile) was swept into the org push-policy commit (3aac1b456c, #730) by a `git add -A` during a gofmt-fix restack. It is not tracked on main and is not part of the org-governance work. Removing it so the dev -> main promotion (#733) doesn't introduce it. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 23:40:16 -05:00
jmiller	aeed197ea5	Merge pull request 'feat(org): org-level email domain policy for members (#727)' (#732) from feat/org-email-domain into dev	2026-07-05 04:34:14 +00:00
jmiller	45fc346d52	Merge pull request 'feat(org): org-level repository defaults applied on repo create/transfer (#727)' (#731) from feat/org-repo-defaults into dev	2026-07-05 04:33:25 +00:00
jmiller	02071a23d6	Merge pull request 'feat(org): org-level push policy enforced in the pre-receive hook (#727)' (#730) from feat/org-push-policy into dev	2026-07-05 04:33:09 +00:00
jmiller	3a5c6a37cf	Merge pull request 'feat(org): org-level tag protection, layered with per-repo protected tags (#727)' (#729) from feat/org-tag-protection into dev	2026-07-05 04:32:53 +00:00
jmiller	37fb3703c7	Merge pull request 'fix(org): layer org-level branch protection with repo rules — most-restrictive wins (#727)' (#728) from fix/727-materialize-org-branch-protection into dev	2026-07-05 04:32:24 +00:00
jmiller	6a3db171c1	feat(org): org-level email domain policy for members (#727) ... Restricts which email domains an organization's members may have. When a policy is configured, a user can only be added to the org (via any team) if their primary email matches one of the allowed domain globs. Enforced at the single membership choke point services/org.AddTeamMember, which every add path (API, web, group-sync) funnels through — so one check covers them all. On violation it returns a typed ErrEmailDomainNotAllowed; the API team-add handler maps it to 422. - models/git/org_email_domain.go: OrgEmailDomainPolicy model + EmailAllowed (domain glob match) + OrgEmailDomainAllowed + typed error + CRUD. Migration 366. - API: GET/PATCH/DELETE /orgs/{org}/email_domain_policy. - Enforcement in services/org/team.go; 422 mapping in routers/api/v1/org/team.go. An empty policy imposes no restriction. This is the one bounded piece of the "access/security" tier; org 2FA-required and IP allowlists were deliberately NOT built here — they are cross-cutting enforcement (auth gating / request middleware) that needs a compiler + tests, not a blind stacked PR. Stacked on #731/#730/#729/#728 for migration ordering (this = 366). Swagger omitted. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block), imports (git_model added to the api team handler, gci order), typed-error detection, migration contiguous (366). Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 23:23:11 -05:00
jmiller	d3134b1c53	feat(org): org-level repository defaults applied on repo create/transfer (#727) ... Adds a single per-org repository-defaults config, applied to a repo when it is created in or transferred into the org via a notifier (services/org): - ForcePrivate — force new/transferred repos private (Repository.IsPrivate). - PR defaults (when ApplyPRDefaults) — allowed merge styles, default merge style, and auto-delete-branch-after-merge, written to the repo's pull-requests unit config via repo_service.UpdateRepositoryUnits. Best-effort: the notifier logs and swallows errors, so a defaults bug can never break repository creation or transfer. - models/git/org_repo_defaults.go: OrgRepoDefaults model + CRUD + migration 365. - API: GET/PATCH/DELETE /orgs/{org}/repo_defaults. - services/org/notifier.go: CreateRepository/TransferRepository -> apply defaults; registered from routers/init.go (org_service.Init()). Stacked on #730/#729/#728 for migration ordering (this = 365). Swagger omitted. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block, struct/DTO alignment), imports used, no Init() collision in services/org, migration contiguous (365), notifier signatures match the Notifier interface. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 23:22:38 -05:00
jmiller	3aac1b456c	feat(org): org-level push policy enforced in the pre-receive hook (#727) ... Adds a single per-org push policy that cascades to every repo of the org and is enforced in the pre-receive hook: - Branch/tag name conventions (glob) — a pushed ref name must match. Fail-closed. - Mandatory secret-scanning block-on-push — org can force secret blocking that a repo cannot disable (overrides the per-repo scanner config in the orchestrator). - Max pushed-file size — rejects a tip tree containing a blob over the limit. - Blocked file-path patterns — rejects pushes changing matching paths (reuses pull_service.CheckFileProtection). The two content checks (blocked paths, max size) FAIL OPEN on any error so a policy/parsing bug can never wedge all pushes; naming is fail-closed. - models/git/org_push_policy.go: OrgPushPolicy model + CRUD + matchers + GetOrgPushPolicyForRepo. Migration 364. - API: GET/PATCH/DELETE /orgs/{org}/push_policy (routers/api/v1/org/push_policy.go, DTOs in modules/structs/org_push_policy.go, wired in api.go). - Enforcement: routers/private/hook_pre_receive.go (branch: naming + blocked paths + max size; tag: naming) and services/security/orchestrator.go (secret mandate). Deferred: a repo-facing read-only view of the org push policy (it is an org-wide config, not per-repo overlay rules; readable via the API for now). Stacked on #729/#728 for migration ordering (this = 364). Swagger annotations omitted (can't regenerate without the toolchain). Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block), escape sequences in the ls-tree parser, imports used, migration contiguous (364), fail-open on content checks. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 23:20:39 -05:00
jmiller	b31336d1fe	feat(org): org-level tag protection, layered with per-repo protected tags (#727) ... Adds org-level tag protection as a parallel to org-level branch protection. An org tag rule is {NamePattern, AllowlistTeamIDs}; it cascades to every repo in the org and layers on top of the repo's own protected tags — a tag is controllable (push/delete) only if allowed at BOTH levels (fail-closed). - models/git/org_protected_tag.go: OrgProtectedTag model + CRUD + ToProtectedTag() (reuses the ProtectedTag matcher/allowlist logic) + IsUserAllowedToControlTagInRepo() which ANDs the repo decision with the org decision. Migration 363. - API: /orgs/{org}/tag_protections CRUD (routers/api/v1/org/tag_protection.go, DTOs in modules/structs/org_tag.go, wired in api.go). - Enforcement: the git push/delete hook (hook_pre_receive.go) and the two release paths (release.go create/delete) now call the layered check, so no per-site tag logic changes beyond swapping the helper. - View: the repo Tag settings page lists inherited org tag rules read-only. Stacked on #728 (branch-protection PR) for migration ordering — merge #728 first. Swagger annotations omitted (can't regenerate the swagger JSON without the toolchain); routes still register. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Hand-verified: gofmt (tabs, no blank-in-block, struct alignment), template nesting balances, all .Rule fields exist on OrgProtectedTag, all locale keys defined, JSON valid, migration contiguous (363). Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 21:37:18 -05:00
jmiller	4b68853f08	feat(org): add branch-deletion protection + expandable inherited-rule view (#727) ... Two related additions: 1. Branch deletion as an org-level ability. OrgProtectedBranch gained CanDelete / EnableDeleteAllowlist / DeleteAllowlistTeamIDs (migration 362), ToProtectedBranch maps them, and the API (create/edit/response DTOs + handlers) exposes enable_delete / enable_delete_allowlist / delete_allowlist_teams. The layering merge already combined delete fields, so org delete-protection now enforces once ToProtectedBranch populates them. 2. The repo Branch Protection view now renders each inherited org rule as an expandable detail (direct push, force-push, branch deletion, merge, required approvals, status checks, protected files) with team names resolved, instead of three headline badges. Still read-only. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Verified by hand: struct-field gofmt alignment, template block nesting balances, every .Rule field exists on OrgProtectedBranch, and all locale keys referenced in the template are defined. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 21:16:24 -05:00
jmiller	86bd8a2cad	feat(org): show inherited org branch-protection rules in repo settings (#727) ... The org "floor" is enforced implicitly at the choke point, so a repo admin couldn't see which org-level rules apply to their repo. Surface them in the repo's Branch Protection settings page (read-only), the way GitHub shows organization rulesets in a repository. - ProtectedBranchRules handler: when the owner is an org, load FindOrgProtectedBranchRules and expose them as OrgProtectedBranches. - branches.tmpl: new read-only "Organization Branch Protection" section listing each org rule with an "Organization" badge, a lock/read-only marker, and compact indicators (required approvals, signed commits, status checks). No edit/delete controls — these are managed at the org level. - en-US locale strings. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 20:25:24 -05:00
jmiller	24b3516c1d	fix(org): layer org-level branch protection with repo rules, most-restrictive wins (#727) ... Org-level branch protection was already consulted at the single enforcement choke point `GetFirstMatchProtectedBranchRule`, but only as a FALLBACK: if any repo-level rule matched the branch, the org rule was ignored entirely. That let a repo define a looser rule for a pattern and effectively opt out of the org's protection. Make the choke point LAYER the two rules instead: when both an org rule and a repo rule match a branch, return their most-restrictive (fail-closed) combination, so the org rule is a mandatory floor a repo can only tighten. - models/git/protected_branch_merge.go: mergeMostRestrictive + helpers. Allow flags AND'd; gate/require/block flags OR'd; RequiredApprovals max'd; required sets (status contexts, protected files) unioned; allow sets (whitelists, unprotected files) intersected. A disabled allowlist means "everyone", so it only constrains when enabled. - models/git/protected_branch_list.go: GetFirstMatchProtectedBranchRule now fetches both the repo rule and the org rule and merges when both match; returns whichever exists when only one matches. Org lookup factored into getFirstMatchOrgProtectedBranchRule. Supersedes the materialization approach previously proposed for this issue — the org fallback already existed, so only this one function needed to change. Fail-closed by design: any merge edge errs toward MORE protection (over-restrict) rather than less, so it cannot open a hole. Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here — relying on CI to validate build, formatting, and tests. Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT	2026-07-04 19:42:08 -05:00
jmiller	343cba690e	Update .mokogitea/ISSUE_TEMPLATE/feature_request.md	2026-07-01 05:18:57 +00:00