jmiller
6a3db171c1
Universal: PR Check / Branch Policy (pull_request) Successful in 1s
PR RC Release / Build RC Release (pull_request) Successful in 3s
Universal: PR Check / Validate PR (pull_request) Successful in 12s
Generic: Project CI / Lint & Validate (pull_request) Successful in 25s
Universal: PR Check / Secret Scan (pull_request) Successful in 1m2s
RC Revert / Rename rc/ back to dev/ (pull_request) Has been skipped
Branch Cleanup / Delete merged branch (pull_request) Successful in 4s
Generic: Project CI / Tests (pull_request) Has been cancelled
Universal: PR Check / Build RC Package (pull_request) Has been cancelled
Universal: PR Check / Report Issues (pull_request) Has been cancelled
Restricts which email domains an organization's members may have. When a policy
is configured, a user can only be added to the org (via any team) if their
primary email matches one of the allowed domain globs.
Enforced at the single membership choke point services/org.AddTeamMember, which
every add path (API, web, group-sync) funnels through — so one check covers them
all. On violation it returns a typed ErrEmailDomainNotAllowed; the API team-add
handler maps it to 422.
- models/git/org_email_domain.go: OrgEmailDomainPolicy model + EmailAllowed
(domain glob match) + OrgEmailDomainAllowed + typed error + CRUD. Migration 366.
- API: GET/PATCH/DELETE /orgs/{org}/email_domain_policy.
- Enforcement in services/org/team.go; 422 mapping in routers/api/v1/org/team.go.
An empty policy imposes no restriction. This is the one bounded piece of the
"access/security" tier; org 2FA-required and IP allowlists were deliberately NOT
built here — they are cross-cutting enforcement (auth gating / request
middleware) that needs a compiler + tests, not a blind stacked PR.
Stacked on #731/#730/#729/#728 for migration ordering (this = 366). Swagger
omitted.
Note: no Go toolchain available locally, so not compiled/gofmt'd/tested here.
Hand-verified: gofmt (tabs, no blank-in-block), imports (git_model added to the
api team handler, gci order), typed-error detection, migration contiguous (366).
Claude-Session: https://claude.ai/code/session_01Wsno14cxE49MstXFs9G5KT
MokoGitea
Custom Gitea fork with enhanced wiki system, DLID licensing, issue statuses, cascade merge, security scanning, org metadata, CI standardization, and project board API.
Key Features
- Wiki System -- wikilinks, categories, backlinks, template transclusion, revision diffs, rename redirects, folder ACL, enhanced ToC, print view, ZIP export (details)
- DLID Licensing -- license management, entitlements, domain activations, ed25519-signed downloads
- API Token Scope Editing -- edit token scopes via API (PATCH) or web UI after creation
- Issue Statuses -- custom workflow statuses per org with required baseline protection, presets, cross-org migration
- Cascade Merge -- auto-create PRs to downstream branches after merge with configurable rules per repo
- Security Scanning -- secret detection (pre-receive blocking) + code analysis (SQL injection, XSS, command injection, path traversal, and more) with REST API for alerts, config, and on-demand scans
- Default Org Teams -- auto-create Developers, Reviewers, and CI/CD teams on org creation
- Org Metadata -- per-repo metadata API (public GET, admin PUT), platform detection for versioning
- Branch Protection -- delete allowlist for protected branches (per-user/team/deploy-key)
- Project Board API -- REST endpoints for project columns and cards
- CI Infrastructure -- reusable workflows, centralized ci-issue-reporter, standardized MOKOGITEA_TOKEN naming
- Dev Deploy Gate -- builds deploy to dev environment first, production checks dev health
Documentation
- Org Wiki -- standards, CLI reference, API docs
- Wiki Features -- all 10 wiki enhancements
- Licensing API
- Repo Wiki -- feature docs, API reference, operations
Contributing
See the org wiki for development guidelines, coding standards, and contribution instructions.
License
This project is licensed under the GNU General Public License v3.0 or later -- see the LICENSE file.