Merge pull request 'feat(settings): manifest auto-sync on push + wiki pages' (#510) from feat/315-manifest-settings into dev

Also includes:
- Auto-sync manifest.xml to DB on push to default branch
- Wiki pages for custom fields, custom statuses, manifest settings
- Updated wiki home page with all current features

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.mokogitea/CLAUDE.md

@@ -0,0 +1,42 @@
+# MokoGitea
+
+Fork of Gitea — self-hosted Git service at git.mokoconsulting.tech. Go backend + TypeScript frontend.
+
+## Quick Reference
+
+| Field | Value |
+|---|---|
+| **Language** | Go 1.26+ / TypeScript |
+| **Module** | `code.mokoconsulting.tech/MokoConsulting/MokoGitea` |
+| **Branch** | develop on `dev`, merge to `main` (protected) |
+| **Wiki** | [MokoGitea Wiki](https://git.mokoconsulting.tech/MokoConsulting/MokoGitea/wiki) |
+
+## Commands
+
+```bash
+make help             # List all available targets
+make fmt              # Format .go files
+make lint-go          # Lint Go code
+make lint-js          # Lint TypeScript
+make tidy             # After go.mod changes
+make build            # Build binary
+
+# Testing
+go test -run '^TestName$' ./modulepath/        # Single Go test
+pnpm exec vitest <path-filter>                 # Single JS test
+GITEA_TEST_E2E_FLAGS='<filepath>' make test-e2e  # Single Playwright test
+```
+
+## Rules
+
+- Add current year copyright header on new `.go` files
+- No trailing whitespace in edited files
+- Conventional Commits for commit messages and PR titles
+- Never force-push, amend, or squash unless asked — use new commits
+- Preserve existing code comments
+- TypeScript: use `!` (non-null assertion) not `?.`/`??` when value is known to exist
+- CSS: prefer `flex-*` helpers over per-child `tw-ml-*`/`tw-mr-*` margins
+- Add `Co-Authored-By` lines to all commits
+- **Workflow directory**: `.mokogitea/` (not `.gitea/` or `.github/`)
+- **Attribution**: `Authored-by: Moko Consulting`
+- **Standards**: [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/moko-platform/wiki/Home)

.mokogitea/manifest.xml

@@ -4,7 +4,7 @@
         <name>MokoGitea</name>
         <org>MokoConsulting</org>
         <description>Moko fork of Gitea — adding project board REST API endpoints and custom enhancements</description>
-        <version>05.14.00</version>
+        <version>05.47.00</version>
         <license spdx="GPL-3.0-or-later">GNU General Public License v3</license>
     </identity>
     <governance>

.mokogitea/workflows/auto-release.yml

@@ -102,13 +102,14 @@ jobs:
         run: |
           php /tmp/moko-platform-api/cli/release_publish.php \
             --path . --stability rc --bump minor --branch rc \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}"
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
+            --skip-update-stream
 
       - name: Summary
         if: always()
         run: |
           echo "## Promoted to Release Candidate" >> $GITHUB_STEP_SUMMARY
-          echo "Branch renamed to rc, minor bump, RC + lesser stream releases built, updates.xml synced" >> $GITHUB_STEP_SUMMARY
+          echo "Branch renamed to rc, minor bump, RC release built (updates.xml managed by Gitea Pages)" >> $GITHUB_STEP_SUMMARY
 
   # ── Merged PR → Build & Release (or promote RC to stable) ────────────────────
   release:
@@ -167,7 +168,8 @@ jobs:
         run: |
           php /tmp/moko-platform-api/cli/release_publish.php \
             --path . --stability stable --bump minor --branch main \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}"
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
+            --skip-update-stream
 
       # -- STEP 9: Mirror to GitHub (stable only) --------------------------------
       - name: "Step 9: Mirror release to GitHub"

.mokogitea/workflows/issue-branch.yml

@@ -5,7 +5,7 @@
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
 # INGROUP: moko-platform.Automation
-# VERSION: 05.14.00
+# VERSION: 05.47.00
 # BRIEF: Auto-create feature branch when an issue is opened
 
 name: "Universal: Issue Branch"

.mokogitea/workflows/pr-check.yml

@@ -147,6 +147,98 @@ jobs:
           echo "PHP lint: ${ERRORS} error(s)"
           [ "$ERRORS" -eq 0 ] || { echo "::error::PHP syntax errors found"; exit 1; }
 
+      - name: Joomla JEXEC guard check
+        if: steps.platform.outputs.platform == 'joomla'
+        run: |
+          ERRORS=0
+          while IFS= read -r -d '' file; do
+            # Skip vendor, node_modules, and index.html stub files
+            case "$file" in ./vendor/*|./node_modules/*) continue ;; esac
+            # Check first 10 lines for JEXEC or JPATH guard
+            if ! head -20 "$file" | grep -qE "defined\s*\(\s*['\"](_JEXEC|JPATH_BASE|\\\\JPATH_PLATFORM)['\"]"; then
+              echo "::error file=${file}::Missing JEXEC guard: ${file}"
+              ERRORS=$((ERRORS + 1))
+            fi
+          done < <(find . -name "*.php" -path "*/src/*" -not -path "./.git/*" -not -path "./vendor/*" -print0)
+          if [ "$ERRORS" -gt 0 ]; then
+            echo "::error::${ERRORS} PHP file(s) missing defined('_JEXEC') or die guard"
+            echo "## JEXEC Guard Check: Failed" >> $GITHUB_STEP_SUMMARY
+            echo "${ERRORS} file(s) in src/ are missing the Joomla execution guard." >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+          echo "JEXEC guard: OK"
+
+      - name: Joomla directory listing protection
+        if: steps.platform.outputs.platform == 'joomla'
+        run: |
+          MISSING=0
+          SOURCE_DIR="src"
+          [ ! -d "$SOURCE_DIR" ] && exit 0
+          while IFS= read -r dir; do
+            if [ ! -f "${dir}/index.html" ]; then
+              echo "::warning::Missing index.html in ${dir} (directory listing protection)"
+              MISSING=$((MISSING + 1))
+            fi
+          done < <(find "$SOURCE_DIR" -type d -not -path "./.git/*" -not -path "*/vendor/*" -not -path "*/node_modules/*")
+          if [ "$MISSING" -gt 0 ]; then
+            echo "## Directory Protection" >> $GITHUB_STEP_SUMMARY
+            echo "${MISSING} director(ies) missing index.html" >> $GITHUB_STEP_SUMMARY
+          fi
+          echo "Directory protection: ${MISSING} missing (advisory)"
+
+      - name: Joomla script file and asset checks
+        if: steps.platform.outputs.platform == 'joomla'
+        run: |
+          ERRORS=0
+          MANIFEST=$(find . -maxdepth 3 -name "*.xml" ! -path "./.git/*" -exec grep -l '<extension' {} \; 2>/dev/null | head -1)
+          [ -z "$MANIFEST" ] && exit 0
+          MANIFEST_DIR=$(dirname "$MANIFEST")
+
+          # Check scriptfile exists if declared
+          SCRIPTFILE=$(sed -n 's/.*<scriptfile>\([^<]*\)<\/scriptfile>.*/\1/p' "$MANIFEST" 2>/dev/null)
+          if [ -n "$SCRIPTFILE" ]; then
+            if [ ! -f "${MANIFEST_DIR}/${SCRIPTFILE}" ]; then
+              echo "::error::Manifest declares <scriptfile>${SCRIPTFILE}</scriptfile> but file not found at ${MANIFEST_DIR}/${SCRIPTFILE}"
+              ERRORS=$((ERRORS + 1))
+            else
+              echo "Script file: ${MANIFEST_DIR}/${SCRIPTFILE} (OK)"
+            fi
+          fi
+
+          # Require joomla.asset.json and validate it
+          ASSET_JSON=$(find "$MANIFEST_DIR" -name "joomla.asset.json" -not -path "./.git/*" 2>/dev/null | head -1)
+          if [ -z "$ASSET_JSON" ]; then
+            echo "::error::joomla.asset.json not found — Joomla asset system is required"
+            ERRORS=$((ERRORS + 1))
+          else
+            if command -v php &> /dev/null; then
+              php -r "json_decode(file_get_contents('$ASSET_JSON')); if(json_last_error()!==JSON_ERROR_NONE){echo json_last_error_msg();exit(1);}" 2>&1 || {
+                echo "::error::joomla.asset.json is not valid JSON"
+                ERRORS=$((ERRORS + 1))
+              }
+            fi
+            echo "joomla.asset.json: valid"
+          fi
+
+          # Validate all XML files in src/ are well-formed
+          XML_ERRORS=0
+          if command -v php &> /dev/null; then
+            while IFS= read -r -d '' xmlfile; do
+              if ! php -r "libxml_use_internal_errors(true); \$x = simplexml_load_file('$xmlfile'); if(!\$x){foreach(libxml_get_errors() as \$e) echo trim(\$e->message) . ' in $xmlfile'; exit(1);}" 2>&1; then
+                XML_ERRORS=$((XML_ERRORS + 1))
+              fi
+            done < <(find "$MANIFEST_DIR" -name "*.xml" -not -path "./.git/*" -print0)
+          fi
+          if [ "$XML_ERRORS" -gt 0 ]; then
+            echo "::error::${XML_ERRORS} XML file(s) are malformed"
+            ERRORS=$((ERRORS + 1))
+          else
+            echo "XML well-formedness: OK"
+          fi
+
+          [ "$ERRORS" -gt 0 ] && exit 1
+          echo "Joomla asset checks: OK"
+
       - name: Validate platform manifest
         run: |
           PLATFORM="${{ steps.platform.outputs.platform }}"
@@ -164,6 +256,13 @@ jobs:
               for ELEMENT in name version description; do
                 grep -q "<${ELEMENT}>" "$MANIFEST" || { echo "::error::Missing <${ELEMENT}> in manifest"; exit 1; }
               done
+              # Block legacy raw/branch update server URLs on MokoGitea
+              RAW_URLS=$(grep -n 'raw/branch' "$MANIFEST" | grep -i 'mokoconsulting\|mokogitea\|git\.mokoconsulting\.tech' || true)
+              if [ -n "$RAW_URLS" ]; then
+                echo "::error::Manifest contains legacy raw/branch update server URL on MokoGitea. Use the Gitea Pages URL instead (e.g. /{REPO}/updates.xml not /{REPO}/raw/branch/main/updates.xml)"
+                echo "$RAW_URLS"
+                exit 1
+              fi
               echo "Joomla manifest valid"
               ;;
             dolibarr)
@@ -196,6 +295,138 @@ jobs:
               ;;
           esac
 
+      - name: Validate Joomla language files
+        if: steps.platform.outputs.platform == 'joomla'
+        run: |
+          ERRORS=0
+          WARNINGS=0
+
+          # Require both en-GB and en-US language directories
+          LANG_ROOT=$(find . -path "*/language" -type d -not -path "./.git/*" 2>/dev/null | head -1)
+          if [ -z "$LANG_ROOT" ]; then
+            echo "No language/ directory found — skipping"
+            exit 0
+          fi
+
+          if [ ! -d "$LANG_ROOT/en-GB" ]; then
+            echo "::error::Missing en-GB language directory (${LANG_ROOT}/en-GB)"
+            ERRORS=$((ERRORS + 1))
+          fi
+          if [ ! -d "$LANG_ROOT/en-US" ]; then
+            echo "::error::Missing en-US language directory (${LANG_ROOT}/en-US)"
+            ERRORS=$((ERRORS + 1))
+          fi
+
+          # Check that en-GB and en-US have matching .ini files
+          if [ -d "$LANG_ROOT/en-GB" ] && [ -d "$LANG_ROOT/en-US" ]; then
+            for GB_INI in "$LANG_ROOT/en-GB"/*.ini; do
+              [ ! -f "$GB_INI" ] && continue
+              US_INI="$LANG_ROOT/en-US/$(basename "$GB_INI")"
+              if [ ! -f "$US_INI" ]; then
+                echo "::error::$(basename "$GB_INI") exists in en-GB but missing from en-US"
+                ERRORS=$((ERRORS + 1))
+              fi
+            done
+            for US_INI in "$LANG_ROOT/en-US"/*.ini; do
+              [ ! -f "$US_INI" ] && continue
+              GB_INI="$LANG_ROOT/en-GB/$(basename "$US_INI")"
+              if [ ! -f "$GB_INI" ]; then
+                echo "::error::$(basename "$US_INI") exists in en-US but missing from en-GB"
+                ERRORS=$((ERRORS + 1))
+              fi
+            done
+          fi
+
+          # Find all .ini language files
+          INI_FILES=$(find . -path "*/language/*/*.ini" -not -path "./.git/*" 2>/dev/null)
+          if [ -z "$INI_FILES" ]; then
+            echo "No .ini language files found"
+            [ "$ERRORS" -gt 0 ] && exit 1
+            exit 0
+          fi
+
+          echo "Found $(echo "$INI_FILES" | wc -l) language file(s)"
+
+          for FILE in $INI_FILES; do
+            FNAME=$(basename "$FILE")
+            LINENUM=0
+            SEEN_KEYS=""
+
+            while IFS= read -r line || [ -n "$line" ]; do
+              LINENUM=$((LINENUM + 1))
+
+              # Skip empty lines and comments
+              [ -z "$line" ] && continue
+              echo "$line" | grep -qE '^\s*;' && continue
+              echo "$line" | grep -qE '^\s*$' && continue
+
+              # Must match KEY="VALUE" format
+              if ! echo "$line" | grep -qE '^[A-Z_][A-Z0-9_]*=".*"$'; then
+                echo "::error file=${FILE},line=${LINENUM}::Malformed line: ${line}"
+                ERRORS=$((ERRORS + 1))
+                continue
+              fi
+
+              # Extract key and check for duplicates
+              KEY=$(echo "$line" | sed 's/=.*//')
+              if echo "$SEEN_KEYS" | grep -qx "$KEY"; then
+                echo "::error file=${FILE},line=${LINENUM}::Duplicate key: ${KEY}"
+                ERRORS=$((ERRORS + 1))
+              fi
+              SEEN_KEYS="${SEEN_KEYS}
+          ${KEY}"
+            done < "$FILE"
+
+            echo "  ${FILE}: checked ${LINENUM} lines"
+          done
+
+          # Cross-check en-GB vs en-US key consistency
+          GB_DIR=$(find . -path "*/language/en-GB" -type d -not -path "./.git/*" 2>/dev/null | head -1)
+          US_DIR=$(find . -path "*/language/en-US" -type d -not -path "./.git/*" 2>/dev/null | head -1)
+
+          if [ -n "$GB_DIR" ] && [ -n "$US_DIR" ]; then
+            for GB_FILE in "$GB_DIR"/*.ini; do
+              [ ! -f "$GB_FILE" ] && continue
+              FNAME=$(basename "$GB_FILE")
+              US_FILE="$US_DIR/$FNAME"
+              [ ! -f "$US_FILE" ] && continue
+
+              GB_KEYS=$(grep -oP '^[A-Z_][A-Z0-9_]*(?==)' "$GB_FILE" 2>/dev/null | sort)
+              US_KEYS=$(grep -oP '^[A-Z_][A-Z0-9_]*(?==)' "$US_FILE" 2>/dev/null | sort)
+
+              # Keys in en-GB but not en-US
+              MISSING_US=$(comm -23 <(echo "$GB_KEYS") <(echo "$US_KEYS"))
+              if [ -n "$MISSING_US" ]; then
+                echo "::warning::Keys in en-GB/$FNAME but missing from en-US/$FNAME:"
+                echo "$MISSING_US" | while read -r k; do echo "  - $k"; done
+                WARNINGS=$((WARNINGS + 1))
+              fi
+
+              # Keys in en-US but not en-GB
+              MISSING_GB=$(comm -13 <(echo "$GB_KEYS") <(echo "$US_KEYS"))
+              if [ -n "$MISSING_GB" ]; then
+                echo "::warning::Keys in en-US/$FNAME but missing from en-GB/$FNAME:"
+                echo "$MISSING_GB" | while read -r k; do echo "  - $k"; done
+                WARNINGS=$((WARNINGS + 1))
+              fi
+            done
+          fi
+
+          {
+            echo "### Language File Validation"
+            echo "| Metric | Count |"
+            echo "|---|---|"
+            echo "| Files checked | $(echo "$INI_FILES" | wc -l) |"
+            echo "| Errors | ${ERRORS} |"
+            echo "| Warnings | ${WARNINGS} |"
+          } >> $GITHUB_STEP_SUMMARY
+
+          if [ "$ERRORS" -gt 0 ]; then
+            echo "::error::Language validation failed with ${ERRORS} error(s)"
+            exit 1
+          fi
+          echo "Language files: OK (${WARNINGS} warning(s))"
+
       - name: Check changelog has unreleased entry
         run: |
           if [ ! -f "CHANGELOG.md" ]; then

.mokogitea/workflows/pre-release.yml

@@ -0,0 +1,241 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: moko-platform.Release
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
+# PATH: /templates/workflows/universal/pre-release.yml.template
+# VERSION: 05.01.00
+# BRIEF: Manual pre-release -- builds dev/alpha/beta/rc packages from any branch
+
+name: "Universal: Pre-Release"
+
+on:
+  pull_request:
+    types: [closed]
+    branches:
+      - dev
+  pull_request_target:
+    types: [synchronize, opened, reopened]
+    branches:
+      - main
+  workflow_dispatch:
+    inputs:
+      stability:
+        description: 'Pre-release channel'
+        required: true
+        type: choice
+        options:
+          - development
+          - alpha
+          - beta
+          - release-candidate
+
+permissions:
+  contents: write
+
+env:
+  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  GITEA_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
+  GITEA_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
+
+jobs:
+  build:
+    name: "Build Pre-Release (${{ inputs.stability || 'development' }})"
+    runs-on: release
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request' && github.event.pull_request.merged == true && github.event.pull_request.base.ref == 'dev') ||
+      (github.event_name == 'pull_request_target' && github.event.pull_request.base.ref == 'main')
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
+          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.sha || '' }}
+
+      - name: Setup moko-platform tools
+        env:
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
+        run: |
+          # Use pre-installed /opt/moko-platform if available (updated by cron every 6h)
+          if [ -f “/opt/moko-platform/cli/version_bump.php” ] && [ -f “/opt/moko-platform/vendor/autoload.php” ]; then
+            echo “Using pre-installed /opt/moko-platform”
+            echo “MOKO_CLI=/opt/moko-platform/cli” >> “$GITHUB_ENV”
+          else
+            echo “Falling back to fresh clone”
+            if ! command -v composer &> /dev/null; then
+              sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
+            fi
+            rm -rf /tmp/moko-platform-api
+            git clone --depth 1 --branch main --quiet \
+              “https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/moko-platform.git” \
+              /tmp/moko-platform-api
+            cd /tmp/moko-platform-api && composer install --no-dev --no-interaction --quiet
+            echo “MOKO_CLI=/tmp/moko-platform-api/cli” >> “$GITHUB_ENV”
+          fi
+
+      - name: Detect platform
+        id: platform
+        run: |
+          php ${MOKO_CLI}/manifest_read.php --path . --github-output
+
+      - name: Resolve metadata and bump version
+        id: meta
+        run: |
+          # Auto-detect stability: RC for PRs targeting main, else use input or default to development
+          if [ "${{ github.event_name }}" = "pull_request_target" ] && [ "${{ github.event.pull_request.base.ref }}" = "main" ]; then
+            STABILITY="release-candidate"
+          else
+            STABILITY="${{ inputs.stability || 'development' }}"
+          fi
+
+          case "$STABILITY" in
+            development)        SUFFIX="-dev";   TAG="development" ;;
+            alpha)              SUFFIX="-alpha"; TAG="alpha" ;;
+            beta)               SUFFIX="-beta";  TAG="beta" ;;
+            release-candidate)  SUFFIX="-rc";    TAG="release-candidate" ;;
+          esac
+
+          # Bump version via CLI: patch for dev/alpha/beta, minor for RC
+          case "$STABILITY" in
+            release-candidate) BUMP="minor" ;;
+            *)                 BUMP="patch" ;;
+          esac
+
+          php ${MOKO_CLI}/version_bump.php --path . $([ "$BUMP" = "minor" ] && echo "--minor") 2>/dev/null || true
+
+          # Set stability suffix and verify consistency
+          VERSION=$(php ${MOKO_CLI}/version_read.php --path . 2>/dev/null || echo "00.00.01")
+          VERSION=$(echo "$VERSION" | sed 's/-\(dev\|alpha\|beta\|rc\)$//')
+
+          php ${MOKO_CLI}/version_set_platform.php \
+            --path . --version "$VERSION" --branch "${{ github.ref_name }}" --stability "$STABILITY" 2>/dev/null || true
+          php ${MOKO_CLI}/version_check.php --path . --fix 2>/dev/null || true
+
+          # Append suffix for output
+          if [ -n "$SUFFIX" ]; then
+            VERSION="${VERSION}${SUFFIX}"
+          fi
+
+          # Commit version bump
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "gitea-actions[bot]"
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+          git add -A
+          git diff --cached --quiet || {
+            git commit -m "chore(version): pre-release bump to ${VERSION} [skip ci]"
+            git push origin HEAD 2>&1
+          }
+
+          # Auto-detect element via manifest_element.php
+          php ${MOKO_CLI}/manifest_element.php \
+            --path . --version "$VERSION" --stability "$STABILITY" \
+            --repo "${GITEA_REPO}" --github-output
+
+          # Read back element outputs
+          EXT_ELEMENT=$(grep '^ext_element=' "$GITHUB_OUTPUT" | tail -1 | cut -d= -f2)
+          ZIP_NAME=$(grep '^zip_name=' "$GITHUB_OUTPUT" | tail -1 | cut -d= -f2)
+          [ -z "$EXT_ELEMENT" ] && EXT_ELEMENT=$(echo "${GITEA_REPO}" | tr '[:upper:]' '[:lower:]' | tr -d ' -')
+          [ -z "$ZIP_NAME" ] && ZIP_NAME="${EXT_ELEMENT}-${VERSION}.zip"
+
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "stability=${STABILITY}" >> "$GITHUB_OUTPUT"
+          echo "suffix=${SUFFIX}" >> "$GITHUB_OUTPUT"
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+          echo "zip_name=${ZIP_NAME}" >> "$GITHUB_OUTPUT"
+          echo "ext_element=${EXT_ELEMENT}" >> "$GITHUB_OUTPUT"
+
+          echo "=== Pre-Release: ${EXT_ELEMENT} ${VERSION}${SUFFIX} ==="
+
+      - name: Create release
+        id: release
+        run: |
+          TAG="${{ steps.meta.outputs.tag }}"
+          VERSION="${{ steps.meta.outputs.version }}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          php ${MOKO_CLI}/release_create.php \
+            --path . --version "$VERSION" --tag "$TAG" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
+            --repo "${GITEA_REPO}" --branch dev --prerelease
+
+      - name: Update release notes from CHANGELOG.md
+        run: |
+          TAG="${{ steps.meta.outputs.tag }}"
+          VERSION="${{ steps.meta.outputs.version }}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+
+          # Extract [Unreleased] section from changelog (everything between [Unreleased] and next ## heading)
+          if [ -f "CHANGELOG.md" ]; then
+            NOTES=$(awk '/^## \[Unreleased\]/{found=1; next} /^## \[/{if(found) exit} found{print}' CHANGELOG.md)
+            [ -z "$NOTES" ] && NOTES="Release ${VERSION}"
+          else
+            NOTES="Release ${VERSION}"
+          fi
+
+          # Update release body via API
+          RELEASE_ID=$(curl -sf -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \
+            "${API_BASE}/releases/tags/${TAG}" | python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
+
+          if [ -n "$RELEASE_ID" ]; then
+            python3 -c "
+          import json, urllib.request
+          body = open('/dev/stdin').read()
+          payload = json.dumps({'body': body}).encode()
+          req = urllib.request.Request(
+              '${API_BASE}/releases/${RELEASE_ID}',
+              data=payload, method='PATCH',
+              headers={
+                  'Authorization': 'token ${{ secrets.MOKOGITEA_TOKEN }}',
+                  'Content-Type': 'application/json'
+              })
+          urllib.request.urlopen(req)
+          " <<< "$NOTES"
+            echo "Release notes updated from CHANGELOG.md"
+          fi
+
+      - name: Build package and upload
+        id: package
+        run: |
+          VERSION="${{ steps.meta.outputs.version }}"
+          TAG="${{ steps.meta.outputs.tag }}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          php ${MOKO_CLI}/release_package.php \
+            --path . --version "$VERSION" --tag "$TAG" \
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
+            --repo "${GITEA_REPO}" --output /tmp || true
+
+      # updates.xml is generated dynamically by MokoGitea license server
+      # No need to build, commit, or sync updates.xml from workflows
+
+      - name: "Delete lesser pre-release channels (cascade)"
+        continue-on-error: true
+        run: |
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+
+          php ${MOKO_CLI}/release_cascade.php \
+            --stability "${{ steps.meta.outputs.stability }}" \
+            --token "${TOKEN}" \
+            --api-base "${API_BASE}"
+
+      - name: Summary
+        if: always()
+        run: |
+          VERSION="${{ steps.meta.outputs.version }}"
+          STABILITY="${{ steps.meta.outputs.stability }}"
+          ZIP_NAME="${{ steps.meta.outputs.zip_name }}"
+          SHA256="${{ steps.package.outputs.sha256_zip }}"
+          echo "## Pre-Release Complete" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY
+          echo "|-------|-------|" >> $GITHUB_STEP_SUMMARY
+          echo "| Version | \`${VERSION}\` |" >> $GITHUB_STEP_SUMMARY
+          echo "| Channel | ${STABILITY} |" >> $GITHUB_STEP_SUMMARY
+          echo "| Package | \`${ZIP_NAME}\` |" >> $GITHUB_STEP_SUMMARY
+          echo "| SHA-256 | \`${SHA256:-n/a}\` |" >> $GITHUB_STEP_SUMMARY

AGENTS.md

@@ -1,16 +0,0 @@
-- Use `make help` to find available development targets
-- Run `make fmt` to format `.go` files, and run `make lint-go` to lint them
-- Run `make lint-js` to lint `.ts` files
-- Run `make tidy` after any `go.mod` changes
-- Run single go tests with `go test -run '^TestName$' ./modulepath/`
-- Run single js test files with `pnpm exec vitest <path-filter>`
-- Run single playwright e2e test files with `GITEA_TEST_E2E_FLAGS='<filepath>' make test-e2e`
-- Add the current year into the copyright header of new `.go` files
-- Ensure no trailing whitespace in edited files
-- Use Conventional Commits format for commit messages and PR titles (e.g. `type(scope): subject`)
-- Never force-push, amend, or squash unless asked. Use new commits and normal push for pull request updates
-- Preserve existing code comments, do not remove or rewrite comments that are still relevant
-- In TypeScript, use `!` (non-null assertion) instead of `?.`/`??` when a value is known to always exist
-- For CSS layout, prefer `flex-*` helpers over per-child `tw-ml-*` / `tw-mr-*` margins; fall back to `tw-*` utilities when specificity requires `!important`
-- Include authorship attribution in issue and pull request comments
-- Add `Co-Authored-By` lines to all commits, indicating name and model used

CHANGELOG.md

@@ -1,9 +1,9 @@
 # Changelog
 
-This changelog goes through the changes that have been made in each release
-without substantial changes to our git log; to see the highlights of what has
-been added to each release, please refer to the [blog](https://blog.gitea.com).
-## [v1.26.1-moko.06.02.00] - 2026-06-02
+All notable changes to MokoGitea are documented here. Versions follow the format
+`v{upstream}-moko.{major}.{minor}` (e.g. `v1.26.1-moko.06.03`).
+
+## [v1.26.1-moko.06.04] - 2026-06-06
 
 * FEATURES
   * feat(licenses): full commercial license management system
@@ -11,40 +11,53 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
     * Search keys by customer, domain, key number, email, or payment ref
     * Download gating (none/prerelease/all modes)
     * Domain lock grace period (DomainLockHours)
+    * Domain restriction on packages and keys (comma-separated allowed domains)
     * RepoScope enforcement — packages scoped to specific repos
     * Configurable license key prefix per organization
+    * Master key auto-generates, sorts first in key list
+    * License package creation at repo level via modal
+    * Key generation modal with licensee name, email, and domain fields
     * Manual release-to-stream mapping with UI selector
-    * Joomla changelog XML endpoint (/changelog.xml)
-    * SHA256 checksums from sidecar files in Joomla updates.xml
-    * Joomla-standard tag values (dev/alpha/beta/rc/stable)
     * Double confirmation modals for permanent deletion
     * Combolist channel picker (replaces checkboxes)
     * Extension metadata in repo settings (per-repo override)
     * API: package CRUD, key revoke, key renew, settings GET/PUT
     * API: purchase webhook with PaymentRef idempotency
     * API: public validation endpoint (no auth)
-    * Migration v340-v342: all new columns synced
-  * feat(updates): 7 platform update feeds
-    * Joomla XML with downloadkey, SHA256, changelog URL
+    * Migration v340-v344: all new columns synced
+  * feat(updates): Update Server system (renamed from "Licensing")
+    * Joomla XML with SHA256, changelog URL, version from asset filename
     * Dolibarr JSON with channel filtering
     * WordPress PUC-compatible JSON (plugin-update-checker)
     * Composer packages.json
     * PrestaShop module update XML
     * Drupal update status XML
     * WHMCS module update JSON
-  * feat(updates): feed always public — downloads gated separately
-  * feat(updates): stream-name tags supported alongside version tags
-  * feat(updates): version extraction via regex from release titles
-  * feat(updates): infourl defaults to release listing / support URL
-  * feat(updates): downloadkey prefix matches Akeeba pattern (dlid=)
+    * Feed always public — downloads gated separately
+    * Stream-name tags supported alongside version tags
+    * Omit `<client>` for package extension types
+    * `<downloadkey>` only when download_gating is prerelease or all
+    * Version extracted from asset filename (matches actual download)
+    * Joomla tag values verified: dev, alpha, beta, rc, stable
   * feat(orgs): enterprise sub-org hierarchy with parent-child relationships
   * feat(repos): three-level visibility — Public (200), Private (403), Hidden (404)
-  * feat(settings): separate licensing settings page (/settings/licensing)
-  * feat(settings): advanced settings on dedicated page (/settings/advanced)
-  * feat(settings): section headers with dividers and icons
-  * feat(ui): icons on all settings navbars (repo, org, user, admin)
+  * feat(settings): Update Server settings page with enable toggle in Advanced Settings
+  * feat(settings): advanced settings on dedicated page with dividing headers
+  * feat(settings): icons on all settings navbars (repo, org, user, admin)
   * feat(ui): styled 403 Access Denied page with inline login form
-  * feat(ui): open-in-new-tab button on feed URLs
+  * feat(issues): custom fields with inline editing in issue sidebar
+  * feat(issues): pre-fill custom fields from issue template YAML frontmatter (#493)
+    * Templates specify `custom_fields:` map (field name → default value)
+    * New issue sidebar shows org-level fields with template defaults pre-selected
+    * API create issue accepts `custom_fields` map by name
+  * feat(updateserver): resolve extension metadata from org-level custom fields (#492)
+    * Cascading fallback: custom fields → config table → repo-derived defaults
+    * All six generators updated (Joomla, WordPress, Composer, Drupal, PrestaShop, WHMCS)
+    * Repos can be migrated to custom fields gradually
+  * feat(ui): two-in-one Update Server / Licenses tab
+    * No gating: shows "Update Server" tab with feed URLs only
+    * Gated: shows "Licenses" tab with full key management
+    * `<downloadkey>` only appears when downloads are gated
 * SECURITY
   * fix(security): ownership guards on all API handlers (cross-org prevention)
   * fix(security): RepoScope JSON parsing (substring matching bug)
@@ -55,48 +68,50 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
   * fix(security): licensed private repos allow release viewing for signed-in users
   * fix(security): anonymous download access respects download_gating setting
 * FIXES
-  * fix(licenses): expanded delete permissions to org owners + site admins
   * fix(licenses): explicit xorm column names for UpdateStreamConfig fields
   * fix(licenses): feed always public when licensing enabled
+  * fix(settings): prevent double-highlight on Advanced Settings nav item
+  * fix(settings): redirect back to /settings/advanced after save
+  * fix(build): remove stale custom field API routes and dead code
+  * fix(build): replace invalid UTF-8 character in API comment
   * fix(build): permanent fixes for AI migration, feed/file.go, unused imports
+  * fix(updateserver): version extracted from asset filename (not release title)
+  * fix(updateserver): omit `<client>` for package types per Joomla spec
+  * fix(updateserver): `<downloadkey>` only shown when downloads are gated
+  * fix(updateserver): prevent stream name tag from overriding asset-derived version
+  * fix(build): restore build/ directory after accidental deletion
+  * fix(licenses): master key banner removed, master keys sort first in table
+  * fix(issues): issue sidebar loads org-level fields instead of legacy repo-level fields
 
-## [v1.26.1-moko.05.15.00] - 2026-05-31
+## [v1.26.1-moko.05] - 2026-05-31
 
 * BREAKING CHANGES
   * Deprecated Issue.Ref branch selector UI (#307)
     * Removed branch/tag selector from issue sidebar and new issue form
-    * Removed ref badge from issue lists
-    * Removed POST /ref web route and UpdateIssueRef handler
     * DB column and commit-close logic preserved for backward compatibility
-    * API create/edit still accept `ref` field (no-op) for backward compat
 * FEATURES
-  * feat(ui): add generic combo-multiselect component (#361)
+  * feat(ui): generic combo-multiselect component (#361)
     * Reusable dropdown with search, checkable items, and selected-items display
-    * Template: `shared/combolist.tmpl` — accepts Items, Name, Title, SelectedValues
-    * Decoupled from issue sidebar — works in any form context
+    * Template: `shared/combolist.tmpl`
   * feat(updates): extension metadata settings for update feed generation
   * feat(licenses): platform enforcement, key deletion, expired key cleanup
-  * feat(licenses): store keys in plaintext, show full key with copy button
+  * feat(actions): rebrand actions bot user to mokogitea-actions (#233, #234)
+    * Backward-compatible: recognizes github-actions[bot], gitea-actions[bot]
+  * feat(actions): actions bot user in branch protection whitelist (#233, #234)
+    * WhitelistActionsUser, MergeWhitelistActionsUser, ForcePushAllowlistActionsUser
 * TECH DEBT
-  * chore: full namespace migration from git.mokoconsulting.tech to code.mokoconsulting.tech (#336, #337, #344)
-    * Go module path, all imports, template URLs, workflow configs (2,276 files)
+  * chore: full namespace migration to code.mokoconsulting.tech (#336, #337, #344)
   * fix(blame): set HasSourceRenderedToggle for renderable files (#344)
-  * fix(settings): translate team permission strings via data-locale attributes (#344)
+  * fix(settings): translate team permission strings via data-locale (#344)
   * fix(dropzone): use relative path for non-image attachment markdown links (#344)
   * fix(templates): add required validation to issue dropdown fields (#350)
-  * refactor(ts): remove redundant `handled` field from MarkdownHandleIndentionResult (#350)
-  * refactor(go): rename HasOrgOrUserVisible to IsOwnerVisibleToDoer (#350)
   * refactor(go): replace ValuesRepository with maps.Values (Go 1.21+) (#357)
-  * refactor(go): remove CanEnableEditor wrapper, use CanContentChange directly (#357)
-  * fix(ts): parseIssueHref now uses URL pathname and trims appSubUrl (#360)
-  * fix(actions): enforce MaxJobNumPerRun (256) limit when creating jobs (#360)
+  * refactor(go): remove CanEnableEditor wrapper (#357)
+  * fix(ts): parseIssueHref uses URL pathname and trims appSubUrl (#360)
+  * fix(actions): enforce MaxJobNumPerRun (256) limit (#360)
   * fix(css): use calc(infinity * 1px) for --border-radius-full (#361)
-  * fix(css): remove legacy .center class from 2015, replace with tw-text-center (#361)
-  * chore: remove stale TODO from OAuth2 regenerate secret (already implemented) (#332)
-  * chore: remove stale pull request test stub TODOs (#328)
-  * chore: remove stale GetProjectsMode TODO
-  * chore: remove stale mustNotBeArchived/mustEnableEditor FIXME from API
-  * fix(routes): remove dead legacy /cherry-pick/{sha} route (replaced by /_cherrypick/)
+  * fix(css): remove legacy .center class, replace with tw-text-center (#361)
+  * fix(routes): remove dead legacy /cherry-pick/{sha} route
   * fix(feed): use full ref name instead of ShortName for file feed revision
 * BUGFIXES
   * fix(build): use slices.Collect for maps.Values (Go 1.23+ compat)
@@ -104,25 +119,10 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
   * fix(licenses): only show licenses tab when licensing is enabled
   * fix(licenses): show feed URLs based on repo update platform setting
   * fix(updates): correct dlid prefix and align XML with Joomla standard
-
-## [v1.26.1-moko.05.06.00] - 2026-05-30
-
-* FEATURES
-  * feat(actions): rebrand actions bot user to mokogitea-actions (#233, #234)
-    * Name: gitea-actions → mokogitea-actions, FullName: MokoGitea Actions
-    * Email: mokogitea-actions[bot]@mokoconsulting.tech
-    * Backward-compatible: recognizes github-actions[bot], gitea-actions[bot], mokogitea-actions[bot]
-  * feat(actions): add actions bot user to branch protection whitelist (#233, #234)
-    * New toggles: WhitelistActionsUser, MergeWhitelistActionsUser, ForcePushAllowlistActionsUser
-    * Allows CI/CD workflows to push/merge/force-push to protected branches when enabled
-    * DB migration v334 adds the three boolean columns
-    * Exposed in API (create/edit branch protection) and web UI settings
 * INFRASTRUCTURE
   * fix(ci): auto-deploy to production on merge to main (#235)
-    * Deploy workflow now triggers on push to main, not just manual dispatch
-    * Version derived from git describe for auto-deploys
 
-## [v1.26.1-moko.04.00.00] - 2026-05-24
+## [v1.26.1-moko.04] - 2026-05-24
 
 * SECURITY
   * Backport 12 upstream v1.26.2 security fixes:
@@ -131,47 +131,38 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
     * OAuth PKCE hardening and refresh token replay protection (#142)
     * Wiki git write and LFS token access enforcement (#143)
     * Public-only token filtering in API queries (#144)
-    * Reading permission fix (#145)
     * Artifact signature payload hardening (#146)
     * AWS credentials encryption (#161)
     * Mermaid v11.15.0 security update (#162)
     * Composer package permission check (#164)
 * BUGFIXES
   * fix(actions): nil pointer dereference in concurrency during PR creation (#136)
-  * fix(ui): actions runs list broken row layout — CSS class mismatch (#138)
-  * fix: scheduled action panic with null event payload (upstream #37459)
-  * fix: treat email addresses case-insensitively (upstream #37600)
+  * fix(ui): actions runs list broken row layout (#138)
+  * fix: scheduled action panic with null event payload
+  * fix: treat email addresses case-insensitively
   * fix: .mod lexer panic — removed invalid AMPL mapping
-  * fix: remove unused setting import in action.go
-  * fix: restore Permission field access in context middleware
 * FEATURES
-  * Joomla-style updates.xml with channel selection (stable/dev/security/rc)
-  * Update checker reads from updates.xml with configurable CHANNEL setting
-  * Admin dashboard shows update banner with channel name and docker pull command
-  * Upstream bug sync workflow — daily automated issue creation from release/v1.26
+  * Joomla-style updates.xml with channel selection
+  * Update checker with configurable CHANNEL setting
+  * Admin dashboard update banner with docker pull command
+  * Upstream bug sync workflow — daily automated issue creation
   * PR RC release workflow — auto-build RC on PR to main
 * INFRASTRUCTURE
   * New 3-part versioning: v{upstream}-moko.{major}.{minor}.{patch}
-  * Branding updates: error pages, home page, settings link to MokoGitea
+  * Branding updates: error pages, home page, settings link
   * Deploy workflow updated for new version format
 * PROCESS
   * Created `type: bug` and `upstream` labels for automated issue tracking
-  * Deduplicated 19 duplicate feature request issues
   * Closed 24 upstream bug/security issues after backporting
 
-## [MokoGitea Unreleased]
+## [v1.26.1-moko.03] - 2026-05-15
 
 * FEATURES
-  * feat(api): Bulk issue operations — add/remove/replace labels, close/reopen, set milestone, and set assignees across multiple issues in a single request (#21)
-    * `POST /api/v1/repos/{owner}/{repo}/issues/bulk/labels`
-    * `POST /api/v1/repos/{owner}/{repo}/issues/bulk/state`
-    * `POST /api/v1/repos/{owner}/{repo}/issues/bulk/milestone`
-    * `POST /api/v1/repos/{owner}/{repo}/issues/bulk/assignees`
-    * Partial-failure support: returns per-issue success/failure map
+  * feat(api): Bulk issue operations — add/remove/replace labels, close/reopen, set milestone, assignees (#21)
 * INFRASTRUCTURE
-  * Grafana: Standardized kiosk header across all 14 playlist dashboards — each now shows dashboard name, kiosk link, terminal/exit/switch instructions
+  * Grafana: Standardized kiosk header across all 14 playlist dashboards
 * PROCESS
-  * Reopened 9 closed issues lacking documented testing proof (#3, #5, #38, #41, #70, #74, #75, #76, #78)
+  * Reopened 9 closed issues lacking documented testing proof
   * Created `pending: testing` label for features awaiting verification
   * Established policy: issues must not be closed without documented testing proof
 
@@ -196,403 +187,3 @@ been added to each release, please refer to the [blog](https://blog.gitea.com).
   * Fix org team assignee/reviewer lookups for team member permissions (#37365) #37391
   * Fix repo init README EOL (#37388) #37399
   * Fix: dump with default zip type produces uncompressed zip (#37401)#37402
-
-## [1.26.0](https://github.com/go-gitea/gitea/releases/tag/v1.26.0) - 2026-04-17
-
-* BREAKING
-  * Correct swagger annotations for enums, status codes, and notification state (#37030)
-  * Remove GET API registration-token (#36801)
-  * Support Actions `concurrency` syntax (#32751)
-  * Make PUBLIC_URL_DETECTION default to "auto" (#36955)
-* SECURITY
-  * Bound PageSize in `ListUnadoptedRepositories` (#36884)
-* FEATURES
-  * Support Actions `concurrency` syntax (#32751)
-  * Add terraform state registry (#36710)
-  * Instance-wide (global) info banner and maintenance mode (#36571)
-  * Support rendering OpenAPI spec (#36449)
-  * Add keyboard shortcuts for repository file and code search (#36416)
-  * Add support for archive-upload rpc (#36391)
-  * Add ability to download subpath archive (#36371)
-  * Add workflow dependencies visualization (#26062) (#36248) & Restyle Workflow Graph (#36912)
-  * Automatic generation of release notes (#35977)
-  * Add "Go to file", "Delete Directory" to repo file list page (#35911)
-  * Introduce "config edit-ini" sub command to help maintaining INI config file (#35735)
-  * Add button to re-run failed jobs in Actions (#36924)
-  * Support actions and reusable workflows from private repos (#32562)
-  * Add summary to action runs view (#36883)
-  * Add user badges (#36752)
-  * Add configurable permissions for Actions automatic tokens (#36173)
-  * Add per-runner "Disable/Pause"  (#36776)
-  * Feature non-zipped actions artifacts (action v7 / nodejs / npm v6.2.0) (#36786)
-* PERFORMANCE
-  * WorkflowDispatch API optionally return runid (#36706)
-  * Add render cache for SVG icons (#36863)
-  * Load `mentionValues` asynchronously (#36739)
-  * Lazy-load some Vue components, fix heatmap chunk loading on every page (#36719)
-  * Load heatmap data asynchronously (#36622)
-  * Use prev/next pagination for user profile activities page to speed up (#36642)
-  * Refactor cat-file batch operations and support `--batch-command` approach (#35775)
-  * Use merge tree to detect conflicts when possible (#36400)
-* ENHANCEMENTS
-  * Implement logout redirection for reverse proxy auth setups (#36085) (#37171)
-  * Adds option to force update new branch in contents routes (#35592)
-  * Add viewer controller for mermaid (zoom, drag) (#36557)
-  * Add code editor setting dropdowns (#36534)
-  * Add `elk` layout support to mermaid (#36486)
-  * Add resolve/unresolve review comment API endpoints (#36441)
-  * Allow configuring default PR base branch (fixes #36412) (#36425)
-  * Add support for RPM Errata (updateinfo.xml) (#37125)
-  * Require additional user confirmation for making repo private (#36959)
-  * Add `actions.WORKFLOW_DIRS` setting (#36619)
-  * Avoid opening new tab when downloading actions logs (#36740)
-  * Implements OIDC RP-Initiated Logout (#36724)
-  * Show workflow link (#37070)
-  * Desaturate dark theme background colors (#37056)
-  * Refactor "org teams" page and help new users to "add member" to an org (#37051)
-  * Add webhook name field to improve webhook identification (#37025) (#37040)
-  * Make task list checkboxes clickable in the preview tab (#37010)
-  * Improve severity labels in Actions logs and tweak colors (#36993)
-  * Linkify URLs in Actions workflow logs (#36986)
-  * Allow text selection on checkbox labels (#36970)
-  * Support dark/light theme images in markdown (#36922)
-  * Enable native dark mode for swagger-ui (#36899)
-  * Rework checkbox styling, remove `input` border hover effect (#36870)
-  * Refactor storage content-type handling of ServeDirectURL (#36804)
-  * Use "Enable Gravatar" but not "Disable" (#36771)
-  * Use case-insensitive matching for Git error "Not a valid object name" (#36728)
-  * Add "Copy Source" to markup comment menu (#36726)
-  * Change image transparency grid to CSS (#36711)
-  * Add "Run" prefix for unnamed action steps (#36624)
-  * Persist actions log time display settings in `localStorage` (#36623)
-  * Use first commit title for multi-commit PRs and fix auto-focus title field (#36606)
-  * Improve BuildCaseInsensitiveLike with lowercase (#36598)
-  * Improve diff highlighting (#36583)
-  * Exclude cancelled runs from failure-only email notifications (#36569)
-  * Use full-file highlighting for diff sections (#36561)
-  * Color command/error logs in Actions log (#36538)
-  * Add paging headers (#36521)
-  * Improve timeline entries for WIP prefix changes in pull requests (#36518)
-  * Add FOLDER_ICON_THEME configuration option (#36496)
-  * Normalize guessed languages for code highlighting (#36450)
-  * Add chunked transfer encoding support for LFS uploads (#36380)
-  * Indicate when only optional checks failed (#36367)
-  * Add 'allow_maintainer_edit' API option for creating a pull request (#36283)
-  * Support closing keywords with URL references (#36221)
-  * Improve diff file headers (#36215)
-  * Fix and enhance comment editor monospace toggle (#36181)
-  * Add git.DIFF_RENAME_SIMILARITY_THRESHOLD option (#36164)
-  * Add matching pair insertion to markdown textarea (#36121)
-  * Add sorting/filtering to admin user search API endpoint (#36112)
-  * Allow action user have read permission in public repo like other user (#36095)
-  * Disable matchBrackets in monaco (#36089)
-  * Use GitHub-style commit message for squash merge (#35987)
-  * Make composer registry support tar.gz and tar.bz2 and fix bugs (#35958)
-  * Add GITEA_PR_INDEX env variable to githooks (#35938)
-  * Add proper error message if session provider can not be created (#35520)
-  * Add button to copy file name in PR files (#35509)
-  * Move `X_FRAME_OPTIONS` setting from `cors` to `security` section (#30256)
-  * Add placeholder content for empty content page (#37114)
-  * Add `DEFAULT_DELETE_BRANCH_AFTER_MERGE` setting (#36917)
-  * Redirect to the only OAuth2 provider when no other login methods and fix various problems (#36901)
-  * Add admin badge to navbar avatar (#36790)
-  * Add `never` option to `PUBLIC_URL_DETECTION` configuration (#36785)
-  * Add background and run count to actions list page (#36707)
-  * Add icon to buttons "Close with Comment", "Close Pull Request", "Close Issue" (#36654)
-  * Add support for in_progress event in workflow_run webhook (#36979)
-  * Report commit status for pull_request_review events (#36589)
-  * Render merged pull request title as such in dashboard feed (#36479)
-  * Feature to be able to filter project boards by milestones (#36321)
-  * Use user id in noreply emails (#36550)
-  * Enable pagination on GiteaDownloader.getIssueReactions() (#36549)
-  * Remove striped tables in UI (#36509)
-  * Improve control char rendering and escape button styling (#37094)
-  * Support legacy run/job index-based URLs and refactor migration 326 (#37008)
-  * Add date to "No Contributions" tooltip (#36190)
-  * Show edit page confirmation dialog on tree view file change (#36130)
-  * Mention proc-receive in text for dashboard.resync_all_hooks func (#35991)
-  * Reuse selectable style for wiki (#35990)
-  * Support blue yellow colorblind theme (#35910)
-  * Support selecting theme on the footer (#35741)
-  * Improve online runner check (#35722)
-  * Add quick approve button on PR page (#35678)
-  * Enable commenting on expanded lines in PR diffs (#35662)
-  * Print PR-Title into tooltip for actions (#35579)
-  * Use explicit, stronger defaults for newly generated repo signing keys for Debian (#36236)
-  * Improve the compare page (#36261)
-  * Unify repo names in system notices (#36491)
-  * Move package settings to package instead of being tied to version (#37026)
-  * Add Actions API rerun endpoints for runs and jobs (#36768)
-  * Add branch_count to repository API (#35351) (#36743)
-  * Add created_by filter to SearchIssues (#36670)
-  * Allow admins to rename non-local users (#35970)
-  * Support updating branch via API (#35951)
-  * Add an option to automatically verify SSH keys from LDAP (#35927)
-  * Make "update file" API can create a new file when SHA is not set (#35738)
-  * Update issue.go with labels documentation (labels content, not ids) (#35522)
-  * Expose content_version for optimistic locking on issue and PR edits (#37035)
-  * Pass ServeHeaderOptions by value instead of pointer, fine tune httplib tests (#36982)
-* BUGFIXES
-  * Frontend iframe renderer framework: 3D models, OpenAPI (#37233) (#37273)
-  * Fix CODEOWNERS absolute path matching. (#37244) (#37264)
-  * Swift registry metadata: preserve more JSON fields and accept empty metadata (#37254) (#37261)
-  * Fix user ssh key exporting and tests (#37256) (#37258)
-  * Fix team member avatar size and add tooltip (#37253)
-  * Fix commit title rendering in action run and blame (#37243) (#37251)
-  * Fix corrupted JSON caused by goccy library (#37214) (#37220)
-  * Add test for "fetch redirect", add CSS value validation for external render (#37207) (#37216)
-  * Fix incorrect concurrency check (#37205) (#37215)
-  * Fix handle missing base branch in PR commits API (#37193) (#37203)
-  * Fix encoding for Matrix Webhooks (#37190) (#37201)
-  * Fix handle fork-only commits in compare API (#37185) (#37199)
-  * Indicate form field readonly via background, fix RunUser config (#37175, #37180) (#37178)
-  * Report structurally invalid workflows to users (#37116) (#37164)
-  * Fix API not persisting pull request unit config when has_pull_requests is not set (#36718)
-  * Rename CSS variables and improve colorblind themes (#36353)
-  * Hide `add-matcher` and `remove-matcher` from actions job logs (#36520)
-  * Prevent navigation keys from triggering actions during IME composition (#36540)
-  * Fix vertical alignment of `.commit-sign-badge` children (#36570)
-  * Fix duplicate startup warnings in admin panel (#36641)
-  * Fix CODEOWNERS review request attribution using comment metadata (#36348)
-  * Fix HTML tags appearing in wiki table of contents (#36284)
-  * Fix various bugs (#37096)
-  * Fix various legacy problems (#37092)
-  * Fix RPM Registry 404 when package name contains 'package' (#37087)
-  * Merge some standalone Vite entries into index.js (#37085)
-  * Fix various problems (#37077)
-  * Fix issue label deletion with Actions tokens (#37013)
-  * Hide delete branch or tag buttons in mirror or archived repositories. (#37006)
-  * Fix org contact email not clearable once set (#36975)
-  * Fix a bug when forking a repository in an organization (#36950)
-  * Preserve sort order of exclusive labels from template repo (#36931)
-  * Make container registry support Apple Container (basic auth) (#36920)
-  * Fix the wrong push commits in the pull request when force push (#36914)
-  * Add class "list-header-filters" to the div for projects (#36889)
-  * Fix dbfs error handling (#36844)
-  * Fix incorrect viewed files counter if reverted change was viewed (#36819)
-  * Refactor avatar package, support default avatar fallback (#36788)
-  * Fix README symlink resolution in subdirectories like .github (#36775)
-  * Fix CSS stacking context issue in actions log (#36749)
-  * Add gpg signing for merge rebase and update by rebase (#36701)
-  * Delete non-exist branch should return 404 (#36694)
-  * Fix `TestActionsCollaborativeOwner` (#36657)
-  * Fix multi-arch Docker build SIGILL by splitting frontend stage (#36646)
-  * Fix linguist-detectable attribute being ignored for configuration files (#36640)
-  * Fix state desync in ComboMarkdownEditor (#36625)
-  * Unify DEFAULT_SHOW_FULL_NAME output in templates and dropdown (#36597)
-  * Pull Request Pusher should be the author of the merge (#36581)
-  * Fix various version parsing problems (#36553)
-  * Fix highlight diff result (#36539)
-  * Fix mirror sync parser and fix mirror messages (#36504)
-  * Fix bug when list pull request commits (#36485)
-  * Fix various bugs (#36446)
-  * Fix issue filter menu layout (#36426)
-  * Restrict branch naming when new change matches with protection rules (#36405)
-  * Fix link/origin referrer and login redirect (#36279)
-  * Generate IDs for HTML headings without id attribute (#36233)
-  * Use a migration test instead of a wrong test which populated the meta test repositories and fix a migration bug (#36160)
-  * Fix issue close timeline icon (#36138)
-  * Fix diff blob excerpt expansion (#35922)
-  * Fix external render (#35727)
-  * Fix review request webhook bug (#35339) (#35723)
-  * Fix shutdown waitgroup panic (#35676)
-  * Cleanup ActionRun creation (#35624)
-  * Fix possible bug when migrating issues/pull requests (#33487)
-  * Various fixes (#36697)
-  * Apply notify/register mail flags during install load (#37120)
-  * Repair duration display for bad stopped timestamps (#37121)
-  * Fix(upgrade.sh): use HTTPS for GPG key import and restore SELinux context after upgrade (#36930)
-  * Fix various trivial problems (#36921)
-  * Fix various trivial problems (#36953)
-  * Fix NuGet package upload error handling (#37074)
-  * Fix CodeQL code scanning alerts (#36858)
-  * Refactor issue sidebar and fix various problems (#37045)
-  * Fix various problems (#37029)
-  * Fix relative-time RangeError (#37021)
-  * Fix chroma lexer mapping (#36629)
-  * Fix typos and grammar in English locale (#36751)
-  * Fix milestone/project text overflow in issue sidebar (#36741)
-  * Fix `no-content` message not rendering after comment edit (#36733)
-  * Fix theme loading in development (#36605)
-  * Fix workflow run jobs API returning null steps (#36603)
-  * Fix timeline event layout overflow with long content (#36595)
-  * Fix minor UI issues in runner edit page (#36590)
-  * Fix incorrect vendored detections (#36508)
-  * Fix editorconfig not respected in PR Conversation view (#36492)
-  * Don't create self-references in merged PRs (#36490)
-  * Fix potential incorrect runID in run status update (#36437)
-  * Fix file-tree ui error when adding files to repo without commits (#36312)
-  * Improve image captcha contrast for dark mode (#36265)
-  * Fix panic in blame view when a file has only a single commit (#36230)
-  * Fix spelling error in migrate-storage cmd utility (#36226)
-  * Fix code highlighting on blame page (#36157)
-  * Fix nilnil in onedev downloader (#36154)
-  * Fix actions lint (#36029)
-  * Fix oauth2 session gob register (#36017)
-  * Fix Arch repo pacman.conf snippet (#35825)
-  * Fix a number of `strictNullChecks`-related issues (#35795)
-  * Fix URLJoin, markup render link reoslving, sign-in/up/linkaccount page common data (#36861)
-  * Hide delete directory button for mirror or archive repository and disable the menu item if user have no permission (#36384)
-  * Update message severity colors, fix navbar double border (#37019)
-  * Inline and lazy-load EasyMDE CSS, fix border colors (#36714)
-  * Closed milestones with no issues now show as 100% completed (#36220)
-  * Add test for ExtendCommentTreePathLength migration and fix bugs (#35791)
-  * Only turn links to current instance into hash links (#36237)
-  * Fix typos in code comments: doesnt, dont, wont (#36890)
-* REFACTOR
-  * Clean up and improve non-gitea js error filter (#37148) (#37155)
-  * Always show owner/repo name in compare page dropdowns (#37172) (#37200)
-  * Remove dead CSS rules (#37173) (#37177)
-  * Replace Monaco with CodeMirror (#36764)
-  * Replace CSRF cookie with `CrossOriginProtection` (#36183)
-  * Replace index with id in actions routes (#36842)
-  * Remove unnecessary function parameter (#35765)
-  * Move jobparser from act repository to Gitea (#36699)
-  * Refactor compare router param parse (#36105)
-  * Optimize 'refreshAccesses' to perform update without removing then adding (#35702)
-  * Clean up checkbox cursor styles (#37016)
-  * Remove undocumented support of signing key in the repository git configuration file (#36143)
-  * Switch `cmd/` to use constructor functions. (#36962)
-  * Use `relative-time` to render absolute dates (#36238)
-  * Some refactors about GetMergeBase (#36186)
-  * Some small refactors (#36163)
-  * Use gitRepo as parameter instead of repopath when invoking sign functions (#36162)
-  * Move blame to gitrepo (#36161)
-  * Move some functions to gitrepo package to reduce RepoPath reference directly (#36126)
-  * Use gitrepo's clone and push when possible (#36093)
-  * Remove mermaid margin workaround (#35732)
-  * Move some functions to gitrepo package (#35543)
-  * Move GetDiverging functions to gitrepo (#35524)
-  * Use global lock instead of status pool for cron lock (#35507)
-  * Use explicit mux instead of DefaultServeMux (#36276)
-  * Use gitrepo's push function (#36245)
-  * Pass request context to generateAdditionalHeadersForIssue (#36274)
-  * Move assign project when creating pull request to the same database transaction (#36244)
-  * Move catfile batch to a sub package of git module (#36232)
-  * Use gitrepo.Repository instead of wikipath (#35398)
-  * Use experimental go json v2 library (#35392)
-  * Refactor template render (#36438)
-  * Refactor GetRepoRawDiffForFile to avoid unnecessary pipe or goroutine (#36434)
-  * Refactor text utility classes to Tailwind CSS (#36703)
-  * Refactor git command stdio pipe (#36422)
-  * Refactor git command context & pipeline (#36406)
-  * Refactor git command stdio pipe (#36393)
-  * Remove unused functions (#36672)
-  * Refactor Actions Token Access (#35688)
-  * Move commit related functions to gitrepo package (#35600)
-  * Move archive function to repo_model and gitrepo (#35514)
-  * Move some functions to gitrepo package (#35503)
-  * Use git model to detect whether branch exist instead of gitrepo method (#35459)
-  * Some refactor for repo path (#36251)
-  * Extract helper functions from SearchIssues (#36158)
-  * Refactor merge conan and container auth preserve actions taskID (#36560)
-  * Refactor Nuget Auth to reuse Basic Auth Token Validation (#36558)
-  * Refactor ActionsTaskID (#36503)
-  * Refactor auth middleware (#36848)
-  * Refactor code render and render control chars (#37078)
-  * Clean up AppURL, remove legacy origin-url webcomponent (#37090)
-  * Remove `util.URLJoin` and replace all callers with direct path concatenation (#36867)
-  * Replace legacy tw-flex utility classes with flex-text-block/inline (#36778)
-  * Mark unused&immature activitypub as "not implemented" (#36789)
-* TESTING
-  * Add e2e tests for server push events (#36879)
-  * Rework e2e tests (#36634)
-  * Add e2e reaction test, improve accessibility, enable parallel testing (#37081)
-  * Increase e2e test timeouts on CI to fix flaky tests (#37053)
-* BUILD
-  * Upgrade go-git to v5.18.0 (#37269)
-  * Replace rollup-plugin-license with rolldown-license-plugin (#37130) (#37158)
-  * Bump min go version to 1.26.2 (#37139) (#37143)
-  * Convert locale files from ini to json format (#35489)
-  * Bump golangci-lint to 2.7.2, enable modernize stringsbuilder (#36180)
-  * Port away from `flake-utils` (#35675)
-  * Remove nolint (#36252)
-  * Update the Unlicense copy to latest version (#36636)
-  * Update to go 1.26.0 and golangci-lint 2.9.0 (#36588)
-  * Replace `google/go-licenses` with custom generation (#36575)
-  * Update go dependencies (#36548)
-  * Bump appleboy/git-push-action from 1.0.0 to 1.2.0 (#36306)
-  * Remove fomantic form module (#36222)
-  * Bump setup-node to v6, re-enable cache (#36207)
-  * Bump crowdin/github-action from 1 to 2 (#36204)
-  * Revert "Bump alpine to 3.23 (#36185)" (#36202)
-  * Update chroma to v2.21.1 (#36201)
-  * Bump astral-sh/setup-uv from 6 to 7 (#36198)
-  * Bump docker/build-push-action from 5 to 6 (#36197)
-  * Bump aws-actions/configure-aws-credentials from 4 to 5 (#36196)
-  * Bump dev-hanz-ops/install-gh-cli-action from 0.1.0 to 0.2.1 (#36195)
-  * Add JSON linting (#36192)
-  * Enable dependabot for actions (#36191)
-  * Bump alpine to 3.23 (#36185)
-  * Update chroma to v2.21.0 (#36171)
-  * Update JS deps and eslint enhancements (#36147)
-  * Update JS deps (#36091)
-  * update golangci-lint to v2.7.0 (#36079)
-  * Update JS deps, fix deprecations (#36040)
-  * Update JS deps (#35978)
-  * Add toolchain directive to go.mod (#35901)
-  * Move `gitea-vet` to use `go tool` (#35878)
-  * Update to go 1.25.4 (#35877)
-  * Enable TypeScript `strictNullChecks` (#35843)
-  * Enable `vue/require-typed-ref` eslint rule (#35764)
-  * Update JS dependencies (#35759)
-  * Move `codeformat` folder to tools (#35758)
-  * Update dependencies (#35733)
-  * Bump happy-dom from 20.0.0 to 20.0.2 (#35677)
-  * Bump setup-go to v6 (#35660)
-  * Update JS deps, misc tweaks (#35643)
-  * Bump happy-dom from 19.0.2 to 20.0.0 (#35625)
-  * Use bundled version of spectral (#35573)
-  * Update JS and PY deps (#35565)
-  * Bump github.com/wneessen/go-mail from 0.6.2 to 0.7.1 (#35557)
-  * Migrate from webpack to vite (#37002)
-  * Update JS dependencies and misc tweaks (#37064)
-  * Update to eslint 10 (#36925)
-  * Optimize Docker build with dependency layer caching (#36864)
-  * Update JS deps (#36850)
-  * Update tool dependencies and fix new lint issues (#36702)
-  * Remove redundant linter rules (#36658)
-  * Move Fomantic dropdown CSS to custom module (#36530)
-  * Remove and forbid `@ts-expect-error` (#36513)
-  * Refactor git command stderr handling (#36402)
-  * Enable gocheckcompilerdirectives linter (#36156)
-  * Replace `lint-go-gopls` with additional `govet` linters (#36028)
-  * Update golangci-lint to v2.6.0 (#35801)
-  * Misc tool tweaks (#35734)
-  * Add cache to container build (#35697)
-  * Upgrade vite (#37126)
-  * Update `setup-uv` to v8.0.0 (#37101)
-  * Upgrade `go-git` to v5.17.2 and related dependencies (#37060)
-  * Raise minimum Node.js version to 22.18.0 (#37058)
-  * Upgrade `golang.org/x/image` to v0.38.0 (#37054)
-  * Update minimum go version to 1.26.1, golangci-lint to 2.11.2, fix test style (#36876)
-  * Enable eslint concurrency (#36878)
-  * Vendor relative-time-element as local web component (#36853)
-  * Update material-icon-theme v5.32.0 (#36832)
-  * Update Go dependencies (#36781)
-  * Upgrade minimatch (#36760)
-  * Remove i18n backport tool at the moment because of translation format changed (#36643)
-  * Update emoji data for Unicode 16 (#36596)
-  * Update JS dependencies, adjust webpack config, misc fixes (#36431)
-  * Update material-icon-theme to v5.31.0 (#36427)
-  * Update JS and PY deps (#36383)
-  * Bump alpine to 3.23, add platforms to `docker-dryrun` (#36379)
-  * Update JS deps (#36354)
-  * Update goldmark to v1.7.16 (#36343)
-  * Update chroma to v2.22.0 (#36342)
-* DOCS
-  * Update AI Contribution Policy (#37022)
-  * Update AGENTS.md with additional guidelines (#37018)
-  * Add missing cron tasks to example ini (#37012)
-  * Add AI Contribution Policy to CONTRIBUTING.md (#36651)
-  * Minor punctuation improvement in CONTRIBUTING.md (#36291)
-  * Add documentation for markdown anchor post-processing (#36443)
-* MISC
-  * Correct spelling (#36783)
-  * Update Nix flake (#37110)
-  * Update Nix flake (#37024)
-  * Add valid github scopes (#36977)
-  * Update Nix flake (#36943)
-  * Update Nix flake (#36902)
-  * Update Nix flake (#36857)
-  * Update Nix flake (#36787)

CLAUDE.md

@@ -1 +0,0 @@
-@AGENTS.md

models/issues/custom_field.go

@@ -27,14 +27,26 @@ const (
 	CustomFieldTypeURL      CustomFieldType = "url"
 )
 
-// CustomFieldDef defines a custom field available for issues in a repository.
+// CustomFieldScope determines where the field appears.
+type CustomFieldScope string
+
+const (
+	CustomFieldScopeIssue CustomFieldScope = "issue" // appears in issue sidebar
+	CustomFieldScopeRepo  CustomFieldScope = "repo"  // appears in repo settings metadata
+)
+
+// CustomFieldDef defines a custom field at the org level.
+// owner_id = org ID, scope = issue or repo.
+// repo_id is kept for backward compat but 0 for org-level definitions.
 type CustomFieldDef struct {
 	ID          int64              `xorm:"pk autoincr"`
-	RepoID      int64              `xorm:"INDEX NOT NULL 'repo_id'"`
+	OwnerID     int64              `xorm:"INDEX NOT NULL DEFAULT 0 'owner_id'"` // org that owns this field
+	RepoID      int64              `xorm:"INDEX NOT NULL DEFAULT 0 'repo_id'"`  // 0 = org-level (inherited by all repos)
+	Scope       CustomFieldScope   `xorm:"VARCHAR(10) NOT NULL DEFAULT 'issue' 'scope'"`
 	Name        string             `xorm:"NOT NULL"`
 	FieldType   CustomFieldType    `xorm:"VARCHAR(20) NOT NULL 'field_type'"`
 	Description string             `xorm:"TEXT"`
-	Options     string             `xorm:"TEXT"`                              // JSON array for dropdown options
+	Options     string             `xorm:"TEXT"` // JSON array for dropdown options
 	Required    bool               `xorm:"NOT NULL DEFAULT false"`
 	SortOrder   int                `xorm:"NOT NULL DEFAULT 0 'sort_order'"`
 	IsActive    bool               `xorm:"NOT NULL DEFAULT true 'is_active'"`
@@ -46,10 +58,11 @@ func (CustomFieldDef) TableName() string {
 	return "custom_field_def"
 }
 
-// CustomFieldValue stores a custom field value for a specific issue.
+// CustomFieldValue stores a custom field value for an entity (issue or repo).
 type CustomFieldValue struct {
 	ID          int64              `xorm:"pk autoincr"`
-	IssueID     int64              `xorm:"INDEX NOT NULL 'issue_id'"`
+	EntityID    int64              `xorm:"INDEX NOT NULL 'entity_id'"`   // issue ID or repo ID
+	EntityType  string             `xorm:"VARCHAR(10) NOT NULL DEFAULT 'issue' 'entity_type'"` // "issue" or "repo"
 	FieldID     int64              `xorm:"INDEX NOT NULL 'field_id'"`
 	Value       string             `xorm:"TEXT"`
 	CreatedUnix timeutil.TimeStamp `xorm:"INDEX CREATED 'created_unix'"`
@@ -60,16 +73,55 @@ func (CustomFieldValue) TableName() string {
 	return "custom_field_value"
 }
 
-// GetCustomFieldsByRepo returns all active custom field definitions for a repo.
-func GetCustomFieldsByRepo(ctx context.Context, repoID int64) ([]*CustomFieldDef, error) {
+// ──────────────────────────────────────────────────────────────────────
+// Queries for org-level field definitions
+// ──────────────────────────────────────────────────────────────────────
+
+// GetCustomFieldsByOwner returns all active field definitions for an org with a given scope.
+func GetCustomFieldsByOwner(ctx context.Context, ownerID int64, scope CustomFieldScope) ([]*CustomFieldDef, error) {
 	fields := make([]*CustomFieldDef, 0, 10)
 	return fields, db.GetEngine(ctx).
-		Where("repo_id = ? AND is_active = ?", repoID, true).
+		Where("owner_id = ? AND scope = ? AND is_active = ?", ownerID, scope, true).
 		OrderBy("sort_order ASC, id ASC").
 		Find(&fields)
 }
 
-// GetAllCustomFieldsByRepo returns all custom field definitions including inactive.
+// GetAllCustomFieldsByOwner returns all field definitions for an org (including inactive).
+func GetAllCustomFieldsByOwner(ctx context.Context, ownerID int64) ([]*CustomFieldDef, error) {
+	fields := make([]*CustomFieldDef, 0, 10)
+	return fields, db.GetEngine(ctx).
+		Where("owner_id = ?", ownerID).
+		OrderBy("scope ASC, sort_order ASC, id ASC").
+		Find(&fields)
+}
+
+// GetCustomFieldsByOwnerAndScope returns all fields for an org filtered by scope.
+func GetCustomFieldsByOwnerAndScope(ctx context.Context, ownerID int64, scope CustomFieldScope) ([]*CustomFieldDef, error) {
+	fields := make([]*CustomFieldDef, 0, 10)
+	return fields, db.GetEngine(ctx).
+		Where("owner_id = ? AND scope = ?", ownerID, scope).
+		OrderBy("sort_order ASC, id ASC").
+		Find(&fields)
+}
+
+// ──────────────────────────────────────────────────────────────────────
+// Backward-compatible queries (load by repo's owner)
+// ──────────────────────────────────────────────────────────────────────
+
+// GetCustomFieldsByRepo returns active issue-scoped fields for a repo's org.
+// This is the main query used by the issue sidebar.
+func GetCustomFieldsByRepo(ctx context.Context, repoID int64) ([]*CustomFieldDef, error) {
+	// First try org-level fields (owner_id != 0, repo_id = 0)
+	// Fall back to legacy repo-level fields (repo_id = repoID)
+	fields := make([]*CustomFieldDef, 0, 10)
+	return fields, db.GetEngine(ctx).
+		Where("((owner_id != 0 AND repo_id = 0) OR repo_id = ?) AND scope = ? AND is_active = ?",
+			repoID, CustomFieldScopeIssue, true).
+		OrderBy("sort_order ASC, id ASC").
+		Find(&fields)
+}
+
+// GetAllCustomFieldsByRepo returns all field definitions for a repo (for settings page).
 func GetAllCustomFieldsByRepo(ctx context.Context, repoID int64) ([]*CustomFieldDef, error) {
 	fields := make([]*CustomFieldDef, 0, 10)
 	return fields, db.GetEngine(ctx).
@@ -78,6 +130,10 @@ func GetAllCustomFieldsByRepo(ctx context.Context, repoID int64) ([]*CustomField
 		Find(&fields)
 }
 
+// ──────────────────────────────────────────────────────────────────────
+// Field definition CRUD
+// ──────────────────────────────────────────────────────────────────────
+
 // GetCustomFieldDefByID returns a single field definition.
 func GetCustomFieldDefByID(ctx context.Context, id int64) (*CustomFieldDef, error) {
 	field := new(CustomFieldDef)
@@ -112,10 +168,14 @@ func DeleteCustomFieldDef(ctx context.Context, id int64) error {
 	return err
 }
 
-// GetCustomFieldValuesMap returns field_id -> value for an issue.
-func GetCustomFieldValuesMap(ctx context.Context, issueID int64) (map[int64]string, error) {
+// ──────────────────────────────────────────────────────────────────────
+// Field values — generic entity-based (works for issues and repos)
+// ──────────────────────────────────────────────────────────────────────
+
+// GetCustomFieldValuesMap returns field_id -> value for an entity.
+func GetCustomFieldValuesMap(ctx context.Context, entityID int64) (map[int64]string, error) {
 	values := make([]*CustomFieldValue, 0, 10)
-	if err := db.GetEngine(ctx).Where("issue_id = ?", issueID).Find(&values); err != nil {
+	if err := db.GetEngine(ctx).Where("entity_id = ?", entityID).Find(&values); err != nil {
 		return nil, err
 	}
 	result := make(map[int64]string, len(values))
@@ -126,9 +186,9 @@ func GetCustomFieldValuesMap(ctx context.Context, issueID int64) (map[int64]stri
 }
 
 // SetCustomFieldValue creates or updates a single custom field value.
-func SetCustomFieldValue(ctx context.Context, issueID, fieldID int64, value string) error {
+func SetCustomFieldValue(ctx context.Context, entityID, fieldID int64, value string) error {
 	existing := new(CustomFieldValue)
-	has, err := db.GetEngine(ctx).Where("issue_id = ? AND field_id = ?", issueID, fieldID).Get(existing)
+	has, err := db.GetEngine(ctx).Where("entity_id = ? AND field_id = ?", entityID, fieldID).Get(existing)
 	if err != nil {
 		return err
 	}
@@ -138,17 +198,17 @@ func SetCustomFieldValue(ctx context.Context, issueID, fieldID int64, value stri
 		return err
 	}
 	_, err = db.GetEngine(ctx).Insert(&CustomFieldValue{
-		IssueID: issueID,
-		FieldID: fieldID,
-		Value:   value,
+		EntityID: entityID,
+		FieldID:  fieldID,
+		Value:    value,
 	})
 	return err
 }
 
-// SetCustomFieldValues sets multiple custom field values for an issue.
-func SetCustomFieldValues(ctx context.Context, issueID int64, values map[int64]string) error {
+// SetCustomFieldValues sets multiple custom field values for an entity.
+func SetCustomFieldValues(ctx context.Context, entityID int64, values map[int64]string) error {
 	for fieldID, value := range values {
-		if err := SetCustomFieldValue(ctx, issueID, fieldID, value); err != nil {
+		if err := SetCustomFieldValue(ctx, entityID, fieldID, value); err != nil {
 			return err
 		}
 	}

models/issues/issue.go

@@ -76,6 +76,8 @@ type Issue struct {
 	Assignee          *user_model.User `xorm:"-"`
 	isAssigneeLoaded  bool             `xorm:"-"`
 	IsClosed          bool             `xorm:"INDEX"`
+	StatusID          int64            `xorm:"INDEX NOT NULL DEFAULT 0 'status_id'"`
+	Status            *IssueStatusDef  `xorm:"-"`
 	IsRead            bool             `xorm:"-"`
 	IsPull            bool             `xorm:"INDEX"` // Indicates whether is a pull request or not.
 	PullRequest       *PullRequest     `xorm:"-"`

models/issues/issue_search.go

@@ -49,8 +49,9 @@ type IssuesOptions struct { //nolint:revive // export stutter
 	UpdatedAfterUnix   int64
 	UpdatedBeforeUnix  int64
 	// prioritize issues from this repo
-	PriorityRepoID int64
-	IsArchived     optional.Option[bool]
+	PriorityRepoID    int64
+	IsArchived        optional.Option[bool]
+	CustomFieldFilters map[int64]string // field_id → required value (AND semantics)
 	Owner          *user_model.User   // issues permission scope, it could be an organization or a user
 	Team           *organization.Team // issues permission scope
 	Doer           *user_model.User   // issues permission scope
@@ -211,6 +212,20 @@ func applyProjectCondition(sess *xorm.Session, opts *IssuesOptions) {
 	// do not need to apply any condition
 }
 
+func applyCustomFieldCondition(sess *xorm.Session, opts *IssuesOptions) {
+	if len(opts.CustomFieldFilters) == 0 {
+		return
+	}
+	// Each filtered field adds a subquery: the issue must have a matching
+	// custom_field_value row for every specified field (AND semantics).
+	for fieldID, value := range opts.CustomFieldFilters {
+		subQuery := builder.Select("entity_id").From("custom_field_value").Where(
+			builder.Eq{"field_id": fieldID, "value": value, "entity_type": "issue"},
+		)
+		sess.And(builder.In("issue.id", subQuery))
+	}
+}
+
 func applyRepoConditions(sess *xorm.Session, opts *IssuesOptions) {
 	if len(opts.RepoIDs) == 1 {
 		opts.RepoCond = builder.Eq{"issue.repo_id": opts.RepoIDs[0]}
@@ -278,6 +293,7 @@ func applyConditions(sess *xorm.Session, opts *IssuesOptions) {
 	}
 
 	applyLabelsCondition(sess, opts)
+	applyCustomFieldCondition(sess, opts)
 
 	if opts.Owner != nil {
 		sess.And(repo_model.UserOwnedRepoCond(opts.Owner.ID))

models/issues/issue_status.go

@@ -0,0 +1,104 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package issues
+
+import (
+	"context"
+
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/db"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/timeutil"
+)
+
+func init() {
+	db.RegisterModel(new(IssueStatusDef))
+}
+
+// IssueStatusDef defines a custom issue status at the org level.
+type IssueStatusDef struct {
+	ID          int64              `xorm:"pk autoincr"`
+	OrgID       int64              `xorm:"INDEX NOT NULL DEFAULT 0 'org_id'"`
+	Name        string             `xorm:"NOT NULL"`
+	Color       string             `xorm:"VARCHAR(7)"`  // hex color, e.g. "#e11d48"
+	Description string             `xorm:"TEXT"`
+	ClosesIssue bool               `xorm:"NOT NULL DEFAULT false 'closes_issue'"`
+	SortOrder   int                `xorm:"NOT NULL DEFAULT 0 'sort_order'"`
+	IsActive    bool               `xorm:"NOT NULL DEFAULT true 'is_active'"`
+	CreatedUnix timeutil.TimeStamp `xorm:"INDEX CREATED 'created_unix'"`
+	UpdatedUnix timeutil.TimeStamp `xorm:"UPDATED 'updated_unix'"`
+}
+
+func (IssueStatusDef) TableName() string {
+	return "issue_status_def"
+}
+
+// ──────────────────────────────────────────────────────────────────────
+// Queries
+// ──────────────────────────────────────────────────────────────────────
+
+// GetIssueStatusDefsByOrg returns active status definitions for an org.
+func GetIssueStatusDefsByOrg(ctx context.Context, orgID int64) ([]*IssueStatusDef, error) {
+	defs := make([]*IssueStatusDef, 0, 10)
+	return defs, db.GetEngine(ctx).
+		Where("org_id = ? AND is_active = ?", orgID, true).
+		OrderBy("sort_order ASC, id ASC").
+		Find(&defs)
+}
+
+// GetAllIssueStatusDefsByOrg returns all status definitions (including inactive).
+func GetAllIssueStatusDefsByOrg(ctx context.Context, orgID int64) ([]*IssueStatusDef, error) {
+	defs := make([]*IssueStatusDef, 0, 10)
+	return defs, db.GetEngine(ctx).
+		Where("org_id = ?", orgID).
+		OrderBy("sort_order ASC, id ASC").
+		Find(&defs)
+}
+
+// GetIssueStatusDefByID returns a single status definition.
+func GetIssueStatusDefByID(ctx context.Context, id int64) (*IssueStatusDef, error) {
+	def := new(IssueStatusDef)
+	has, err := db.GetEngine(ctx).ID(id).Get(def)
+	if err != nil {
+		return nil, err
+	}
+	if !has {
+		return nil, db.ErrNotExist{Resource: "IssueStatusDef", ID: id}
+	}
+	return def, nil
+}
+
+// ──────────────────────────────────────────────────────────────────────
+// CRUD
+// ──────────────────────────────────────────────────────────────────────
+
+// CreateIssueStatusDef creates a new status definition.
+func CreateIssueStatusDef(ctx context.Context, def *IssueStatusDef) error {
+	_, err := db.GetEngine(ctx).Insert(def)
+	return err
+}
+
+// UpdateIssueStatusDef updates a status definition.
+func UpdateIssueStatusDef(ctx context.Context, def *IssueStatusDef) error {
+	_, err := db.GetEngine(ctx).ID(def.ID).AllCols().Update(def)
+	return err
+}
+
+// DeleteIssueStatusDef deletes a status definition and clears references on issues.
+func DeleteIssueStatusDef(ctx context.Context, id int64) error {
+	// Clear status_id on all issues that reference this definition
+	if _, err := db.GetEngine(ctx).Exec("UPDATE issue SET status_id = 0 WHERE status_id = ?", id); err != nil {
+		return err
+	}
+	_, err := db.GetEngine(ctx).ID(id).Delete(new(IssueStatusDef))
+	return err
+}
+
+// ──────────────────────────────────────────────────────────────────────
+// Issue status helpers
+// ──────────────────────────────────────────────────────────────────────
+
+// SetIssueStatusID updates the status_id on an issue.
+func SetIssueStatusID(ctx context.Context, issueID, statusID int64) error {
+	_, err := db.GetEngine(ctx).Exec("UPDATE issue SET status_id = ? WHERE id = ?", statusID, issueID)
+	return err
+}

models/licenses/license_key.go

@@ -130,10 +130,11 @@ func GetLicenseKeyByID(ctx context.Context, id int64) (*LicenseKey, error) {
 	return key, nil
 }
 
-// ListLicenseKeys returns all keys for the given owner.
+// ListLicenseKeys returns all keys for the given owner, master keys first.
 func ListLicenseKeys(ctx context.Context, ownerID int64) ([]*LicenseKey, error) {
 	keys := make([]*LicenseKey, 0, 20)
-	return keys, db.GetEngine(ctx).Where("owner_id = ?", ownerID).Find(&keys)
+	return keys, db.GetEngine(ctx).Where("owner_id = ?", ownerID).
+		OrderBy("is_internal DESC, created_unix DESC").Find(&keys)
 }
 
 // SearchLicenseKeys searches keys for an owner by key prefix/raw, licensee, email, or domain.

models/migrations/migrations.go

@@ -422,6 +422,9 @@ func prepareMigrationTasks() []*migration {
 		newMigration(342, "Add is_hidden to repository for three-level visibility", v1_27.AddIsHiddenToRepository),
 		newMigration(343, "Add custom field tables for issue custom fields", v1_27.AddCustomFieldTables),
 		newMigration(344, "Add domain_restriction to license_package table", v1_27.AddDomainRestrictionToLicensePackage),
+		newMigration(345, "Migrate custom fields to org-level with scope", v1_27.MigrateCustomFieldsToOrgLevel),
+		newMigration(346, "Add issue status definitions table", v1_27.AddIssueStatusDefTable),
+		newMigration(347, "Add repo manifest table", v1_27.AddRepoManifestTable),
 	}
 	return preparedMigrations
 }

models/migrations/v1_27/v345.go

@@ -0,0 +1,39 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package v1_27
+
+import (
+	"xorm.io/xorm"
+)
+
+// MigrateCustomFieldsToOrgLevel adds owner_id, scope to custom_field_def
+// and renames issue_id to entity_id + adds entity_type in custom_field_value.
+func MigrateCustomFieldsToOrgLevel(x *xorm.Engine) error {
+	// Add new columns to custom_field_def
+	type CustomFieldDef struct {
+		OwnerID int64  `xorm:"INDEX NOT NULL DEFAULT 0 'owner_id'"`
+		Scope   string `xorm:"VARCHAR(10) NOT NULL DEFAULT 'issue' 'scope'"`
+	}
+	if err := x.Sync(new(CustomFieldDef)); err != nil {
+		return err
+	}
+
+	// Add entity_type and entity_id to custom_field_value
+	type CustomFieldValue struct {
+		EntityID   int64  `xorm:"INDEX NOT NULL DEFAULT 0 'entity_id'"`
+		EntityType string `xorm:"VARCHAR(10) NOT NULL DEFAULT 'issue' 'entity_type'"`
+	}
+	if err := x.Sync(new(CustomFieldValue)); err != nil {
+		return err
+	}
+
+	// Migrate existing data: copy issue_id to entity_id where entity_id is 0
+	if _, err := x.Exec("UPDATE custom_field_value SET entity_id = issue_id WHERE entity_id = 0 AND issue_id != 0"); err != nil {
+		return err
+	}
+
+	// Set issue_id default to 0 so new inserts don't require it
+	_, err := x.Exec("ALTER TABLE custom_field_value MODIFY COLUMN issue_id bigint NOT NULL DEFAULT 0")
+	return err
+}

models/migrations/v1_27/v346.go

@@ -0,0 +1,34 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package v1_27
+
+import (
+	"xorm.io/xorm"
+)
+
+// AddIssueStatusDefTable creates the issue_status_def table and adds
+// status_id to the issue table.
+func AddIssueStatusDefTable(x *xorm.Engine) error {
+	type IssueStatusDef struct {
+		ID          int64  `xorm:"pk autoincr"`
+		OrgID       int64  `xorm:"INDEX NOT NULL DEFAULT 0 'org_id'"`
+		Name        string `xorm:"NOT NULL"`
+		Color       string `xorm:"VARCHAR(7)"`
+		Description string `xorm:"TEXT"`
+		ClosesIssue bool   `xorm:"NOT NULL DEFAULT false 'closes_issue'"`
+		SortOrder   int    `xorm:"NOT NULL DEFAULT 0 'sort_order'"`
+		IsActive    bool   `xorm:"NOT NULL DEFAULT true 'is_active'"`
+		CreatedUnix int64  `xorm:"INDEX CREATED 'created_unix'"`
+		UpdatedUnix int64  `xorm:"UPDATED 'updated_unix'"`
+	}
+	if err := x.Sync(new(IssueStatusDef)); err != nil {
+		return err
+	}
+
+	// Add status_id column to issue table
+	type Issue struct {
+		StatusID int64 `xorm:"INDEX NOT NULL DEFAULT 0 'status_id'"`
+	}
+	return x.Sync(new(Issue))
+}

models/migrations/v1_27/v347.go

@@ -0,0 +1,32 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package v1_27
+
+import (
+	"xorm.io/xorm"
+)
+
+// AddRepoManifestTable creates the repo_manifest table for storing
+// moko-platform manifest settings per repository.
+func AddRepoManifestTable(x *xorm.Engine) error {
+	type RepoManifest struct {
+		ID               int64  `xorm:"pk autoincr"`
+		RepoID           int64  `xorm:"UNIQUE INDEX NOT NULL 'repo_id'"`
+		Name             string `xorm:"TEXT 'name'"`
+		Org              string `xorm:"TEXT 'org'"`
+		Description      string `xorm:"TEXT 'description'"`
+		Version          string `xorm:"TEXT 'version'"`
+		LicenseSPDX      string `xorm:"VARCHAR(50) 'license_spdx'"`
+		LicenseName      string `xorm:"TEXT 'license_name'"`
+		Platform         string `xorm:"VARCHAR(50) 'platform'"`
+		StandardsVersion string `xorm:"VARCHAR(20) 'standards_version'"`
+		StandardsSource  string `xorm:"TEXT 'standards_source'"`
+		Language         string `xorm:"VARCHAR(50) 'language'"`
+		PackageType      string `xorm:"VARCHAR(50) 'package_type'"`
+		EntryPoint       string `xorm:"TEXT 'entry_point'"`
+		CreatedUnix      int64  `xorm:"INDEX CREATED 'created_unix'"`
+		UpdatedUnix      int64  `xorm:"UPDATED 'updated_unix'"`
+	}
+	return x.Sync(new(RepoManifest))
+}

models/repo/repo_manifest.go

@@ -0,0 +1,83 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package repo
+
+import (
+	"context"
+
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/db"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/timeutil"
+)
+
+func init() {
+	db.RegisterModel(new(RepoManifest))
+}
+
+// RepoManifest stores moko-platform manifest settings for a repository.
+// These fields correspond to the .mokogitea/manifest.xml schema and are
+// exposed via API for use by Actions workflows and the moko-platform CLI.
+type RepoManifest struct {
+	ID        int64              `xorm:"pk autoincr"`
+	RepoID    int64              `xorm:"UNIQUE INDEX NOT NULL 'repo_id'"`
+
+	// identity section
+	Name        string `xorm:"TEXT 'name'"`         // project name
+	Org         string `xorm:"TEXT 'org'"`           // organization name
+	Description string `xorm:"TEXT 'description'"`   // project description
+	Version     string `xorm:"TEXT 'version'"`       // current version string
+	LicenseSPDX string `xorm:"VARCHAR(50) 'license_spdx'"` // SPDX identifier, e.g. "GPL-3.0-or-later"
+	LicenseName string `xorm:"TEXT 'license_name'"`  // human-readable license name
+
+	// governance section
+	Platform         string `xorm:"VARCHAR(50) 'platform'"`          // go, php, node, python, etc.
+	StandardsVersion string `xorm:"VARCHAR(20) 'standards_version'"` // moko-platform standards version
+	StandardsSource  string `xorm:"TEXT 'standards_source'"`          // URL to standards repo
+
+	// build section
+	Language    string `xorm:"VARCHAR(50) 'language'"`     // Go, PHP, TypeScript, etc.
+	PackageType string `xorm:"VARCHAR(50) 'package_type'"` // application, library, plugin, module, component, package
+	EntryPoint  string `xorm:"TEXT 'entry_point'"`          // build entry point path
+
+	CreatedUnix timeutil.TimeStamp `xorm:"INDEX CREATED 'created_unix'"`
+	UpdatedUnix timeutil.TimeStamp `xorm:"UPDATED 'updated_unix'"`
+}
+
+func (RepoManifest) TableName() string {
+	return "repo_manifest"
+}
+
+// GetRepoManifest returns the manifest for a repo, or nil if none exists.
+func GetRepoManifest(ctx context.Context, repoID int64) (*RepoManifest, error) {
+	m := new(RepoManifest)
+	has, err := db.GetEngine(ctx).Where("repo_id = ?", repoID).Get(m)
+	if err != nil {
+		return nil, err
+	}
+	if !has {
+		return nil, nil
+	}
+	return m, nil
+}
+
+// CreateOrUpdateRepoManifest upserts a repo manifest.
+func CreateOrUpdateRepoManifest(ctx context.Context, m *RepoManifest) error {
+	existing := new(RepoManifest)
+	has, err := db.GetEngine(ctx).Where("repo_id = ?", m.RepoID).Get(existing)
+	if err != nil {
+		return err
+	}
+	if has {
+		m.ID = existing.ID
+		_, err = db.GetEngine(ctx).ID(m.ID).AllCols().Update(m)
+		return err
+	}
+	_, err = db.GetEngine(ctx).Insert(m)
+	return err
+}
+
+// DeleteRepoManifest deletes the manifest for a repo.
+func DeleteRepoManifest(ctx context.Context, repoID int64) error {
+	_, err := db.GetEngine(ctx).Where("repo_id = ?", repoID).Delete(new(RepoManifest))
+	return err
+}

modules/indexer/issues/db/options.go

@@ -82,6 +82,8 @@ func ToDBOptions(ctx context.Context, options *internal.SearchOptions) (*issue_m
 		Doer:               nil,
 	}
 
+	opts.CustomFieldFilters = options.CustomFieldFilters
+
 	if len(options.MilestoneIDs) == 1 && options.MilestoneIDs[0] == 0 {
 		opts.MilestoneIDs = []int64{db.NoConditionID}
 	} else {

modules/indexer/issues/dboptions.go

@@ -79,6 +79,7 @@ func ToSearchOptions(keyword string, opts *issues_model.IssuesOptions) *SearchOp
 	}
 
 	searchOpt.Paginator = opts.Paginator
+	searchOpt.CustomFieldFilters = opts.CustomFieldFilters
 
 	switch opts.SortType {
 	case "", "latest":

modules/indexer/issues/internal/model.go

@@ -114,6 +114,8 @@ type SearchOptions struct {
 	Paginator *db.ListOptions
 
 	SortBy SortBy // sort by field
+
+	CustomFieldFilters map[int64]string // field_id → required value (AND semantics, DB-only)
 }
 
 // Copy returns a copy of the options.

modules/structs/issue.go

@@ -104,6 +104,8 @@ type CreateIssueOption struct {
 	// list of project ids
 	Projects []int64 `json:"projects"`
 	Closed   bool    `json:"closed"`
+	// custom field values keyed by field name
+	CustomFields map[string]string `json:"custom_fields,omitempty"`
 }
 
 // EditIssueOption options for editing an issue
@@ -190,15 +192,16 @@ const (
 // IssueTemplate represents an issue template for a repository
 // swagger:model
 type IssueTemplate struct {
-	Name      string                   `json:"name" yaml:"name"`
-	Title     string                   `json:"title" yaml:"title"`
-	About     string                   `json:"about" yaml:"about"` // Using "description" in a template file is compatible
-	Labels    IssueTemplateStringSlice `json:"labels" yaml:"labels"`
-	Assignees IssueTemplateStringSlice `json:"assignees" yaml:"assignees"`
-	Ref       string                   `json:"ref" yaml:"ref"`
-	Content   string                   `json:"content" yaml:"-"`
-	Fields    []*IssueFormField        `json:"body" yaml:"body"`
-	FileName  string                   `json:"file_name" yaml:"-"`
+	Name         string                   `json:"name" yaml:"name"`
+	Title        string                   `json:"title" yaml:"title"`
+	About        string                   `json:"about" yaml:"about"` // Using "description" in a template file is compatible
+	Labels       IssueTemplateStringSlice `json:"labels" yaml:"labels"`
+	Assignees    IssueTemplateStringSlice `json:"assignees" yaml:"assignees"`
+	Ref          string                   `json:"ref" yaml:"ref"`
+	Content      string                   `json:"content" yaml:"-"`
+	Fields       []*IssueFormField        `json:"body" yaml:"body"`
+	FileName     string                   `json:"file_name" yaml:"-"`
+	CustomFields map[string]string        `json:"custom_fields,omitempty" yaml:"custom_fields"`
 }
 
 type IssueTemplateStringSlice []string

options/locale/locale_en-US.json

@@ -1004,6 +1004,12 @@
   "repo.object_format": "Object Format",
   "repo.object_format_helper": "Object format of the repository. Cannot be changed later. SHA1 is most compatible.",
   "repo.readme": "README",
+  "repo.well_known_file.readme": "Readme",
+  "repo.well_known_file.license": "License",
+  "repo.well_known_file.contributing": "Contributing",
+  "repo.well_known_file.code_of_conduct": "Code of Conduct",
+  "repo.well_known_file.security": "Security",
+  "repo.well_known_file.changelog": "Changelog",
   "repo.readme_helper": "Select a README file template.",
   "repo.readme_helper_desc": "This is the place where you can write a complete description for your project.",
   "repo.auto_init": "Initialize Repository (Adds .gitignore, License and README)",
@@ -1412,6 +1418,7 @@
   "repo.issues.new.open_projects": "Open Projects",
   "repo.issues.new.closed_projects": "Closed Projects",
   "repo.issues.new.no_items": "No items",
+  "repo.issues.custom_fields": "Custom Fields",
   "repo.issues.new.milestone": "Milestone",
   "repo.issues.new.no_milestone": "No Milestone",
   "repo.issues.new.clear_milestone": "Clear milestone",
@@ -1575,6 +1582,7 @@
   "repo.issues.edit": "Edit",
   "repo.issues.cancel": "Cancel",
   "repo.issues.save": "Save",
+  "repo.issues.status": "Status",
   "repo.issues.label_title": "Name",
   "repo.issues.label_description": "Description",
   "repo.issues.label_color": "Color",
@@ -2149,15 +2157,15 @@
   "repo.settings.unit_visibility_private": "Private (follow repo visibility)",
   "repo.settings.unit_visibility_public": "Public (anyone can read)",
   "repo.settings.unit_visibility_releases_help": "Controls whether the releases page is visible to anonymous visitors.",
-  "repo.settings.licensing_section": "Licensing & Updates",
-  "repo.settings.licensing_section_desc": "Manage commercial license keys and gated update feeds for this repository. When enabled, the Licenses tab appears and release tags must follow update stream naming.",
+  "repo.settings.licensing_section": "Update Server",
+  "repo.settings.licensing_section_desc": "Manage update feeds and optional license key gating for this repository. When enabled, the Licenses tab appears and release tags are served via update feeds.",
   "repo.settings.update_platform": "Update Feed Format",
   "repo.settings.update_platform_both": "Both (Joomla + Dolibarr)",
   "repo.settings.update_platform_help": "Choose which update feed format to generate. All formats support license key validation.",
   "repo.settings.require_update_key": "Require license key for update feeds",
   "repo.settings.require_update_key_help": "When enabled, update feeds return empty results unless a valid license key is provided. Joomla clients will see a Download Key field in Update Sites.",
-  "repo.settings.enable_licensing": "Enable licensing for this repository",
-  "repo.settings.enable_licensing_help": "Show the Licenses tab and enable license key management for this repository.",
+  "repo.settings.enable_licensing": "Enable Update Server for this repository",
+  "repo.settings.enable_licensing_help": "Serve update feeds from releases and show the Licenses tab for optional key management.",
   "repo.settings.packages_desc": "Enable Repository Packages Registry",
   "repo.settings.projects_desc": "Enable Projects",
   "repo.settings.projects_mode_desc": "Projects Mode (which kinds of projects to show)",
@@ -2721,6 +2729,28 @@
   "repo.settings.support_url": "Support / Product Page URL",
   "repo.settings.support_url_help": "Shown when downloads are gated. Can point to your wiki, product page, or external support site.",
   "repo.settings.custom_fields": "Custom Fields",
+  "repo.settings.manifest": "Manifest",
+  "repo.settings.manifest_desc": "Project identity, governance, and build settings from the moko-platform manifest. These are accessible via API for Actions workflows and the moko-platform CLI.",
+  "repo.settings.manifest_identity": "Identity",
+  "repo.settings.manifest_name": "Project Name",
+  "repo.settings.manifest_org": "Organization",
+  "repo.settings.manifest_description": "Description",
+  "repo.settings.manifest_version": "Version",
+  "repo.settings.manifest_license_spdx": "License (SPDX)",
+  "repo.settings.manifest_license_name": "License Name",
+  "repo.settings.manifest_governance": "Governance",
+  "repo.settings.manifest_platform": "Platform",
+  "repo.settings.manifest_standards_version": "Standards Version",
+  "repo.settings.manifest_standards_source": "Standards Source",
+  "repo.settings.manifest_build": "Build",
+  "repo.settings.manifest_language": "Language",
+  "repo.settings.manifest_package_type": "Package Type",
+  "repo.settings.manifest_entry_point": "Entry Point",
+  "repo.settings.manifest_save": "Save Manifest",
+  "repo.settings.manifest_saved": "Manifest settings saved.",
+  "repo.settings.metadata": "Metadata",
+  "repo.settings.metadata_saved": "Repository metadata saved.",
+  "repo.settings.metadata_empty": "No metadata fields defined. Org admins can add fields in Organization Settings > Custom Fields.",
   "repo.settings.custom_field_new": "New Field",
   "repo.settings.custom_field_create": "Create Field",
   "repo.settings.custom_field_name": "Field Name",
@@ -2894,11 +2924,39 @@
   "org.form.create_org_not_allowed": "You are not allowed to create an organization.",
   "org.settings": "Settings",
   "org.settings.options": "Organization",
-  "org.settings.update_streams": "Licensing & Update Streams",
-  "org.settings.licensing": "Licensing",
-  "org.settings.licensing_desc": "Control commercial license key management and gated update feeds across all repositories in this organization.",
-  "org.settings.enable_licensing": "Enable licensing for this organization",
-  "org.settings.enable_licensing_help": "Show the Licenses page in the org menu and enable license key management. Individual repos can also enable licensing independently.",
+  "org.settings.custom_fields": "Custom Fields",
+  "org.settings.custom_fields_desc": "Define custom fields that appear across all repositories in this organization. Issue fields show in issue sidebars. Repo fields show in repo settings metadata.",
+  "org.settings.custom_fields_empty": "No custom fields defined yet.",
+  "org.settings.custom_field_add": "Add Custom Field",
+  "org.settings.custom_field_name": "Field Name",
+  "org.settings.custom_field_scope": "Scope",
+  "org.settings.custom_field_type": "Type",
+  "org.settings.custom_field_options": "Options (JSON)",
+  "org.settings.custom_field_options_help": "For dropdown fields, enter options as a JSON array.",
+  "org.settings.custom_field_description": "Description",
+  "org.settings.custom_field_created": "Custom field created.",
+  "org.settings.custom_field_updated": "Custom field updated.",
+  "org.settings.custom_field_deleted": "Custom field deleted.",
+  "org.settings.issue_statuses": "Issue Statuses",
+  "org.settings.issue_statuses_desc": "Define custom issue statuses for all repositories in this organization. Statuses appear in the issue sidebar and can automatically close or reopen issues.",
+  "org.settings.issue_statuses_empty": "No custom issue statuses defined yet.",
+  "org.settings.issue_status_add": "Add Status",
+  "org.settings.issue_status_name": "Status Name",
+  "org.settings.issue_status_color": "Color",
+  "org.settings.issue_status_description": "Description",
+  "org.settings.issue_status_closes_issue": "Closes issue",
+  "org.settings.issue_status_closes_issue_help": "When this status is selected, the issue will be automatically closed.",
+  "org.settings.issue_status_closes": "Closes",
+  "org.settings.issue_status_sort_order": "Sort Order",
+  "org.settings.issue_status_inactive": "Inactive",
+  "org.settings.issue_status_created": "Issue status created.",
+  "org.settings.issue_status_updated": "Issue status updated.",
+  "org.settings.issue_status_deleted": "Issue status deleted.",
+  "org.settings.update_streams": "Update Server",
+  "org.settings.licensing": "Update Server",
+  "org.settings.licensing_desc": "Manage update feeds and optional license key gating across all repositories in this organization.",
+  "org.settings.enable_licensing": "Enable Update Server for this organization",
+  "org.settings.enable_licensing_help": "Show the Licenses page in the org menu and serve update feeds. Individual repos can also enable this independently.",
   "org.settings.require_key": "Require license key for all update feeds",
   "org.settings.require_key_help": "Update feeds return empty results unless a valid key is provided. Joomla clients will see a Download Key field. Individual repos can override this.",
   "org.settings.feed_visibility": "Update Feed Visibility",

routers/api/v1/api.go

@@ -1479,6 +1479,9 @@ func Routes() *web.Router {
 							Delete(reqToken(), repo.DeleteTopic)
 					}, reqAdmin())
 				}, reqAnyRepoReader())
+				m.Combo("/manifest", reqRepoReader(unit.TypeCode)).
+					Get(repo.GetRepoManifest).
+					Put(reqToken(), reqAdmin(), repo.UpdateRepoManifest)
 				// MokoGitea badge engine
 				m.Get("/badge/{type}.svg", repo.GetRepoBadge)
 				m.Get("/issue_templates", reqRepoReader(unit.TypeCode), context.ReferencesGitRepo(), repo.GetIssueTemplates)
@@ -1655,9 +1658,16 @@ func Routes() *web.Router {
 //						})
 //					})
 //				})
-				// TODO: custom-fields API routes - handler not yet implemented
-				// m.Group("/custom-fields", func() { ... })
-				// m.Group("/issues/{index}/custom-fields", func() { ... })
+				// Repo metadata (repo-scoped custom fields)
+				m.Group("/metadata", func() {
+					m.Get("", repo.GetRepoMetadata)
+					m.Put("", reqToken(), reqRepoWriter(unit.TypeCode), repo.SetRepoMetadata)
+				})
+				// Issue custom fields
+				m.Group("/issues/{index}/custom-fields", func() {
+					m.Get("", repo.GetIssueCustomFields)
+					m.Put("", reqToken(), reqRepoWriter(unit.TypeIssues), repo.SetIssueCustomFields)
+				})
 			}, repoAssignment(), checkTokenPublicOnly())
 		}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryIssue))
 
@@ -1758,6 +1768,11 @@ func Routes() *web.Router {
 					m.Delete("", org.UnblockUser)
 				})
 			}, reqToken(), reqOrgOwnership())
+			m.Group("/custom-fields", func() {
+				m.Get("", org.ListOrgCustomFields)
+				m.Post("", reqToken(), reqOrgOwnership(), org.CreateOrgCustomField)
+				m.Delete("/{id}", reqToken(), reqOrgOwnership(), org.DeleteOrgCustomField)
+			})
 		}, tokenRequiresScopes(auth_model.AccessTokenScopeCategoryOrganization), orgAssignment(true), checkTokenPublicOnly())
 		m.Group("/teams/{teamid}", func() {
 			m.Combo("").Get(reqToken(), org.GetTeam).

routers/api/v1/org/custom_fields.go

@@ -0,0 +1,139 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package org
+
+import (
+	"encoding/json"
+	"net/http"
+
+	issues_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/issues"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
+)
+
+type apiCustomFieldDef struct {
+	ID          int64  `json:"id"`
+	OwnerID     int64  `json:"owner_id"`
+	Scope       string `json:"scope"`
+	Name        string `json:"name"`
+	FieldType   string `json:"field_type"`
+	Description string `json:"description"`
+	Options     any    `json:"options"`
+	Required    bool   `json:"required"`
+	SortOrder   int    `json:"sort_order"`
+	IsActive    bool   `json:"is_active"`
+}
+
+func toAPIFieldDef(f *issues_model.CustomFieldDef) apiCustomFieldDef {
+	var opts any
+	if f.Options != "" {
+		var parsed []string
+		if json.Unmarshal([]byte(f.Options), &parsed) == nil {
+			opts = parsed
+		} else {
+			opts = f.Options
+		}
+	}
+	return apiCustomFieldDef{
+		ID:          f.ID,
+		OwnerID:     f.OwnerID,
+		Scope:       string(f.Scope),
+		Name:        f.Name,
+		FieldType:   string(f.FieldType),
+		Description: f.Description,
+		Options:     opts,
+		Required:    f.Required,
+		SortOrder:   f.SortOrder,
+		IsActive:    f.IsActive,
+	}
+}
+
+// ListOrgCustomFields returns all custom field definitions for an org.
+func ListOrgCustomFields(ctx *context.APIContext) {
+	fields, err := issues_model.GetAllCustomFieldsByOwner(ctx, ctx.Org.Organization.ID)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	result := make([]apiCustomFieldDef, 0, len(fields))
+	for _, f := range fields {
+		result = append(result, toAPIFieldDef(f))
+	}
+	ctx.JSON(http.StatusOK, result)
+}
+
+// CreateOrgCustomField creates a new custom field definition.
+func CreateOrgCustomField(ctx *context.APIContext) {
+	var req struct {
+		Scope       string   `json:"scope" binding:"Required"`
+		Name        string   `json:"name" binding:"Required"`
+		FieldType   string   `json:"field_type" binding:"Required"`
+		Description string   `json:"description"`
+		Options     []string `json:"options"`
+		Required    bool     `json:"required"`
+		SortOrder   int      `json:"sort_order"`
+	}
+	if err := ctx.Req.ParseForm(); err != nil {
+		ctx.APIError(http.StatusBadRequest, err)
+		return
+	}
+	if err := json.NewDecoder(ctx.Req.Body).Decode(&req); err != nil {
+		ctx.APIError(http.StatusBadRequest, err)
+		return
+	}
+	if req.Name == "" || req.Scope == "" {
+		ctx.APIError(http.StatusBadRequest, "name and scope are required")
+		return
+	}
+
+	scope := issues_model.CustomFieldScope(req.Scope)
+	if scope != issues_model.CustomFieldScopeIssue && scope != issues_model.CustomFieldScopeRepo {
+		ctx.APIError(http.StatusBadRequest, "scope must be 'issue' or 'repo'")
+		return
+	}
+
+	var optionsJSON string
+	if len(req.Options) > 0 {
+		data, _ := json.Marshal(req.Options)
+		optionsJSON = string(data)
+	}
+
+	field := &issues_model.CustomFieldDef{
+		OwnerID:     ctx.Org.Organization.ID,
+		RepoID:      0,
+		Scope:       scope,
+		Name:        req.Name,
+		FieldType:   issues_model.CustomFieldType(req.FieldType),
+		Description: req.Description,
+		Options:     optionsJSON,
+		Required:    req.Required,
+		SortOrder:   req.SortOrder,
+		IsActive:    true,
+	}
+
+	if err := issues_model.CreateCustomFieldDef(ctx, field); err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+
+	ctx.JSON(http.StatusCreated, toAPIFieldDef(field))
+}
+
+// DeleteOrgCustomField deletes a custom field definition.
+func DeleteOrgCustomField(ctx *context.APIContext) {
+	id := ctx.PathParamInt64("id")
+	field, err := issues_model.GetCustomFieldDefByID(ctx, id)
+	if err != nil {
+		ctx.APIErrorNotFound()
+		return
+	}
+	if field.OwnerID != ctx.Org.Organization.ID {
+		ctx.APIErrorNotFound()
+		return
+	}
+	if err := issues_model.DeleteCustomFieldDef(ctx, id); err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	ctx.Status(http.StatusNoContent)
+}

routers/api/v1/repo/custom_fields.go

@@ -0,0 +1,137 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package repo
+
+import (
+	"encoding/json"
+	"net/http"
+
+	issues_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/issues"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
+)
+
+// GetRepoMetadata returns all repo-scoped custom field values.
+func GetRepoMetadata(ctx *context.APIContext) {
+	ownerID := ctx.Repo.Repository.OwnerID
+	repoID := ctx.Repo.Repository.ID
+
+	fields, err := issues_model.GetCustomFieldsByOwner(ctx, ownerID, issues_model.CustomFieldScopeRepo)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+
+	values, err := issues_model.GetCustomFieldValuesMap(ctx, repoID)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+
+	result := make(map[string]string, len(fields))
+	for _, f := range fields {
+		result[f.Name] = values[f.ID]
+	}
+	ctx.JSON(http.StatusOK, result)
+}
+
+// SetRepoMetadata sets repo-scoped custom field values.
+func SetRepoMetadata(ctx *context.APIContext) {
+	ownerID := ctx.Repo.Repository.OwnerID
+	repoID := ctx.Repo.Repository.ID
+
+	var req map[string]string
+	if err := json.NewDecoder(ctx.Req.Body).Decode(&req); err != nil {
+		ctx.APIError(http.StatusBadRequest, err)
+		return
+	}
+
+	fields, err := issues_model.GetCustomFieldsByOwner(ctx, ownerID, issues_model.CustomFieldScopeRepo)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+
+	// Build name->ID map
+	nameToID := make(map[string]int64, len(fields))
+	for _, f := range fields {
+		nameToID[f.Name] = f.ID
+	}
+
+	for name, value := range req {
+		if fieldID, ok := nameToID[name]; ok {
+			if err := issues_model.SetCustomFieldValue(ctx, repoID, fieldID, value); err != nil {
+				ctx.APIErrorInternal(err)
+				return
+			}
+		}
+	}
+
+	ctx.Status(http.StatusNoContent)
+}
+
+// GetIssueCustomFields returns custom field values for an issue.
+func GetIssueCustomFields(ctx *context.APIContext) {
+	issue, err := issues_model.GetIssueByIndex(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("index"))
+	if err != nil {
+		ctx.APIErrorNotFound()
+		return
+	}
+
+	ownerID := ctx.Repo.Repository.OwnerID
+	fields, err := issues_model.GetCustomFieldsByOwner(ctx, ownerID, issues_model.CustomFieldScopeIssue)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+
+	values, err := issues_model.GetCustomFieldValuesMap(ctx, issue.ID)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+
+	result := make(map[string]string, len(fields))
+	for _, f := range fields {
+		result[f.Name] = values[f.ID]
+	}
+	ctx.JSON(http.StatusOK, result)
+}
+
+// SetIssueCustomFields sets custom field values for an issue.
+func SetIssueCustomFields(ctx *context.APIContext) {
+	issue, err := issues_model.GetIssueByIndex(ctx, ctx.Repo.Repository.ID, ctx.PathParamInt64("index"))
+	if err != nil {
+		ctx.APIErrorNotFound()
+		return
+	}
+
+	var req map[string]string
+	if err := json.NewDecoder(ctx.Req.Body).Decode(&req); err != nil {
+		ctx.APIError(http.StatusBadRequest, err)
+		return
+	}
+
+	ownerID := ctx.Repo.Repository.OwnerID
+	fields, err := issues_model.GetCustomFieldsByOwner(ctx, ownerID, issues_model.CustomFieldScopeIssue)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+
+	nameToID := make(map[string]int64, len(fields))
+	for _, f := range fields {
+		nameToID[f.Name] = f.ID
+	}
+
+	for name, value := range req {
+		if fieldID, ok := nameToID[name]; ok {
+			if err := issues_model.SetCustomFieldValue(ctx, issue.ID, fieldID, value); err != nil {
+				ctx.APIErrorInternal(err)
+				return
+			}
+		}
+	}
+
+	ctx.Status(http.StatusNoContent)
+}

routers/api/v1/repo/issue.go

@@ -289,6 +289,12 @@ func SearchIssues(ctx *context.APIContext) {
 		}
 	}
 
+	if cfFilters, cfErr := parseAPICustomFieldFilters(ctx); cfErr != nil {
+		return
+	} else if len(cfFilters) > 0 {
+		searchOpt.CustomFieldFilters = cfFilters
+	}
+
 	ids, total, err := issue_indexer.SearchIssues(ctx, searchOpt)
 	if err != nil {
 		ctx.APIErrorInternal(err)
@@ -517,6 +523,12 @@ func ListIssues(ctx *context.APIContext) {
 		searchOpt.MentionID = optional.Some(mentionedByID)
 	}
 
+	if cfFilters, cfErr := parseAPICustomFieldFilters(ctx); cfErr != nil {
+		return
+	} else if len(cfFilters) > 0 {
+		searchOpt.CustomFieldFilters = cfFilters
+	}
+
 	ids, total, err := issue_indexer.SearchIssues(ctx, searchOpt)
 	if err != nil {
 		ctx.APIErrorInternal(err)
@@ -553,6 +565,25 @@ func getUserIDForFilter(ctx *context.APIContext, queryName string) int64 {
 	return user.ID
 }
 
+// parseAPICustomFieldFilters extracts cf_{fieldID}=value query parameters.
+// Returns an error (and writes a 400 response) if a field ID is non-numeric or non-positive.
+func parseAPICustomFieldFilters(ctx *context.APIContext) (map[int64]string, error) {
+	filters := make(map[int64]string)
+	for key, values := range ctx.Req.URL.Query() {
+		after, ok := strings.CutPrefix(key, "cf_")
+		if !ok || len(values) == 0 || values[0] == "" {
+			continue
+		}
+		fieldID, err := strconv.ParseInt(after, 10, 64)
+		if err != nil || fieldID <= 0 {
+			ctx.APIError(http.StatusBadRequest, fmt.Sprintf("invalid custom field filter: cf_%s must use a positive numeric field ID", after))
+			return nil, fmt.Errorf("invalid cf_ param")
+		}
+		filters[fieldID] = values[0]
+	}
+	return filters, nil
+}
+
 // GetIssue get an issue of a repository
 func GetIssue(ctx *context.APIContext) {
 	// swagger:operation GET /repos/{owner}/{repo}/issues/{index} issue issueGetIssue
@@ -702,6 +733,29 @@ func CreateIssue(ctx *context.APIContext) {
 		return
 	}
 
+	// Save custom field values if provided (resolve field names to IDs).
+	if len(form.CustomFields) > 0 {
+		defs, defErr := issues_model.GetCustomFieldsByOwner(ctx, ctx.Repo.Repository.OwnerID, issues_model.CustomFieldScopeIssue)
+		if defErr != nil {
+			ctx.APIErrorInternal(defErr)
+			return
+		}
+		if len(defs) > 0 {
+			vals := make(map[int64]string)
+			for _, def := range defs {
+				if v, ok := form.CustomFields[def.Name]; ok {
+					vals[def.ID] = v
+				}
+			}
+			if len(vals) > 0 {
+				if setErr := issues_model.SetCustomFieldValues(ctx, issue.ID, vals); setErr != nil {
+					ctx.APIErrorInternal(setErr)
+					return
+				}
+			}
+		}
+	}
+
 	if form.Closed {
 		if err := issue_service.CloseIssue(ctx, issue, ctx.Doer, ""); err != nil {
 			if issues_model.IsErrDependenciesLeft(err) {

routers/api/v1/repo/manifest.go

@@ -0,0 +1,125 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package repo
+
+import (
+	"encoding/json"
+	"net/http"
+
+	repo_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
+)
+
+// apiManifest is the JSON representation of a repo manifest.
+type apiManifest struct {
+	Name             string `json:"name"`
+	Org              string `json:"org"`
+	Description      string `json:"description"`
+	Version          string `json:"version"`
+	LicenseSPDX      string `json:"license_spdx"`
+	LicenseName      string `json:"license_name"`
+	Platform         string `json:"platform"`
+	StandardsVersion string `json:"standards_version"`
+	StandardsSource  string `json:"standards_source"`
+	Language         string `json:"language"`
+	PackageType      string `json:"package_type"`
+	EntryPoint       string `json:"entry_point"`
+}
+
+// GetRepoManifest returns the manifest settings for a repository.
+func GetRepoManifest(ctx *context.APIContext) {
+	// swagger:operation GET /repos/{owner}/{repo}/manifest repository repoGetManifest
+	// ---
+	// summary: Get repo manifest settings
+	// produces:
+	// - application/json
+	// responses:
+	//   "200":
+	//     "$ref": "#/responses/Manifest"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+	m, err := repo_model.GetRepoManifest(ctx, ctx.Repo.Repository.ID)
+	if err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+	if m == nil {
+		// Return defaults from repo metadata.
+		ctx.JSON(http.StatusOK, &apiManifest{
+			Name:        ctx.Repo.Repository.Name,
+			Org:         ctx.Repo.Repository.OwnerName,
+			Description: ctx.Repo.Repository.Description,
+		})
+		return
+	}
+	ctx.JSON(http.StatusOK, &apiManifest{
+		Name:             m.Name,
+		Org:              m.Org,
+		Description:      m.Description,
+		Version:          m.Version,
+		LicenseSPDX:      m.LicenseSPDX,
+		LicenseName:      m.LicenseName,
+		Platform:         m.Platform,
+		StandardsVersion: m.StandardsVersion,
+		StandardsSource:  m.StandardsSource,
+		Language:         m.Language,
+		PackageType:      m.PackageType,
+		EntryPoint:       m.EntryPoint,
+	})
+}
+
+// UpdateRepoManifest updates the manifest settings for a repository.
+func UpdateRepoManifest(ctx *context.APIContext) {
+	// swagger:operation PUT /repos/{owner}/{repo}/manifest repository repoUpdateManifest
+	// ---
+	// summary: Update repo manifest settings
+	// consumes:
+	// - application/json
+	// produces:
+	// - application/json
+	// responses:
+	//   "200":
+	//     "$ref": "#/responses/Manifest"
+	var req apiManifest
+	if err := json.NewDecoder(ctx.Req.Body).Decode(&req); err != nil {
+		ctx.APIError(http.StatusBadRequest, err)
+		return
+	}
+
+	m := &repo_model.RepoManifest{
+		RepoID:           ctx.Repo.Repository.ID,
+		Name:             req.Name,
+		Org:              req.Org,
+		Description:      req.Description,
+		Version:          req.Version,
+		LicenseSPDX:      req.LicenseSPDX,
+		LicenseName:      req.LicenseName,
+		Platform:         req.Platform,
+		StandardsVersion: req.StandardsVersion,
+		StandardsSource:  req.StandardsSource,
+		Language:         req.Language,
+		PackageType:      req.PackageType,
+		EntryPoint:       req.EntryPoint,
+	}
+
+	if err := repo_model.CreateOrUpdateRepoManifest(ctx, m); err != nil {
+		ctx.APIErrorInternal(err)
+		return
+	}
+
+	ctx.JSON(http.StatusOK, &apiManifest{
+		Name:             m.Name,
+		Org:              m.Org,
+		Description:      m.Description,
+		Version:          m.Version,
+		LicenseSPDX:      m.LicenseSPDX,
+		LicenseName:      m.LicenseName,
+		Platform:         m.Platform,
+		StandardsVersion: m.StandardsVersion,
+		StandardsSource:  m.StandardsSource,
+		Language:         m.Language,
+		PackageType:      m.PackageType,
+		EntryPoint:       m.EntryPoint,
+	})
+}

routers/web/org/custom_fields.go

@@ -0,0 +1,120 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package org
+
+import (
+	"net/http"
+	"strconv"
+
+	issues_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/issues"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/templates"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
+)
+
+const tplOrgCustomFields templates.TplName = "org/settings/custom_fields"
+
+// SettingsCustomFields shows the org-level custom fields management page.
+func SettingsCustomFields(ctx *context.Context) {
+	ctx.Data["Title"] = ctx.Tr("org.settings.custom_fields")
+	ctx.Data["PageIsOrgSettings"] = true
+	ctx.Data["PageIsSettingsCustomFields"] = true
+
+	fields, err := issues_model.GetAllCustomFieldsByOwner(ctx, ctx.Org.Organization.ID)
+	if err != nil {
+		ctx.ServerError("GetAllCustomFieldsByOwner", err)
+		return
+	}
+	ctx.Data["CustomFields"] = fields
+
+	ctx.HTML(http.StatusOK, tplOrgCustomFields)
+}
+
+// SettingsCustomFieldsCreatePost creates a new org-level custom field.
+func SettingsCustomFieldsCreatePost(ctx *context.Context) {
+	sortOrder, _ := strconv.Atoi(ctx.FormString("sort_order"))
+	scope := issues_model.CustomFieldScope(ctx.FormString("scope"))
+	if scope != issues_model.CustomFieldScopeIssue && scope != issues_model.CustomFieldScopeRepo {
+		scope = issues_model.CustomFieldScopeIssue
+	}
+
+	field := &issues_model.CustomFieldDef{
+		OwnerID:     ctx.Org.Organization.ID,
+		RepoID:      0, // org-level
+		Scope:       scope,
+		Name:        ctx.FormString("name"),
+		FieldType:   issues_model.CustomFieldType(ctx.FormString("field_type")),
+		Description: ctx.FormString("description"),
+		Options:     ctx.FormString("options"),
+		Required:    ctx.FormString("required") == "on",
+		SortOrder:   sortOrder,
+		IsActive:    true,
+	}
+
+	if field.Name == "" {
+		ctx.Flash.Error("Field name is required")
+		ctx.Redirect(ctx.Org.OrgLink + "/settings/custom-fields")
+		return
+	}
+
+	if err := issues_model.CreateCustomFieldDef(ctx, field); err != nil {
+		ctx.ServerError("CreateCustomFieldDef", err)
+		return
+	}
+
+	ctx.Flash.Success(ctx.Tr("org.settings.custom_field_created"))
+	ctx.Redirect(ctx.Org.OrgLink + "/settings/custom-fields")
+}
+
+// SettingsCustomFieldsEditPost updates an org-level custom field.
+func SettingsCustomFieldsEditPost(ctx *context.Context) {
+	id := ctx.PathParamInt64("id")
+	field, err := issues_model.GetCustomFieldDefByID(ctx, id)
+	if err != nil {
+		ctx.ServerError("GetCustomFieldDefByID", err)
+		return
+	}
+	if field.OwnerID != ctx.Org.Organization.ID {
+		ctx.NotFound(nil)
+		return
+	}
+
+	field.Name = ctx.FormString("name")
+	field.FieldType = issues_model.CustomFieldType(ctx.FormString("field_type"))
+	field.Description = ctx.FormString("description")
+	field.Options = ctx.FormString("options")
+	field.Required = ctx.FormString("required") == "on"
+	field.IsActive = ctx.FormString("is_active") == "on"
+	sortOrder, _ := strconv.Atoi(ctx.FormString("sort_order"))
+	field.SortOrder = sortOrder
+
+	if err := issues_model.UpdateCustomFieldDef(ctx, field); err != nil {
+		ctx.ServerError("UpdateCustomFieldDef", err)
+		return
+	}
+
+	ctx.Flash.Success(ctx.Tr("org.settings.custom_field_updated"))
+	ctx.Redirect(ctx.Org.OrgLink + "/settings/custom-fields")
+}
+
+// SettingsCustomFieldsDeletePost deletes an org-level custom field.
+func SettingsCustomFieldsDeletePost(ctx *context.Context) {
+	id := ctx.PathParamInt64("id")
+	field, err := issues_model.GetCustomFieldDefByID(ctx, id)
+	if err != nil {
+		ctx.ServerError("GetCustomFieldDefByID", err)
+		return
+	}
+	if field.OwnerID != ctx.Org.Organization.ID {
+		ctx.NotFound(nil)
+		return
+	}
+
+	if err := issues_model.DeleteCustomFieldDef(ctx, id); err != nil {
+		ctx.ServerError("DeleteCustomFieldDef", err)
+		return
+	}
+
+	ctx.Flash.Success(ctx.Tr("org.settings.custom_field_deleted"))
+	ctx.Redirect(ctx.Org.OrgLink + "/settings/custom-fields")
+}

routers/web/org/issue_statuses.go

@@ -0,0 +1,112 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package org
+
+import (
+	"net/http"
+	"strconv"
+
+	issues_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/issues"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/templates"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
+)
+
+const tplOrgIssueStatuses templates.TplName = "org/settings/issue_statuses"
+
+// SettingsIssueStatuses shows the org-level issue statuses management page.
+func SettingsIssueStatuses(ctx *context.Context) {
+	ctx.Data["Title"] = ctx.Tr("org.settings.issue_statuses")
+	ctx.Data["PageIsOrgSettings"] = true
+	ctx.Data["PageIsSettingsIssueStatuses"] = true
+
+	defs, err := issues_model.GetAllIssueStatusDefsByOrg(ctx, ctx.Org.Organization.ID)
+	if err != nil {
+		ctx.ServerError("GetAllIssueStatusDefsByOrg", err)
+		return
+	}
+	ctx.Data["IssueStatuses"] = defs
+
+	ctx.HTML(http.StatusOK, tplOrgIssueStatuses)
+}
+
+// SettingsIssueStatusesCreatePost creates a new org-level issue status.
+func SettingsIssueStatusesCreatePost(ctx *context.Context) {
+	sortOrder, _ := strconv.Atoi(ctx.FormString("sort_order"))
+
+	def := &issues_model.IssueStatusDef{
+		OrgID:       ctx.Org.Organization.ID,
+		Name:        ctx.FormString("name"),
+		Color:       ctx.FormString("color"),
+		Description: ctx.FormString("description"),
+		ClosesIssue: ctx.FormString("closes_issue") == "on",
+		SortOrder:   sortOrder,
+		IsActive:    true,
+	}
+
+	if def.Name == "" {
+		ctx.Flash.Error("Status name is required")
+		ctx.Redirect(ctx.Org.OrgLink + "/settings/issue-statuses")
+		return
+	}
+
+	if err := issues_model.CreateIssueStatusDef(ctx, def); err != nil {
+		ctx.ServerError("CreateIssueStatusDef", err)
+		return
+	}
+
+	ctx.Flash.Success(ctx.Tr("org.settings.issue_status_created"))
+	ctx.Redirect(ctx.Org.OrgLink + "/settings/issue-statuses")
+}
+
+// SettingsIssueStatusesEditPost updates an org-level issue status.
+func SettingsIssueStatusesEditPost(ctx *context.Context) {
+	id := ctx.PathParamInt64("id")
+	def, err := issues_model.GetIssueStatusDefByID(ctx, id)
+	if err != nil {
+		ctx.ServerError("GetIssueStatusDefByID", err)
+		return
+	}
+	if def.OrgID != ctx.Org.Organization.ID {
+		ctx.NotFound(nil)
+		return
+	}
+
+	def.Name = ctx.FormString("name")
+	def.Color = ctx.FormString("color")
+	def.Description = ctx.FormString("description")
+	def.ClosesIssue = ctx.FormString("closes_issue") == "on"
+	def.IsActive = ctx.FormString("is_active") == "on"
+	sortOrder, _ := strconv.Atoi(ctx.FormString("sort_order"))
+	def.SortOrder = sortOrder
+
+	if err := issues_model.UpdateIssueStatusDef(ctx, def); err != nil {
+		ctx.ServerError("UpdateIssueStatusDef", err)
+		return
+	}
+
+	ctx.Flash.Success(ctx.Tr("org.settings.issue_status_updated"))
+	ctx.Redirect(ctx.Org.OrgLink + "/settings/issue-statuses")
+}
+
+// SettingsIssueStatusesDeletePost deletes an org-level issue status.
+func SettingsIssueStatusesDeletePost(ctx *context.Context) {
+	id := ctx.PathParamInt64("id")
+	def, err := issues_model.GetIssueStatusDefByID(ctx, id)
+	if err != nil {
+		ctx.ServerError("GetIssueStatusDefByID", err)
+		return
+	}
+	if def.OrgID != ctx.Org.Organization.ID {
+		ctx.NotFound(nil)
+		return
+	}
+
+	if err := issues_model.DeleteIssueStatusDef(ctx, id); err != nil {
+		ctx.ServerError("DeleteIssueStatusDef", err)
+		return
+	}
+
+	ctx.Flash.Success(ctx.Tr("org.settings.issue_status_deleted"))
+	ctx.Redirect(ctx.Org.OrgLink + "/settings/issue-statuses")
+}

routers/web/repo/compare.go

@@ -630,7 +630,7 @@ func (cpi *comparePageInfoType) prepareCreatePullRequestPage(ctx *context.Contex
 			if ctx.Written() {
 				return
 			}
-			_, templateErrs := setTemplateIfExists(ctx, pullRequestTemplateKey, pullRequestTemplateCandidates, pageMetaData)
+			_, templateErrs, _ := setTemplateIfExists(ctx, pullRequestTemplateKey, pullRequestTemplateCandidates, pageMetaData)
 			if len(templateErrs) > 0 {
 				ctx.Flash.Warning(renderErrorOfTemplates(ctx, templateErrs), true)
 			}

routers/web/repo/download_gating.go

@@ -30,6 +30,12 @@ func CheckDownloadGating(ctx *context.Context, tagName string) bool {
 		return true // no download gating configured
 	}
 
+	// Signed-in users with repo access bypass download gating.
+	// The gate is for anonymous/external clients (Joomla update checker).
+	if ctx.IsSigned && ctx.Repo.Permission.HasAnyUnitAccess() {
+		return true
+	}
+
 	// For prerelease-only gating, check if this is a prerelease tag.
 	if gating == "prerelease" && tagName != "" {
 		streams := licenses.GetEffectiveStreams(ctx, repo.OwnerID, repo.ID)

routers/web/repo/issue_custom_field.go

@@ -0,0 +1,33 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package repo
+
+import (
+	"fmt"
+	"net/http"
+
+	issues_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/issues"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
+)
+
+// UpdateIssueCustomField handles POST to set a custom field value on an issue.
+func UpdateIssueCustomField(ctx *context.Context) {
+	issueID := ctx.PathParamInt64("id")
+	fieldID := ctx.PathParamInt64("field_id")
+	value := ctx.FormString("value")
+
+	// Look up issue to get the index for redirect.
+	issue, err := issues_model.GetIssueByID(ctx, issueID)
+	if err != nil {
+		ctx.ServerError("GetIssueByID", err)
+		return
+	}
+
+	if err := issues_model.SetCustomFieldValue(ctx, issueID, fieldID, value); err != nil {
+		ctx.ServerError("SetCustomFieldValue", err)
+		return
+	}
+
+	ctx.Redirect(fmt.Sprintf("%s/issues/%d", ctx.Repo.RepoLink, issue.Index), http.StatusSeeOther)
+}

routers/web/repo/issue_custom_status.go

@@ -0,0 +1,59 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package repo
+
+import (
+	"fmt"
+	"net/http"
+
+	issues_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/issues"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/log"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
+	issue_service "code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/issue"
+)
+
+// UpdateIssueCustomStatus handles POST to set a custom status on an issue.
+// If the chosen status has ClosesIssue=true, the issue is automatically closed.
+// If the chosen status has ClosesIssue=false and the issue is closed, it is reopened.
+func UpdateIssueCustomStatus(ctx *context.Context) {
+	issueID := ctx.PathParamInt64("id")
+	statusID := ctx.FormInt64("status_id")
+
+	issue, err := issues_model.GetIssueByID(ctx, issueID)
+	if err != nil {
+		ctx.ServerError("GetIssueByID", err)
+		return
+	}
+
+	// Validate the status belongs to this repo's org (or is being cleared).
+	if statusID > 0 {
+		statusDef, err := issues_model.GetIssueStatusDefByID(ctx, statusID)
+		if err != nil {
+			ctx.ServerError("GetIssueStatusDefByID", err)
+			return
+		}
+		if statusDef.OrgID != ctx.Repo.Repository.OwnerID {
+			ctx.NotFound(nil)
+			return
+		}
+
+		// Handle automatic close/reopen based on the status definition.
+		if statusDef.ClosesIssue && !issue.IsClosed {
+			if err := issue_service.CloseIssue(ctx, issue, ctx.Doer, ""); err != nil {
+				log.Error("UpdateIssueCustomStatus: CloseIssue: %v", err)
+			}
+		} else if !statusDef.ClosesIssue && issue.IsClosed {
+			if err := issue_service.ReopenIssue(ctx, issue, ctx.Doer, ""); err != nil {
+				log.Error("UpdateIssueCustomStatus: ReopenIssue: %v", err)
+			}
+		}
+	}
+
+	if err := issues_model.SetIssueStatusID(ctx, issueID, statusID); err != nil {
+		ctx.ServerError("SetIssueStatusID", err)
+		return
+	}
+
+	ctx.Redirect(fmt.Sprintf("%s/issues/%d", ctx.Repo.RepoLink, issue.Index), http.StatusSeeOther)
+}

routers/web/repo/issue_list.go

@@ -5,8 +5,11 @@ package repo
 
 import (
 	"bytes"
+	"encoding/json"
+	"fmt"
 	"maps"
 	"net/http"
+	"net/url"
 	"slices"
 	"sort"
 	"strconv"
@@ -521,20 +524,52 @@ func prepareIssueFilterAndList(ctx *context.Context, milestoneID int64, projectI
 
 	prepareIssueFilterExclusiveOrderScopes(ctx, preparedLabelFilter.AllLabels)
 
+	// Parse custom field filters from query params (cf_{fieldID}={value}).
+	customFieldFilters := parseCustomFieldQueryParams(ctx.Req.URL.Query())
+
+	// Load custom field definitions for the filter UI.
+	// If this fails, clear filters so users don't get invisible filtering.
+	customFieldDefs, cfErr := issues_model.GetCustomFieldsByOwner(ctx, repo.OwnerID, issues_model.CustomFieldScopeIssue)
+	if cfErr != nil {
+		log.Error("prepareIssueFilterAndList: GetCustomFieldsByOwner: %v", cfErr)
+		customFieldFilters = make(map[int64]string)
+	}
+	ctx.Data["CustomFieldDefs"] = customFieldDefs
+	ctx.Data["CustomFieldFilters"] = customFieldFilters
+	// Build a query string fragment for cf_ params so they survive pagination/sort changes.
+	cfQuery := make(url.Values)
+	for fieldID, value := range customFieldFilters {
+		cfQuery.Set(fmt.Sprintf("cf_%d", fieldID), value)
+	}
+	ctx.Data["CustomFieldQueryString"] = cfQuery.Encode()
+	fieldOptions := make(map[int64][]string)
+	for _, f := range customFieldDefs {
+		if f.Options != "" {
+			var opts []string
+			if err := json.Unmarshal([]byte(f.Options), &opts); err != nil {
+				log.Error("prepareIssueFilterAndList: invalid options JSON for field %d (%s): %v", f.ID, f.Name, err)
+			} else {
+				fieldOptions[f.ID] = opts
+			}
+		}
+	}
+	ctx.Data["CustomFieldOptions"] = fieldOptions
+
 	var keywordMatchedIssueIDs []int64
 	var issueStats *issues_model.IssueStats
 	statsOpts := &issues_model.IssuesOptions{
-		RepoIDs:           []int64{repo.ID},
-		LabelIDs:          preparedLabelFilter.SelectedLabelIDs,
-		MilestoneIDs:      mileIDs,
-		ProjectIDs:        projectIDs,
-		AssigneeID:        assigneeID,
-		MentionedID:       mentionedID,
-		PosterID:          posterUserID,
-		ReviewRequestedID: reviewRequestedID,
-		ReviewedID:        reviewedID,
-		IsPull:            isPullOption,
-		IssueIDs:          nil,
+		RepoIDs:            []int64{repo.ID},
+		LabelIDs:           preparedLabelFilter.SelectedLabelIDs,
+		MilestoneIDs:       mileIDs,
+		ProjectIDs:         projectIDs,
+		AssigneeID:         assigneeID,
+		MentionedID:        mentionedID,
+		PosterID:           posterUserID,
+		ReviewRequestedID:  reviewRequestedID,
+		ReviewedID:         reviewedID,
+		IsPull:             isPullOption,
+		IssueIDs:           nil,
+		CustomFieldFilters: customFieldFilters,
 	}
 
 	if keyword != "" {
@@ -611,9 +646,10 @@ func prepareIssueFilterAndList(ctx *context.Context, milestoneID int64, projectI
 			ProjectIDs:        projectIDs,
 			IsClosed:          isShowClosed,
 			IsPull:            isPullOption,
-			LabelIDs:          preparedLabelFilter.SelectedLabelIDs,
-			SortType:          sortType,
-			IssueIDs:          keywordMatchedIssueIDs,
+			LabelIDs:           preparedLabelFilter.SelectedLabelIDs,
+			SortType:           sortType,
+			IssueIDs:           keywordMatchedIssueIDs,
+			CustomFieldFilters: customFieldFilters,
 		})
 		if err != nil {
 			ctx.ServerError("DBIndexer.Search", err)
@@ -771,3 +807,17 @@ func Issues(ctx *context.Context) {
 
 	ctx.HTML(http.StatusOK, tplIssues)
 }
+
+// parseCustomFieldQueryParams extracts cf_{fieldID}=value query parameters.
+// Non-numeric or non-positive field IDs are silently skipped.
+func parseCustomFieldQueryParams(query url.Values) map[int64]string {
+	filters := make(map[int64]string)
+	for key, values := range query {
+		if after, ok := strings.CutPrefix(key, "cf_"); ok && len(values) > 0 && values[0] != "" {
+			if fieldID, err := strconv.ParseInt(after, 10, 64); err == nil && fieldID > 0 {
+				filters[fieldID] = values[0]
+			}
+		}
+	}
+	return filters
+}

routers/web/repo/issue_new.go

@@ -4,6 +4,7 @@
 package repo
 
 import (
+	"encoding/json"
 	"errors"
 	"fmt"
 	"html/template"
@@ -36,10 +37,11 @@ import (
 )
 
 // Tries to load and set an issue template. The first return value indicates if a template was loaded.
-func setTemplateIfExists(ctx *context.Context, ctxDataKey string, possibleFiles []string, metaData *IssuePageMetaData) (bool, map[string]error) {
+// The third return value contains the template's custom_fields map (field name → default value).
+func setTemplateIfExists(ctx *context.Context, ctxDataKey string, possibleFiles []string, metaData *IssuePageMetaData) (bool, map[string]error, map[string]string) {
 	commit, err := ctx.Repo.GitRepo.GetBranchCommit(ctx.Repo.Repository.DefaultBranch)
 	if err != nil {
-		return false, nil
+		return false, nil, nil
 	}
 
 	templateCandidates := make([]string, 0, 1+len(possibleFiles))
@@ -84,9 +86,9 @@ func setTemplateIfExists(ctx *context.Context, ctxDataKey string, possibleFiles
 		}
 		metaData.AssigneesData.SelectedAssigneeIDs = strings.Join(selectedAssigneeIDStrings, ",")
 
-		return true, templateErrs
+		return true, templateErrs, template.CustomFields
 	}
-	return false, templateErrs
+	return false, templateErrs, nil
 }
 
 // NewIssue render creating issue page
@@ -128,7 +130,7 @@ func NewIssue(ctx *context.Context) {
 	ctx.Data["Tags"] = tags
 
 	ret := issue_service.ParseTemplatesFromDefaultBranch(ctx.Repo.Repository, ctx.Repo.GitRepo)
-	templateLoaded, errs := setTemplateIfExists(ctx, issueTemplateKey, IssueTemplateCandidates, pageMetaData)
+	templateLoaded, errs, templateCustomFields := setTemplateIfExists(ctx, issueTemplateKey, IssueTemplateCandidates, pageMetaData)
 	maps.Copy(ret.TemplateErrors, errs)
 	if ctx.Written() {
 		return
@@ -140,6 +142,35 @@ func NewIssue(ctx *context.Context) {
 
 	ctx.Data["HasIssuesOrPullsWritePermission"] = ctx.Repo.Permission.CanWrite(unit.TypeIssues)
 
+	// Load org-level issue-scoped custom fields for the new issue sidebar.
+	customFieldDefs, cfErr := issues_model.GetCustomFieldsByOwner(ctx, ctx.Repo.Repository.OwnerID, issues_model.CustomFieldScopeIssue)
+	if cfErr != nil {
+		log.Error("NewIssue: GetCustomFieldsByOwner: %v", cfErr)
+	}
+	ctx.Data["CustomFieldDefs"] = customFieldDefs
+	customFieldValues := make(map[int64]string)
+	fieldOptions := make(map[int64][]string)
+	if len(customFieldDefs) > 0 {
+		// Resolve template custom_fields (name → value) to field IDs.
+		if len(templateCustomFields) > 0 {
+			for _, def := range customFieldDefs {
+				if val, ok := templateCustomFields[def.Name]; ok {
+					customFieldValues[def.ID] = val
+				}
+			}
+		}
+		for _, f := range customFieldDefs {
+			if f.Options != "" {
+				var opts []string
+				if err := json.Unmarshal([]byte(f.Options), &opts); err == nil {
+					fieldOptions[f.ID] = opts
+				}
+			}
+		}
+	}
+	ctx.Data["CustomFieldValues"] = customFieldValues
+	ctx.Data["CustomFieldOptions"] = fieldOptions
+
 	if !issueConfig.BlankIssuesEnabled && hasTemplates && !templateLoaded {
 		// The "issues/new" and "issues/new/choose" share the same query parameters "project" and "milestone", if blank issues are disabled, just redirect to the "issues/choose" page with these parameters.
 		ctx.Redirect(fmt.Sprintf("%s/issues/new/choose?%s", ctx.Repo.Repository.Link(), ctx.Req.URL.RawQuery), http.StatusSeeOther)
@@ -377,6 +408,9 @@ func NewIssuePost(ctx *context.Context) {
 		return
 	}
 
+	// Save custom field values submitted from the new issue form.
+	saveCustomFieldsFromForm(ctx, repo.OwnerID, issue.ID)
+
 	log.Trace("Issue created: %d/%d", repo.ID, issue.ID)
 	if ctx.FormString("redirect_after_creation") == "project" && len(projectIDs) > 0 {
 		// When issue is in multiple projects, redirect to first project from form order.
@@ -392,3 +426,29 @@ func NewIssuePost(ctx *context.Context) {
 	}
 	ctx.JSONRedirect(issue.Link())
 }
+
+// saveCustomFieldsFromForm reads custom field values from the form
+// (submitted as "custom-field-{fieldID}") and persists them for the issue.
+func saveCustomFieldsFromForm(ctx *context.Context, ownerID, issueID int64) {
+	defs, err := issues_model.GetCustomFieldsByOwner(ctx, ownerID, issues_model.CustomFieldScopeIssue)
+	if err != nil {
+		log.Error("saveCustomFieldsFromForm: GetCustomFieldsByOwner: %v", err)
+		return
+	}
+	if len(defs) == 0 {
+		return
+	}
+	vals := make(map[int64]string)
+	for _, def := range defs {
+		v := ctx.Req.FormValue(fmt.Sprintf("custom-field-%d", def.ID))
+		if v != "" {
+			vals[def.ID] = v
+		}
+	}
+	if len(vals) > 0 {
+		if err := issues_model.SetCustomFieldValues(ctx, issueID, vals); err != nil {
+			log.Error("saveCustomFieldsFromForm: %v", err)
+			ctx.Flash.Error("Failed to save custom field values")
+		}
+	}
+}

routers/web/repo/issue_view.go

@@ -4,6 +4,7 @@
 package repo
 
 import (
+	"encoding/json"
 	"fmt"
 	"math/big"
 	"net/http"
@@ -337,6 +338,40 @@ func ViewIssue(ctx *context.Context) {
 
 	ctx.Data["IsProjectsEnabled"] = ctx.Repo.Permission.CanRead(unit.TypeProjects)
 	ctx.Data["IsAttachmentEnabled"] = setting.Attachment.Enabled
+
+	// Load custom fields for the issue sidebar (org-level issue-scoped fields).
+	customFieldDefs, cfErr := issues_model.GetCustomFieldsByOwner(ctx, ctx.Repo.Repository.OwnerID, issues_model.CustomFieldScopeIssue)
+	if cfErr != nil {
+		log.Error("ViewIssue: GetCustomFieldsByOwner: %v", cfErr)
+	}
+	ctx.Data["CustomFieldDefs"] = customFieldDefs
+	customFieldValues := make(map[int64]string)
+	fieldOptions := make(map[int64][]string)
+	if len(customFieldDefs) > 0 {
+		var cvErr error
+		customFieldValues, cvErr = issues_model.GetCustomFieldValuesMap(ctx, issue.ID)
+		if cvErr != nil {
+			log.Error("ViewIssue: GetCustomFieldValuesMap: %v", cvErr)
+		}
+		for _, f := range customFieldDefs {
+			if f.Options != "" {
+				var opts []string
+				if err := json.Unmarshal([]byte(f.Options), &opts); err == nil {
+					fieldOptions[f.ID] = opts
+				}
+			}
+		}
+	}
+	ctx.Data["CustomFieldValues"] = customFieldValues
+	ctx.Data["CustomFieldOptions"] = fieldOptions
+
+	// Load custom issue status definitions for the sidebar.
+	issueStatusDefs, isErr := issues_model.GetIssueStatusDefsByOrg(ctx, ctx.Repo.Repository.OwnerID)
+	if isErr != nil {
+		log.Error("ViewIssue: GetIssueStatusDefsByOrg: %v", isErr)
+	}
+	ctx.Data["IssueStatusDefs"] = issueStatusDefs
+
 	upload.AddUploadContext(ctx, "comment")
 
 	if err := issue.LoadAttributes(ctx); err != nil {

routers/web/repo/licenses.go

@@ -258,7 +258,12 @@ func LicensesRegenerateMasterKey(ctx *context.Context) {
 
 // LicensesGenerateKey handles POST to generate a new key from a package.
 func LicensesGenerateKey(ctx *context.Context) {
-	packageID, _ := strconv.ParseInt(ctx.FormString("package_id"), 10, 64)
+	// Accept package_id from form body or query string (modal sets it via form action URL).
+	pkgIDStr := ctx.FormString("package_id")
+	if pkgIDStr == "" {
+		pkgIDStr = ctx.Req.URL.Query().Get("package_id")
+	}
+	packageID, _ := strconv.ParseInt(pkgIDStr, 10, 64)
 	if packageID == 0 {
 		ctx.Flash.Error("Invalid package")
 		ctx.Redirect(ctx.Repo.RepoLink + "/licenses")

routers/web/repo/setting/manifest.go

@@ -0,0 +1,163 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package setting
+
+import (
+	"encoding/xml"
+	"fmt"
+	"net/http"
+
+	repo_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/log"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/templates"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
+)
+
+const tplSettingsManifest templates.TplName = "repo/settings/manifest"
+
+// manifestXML mirrors the .mokogitea/manifest.xml schema for XML parsing.
+type manifestXML struct {
+	XMLName    xml.Name          `xml:"moko-platform"`
+	Identity   manifestIdentity  `xml:"identity"`
+	Governance manifestGovernance `xml:"governance"`
+	Build      manifestBuild     `xml:"build"`
+}
+
+type manifestIdentity struct {
+	Name        string          `xml:"name"`
+	Org         string          `xml:"org"`
+	Description string          `xml:"description"`
+	Version     string          `xml:"version"`
+	License     manifestLicense `xml:"license"`
+}
+
+type manifestLicense struct {
+	SPDX string `xml:"spdx,attr"`
+	Name string `xml:",chardata"`
+}
+
+type manifestGovernance struct {
+	Platform         string `xml:"platform"`
+	StandardsVersion string `xml:"standards-version"`
+	StandardsSource  string `xml:"standards-source"`
+}
+
+type manifestBuild struct {
+	Language    string `xml:"language"`
+	PackageType string `xml:"package-type"`
+	EntryPoint  string `xml:"entry-point"`
+}
+
+// ManifestSettings displays the repo manifest settings page.
+// On first visit, if no manifest exists in DB but .mokogitea/manifest.xml
+// exists in the repo, it auto-migrates the XML values into the database.
+func ManifestSettings(ctx *context.Context) {
+	ctx.Data["Title"] = ctx.Tr("repo.settings.manifest")
+	ctx.Data["PageIsSettingsManifest"] = true
+
+	repoID := ctx.Repo.Repository.ID
+	manifest, err := repo_model.GetRepoManifest(ctx, repoID)
+	if err != nil {
+		ctx.ServerError("GetRepoManifest", err)
+		return
+	}
+
+	// Auto-detect and migrate .mokogitea/manifest.xml if no DB record exists.
+	if manifest == nil {
+		manifest = tryMigrateManifestXML(ctx)
+	}
+
+	if manifest == nil {
+		// No manifest found — provide empty defaults from repo metadata.
+		manifest = &repo_model.RepoManifest{
+			RepoID:      repoID,
+			Name:        ctx.Repo.Repository.Name,
+			Org:         ctx.Repo.Repository.OwnerName,
+			Description: ctx.Repo.Repository.Description,
+		}
+	}
+
+	ctx.Data["Manifest"] = manifest
+	ctx.HTML(http.StatusOK, tplSettingsManifest)
+}
+
+// ManifestSettingsPost saves manifest settings from the form.
+func ManifestSettingsPost(ctx *context.Context) {
+	manifest := &repo_model.RepoManifest{
+		RepoID:           ctx.Repo.Repository.ID,
+		Name:             ctx.FormString("name"),
+		Org:              ctx.FormString("org"),
+		Description:      ctx.FormString("description"),
+		Version:          ctx.FormString("version"),
+		LicenseSPDX:      ctx.FormString("license_spdx"),
+		LicenseName:      ctx.FormString("license_name"),
+		Platform:         ctx.FormString("platform"),
+		StandardsVersion: ctx.FormString("standards_version"),
+		StandardsSource:  ctx.FormString("standards_source"),
+		Language:         ctx.FormString("language"),
+		PackageType:      ctx.FormString("package_type"),
+		EntryPoint:       ctx.FormString("entry_point"),
+	}
+
+	if err := repo_model.CreateOrUpdateRepoManifest(ctx, manifest); err != nil {
+		ctx.ServerError("CreateOrUpdateRepoManifest", err)
+		return
+	}
+
+	ctx.Flash.Success(ctx.Tr("repo.settings.manifest_saved"))
+	ctx.Redirect(ctx.Repo.RepoLink + "/settings/manifest")
+}
+
+// tryMigrateManifestXML reads .mokogitea/manifest.xml from the repo,
+// parses it, and stores the values in the DB. Returns nil if no file found.
+func tryMigrateManifestXML(ctx *context.Context) *repo_model.RepoManifest {
+	if ctx.Repo.GitRepo == nil || ctx.Repo.Commit == nil {
+		return nil
+	}
+
+	entry, err := ctx.Repo.Commit.GetTreeEntryByPath(".mokogitea/manifest.xml")
+	if err != nil || entry == nil {
+		return nil // no manifest.xml found — not an error
+	}
+
+	reader, err := entry.Blob().DataAsync()
+	if err != nil {
+		log.Error("ManifestMigrate: read blob: %v", err)
+		return nil
+	}
+	defer reader.Close()
+
+	var mxml manifestXML
+	if err := xml.NewDecoder(reader).Decode(&mxml); err != nil {
+		log.Error("ManifestMigrate: parse XML: %v", err)
+		return nil
+	}
+
+	manifest := &repo_model.RepoManifest{
+		RepoID:           ctx.Repo.Repository.ID,
+		Name:             mxml.Identity.Name,
+		Org:              mxml.Identity.Org,
+		Description:      mxml.Identity.Description,
+		Version:          mxml.Identity.Version,
+		LicenseSPDX:      mxml.Identity.License.SPDX,
+		LicenseName:      mxml.Identity.License.Name,
+		Platform:         mxml.Governance.Platform,
+		StandardsVersion: mxml.Governance.StandardsVersion,
+		StandardsSource:  mxml.Governance.StandardsSource,
+		Language:         mxml.Build.Language,
+		PackageType:      mxml.Build.PackageType,
+		EntryPoint:       mxml.Build.EntryPoint,
+	}
+
+	if err := repo_model.CreateOrUpdateRepoManifest(ctx, manifest); err != nil {
+		log.Error("ManifestMigrate: save to DB: %v", err)
+		return nil
+	}
+
+	log.Info("ManifestMigrate: migrated .mokogitea/manifest.xml for repo %s/%s",
+		ctx.Repo.Repository.OwnerName, ctx.Repo.Repository.Name)
+
+	ctx.Flash.Info(fmt.Sprintf("Manifest settings imported from .mokogitea/manifest.xml. You can now delete the file from the repository."))
+	return manifest
+}

routers/web/repo/setting/metadata.go

@@ -0,0 +1,64 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package setting
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+
+	issues_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/issues"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/templates"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
+)
+
+const tplSettingsMetadata templates.TplName = "repo/settings/metadata"
+
+// Metadata displays the repo metadata page (repo-scoped custom field values).
+func Metadata(ctx *context.Context) {
+	ctx.Data["Title"] = ctx.Tr("repo.settings.metadata")
+	ctx.Data["PageIsSettingsMetadata"] = true
+
+	ownerID := ctx.Repo.Repository.OwnerID
+	repoID := ctx.Repo.Repository.ID
+
+	fields, _ := issues_model.GetCustomFieldsByOwner(ctx, ownerID, issues_model.CustomFieldScopeRepo)
+	ctx.Data["CustomFieldDefs"] = fields
+
+	values := make(map[int64]string)
+	fieldOptions := make(map[int64][]string)
+	if len(fields) > 0 {
+		values, _ = issues_model.GetCustomFieldValuesMap(ctx, repoID)
+		for _, f := range fields {
+			if f.Options != "" {
+				var opts []string
+				if err := json.Unmarshal([]byte(f.Options), &opts); err == nil {
+					fieldOptions[f.ID] = opts
+				}
+			}
+		}
+	}
+	ctx.Data["CustomFieldValues"] = values
+	ctx.Data["CustomFieldOptions"] = fieldOptions
+
+	ctx.HTML(http.StatusOK, tplSettingsMetadata)
+}
+
+// MetadataPost saves repo-scoped custom field values.
+func MetadataPost(ctx *context.Context) {
+	repoID := ctx.Repo.Repository.ID
+	ownerID := ctx.Repo.Repository.OwnerID
+
+	fields, _ := issues_model.GetCustomFieldsByOwner(ctx, ownerID, issues_model.CustomFieldScopeRepo)
+	for _, f := range fields {
+		val := ctx.Req.FormValue(fmt.Sprintf("field_%d", f.ID))
+		if err := issues_model.SetCustomFieldValue(ctx, repoID, f.ID, val); err != nil {
+			ctx.ServerError("SetCustomFieldValue", err)
+			return
+		}
+	}
+
+	ctx.Flash.Success(ctx.Tr("repo.settings.metadata_saved"))
+	ctx.Redirect(ctx.Repo.RepoLink + "/settings/metadata")
+}

routers/web/repo/updateserver.go

@@ -94,7 +94,9 @@ func ServeUpdatesXML(ctx *context.Context) {
 	}
 
 	repoCfg, _ := licenses.GetRepoConfig(ctx, ctx.Repo.Repository.ID)
-	requireKey := repoCfg != nil && repoCfg.RequireKey
+	// Show <downloadkey> only when downloads are gated (prerelease or all).
+	// No gating = no license keys needed = no downloadkey element.
+	requireKey := repoCfg != nil && repoCfg.DownloadGating != "" && repoCfg.DownloadGating != "none"
 
 	xmlData, err := updateserver.GenerateJoomlaXML(ctx, ctx.Repo.Repository, requireKey, stripDownloads, allowedChannels...)
 	if err != nil {

routers/web/repo/view_home.go

@@ -151,6 +151,51 @@ func prepareToRenderDirectory(ctx *context.Context) {
 		return
 	}
 
+	// Well-known file tabs — only at root
+	activeTab := ctx.FormString("tab")
+	if ctx.Repo.TreePath == "" {
+		wellKnownTabs := findWellKnownFiles(entries)
+
+		// Determine which tab is active
+		hasReadme := readmeFile != nil
+		if hasReadme || len(wellKnownTabs) > 0 {
+			// Only show tabs if there are at least 2 items (README + at least one well-known file)
+			if hasReadme && len(wellKnownTabs) > 0 {
+				readmeTab := WellKnownFileTab{
+					TabKey:   "readme",
+					Label:    "repo.well_known_file.readme",
+					FileName: "",
+					Active:   activeTab == "" || activeTab == "readme",
+				}
+				if readmeFile != nil {
+					readmeTab.FileName = readmeFile.Name()
+				}
+
+				// Set active state for well-known tabs
+				for i := range wellKnownTabs {
+					wellKnownTabs[i].Active = wellKnownTabs[i].TabKey == activeTab
+				}
+
+				allTabs := append([]WellKnownFileTab{readmeTab}, wellKnownTabs...)
+				ctx.Data["WellKnownFileTabs"] = allTabs
+			}
+		}
+
+		// If a non-readme tab is selected, render that file instead
+		if activeTab != "" && activeTab != "readme" {
+			for _, tab := range wellKnownTabs {
+				if tab.TabKey == activeTab {
+					entry := findFileEntryByName(entries, tab.FileName)
+					if entry != nil {
+						prepareToRenderReadmeFile(ctx, "", entry)
+						return
+					}
+				}
+			}
+			// If the requested tab was not found, fall through to render readme
+		}
+	}
+
 	prepareToRenderReadmeFile(ctx, subfolder, readmeFile)
 }
 

routers/web/repo/view_readme.go

@@ -141,6 +141,63 @@ func localizedExtensions(ext, languageCode string) (localizedExts []string) {
 	return []string{lowerLangCode + ext, ext}
 }
 
+// WellKnownFileTab represents a tab for a well-known root file (LICENSE, CONTRIBUTING, etc.)
+type WellKnownFileTab struct {
+	TabKey   string // query parameter value, e.g. "license"
+	Label    string // locale key suffix, e.g. "repo.well_known_file.license"
+	FileName string // actual file name found in repo, e.g. "LICENSE.md"
+	Active   bool   // whether this tab is currently selected
+}
+
+// wellKnownFilePatterns maps tab keys to the base file names to search for (case-insensitive).
+// Order defines the tab display order.
+var wellKnownFilePatterns = []struct {
+	TabKey   string
+	BaseName string // matched case-insensitively against file names (without extension)
+}{
+	{"license", "LICENSE"},
+	{"contributing", "CONTRIBUTING"},
+	{"code_of_conduct", "CODE_OF_CONDUCT"},
+	{"security", "SECURITY"},
+	{"changelog", "CHANGELOG"},
+}
+
+// findWellKnownFiles scans root directory entries for well-known markdown/text files.
+func findWellKnownFiles(entries []*git.TreeEntry) []WellKnownFileTab {
+	var tabs []WellKnownFileTab
+	for _, pattern := range wellKnownFilePatterns {
+		for _, entry := range entries {
+			if entry.IsDir() || entry.IsSubModule() {
+				continue
+			}
+			name := entry.Name()
+			baseName := name
+			if idx := strings.LastIndex(name, "."); idx >= 0 {
+				baseName = name[:idx]
+			}
+			if strings.EqualFold(baseName, pattern.BaseName) {
+				tabs = append(tabs, WellKnownFileTab{
+					TabKey:   pattern.TabKey,
+					Label:    "repo.well_known_file." + pattern.TabKey,
+					FileName: name,
+				})
+				break // take the first match for this pattern
+			}
+		}
+	}
+	return tabs
+}
+
+// findFileEntryByName finds a tree entry by exact file name.
+func findFileEntryByName(entries []*git.TreeEntry, fileName string) *git.TreeEntry {
+	for _, entry := range entries {
+		if entry.Name() == fileName {
+			return entry
+		}
+	}
+	return nil
+}
+
 func prepareToRenderReadmeFile(ctx *context.Context, subfolder string, readmeFile *git.TreeEntry) {
 	if readmeFile == nil {
 		return

routers/web/web.go

@@ -1061,6 +1061,18 @@ func registerWebRoutes(m *web.Router, webAuth *AuthMiddleware) {
 					m.Get("", org.SettingsUpdateStreams)
 					m.Post("", org.SettingsUpdateStreamsPost)
 				})
+				m.Group("/custom-fields", func() {
+					m.Get("", org.SettingsCustomFields)
+					m.Post("", org.SettingsCustomFieldsCreatePost)
+					m.Post("/{id}/edit", org.SettingsCustomFieldsEditPost)
+					m.Post("/{id}/delete", org.SettingsCustomFieldsDeletePost)
+				})
+				m.Group("/issue-statuses", func() {
+					m.Get("", org.SettingsIssueStatuses)
+					m.Post("", org.SettingsIssueStatusesCreatePost)
+					m.Post("/{id}/edit", org.SettingsIssueStatusesEditPost)
+					m.Post("/{id}/delete", org.SettingsIssueStatusesDeletePost)
+				})
 			}, ctxDataSet("EnableOAuth2", setting.OAuth2.Enabled, "EnablePackages", setting.Packages.Enabled, "PageIsOrgSettings", true))
 		}, context.OrgAssignment(context.OrgAssignmentOptions{RequireOwner: true}))
 	}, reqSignIn)
@@ -1187,12 +1199,8 @@ func registerWebRoutes(m *web.Router, webAuth *AuthMiddleware) {
 			m.Combo("/advanced").Get(repo_setting.AdvancedSettings).Post(web.Bind(forms.RepoSettingForm{}), repo_setting.SettingsPost)
 		}, repo_setting.SettingsCtxData)
 		m.Combo("/licensing").Get(repo_setting.LicensingSettings).Post(repo_setting.LicensingSettingsPost)
-		m.Group("/custom-fields", func() {
-			m.Get("", repo_setting.CustomFields)
-			m.Post("", repo_setting.CustomFieldsCreatePost)
-			m.Post("/{id}/edit", repo_setting.CustomFieldsEditPost)
-			m.Post("/{id}/delete", repo_setting.CustomFieldsDeletePost)
-		})
+		m.Combo("/manifest").Get(repo_setting.ManifestSettings).Post(repo_setting.ManifestSettingsPost)
+		m.Combo("/metadata").Get(repo_setting.Metadata).Post(repo_setting.MetadataPost)
 
 		m.Group("/collaboration", func() {
 			m.Combo("").Get(repo_setting.Collaboration).Post(repo_setting.CollaborationPost)
@@ -1397,6 +1405,8 @@ func registerWebRoutes(m *web.Router, webAuth *AuthMiddleware) {
 			m.Post("/projects/column", reqRepoIssuesOrPullsWriter, reqRepoProjectsWriter, repo.UpdateIssueProjectColumn)
 			m.Post("/assignee", reqRepoIssuesOrPullsWriter, repo.UpdateIssueAssignee)
 			m.Post("/status", reqRepoIssuesOrPullsWriter, repo.UpdateIssueStatus)
+			m.Post("/{id}/custom-fields/{field_id}", reqRepoIssuesOrPullsWriter, repo.UpdateIssueCustomField)
+			m.Post("/{id}/custom-status", reqRepoIssuesOrPullsWriter, repo.UpdateIssueCustomStatus)
 			m.Post("/delete", reqRepoAdmin, repo.BatchDeleteIssues)
 			m.Delete("/unpin/{index}", reqRepoAdmin, repo.IssueUnpin)
 			m.Post("/move_pin", reqRepoAdmin, repo.IssuePinMove)

services/context/repo.go

@@ -663,6 +663,8 @@ func repoAssignmentPrepareTemplateData(ctx *Context, data *repoAssignmentPrepare
 	ctx.Data["NumLicensePackages"] = numLicensePackages
 	ctx.Data["EnableLicenses"] = licensingEnabled || numLicensePackages > 0
 	ctx.Data["LicensingEnabled"] = licensingEnabled
+	downloadGated := repoUpdateCfg != nil && repoUpdateCfg.DownloadGating != "" && repoUpdateCfg.DownloadGating != "none"
+	ctx.Data["DownloadGated"] = downloadGated
 
 	// Determine release page access based on feed visibility mode.
 	feedVis := "public"

services/repository/manifest_sync.go

@@ -0,0 +1,98 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package repository
+
+import (
+	"context"
+	"encoding/xml"
+
+	repo_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/git"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/log"
+)
+
+// manifestXML mirrors the .mokogitea/manifest.xml schema for XML parsing.
+type manifestXML struct {
+	XMLName    xml.Name          `xml:"moko-platform"`
+	Identity   manifestIdentity  `xml:"identity"`
+	Governance manifestGovernance `xml:"governance"`
+	Build      manifestBuild     `xml:"build"`
+}
+
+type manifestIdentity struct {
+	Name        string          `xml:"name"`
+	Org         string          `xml:"org"`
+	Description string          `xml:"description"`
+	Version     string          `xml:"version"`
+	License     manifestLicense `xml:"license"`
+}
+
+type manifestLicense struct {
+	SPDX string `xml:"spdx,attr"`
+	Name string `xml:",chardata"`
+}
+
+type manifestGovernance struct {
+	Platform         string `xml:"platform"`
+	StandardsVersion string `xml:"standards-version"`
+	StandardsSource  string `xml:"standards-source"`
+}
+
+type manifestBuild struct {
+	Language    string `xml:"language"`
+	PackageType string `xml:"package-type"`
+	EntryPoint  string `xml:"entry-point"`
+}
+
+// SyncManifestFromCommit reads .mokogitea/manifest.xml from the given commit
+// and upserts the values into the repo_manifest database table.
+// This is called on push to the default branch to keep the database in sync
+// with the XML file. If no manifest.xml exists, this is a no-op.
+func SyncManifestFromCommit(ctx context.Context, repo *repo_model.Repository, commit *git.Commit) {
+	if commit == nil {
+		return
+	}
+
+	entry, err := commit.GetTreeEntryByPath(".mokogitea/manifest.xml")
+	if err != nil || entry == nil {
+		return // no manifest.xml — not an error
+	}
+
+	reader, err := entry.Blob().DataAsync()
+	if err != nil {
+		log.Error("SyncManifest: read blob for %s: %v", repo.FullName(), err)
+		return
+	}
+	defer reader.Close()
+
+	var mxml manifestXML
+	decoder := xml.NewDecoder(reader)
+	if err := decoder.Decode(&mxml); err != nil {
+		log.Error("SyncManifest: parse XML for %s: %v", repo.FullName(), err)
+		return
+	}
+
+	manifest := &repo_model.RepoManifest{
+		RepoID:           repo.ID,
+		Name:             mxml.Identity.Name,
+		Org:              mxml.Identity.Org,
+		Description:      mxml.Identity.Description,
+		Version:          mxml.Identity.Version,
+		LicenseSPDX:      mxml.Identity.License.SPDX,
+		LicenseName:      mxml.Identity.License.Name,
+		Platform:         mxml.Governance.Platform,
+		StandardsVersion: mxml.Governance.StandardsVersion,
+		StandardsSource:  mxml.Governance.StandardsSource,
+		Language:         mxml.Build.Language,
+		PackageType:      mxml.Build.PackageType,
+		EntryPoint:       mxml.Build.EntryPoint,
+	}
+
+	if err := repo_model.CreateOrUpdateRepoManifest(ctx, manifest); err != nil {
+		log.Error("SyncManifest: save for %s: %v", repo.FullName(), err)
+		return
+	}
+
+	log.Info("SyncManifest: synced .mokogitea/manifest.xml for %s", repo.FullName())
+}

services/repository/push.go

@@ -193,6 +193,8 @@ func pushUpdates(optsList []*repo_module.PushUpdateOptions) error {
 					if err := DelRepoDivergenceFromCache(ctx, repo.ID); err != nil {
 						log.Error("DelRepoDivergenceFromCache: %v", err)
 					}
+					// Auto-sync .mokogitea/manifest.xml to database on default branch push
+					SyncManifestFromCommit(ctx, repo, newCommit)
 				} else {
 					if err := DelDivergenceFromCache(repo.ID, branch); err != nil {
 						log.Error("DelDivergenceFromCache: %v", err)

services/updateserver/composer.go

@@ -68,13 +68,15 @@ func GenerateComposerJSON(ctx context.Context, repo *repo_model.Repository, lice
 	repoLink := fmt.Sprintf("%s/%s/%s", baseURL, repo.Owner.Name, repo.Name)
 
 	cfg := licenses.GetEffectiveConfig(ctx, repo.OwnerID, repo.ID)
+	meta := resolveExtensionMetadata(ctx, repo, cfg)
 
-	// Composer package name: vendor/package
+	// Composer package name: vendor/package (override with resolved extension name if set)
 	packageName := fmt.Sprintf("%s/%s", strings.ToLower(repo.Owner.Name), strings.ToLower(repo.Name))
-	if cfg != nil && cfg.ExtensionName != "" {
-		packageName = cfg.ExtensionName
+	if meta.Element != strings.ToLower(repo.Name) {
+		packageName = meta.Element
 	}
 
+	description := meta.Description
 	maintainer := repo.Owner.Name
 	maintainerURL := fmt.Sprintf("%s/%s", baseURL, repo.Owner.Name)
 	if cfg != nil && cfg.Maintainer != "" {
@@ -84,14 +86,9 @@ func GenerateComposerJSON(ctx context.Context, repo *repo_model.Repository, lice
 		maintainerURL = cfg.MaintainerURL
 	}
 
-	description := ""
-	if cfg != nil && cfg.Description != "" {
-		description = cfg.Description
-	}
-
 	phpMin := ""
-	if cfg != nil && cfg.PHPMinimum != "" {
-		phpMin = ">=" + cfg.PHPMinimum
+	if meta.PHPMinimum != "" {
+		phpMin = ">=" + meta.PHPMinimum
 	}
 
 	streams := licenses.GetEffectiveStreams(ctx, repo.OwnerID, repo.ID)

services/updateserver/drupal.go

@@ -66,16 +66,9 @@ func GenerateDrupalXML(ctx context.Context, repo *repo_model.Repository, allowed
 	repoLink := fmt.Sprintf("%s/%s/%s", baseURL, repo.Owner.Name, repo.Name)
 
 	cfg := licenses.GetEffectiveConfig(ctx, repo.OwnerID, repo.ID)
-	shortName := strings.ToLower(repo.Name)
-	title := repo.Name
-	if cfg != nil {
-		if cfg.ExtensionName != "" {
-			shortName = cfg.ExtensionName
-		}
-		if cfg.DisplayName != "" {
-			title = cfg.DisplayName
-		}
-	}
+	meta := resolveExtensionMetadata(ctx, repo, cfg)
+	shortName := meta.Element
+	title := meta.DisplayName
 
 	streams := licenses.GetEffectiveStreams(ctx, repo.OwnerID, repo.ID)
 

services/updateserver/joomla.go

@@ -13,8 +13,10 @@ import (
 	"time"
 
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/db"
+	issues_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/issues"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/licenses"
 	repo_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/log"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/storage"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/setting"
 )
@@ -37,7 +39,7 @@ type xmlUpdate struct {
 	TargetPlatform xmlTargetPlat   `xml:"targetplatform"`
 	SHA256         string          `xml:"sha256,omitempty"`
 	SHA512         string          `xml:"sha512,omitempty"`
-	Client         string          `xml:"client"`
+	Client         string          `xml:"client,omitempty"`
 	PHPMinimum     string          `xml:"php_minimum,omitempty"`
 	Description    string          `xml:"description,omitempty"`
 	CreationDate   string          `xml:"creationDate,omitempty"`
@@ -120,7 +122,10 @@ func isStreamName(s string, streams []licenses.StreamDef) bool {
 }
 
 // joomlaTagName maps internal stream names to Joomla-standard tag values.
-// Joomla recognizes: dev, alpha, beta, rc, stable.
+// Joomla's Update.php maps tags via STABILITY_ + strtoupper(tag) constants.
+// Valid values: dev (0), alpha (1), beta (2), rc (3), stable (4).
+// Using full names like "development" or "release-candidate" would silently
+// fall back to STABILITY_STABLE, breaking pre-release channel filtering.
 func joomlaTagName(channel string) string {
 	switch channel {
 	case ChannelDevelopment:
@@ -157,9 +162,121 @@ func NormalizeChannel(ch string) string {
 	}
 }
 
+// extensionMetadata holds resolved metadata for feed generation.
+// Fields are resolved with priority: custom field → config table → default.
+type extensionMetadata struct {
+	Element        string
+	DisplayName    string
+	ExtType        string
+	TargetVersion  string
+	PHPMinimum     string
+	Description    string
+	SupportURL     string
+	DownloadGating string
+	KeyPrefix      string
+}
+
+// resolveExtensionMetadata loads extension metadata with cascading fallback:
+// org-level repo-scoped custom fields → update_stream_config → repo-derived defaults.
+func resolveExtensionMetadata(ctx context.Context, repo *repo_model.Repository, cfg *licenses.UpdateStreamConfig) extensionMetadata {
+	m := extensionMetadata{
+		Element:       strings.ToLower(repo.Name),
+		DisplayName:   fmt.Sprintf("%s - %s", repo.Owner.Name, repo.Name),
+		ExtType:       "component",
+		TargetVersion: "(5|6)\\..*",
+	}
+
+	// Apply config table values.
+	if cfg != nil {
+		if cfg.ExtensionName != "" {
+			m.Element = cfg.ExtensionName
+		}
+		if cfg.DisplayName != "" {
+			m.DisplayName = cfg.DisplayName
+		}
+		if cfg.ExtensionType != "" {
+			m.ExtType = cfg.ExtensionType
+		}
+		if cfg.TargetVersion != "" {
+			m.TargetVersion = cfg.TargetVersion
+		}
+		if cfg.PHPMinimum != "" {
+			m.PHPMinimum = cfg.PHPMinimum
+		}
+		if cfg.Description != "" {
+			m.Description = cfg.Description
+		}
+		if cfg.SupportURL != "" {
+			m.SupportURL = cfg.SupportURL
+		}
+		if cfg.DownloadGating != "" {
+			m.DownloadGating = cfg.DownloadGating
+		}
+		if cfg.KeyPrefix != "" {
+			m.KeyPrefix = cfg.KeyPrefix
+		}
+	}
+
+	// Override with custom field values (highest priority).
+	fields, err := issues_model.GetCustomFieldsByOwner(ctx, repo.OwnerID, issues_model.CustomFieldScopeRepo)
+	if err != nil {
+		log.Error("resolveExtensionMetadata: GetCustomFieldsByOwner for repo %d: %v", repo.ID, err)
+		return m
+	}
+	if len(fields) == 0 {
+		return m
+	}
+	values, err := issues_model.GetCustomFieldValuesMap(ctx, repo.ID)
+	if err != nil {
+		log.Error("resolveExtensionMetadata: GetCustomFieldValuesMap for repo %d: %v", repo.ID, err)
+		return m
+	}
+	if len(values) == 0 {
+		return m
+	}
+
+	// Build name → value map from field definitions + values.
+	named := make(map[string]string, len(fields))
+	for _, f := range fields {
+		if v, ok := values[f.ID]; ok && v != "" {
+			named[f.Name] = v
+		}
+	}
+
+	if v := named["Extension Name"]; v != "" {
+		m.Element = v
+	}
+	if v := named["Display Name"]; v != "" {
+		m.DisplayName = v
+	}
+	if v := named["Extension Type"]; v != "" {
+		m.ExtType = v
+	}
+	if v := named["Target Version"]; v != "" {
+		m.TargetVersion = v
+	}
+	if v := named["PHP Minimum"]; v != "" {
+		m.PHPMinimum = v
+	}
+	if v := named["Support URL"]; v != "" {
+		m.SupportURL = v
+	}
+	if v := named["Description"]; v != "" {
+		m.Description = v
+	}
+	if v := named["Download Gating"]; v != "" {
+		m.DownloadGating = v
+	}
+	if v := named["Key Prefix"]; v != "" {
+		m.KeyPrefix = v
+	}
+
+	return m
+}
+
 // GenerateJoomlaXML builds a Joomla-compatible updates.xml from repository releases.
-// It returns the raw XML bytes. Extension metadata is read from the update stream config;
-// falls back to repo name/owner when not configured.
+// It returns the raw XML bytes. Extension metadata is resolved from custom fields first,
+// then the update stream config, then repo-derived defaults.
 // allowedChannels optionally restricts output to specific channels (nil = all).
 func GenerateJoomlaXML(ctx context.Context, repo *repo_model.Repository, requireKey, stripDownloads bool, allowedChannels ...string) ([]byte, error) {
 	releases, err := db.Find[repo_model.Release](ctx, repo_model.FindReleasesOptions{
@@ -182,42 +299,26 @@ func GenerateJoomlaXML(ctx context.Context, repo *repo_model.Repository, require
 	}
 	repoLink := fmt.Sprintf("%s/%s/%s", baseURL, repo.Owner.Name, repo.Name)
 
-	// Load extension metadata from config (falls back to repo-derived values).
+	// Load extension metadata with cascading fallback:
+	// custom fields → config table → repo-derived defaults.
 	cfg := licenses.GetEffectiveConfig(ctx, repo.OwnerID, repo.ID)
+	meta := resolveExtensionMetadata(ctx, repo, cfg)
 
-	element := strings.ToLower(repo.Name)
-	if cfg != nil && cfg.ExtensionName != "" {
-		element = cfg.ExtensionName
+	element := meta.Element
+	displayName := meta.DisplayName
+	extType := meta.ExtType
+	targetVersion := meta.TargetVersion
+	phpMinimum := meta.PHPMinimum
+	feedDescription := meta.Description
+
+	// Maintainer and URL always come from the org profile.
+	maintainer := repo.Owner.FullName
+	if maintainer == "" {
+		maintainer = repo.Owner.Name
 	}
-	displayName := fmt.Sprintf("%s - %s", repo.Owner.Name, repo.Name)
-	if cfg != nil && cfg.DisplayName != "" {
-		displayName = cfg.DisplayName
-	}
-	extType := "component"
-	if cfg != nil && cfg.ExtensionType != "" {
-		extType = cfg.ExtensionType
-	}
-	maintainer := repo.Owner.Name
-	if cfg != nil && cfg.Maintainer != "" {
-		maintainer = cfg.Maintainer
-	}
-	maintainerURL := fmt.Sprintf("%s/%s", baseURL, repo.Owner.Name)
-	if cfg != nil && cfg.SupportURL != "" {
-		maintainerURL = cfg.SupportURL
-	} else if cfg != nil && cfg.MaintainerURL != "" {
-		maintainerURL = cfg.MaintainerURL
-	}
-	targetVersion := "(5|6)\\..*"
-	if cfg != nil && cfg.TargetVersion != "" {
-		targetVersion = cfg.TargetVersion
-	}
-	phpMinimum := ""
-	if cfg != nil && cfg.PHPMinimum != "" {
-		phpMinimum = cfg.PHPMinimum
-	}
-	feedDescription := ""
-	if cfg != nil && cfg.Description != "" {
-		feedDescription = cfg.Description
+	maintainerURL := repo.Owner.Website
+	if maintainerURL == "" {
+		maintainerURL = fmt.Sprintf("%s/%s", baseURL, repo.Owner.Name)
 	}
 
 	// Resolve effective streams (repo override → org default → Joomla default).
@@ -286,9 +387,16 @@ func GenerateJoomlaXML(ctx context.Context, repo *repo_model.Repository, require
 			downloadURL = fmt.Sprintf("%s/archive/%s.zip", repoLink, rel.TagName)
 		}
 
-		version := extractVersion(rel.TagName)
-		// If the tag is a stream name (not a version), try the release title instead.
-		if version == "" || isStreamName(rel.TagName, streams) {
+		// Extract version: prefer asset filename (matches actual download),
+		// then tag name, then release title. Only fall through when empty.
+		version := ""
+		if zipName != "" {
+			version = extractVersion(zipName)
+		}
+		if version == "" {
+			version = extractVersion(rel.TagName)
+		}
+		if version == "" {
 			version = extractVersion(rel.Title)
 		}
 		// Last resort: use the tag name as-is.
@@ -308,9 +416,19 @@ func GenerateJoomlaXML(ctx context.Context, repo *repo_model.Repository, require
 			desc = fmt.Sprintf("%s %s build.", displayName, ch)
 		}
 
+		// Info URL: use support_url (product page), fall back to releases page.
 		infoURL := fmt.Sprintf("%s/releases", repoLink)
-		if cfg != nil && cfg.InfoURL != "" {
-			infoURL = cfg.InfoURL
+		if meta.SupportURL != "" {
+			infoURL = meta.SupportURL
+		}
+
+		// Joomla <client> element: packages use client_id=0 in #__extensions,
+		// so we must output <client>0</client> for Joomla to match the update
+		// to the installed extension. Other types default to "site" (client_id=0)
+		// or "administrator" (client_id=1).
+		client := "site"
+		if extType == "package" {
+			client = "0"
 		}
 
 		u := xmlUpdate{
@@ -318,7 +436,7 @@ func GenerateJoomlaXML(ctx context.Context, repo *repo_model.Repository, require
 			Description: desc,
 			Element:     element,
 			Type:        extType,
-			Client:      "site",
+			Client:      client,
 			Version:     version,
 			CreationDate: time.Unix(int64(rel.CreatedUnix), 0).Format("2006-01-02"),
 			InfoURL: xmlInfoURL{

services/updateserver/prestashop.go

@@ -55,23 +55,13 @@ func GeneratePrestaShopXML(ctx context.Context, repo *repo_model.Repository, all
 	repoLink := fmt.Sprintf("%s/%s/%s", baseURL, repo.Owner.Name, repo.Name)
 
 	cfg := licenses.GetEffectiveConfig(ctx, repo.OwnerID, repo.ID)
-	moduleName := strings.ToLower(repo.Name)
-	displayName := repo.Name
+	meta := resolveExtensionMetadata(ctx, repo, cfg)
+	moduleName := meta.Element
+	displayName := meta.DisplayName
+	description := meta.Description
 	maintainer := repo.Owner.Name
-	description := ""
-	if cfg != nil {
-		if cfg.ExtensionName != "" {
-			moduleName = cfg.ExtensionName
-		}
-		if cfg.DisplayName != "" {
-			displayName = cfg.DisplayName
-		}
-		if cfg.Maintainer != "" {
-			maintainer = cfg.Maintainer
-		}
-		if cfg.Description != "" {
-			description = cfg.Description
-		}
+	if cfg != nil && cfg.Maintainer != "" {
+		maintainer = cfg.Maintainer
 	}
 
 	streams := licenses.GetEffectiveStreams(ctx, repo.OwnerID, repo.ID)

services/updateserver/whmcs.go

@@ -50,23 +50,18 @@ func GenerateWHMCSJSON(ctx context.Context, repo *repo_model.Repository, license
 	repoLink := fmt.Sprintf("%s/%s/%s", baseURL, repo.Owner.Name, repo.Name)
 
 	cfg := licenses.GetEffectiveConfig(ctx, repo.OwnerID, repo.ID)
-	displayName := repo.Name
+	meta := resolveExtensionMetadata(ctx, repo, cfg)
+	displayName := meta.DisplayName
+	description := meta.Description
 	maintainer := repo.Owner.Name
 	maintainerURL := fmt.Sprintf("%s/%s", baseURL, repo.Owner.Name)
-	description := ""
 	if cfg != nil {
-		if cfg.DisplayName != "" {
-			displayName = cfg.DisplayName
-		}
 		if cfg.Maintainer != "" {
 			maintainer = cfg.Maintainer
 		}
 		if cfg.MaintainerURL != "" {
 			maintainerURL = cfg.MaintainerURL
 		}
-		if cfg.Description != "" {
-			description = cfg.Description
-		}
 	}
 
 	streams := licenses.GetEffectiveStreams(ctx, repo.OwnerID, repo.ID)

services/updateserver/wordpress.go

@@ -57,36 +57,30 @@ func GenerateWordPressJSON(ctx context.Context, repo *repo_model.Repository, lic
 	baseURL := strings.TrimSuffix(setting.AppURL, "/")
 	repoLink := fmt.Sprintf("%s/%s/%s", baseURL, repo.Owner.Name, repo.Name)
 
-	// Load extension metadata.
+	// Load extension metadata with cascading fallback:
+	// custom fields → config table → repo-derived defaults.
 	cfg := licenses.GetEffectiveConfig(ctx, repo.OwnerID, repo.ID)
+	meta := resolveExtensionMetadata(ctx, repo, cfg)
 
-	slug := strings.ToLower(repo.Name)
-	displayName := fmt.Sprintf("%s - %s", repo.Owner.Name, repo.Name)
+	slug := meta.Element
+	displayName := meta.DisplayName
+	requiresPHP := meta.PHPMinimum
+	homepage := repoLink
+	if meta.SupportURL != "" {
+		homepage = meta.SupportURL
+	}
 	maintainer := repo.Owner.Name
 	maintainerURL := fmt.Sprintf("%s/%s", baseURL, repo.Owner.Name)
-	homepage := repoLink
-	requiresPHP := ""
 	if cfg != nil {
-		if cfg.ExtensionName != "" {
-			slug = cfg.ExtensionName
-		}
-		if cfg.DisplayName != "" {
-			displayName = cfg.DisplayName
-		}
 		if cfg.Maintainer != "" {
 			maintainer = cfg.Maintainer
 		}
 		if cfg.MaintainerURL != "" {
 			maintainerURL = cfg.MaintainerURL
 		}
-		if cfg.SupportURL != "" {
-			homepage = cfg.SupportURL
-		} else if cfg.InfoURL != "" {
+		if homepage == repoLink && cfg.InfoURL != "" {
 			homepage = cfg.InfoURL
 		}
-		if cfg.PHPMinimum != "" {
-			requiresPHP = cfg.PHPMinimum
-		}
 	}
 
 	// Resolve streams and find the latest stable release.

templates/org/settings/custom_fields.tmpl

@@ -0,0 +1,85 @@
+{{template "org/settings/layout_head" (dict "ctxData" . "pageClass" "organization settings custom-fields")}}
+<h4 class="ui top attached header">
+	{{ctx.Locale.Tr "org.settings.custom_fields"}}
+</h4>
+<div class="ui attached segment">
+	<p class="text grey">{{ctx.Locale.Tr "org.settings.custom_fields_desc"}}</p>
+
+	{{if .CustomFields}}
+	<table class="ui compact table">
+		<thead>
+			<tr>
+				<th>{{ctx.Locale.Tr "org.settings.custom_field_name"}}</th>
+				<th>{{ctx.Locale.Tr "org.settings.custom_field_scope"}}</th>
+				<th>{{ctx.Locale.Tr "org.settings.custom_field_type"}}</th>
+				<th>{{ctx.Locale.Tr "org.settings.custom_field_options"}}</th>
+				<th></th>
+			</tr>
+		</thead>
+		<tbody>
+			{{range .CustomFields}}
+			<tr>
+				<td><strong>{{.Name}}</strong>{{if .Description}}<br><small class="text grey">{{.Description}}</small>{{end}}</td>
+				<td>{{if eq .Scope "issue"}}{{svg "octicon-issue-opened" 14}} Issue{{else}}{{svg "octicon-repo" 14}} Repo{{end}}</td>
+				<td><code>{{.FieldType}}</code></td>
+				<td>{{if .Options}}<code class="tw-text-xs">{{.Options}}</code>{{else}}<span class="text grey">-</span>{{end}}</td>
+				<td class="tw-text-right">
+					<form method="post" action="{{$.OrgLink}}/settings/custom-fields/{{.ID}}/delete" class="tw-inline">
+						{{$.CsrfTokenHtml}}
+						<button class="ui tiny red icon button" type="submit" title="{{ctx.Locale.Tr "remove"}}">{{svg "octicon-trash" 14}}</button>
+					</form>
+				</td>
+			</tr>
+			{{end}}
+		</tbody>
+	</table>
+	{{else}}
+	<div class="empty-placeholder">
+		<p>{{ctx.Locale.Tr "org.settings.custom_fields_empty"}}</p>
+	</div>
+	{{end}}
+
+	<div class="divider"></div>
+
+	<h5>{{ctx.Locale.Tr "org.settings.custom_field_add"}}</h5>
+	<form class="ui form" method="post" action="{{.OrgLink}}/settings/custom-fields">
+		{{.CsrfTokenHtml}}
+		<div class="three fields">
+			<div class="required field">
+				<label>{{ctx.Locale.Tr "org.settings.custom_field_name"}}</label>
+				<input name="name" required placeholder="e.g. Status, Platform, Priority">
+			</div>
+			<div class="field">
+				<label>{{ctx.Locale.Tr "org.settings.custom_field_scope"}}</label>
+				<select name="scope" class="ui dropdown">
+					<option value="issue">{{svg "octicon-issue-opened" 14}} Issue (sidebar)</option>
+					<option value="repo">{{svg "octicon-repo" 14}} Repo (metadata)</option>
+				</select>
+			</div>
+			<div class="field">
+				<label>{{ctx.Locale.Tr "org.settings.custom_field_type"}}</label>
+				<select name="field_type" class="ui dropdown">
+					<option value="dropdown">Dropdown</option>
+					<option value="text">Text</option>
+					<option value="number">Number</option>
+					<option value="date">Date</option>
+					<option value="checkbox">Checkbox</option>
+					<option value="url">URL</option>
+				</select>
+			</div>
+		</div>
+		<div class="two fields">
+			<div class="field">
+				<label>{{ctx.Locale.Tr "org.settings.custom_field_options"}}</label>
+				<input name="options" placeholder='["Option 1","Option 2","Option 3"]'>
+				<p class="help">{{ctx.Locale.Tr "org.settings.custom_field_options_help"}}</p>
+			</div>
+			<div class="field">
+				<label>{{ctx.Locale.Tr "org.settings.custom_field_description"}}</label>
+				<input name="description" placeholder="Help text shown to users">
+			</div>
+		</div>
+		<button class="ui primary button" type="submit">{{ctx.Locale.Tr "org.settings.custom_field_add"}}</button>
+	</form>
+</div>
+{{template "org/settings/layout_footer" .}}

templates/org/settings/issue_statuses.tmpl

@@ -0,0 +1,93 @@
+{{template "org/settings/layout_head" (dict "ctxData" . "pageClass" "organization settings issue-statuses")}}
+<h4 class="ui top attached header">
+	{{ctx.Locale.Tr "org.settings.issue_statuses"}}
+</h4>
+<div class="ui attached segment">
+	<p class="text grey">{{ctx.Locale.Tr "org.settings.issue_statuses_desc"}}</p>
+
+	{{if .IssueStatuses}}
+	<table class="ui compact table">
+		<thead>
+			<tr>
+				<th>{{ctx.Locale.Tr "org.settings.issue_status_color"}}</th>
+				<th>{{ctx.Locale.Tr "org.settings.issue_status_name"}}</th>
+				<th>{{ctx.Locale.Tr "org.settings.issue_status_closes_issue"}}</th>
+				<th>{{ctx.Locale.Tr "org.settings.issue_status_sort_order"}}</th>
+				<th></th>
+			</tr>
+		</thead>
+		<tbody>
+			{{range .IssueStatuses}}
+			<tr {{if not .IsActive}}class="tw-opacity-50"{{end}}>
+				<td>
+					{{if .Color}}
+						<span class="tw-inline-block tw-w-4 tw-h-4 tw-rounded" style="background-color: {{.Color}}"></span>
+					{{else}}
+						<span class="text grey">-</span>
+					{{end}}
+				</td>
+				<td>
+					<strong>{{.Name}}</strong>
+					{{if not .IsActive}}<span class="ui mini grey label">{{ctx.Locale.Tr "org.settings.issue_status_inactive"}}</span>{{end}}
+					{{if .Description}}<br><small class="text grey">{{.Description}}</small>{{end}}
+				</td>
+				<td>
+					{{if .ClosesIssue}}
+						<span class="ui mini purple label">{{ctx.Locale.Tr "org.settings.issue_status_closes"}}</span>
+					{{else}}
+						<span class="text grey">-</span>
+					{{end}}
+				</td>
+				<td>{{.SortOrder}}</td>
+				<td class="tw-text-right">
+					<form method="post" action="{{$.OrgLink}}/settings/issue-statuses/{{.ID}}/delete" class="tw-inline">
+						{{$.CsrfTokenHtml}}
+						<button class="ui tiny red icon button" type="submit" title="{{ctx.Locale.Tr "remove"}}">{{svg "octicon-trash" 14}}</button>
+					</form>
+				</td>
+			</tr>
+			{{end}}
+		</tbody>
+	</table>
+	{{else}}
+	<div class="empty-placeholder">
+		<p>{{ctx.Locale.Tr "org.settings.issue_statuses_empty"}}</p>
+	</div>
+	{{end}}
+
+	<div class="divider"></div>
+
+	<h5>{{ctx.Locale.Tr "org.settings.issue_status_add"}}</h5>
+	<form class="ui form" method="post" action="{{.OrgLink}}/settings/issue-statuses">
+		{{.CsrfTokenHtml}}
+		<div class="three fields">
+			<div class="required field">
+				<label>{{ctx.Locale.Tr "org.settings.issue_status_name"}}</label>
+				<input name="name" required placeholder="e.g. In Progress, Won't Fix, Blocked">
+			</div>
+			<div class="field">
+				<label>{{ctx.Locale.Tr "org.settings.issue_status_color"}}</label>
+				<input name="color" type="color" value="#0075ff">
+			</div>
+			<div class="field">
+				<label>{{ctx.Locale.Tr "org.settings.issue_status_sort_order"}}</label>
+				<input name="sort_order" type="number" value="0" min="0">
+			</div>
+		</div>
+		<div class="two fields">
+			<div class="field">
+				<label>{{ctx.Locale.Tr "org.settings.issue_status_description"}}</label>
+				<input name="description" placeholder="Help text shown to users">
+			</div>
+			<div class="field">
+				<div class="ui checkbox tw-mt-4">
+					<input name="closes_issue" type="checkbox">
+					<label>{{ctx.Locale.Tr "org.settings.issue_status_closes_issue"}}</label>
+				</div>
+				<p class="help">{{ctx.Locale.Tr "org.settings.issue_status_closes_issue_help"}}</p>
+			</div>
+		</div>
+		<button class="ui primary button" type="submit">{{ctx.Locale.Tr "org.settings.issue_status_add"}}</button>
+	</form>
+</div>
+{{template "org/settings/layout_footer" .}}

templates/org/settings/navbar.tmpl

@@ -26,7 +26,13 @@
 		</a>
 		{{end}}
 		<a class="{{if .PageIsSettingsUpdateStreams}}active {{end}}item" href="{{.OrgLink}}/settings/update-streams">
-			{{svg "octicon-key"}} {{ctx.Locale.Tr "org.settings.update_streams"}}
+			{{svg "octicon-broadcast"}} {{ctx.Locale.Tr "org.settings.update_streams"}}
+		</a>
+		<a class="{{if .PageIsSettingsCustomFields}}active {{end}}item" href="{{.OrgLink}}/settings/custom-fields">
+			{{svg "octicon-list-unordered"}} {{ctx.Locale.Tr "org.settings.custom_fields"}}
+		</a>
+		<a class="{{if .PageIsSettingsIssueStatuses}}active {{end}}item" href="{{.OrgLink}}/settings/issue-statuses">
+			{{svg "octicon-tasklist"}} {{ctx.Locale.Tr "org.settings.issue_statuses"}}
 		</a>
 		{{if .EnableActions}}
 		<details class="item toggleable-item" {{if or .PageIsOrgSettingsActionsGeneral .PageIsSharedSettingsRunners .PageIsSharedSettingsSecrets .PageIsSharedSettingsVariables}}open{{end}}>

templates/repo/header.tmpl

@@ -130,9 +130,10 @@
 
 					{{if and .LicensingEnabled .IsSigned}}
 						<a href="{{.RepoLink}}/licenses" class="{{if .IsLicensesPage}}active {{end}}item">
-							{{svg "octicon-key"}} {{ctx.Locale.Tr "repo.licenses"}}
-							{{if .NumLicensePackages}}
-								<span class="ui small label">{{CountFmt .NumLicensePackages}}</span>
+							{{if .DownloadGated}}
+								{{svg "octicon-key"}} {{ctx.Locale.Tr "repo.licenses"}}
+							{{else}}
+								{{svg "octicon-broadcast"}} {{ctx.Locale.Tr "repo.settings.licensing_section"}}
 							{{end}}
 						</a>
 					{{end}}

templates/repo/issue/filter_list.tmpl

@@ -1,6 +1,6 @@
 {{$projectIDs := $.ProjectIDs}}
 {{$projectIDsQuery := SliceUtils.JoinInt64 $projectIDs}}
-{{$queryLink := QueryBuild "?" "q" $.Keyword "type" $.ViewType "sort" $.SortType "state" $.State "labels" $.SelectLabels "milestone" $.MilestoneID "project" $projectIDsQuery "assignee" $.AssigneeID "poster" $.PosterUsername "archived_labels" (Iif $.ShowArchivedLabels "true")}}
+{{$queryLink := QueryBuild (print "?" $.CustomFieldQueryString) "q" $.Keyword "type" $.ViewType "sort" $.SortType "state" $.State "labels" $.SelectLabels "milestone" $.MilestoneID "project" $projectIDsQuery "assignee" $.AssigneeID "poster" $.PosterUsername "archived_labels" (Iif $.ShowArchivedLabels "true")}}
 {{$showAllProjects := not $projectIDs}}
 {{$showNoProjectSelected := and (eq (len $projectIDs) 1) (eq (index $projectIDs 0) -1)}}
 
@@ -96,6 +96,32 @@
 	</div>
 {{end}}
 
+{{if .CustomFieldDefs}}
+<!-- Custom Field Filters -->
+{{$cfFilters := .CustomFieldFilters}}
+{{$cfOptions := .CustomFieldOptions}}
+{{range $def := .CustomFieldDefs}}
+	{{$opts := index $cfOptions $def.ID}}
+	{{if $opts}}
+		{{$cfKey := printf "cf_%d" $def.ID}}
+		{{$currentVal := index $cfFilters $def.ID}}
+		<div class="item ui dropdown jump">
+			<span class="text {{if $currentVal}}tw-font-bold{{end}}">
+				{{$def.Name}}
+			</span>
+			{{svg "octicon-triangle-down" 14 "dropdown icon"}}
+			<div class="menu">
+				<a class="{{if not $currentVal}}active {{end}}item" href="{{QueryBuild $queryLink $cfKey NIL}}">All</a>
+				<div class="divider"></div>
+				{{range $opt := $opts}}
+					<a class="{{if eq $opt $currentVal}}active {{end}}item" href="{{QueryBuild $queryLink $cfKey $opt}}">{{$opt}}</a>
+				{{end}}
+			</div>
+		</div>
+	{{end}}
+{{end}}
+{{end}}
+
 <!-- Sort -->
 <div class="item ui dropdown jump">
 	<span class="text">

templates/repo/issue/new_form.tmpl

@@ -59,6 +59,31 @@
 		{{end}}
 		{{template "repo/issue/sidebar/assignee_list" $.IssuePageMetaData}}
 
+		{{if .CustomFieldDefs}}
+		<div class="divider"></div>
+		<div class="tw-flex tw-flex-col tw-gap-2">
+			{{$values := .CustomFieldValues}}
+			{{$fieldOptions := .CustomFieldOptions}}
+			{{range .CustomFieldDefs}}
+				{{$currentVal := index $values .ID}}
+				<div class="tw-flex tw-items-center tw-justify-between tw-gap-2">
+					<span class="text grey tw-text-sm" {{if .Description}}title="{{.Description}}"{{end}}>{{.Name}}</span>
+					{{if ne .Options ""}}
+						{{$opts := index $fieldOptions .ID}}
+						<select name="custom-field-{{.ID}}" class="ui compact mini dropdown tw-max-w-48">
+							<option value="">—</option>
+							{{range $opts}}
+								<option value="{{.}}" {{if eq . $currentVal}}selected{{end}}>{{.}}</option>
+							{{end}}
+						</select>
+					{{else}}
+						<input name="custom-field-{{.ID}}" type="text" class="tw-max-w-48 tw-text-sm" value="{{$currentVal}}" placeholder="—">
+					{{end}}
+				</div>
+			{{end}}
+		</div>
+		{{end}}
+
 		{{if and .PageIsComparePull (not (eq .HeadRepo.FullName .BaseCompareRepo.FullName)) .CanWriteToHeadRepo}}
 			<div class="divider"></div>
 			<div class="ui checkbox">

templates/repo/issue/sidebar/custom_fields.tmpl

@@ -0,0 +1,33 @@
+{{if .CustomFieldDefs}}
+<div class="divider"></div>
+<div class="tw-flex tw-flex-col tw-gap-2">
+	{{$issueID := .Issue.ID}}
+	{{$repoLink := .RepoLink}}
+	{{$canModify := .HasIssuesOrPullsWritePermission}}
+	{{$values := .CustomFieldValues}}
+	{{$fieldOptions := .CustomFieldOptions}}
+	{{range .CustomFieldDefs}}
+		{{$currentVal := index $values .ID}}
+		<div class="tw-flex tw-items-center tw-justify-between tw-gap-2">
+			<span class="text grey tw-text-sm" {{if .Description}}title="{{.Description}}"{{end}}>{{.Name}}</span>
+			{{if and $canModify (eq .Options "")}}
+				{{/* Non-dropdown: just display the value */}}
+				<span class="tw-text-sm">{{if $currentVal}}{{$currentVal}}{{else}}<span class="text grey">—</span>{{end}}</span>
+			{{else if $canModify}}
+				<form method="post" action="{{$repoLink}}/issues/{{$issueID}}/custom-fields/{{.ID}}" class="tw-inline">
+					{{$.CsrfTokenHtml}}
+					<select name="value" class="ui compact mini dropdown tw-max-w-48" onchange="this.form.submit()">
+						<option value="">—</option>
+						{{$opts := index $fieldOptions .ID}}
+						{{range $opts}}
+							<option value="{{.}}" {{if eq . $currentVal}}selected{{end}}>{{.}}</option>
+						{{end}}
+					</select>
+				</form>
+			{{else}}
+				<span class="tw-text-sm">{{if $currentVal}}{{$currentVal}}{{else}}<span class="text grey">—</span>{{end}}</span>
+			{{end}}
+		</div>
+	{{end}}
+</div>
+{{end}}

templates/repo/issue/sidebar/issue_status.tmpl

@@ -0,0 +1,33 @@
+{{if .IssueStatusDefs}}
+<div class="divider"></div>
+<div class="tw-flex tw-items-center tw-justify-between tw-gap-2">
+	<span class="text grey tw-text-sm">{{ctx.Locale.Tr "repo.issues.status"}}</span>
+	{{$canModify := .HasIssuesOrPullsWritePermission}}
+	{{if $canModify}}
+		<form method="post" action="{{.RepoLink}}/issues/{{.Issue.ID}}/custom-status" class="tw-inline">
+			{{$.CsrfTokenHtml}}
+			<select name="status_id" class="ui compact mini dropdown tw-max-w-48" onchange="this.form.submit()">
+				<option value="0">—</option>
+				{{range .IssueStatusDefs}}
+					<option value="{{.ID}}" {{if eq .ID $.Issue.StatusID}}selected{{end}}
+						{{if .Color}}style="border-left: 3px solid {{.Color}}"{{end}}>
+						{{.Name}}{{if .ClosesIssue}} ⏻{{end}}
+					</option>
+				{{end}}
+			</select>
+		</form>
+	{{else}}
+		{{$found := false}}
+		{{range .IssueStatusDefs}}
+			{{if eq .ID $.Issue.StatusID}}
+				{{if .Color}}<span class="tw-inline-block tw-w-3 tw-h-3 tw-rounded" style="background-color: {{.Color}}"></span>{{end}}
+				<span class="tw-text-sm">{{.Name}}</span>
+				{{$found = true}}
+			{{end}}
+		{{end}}
+		{{if not $found}}
+			<span class="tw-text-sm text grey">—</span>
+		{{end}}
+	{{end}}
+</div>
+{{end}}

templates/repo/issue/view_content/sidebar.tmpl

@@ -7,6 +7,10 @@
 
 	{{template "repo/issue/sidebar/label_list" $.IssuePageMetaData}}
 
+	{{template "repo/issue/sidebar/issue_status" $}}
+
+	{{template "repo/issue/sidebar/custom_fields" $}}
+
 	{{template "repo/issue/sidebar/milestone_list" $.IssuePageMetaData}}
 	{{if .IsProjectsEnabled}}
 		{{template "repo/issue/sidebar/project_list" $.IssuePageMetaData}}

templates/repo/licenses.tmpl

@@ -3,6 +3,7 @@
 	{{template "repo/header" .}}
 	<div class="ui container">
 
+		{{if .DownloadGated}}
 		{{if .NewMasterKey}}
 			<div class="ui info message">
 				<div class="header">{{ctx.Locale.Tr "repo.licenses.master_key_created"}}</div>
@@ -25,27 +26,6 @@
 			</div>
 		{{end}}
 
-		{{/* ── Master Key Info ── */}}
-		{{if and .MasterKey .IsRepoAdmin}}
-			<div class="ui segment tw-flex tw-items-center tw-justify-between tw-gap-4">
-				<div class="tw-flex tw-items-center tw-gap-2">
-					<span class="ui tiny orange label">{{ctx.Locale.Tr "repo.licenses.master_label"}}</span>
-					<code>{{.MasterKey.KeyPrefix}}</code>
-					{{if .MasterKey.IsActive}}
-						<span class="ui tiny green label">{{ctx.Locale.Tr "repo.licenses.active"}}</span>
-					{{else}}
-						<span class="ui tiny grey label">{{ctx.Locale.Tr "repo.licenses.inactive"}}</span>
-					{{end}}
-				</div>
-				<form method="post" action="{{.RepoLink}}/licenses/master-key/regenerate" class="tw-inline">
-					{{.CsrfTokenHtml}}
-					<button class="ui tiny primary button" type="submit" data-tooltip-content="{{ctx.Locale.Tr "repo.licenses.regenerate_master_key_help"}}">
-						{{svg "octicon-sync" 14}} {{ctx.Locale.Tr "repo.licenses.regenerate_master_key"}}
-					</button>
-				</form>
-			</div>
-		{{end}}
-
 		{{/* ── License Packages ── */}}
 		<h4 class="ui top attached header tw-flex tw-items-center tw-justify-between">
 			<span>{{svg "octicon-key" 16}} {{ctx.Locale.Tr "repo.licenses.packages"}}</span>
@@ -78,9 +58,7 @@
 									<td class="tw-text-right tw-flex tw-gap-1 tw-justify-end">
 										<button class="ui tiny primary button show-modal"
 											data-modal="#generate-key-modal"
-											data-modal-generate-key-modal-package-id="{{.ID}}"
-											data-modal-generate-key-modal-package-name="{{.Name}}"
-											data-modal-generate-key-modal-package-domain="{{.DomainRestriction}}"
+											data-modal-form.action="{{$.RepoLink}}/licenses/keys/generate?package_id={{.ID}}"
 											title="{{ctx.Locale.Tr "repo.licenses.generate_key"}}">
 											{{svg "octicon-plus" 14}}
 										</button>
@@ -224,6 +202,8 @@
 			</details>
 		{{end}}
 
+		{{end}}{{/* end DownloadGated */}}
+
 		{{/* ── Update Feed URLs ── */}}
 		{{if .LicensingEnabled}}
 		<h4 class="ui top attached header tw-mt-4">
@@ -333,13 +313,12 @@
 {{end}}
 
 {{/* ── Generate Key Modal ── */}}
-{{if .IsRepoAdmin}}
+{{if and .DownloadGated .IsRepoAdmin}}
 <div class="ui small modal" id="generate-key-modal">
 	<div class="header">{{svg "octicon-plus"}} {{ctx.Locale.Tr "repo.licenses.generate_key"}}</div>
 	<div class="content">
 		<form class="ui form" method="post" action="{{.RepoLink}}/licenses/keys/generate">
 			{{.CsrfTokenHtml}}
-			<input type="hidden" name="package_id" value="">
 			<div class="field">
 				<label>{{ctx.Locale.Tr "repo.licenses.licensee_name"}}</label>
 				<input name="licensee_name" placeholder="Customer name">
@@ -367,6 +346,7 @@
 {{end}}
 
 {{/* ── Delete Package Confirmation Modal ── */}}
+{{if .DownloadGated}}
 <div class="ui small modal" id="license-delete-package-modal">
 	<div class="header">{{svg "octicon-trash"}} {{ctx.Locale.Tr "repo.licenses.delete_package"}}</div>
 	<div class="content">
@@ -397,5 +377,6 @@
 		</form>
 	</div>
 </div>
+{{end}}{{/* end DownloadGated for modals */}}
 
 {{template "base/footer" .}}

templates/repo/settings/advanced.tmpl

@@ -228,7 +228,7 @@
 				</div>
 
 				{{/* ── Licensing ── */}}
-				<h5 class="ui dividing header tw-flex tw-items-center tw-gap-2">{{svg "octicon-key" 16}} {{ctx.Locale.Tr "repo.settings.licensing_section"}}</h5>
+				<h5 class="ui dividing header tw-flex tw-items-center tw-gap-2">{{svg "octicon-broadcast" 16}} {{ctx.Locale.Tr "repo.settings.licensing_section"}}</h5>
 				<div class="inline field">
 					<div class="ui checkbox">
 						<input name="enable_licensing" type="checkbox" {{if .LicensingEnabled}}checked{{end}}>

templates/repo/settings/licensing.tmpl

@@ -1,7 +1,7 @@
 {{template "repo/settings/layout_head" (dict "pageClass" "repository settings licensing")}}
 	<div class="user-main-content twelve wide column">
 		<h4 class="ui top attached header">
-			{{svg "octicon-key" 16}} {{ctx.Locale.Tr "repo.settings.licensing_section"}}
+			{{svg "octicon-broadcast" 16}} {{ctx.Locale.Tr "repo.settings.licensing_section"}}
 		</h4>
 		<div class="ui attached segment">
 			<form class="ui form" method="post" action="{{.Link}}">

templates/repo/settings/manifest.tmpl

@@ -0,0 +1,88 @@
+{{template "repo/settings/layout_head" (dict "ctxData" . "pageClass" "repository settings manifest")}}
+<h4 class="ui top attached header">
+	{{ctx.Locale.Tr "repo.settings.manifest"}}
+</h4>
+<div class="ui attached segment">
+	<p class="text grey">{{ctx.Locale.Tr "repo.settings.manifest_desc"}}</p>
+
+	<form class="ui form" method="post" action="{{.RepoLink}}/settings/manifest">
+		{{.CsrfTokenHtml}}
+
+		<h5 class="ui dividing header">{{ctx.Locale.Tr "repo.settings.manifest_identity"}}</h5>
+		<div class="two fields">
+			<div class="field">
+				<label>{{ctx.Locale.Tr "repo.settings.manifest_name"}}</label>
+				<input name="name" value="{{.Manifest.Name}}" placeholder="Project name">
+			</div>
+			<div class="field">
+				<label>{{ctx.Locale.Tr "repo.settings.manifest_org"}}</label>
+				<input name="org" value="{{.Manifest.Org}}" placeholder="Organization">
+			</div>
+		</div>
+		<div class="field">
+			<label>{{ctx.Locale.Tr "repo.settings.manifest_description"}}</label>
+			<input name="description" value="{{.Manifest.Description}}" placeholder="Project description">
+		</div>
+		<div class="three fields">
+			<div class="field">
+				<label>{{ctx.Locale.Tr "repo.settings.manifest_version"}}</label>
+				<input name="version" value="{{.Manifest.Version}}" placeholder="e.g. 06.00.00">
+			</div>
+			<div class="field">
+				<label>{{ctx.Locale.Tr "repo.settings.manifest_license_spdx"}}</label>
+				<input name="license_spdx" value="{{.Manifest.LicenseSPDX}}" placeholder="e.g. GPL-3.0-or-later">
+			</div>
+			<div class="field">
+				<label>{{ctx.Locale.Tr "repo.settings.manifest_license_name"}}</label>
+				<input name="license_name" value="{{.Manifest.LicenseName}}" placeholder="e.g. GNU General Public License v3">
+			</div>
+		</div>
+
+		<h5 class="ui dividing header">{{ctx.Locale.Tr "repo.settings.manifest_governance"}}</h5>
+		<div class="three fields">
+			<div class="field">
+				<label>{{ctx.Locale.Tr "repo.settings.manifest_platform"}}</label>
+				<select name="platform" class="ui dropdown">
+					<option value="">—</option>
+					{{$platform := .Manifest.Platform}}
+					{{range $val := StringUtils.Split "go,php,node,python,ruby,java,dotnet,rust" ","}}
+						<option value="{{$val}}" {{if eq $val $platform}}selected{{end}}>{{$val}}</option>
+					{{end}}
+				</select>
+			</div>
+			<div class="field">
+				<label>{{ctx.Locale.Tr "repo.settings.manifest_standards_version"}}</label>
+				<input name="standards_version" value="{{.Manifest.StandardsVersion}}" placeholder="e.g. 05.00.00">
+			</div>
+			<div class="field">
+				<label>{{ctx.Locale.Tr "repo.settings.manifest_standards_source"}}</label>
+				<input name="standards_source" value="{{.Manifest.StandardsSource}}" placeholder="URL to standards repo">
+			</div>
+		</div>
+
+		<h5 class="ui dividing header">{{ctx.Locale.Tr "repo.settings.manifest_build"}}</h5>
+		<div class="three fields">
+			<div class="field">
+				<label>{{ctx.Locale.Tr "repo.settings.manifest_language"}}</label>
+				<input name="language" value="{{.Manifest.Language}}" placeholder="e.g. Go, PHP, TypeScript">
+			</div>
+			<div class="field">
+				<label>{{ctx.Locale.Tr "repo.settings.manifest_package_type"}}</label>
+				<select name="package_type" class="ui dropdown">
+					<option value="">—</option>
+					{{$pkgType := .Manifest.PackageType}}
+					{{range $val := StringUtils.Split "application,library,plugin,module,component,package,template" ","}}
+						<option value="{{$val}}" {{if eq $val $pkgType}}selected{{end}}>{{$val}}</option>
+					{{end}}
+				</select>
+			</div>
+			<div class="field">
+				<label>{{ctx.Locale.Tr "repo.settings.manifest_entry_point"}}</label>
+				<input name="entry_point" value="{{.Manifest.EntryPoint}}" placeholder="e.g. ./ or src/index.ts">
+			</div>
+		</div>
+
+		<button class="ui primary button" type="submit">{{ctx.Locale.Tr "repo.settings.manifest_save"}}</button>
+	</form>
+</div>
+{{template "repo/settings/layout_footer" .}}

templates/repo/settings/metadata.tmpl

@@ -0,0 +1,49 @@
+{{template "repo/settings/layout_head" (dict "pageClass" "repository settings metadata")}}
+	<div class="user-main-content twelve wide column">
+		<h4 class="ui top attached header">
+			{{svg "octicon-list-unordered" 16}} {{ctx.Locale.Tr "repo.settings.metadata"}}
+		</h4>
+		<div class="ui attached segment">
+			{{if .CustomFieldDefs}}
+			<form class="ui form" method="post" action="{{.RepoLink}}/settings/metadata">
+				{{.CsrfTokenHtml}}
+				{{$values := .CustomFieldValues}}
+				{{$options := .CustomFieldOptions}}
+				{{range .CustomFieldDefs}}
+					{{$currentVal := index $values .ID}}
+					<div class="field">
+						<label>{{.Name}}{{if .Description}} <small class="text grey">({{.Description}})</small>{{end}}</label>
+						{{if .Options}}
+							{{$opts := index $options .ID}}
+							<select name="field_{{.ID}}" class="ui dropdown">
+								<option value="">—</option>
+								{{range $opts}}
+									<option value="{{.}}" {{if eq . $currentVal}}selected{{end}}>{{.}}</option>
+								{{end}}
+							</select>
+						{{else if eq (printf "%s" .FieldType) "checkbox"}}
+							<div class="ui checkbox">
+								<input type="checkbox" name="field_{{.ID}}" value="true" {{if eq $currentVal "true"}}checked{{end}}>
+								<label></label>
+							</div>
+						{{else if eq (printf "%s" .FieldType) "number"}}
+							<input type="number" name="field_{{.ID}}" value="{{$currentVal}}">
+						{{else if eq (printf "%s" .FieldType) "url"}}
+							<input type="url" name="field_{{.ID}}" value="{{$currentVal}}" placeholder="https://...">
+						{{else if eq (printf "%s" .FieldType) "date"}}
+							<input type="date" name="field_{{.ID}}" value="{{$currentVal}}">
+						{{else}}
+							<input type="text" name="field_{{.ID}}" value="{{$currentVal}}">
+						{{end}}
+					</div>
+				{{end}}
+				<div class="field tw-mt-4">
+					<button class="ui primary button" type="submit">{{ctx.Locale.Tr "save"}}</button>
+				</div>
+			</form>
+			{{else}}
+			<p class="text grey">{{ctx.Locale.Tr "repo.settings.metadata_empty"}}</p>
+			{{end}}
+		</div>
+	</div>
+{{template "repo/settings/layout_footer" .}}

templates/repo/settings/navbar.tmpl

@@ -9,11 +9,14 @@
 		</a>
 		{{if .LicensingEnabled}}
 		<a class="{{if .PageIsSettingsLicensing}}active {{end}}item" href="{{.RepoLink}}/settings/licensing">
-			{{svg "octicon-key"}} {{ctx.Locale.Tr "repo.settings.licensing_section"}}
+			{{svg "octicon-broadcast"}} {{ctx.Locale.Tr "repo.settings.licensing_section"}}
 		</a>
 		{{end}}
-		<a class="{{if .PageIsSettingsCustomFields}}active {{end}}item" href="{{.RepoLink}}/settings/custom-fields">
-			{{svg "octicon-list-unordered"}} {{ctx.Locale.Tr "repo.settings.custom_fields"}}
+		<a class="{{if .PageIsSettingsManifest}}active {{end}}item" href="{{.RepoLink}}/settings/manifest">
+			{{svg "octicon-file-code"}} {{ctx.Locale.Tr "repo.settings.manifest"}}
+		</a>
+		<a class="{{if .PageIsSettingsMetadata}}active {{end}}item" href="{{.RepoLink}}/settings/metadata">
+			{{svg "octicon-list-unordered"}} {{ctx.Locale.Tr "repo.settings.metadata"}}
 		</a>
 		{{if or .Repository.IsPrivate .Permission.HasAnyUnitPublicAccess}}
 		<a class="{{if .PageIsSettingsPublicAccess}}active {{end}}item" href="{{.RepoLink}}/settings/public_access">

templates/repo/view_content.tmpl

@@ -130,6 +130,21 @@
 		{{template "repo/code/upstream_diverging_info" .}}
 	{{end}}
 	{{template "repo/view_list" .}}
+	{{if .WellKnownFileTabs}}
+		<div class="ui top attached tabular menu well-known-file-tabs">
+			{{range .WellKnownFileTabs}}
+				<a class="{{if .Active}}active {{end}}item" href="?tab={{.TabKey}}">
+					{{if eq .TabKey "readme"}}{{svg "octicon-book" 16 "tw-mr-1"}}{{end -}}
+					{{if eq .TabKey "license"}}{{svg "octicon-law" 16 "tw-mr-1"}}{{end -}}
+					{{if eq .TabKey "contributing"}}{{svg "octicon-heart" 16 "tw-mr-1"}}{{end -}}
+					{{if eq .TabKey "code_of_conduct"}}{{svg "octicon-people" 16 "tw-mr-1"}}{{end -}}
+					{{if eq .TabKey "security"}}{{svg "octicon-shield" 16 "tw-mr-1"}}{{end -}}
+					{{if eq .TabKey "changelog"}}{{svg "octicon-history" 16 "tw-mr-1"}}{{end -}}
+					{{ctx.Locale.Tr .Label}}
+				</a>
+			{{end}}
+		</div>
+	{{end}}
 	{{if and .ReadmeExist (or .RenderAsMarkup .IsPlainText)}}
 		{{template "repo/view_file" .}}
 	{{end}}

updates.xml

@@ -1,103 +0,0 @@
-<?xml version='1.0' encoding='UTF-8'?>
-<!-- Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
- SPDX-License-Identifier: GPL-3.0-or-later
- VERSION: 05.27.00
- -->
-
-<updates>
-  <update>
-    <name>MokoGitea</name>
-    <description>MokoGitea dev build.</description>
-    <element>mokogitea</element>
-    <type>application</type>
-    <client>site</client>
-    <version>05.05.00-dev</version>
-    <creationDate>2026-05-30</creationDate>
-    <infourl title="MokoGitea">https://code.mokoconsulting.tech/MokoConsulting/MokoGitea/releases/tag/development</infourl>
-    <downloads>
-      <downloadurl type="full" format="zip">https://code.mokoconsulting.tech/MokoConsulting/MokoGitea/releases/download/development/mokogitea-05.05.00-dev.zip</downloadurl>
-    </downloads>
-    <sha256>4fee9eb03e4b819a63bce2ceb54fdce0d3eb8bf5b31460fcc42e5ecd75cc856e</sha256>
-    <tags><tag>dev</tag></tags>
-    <changelogurl>https://code.mokoconsulting.tech/MokoConsulting/MokoGitea/raw/branch/main/CHANGELOG.md</changelogurl>
-    <maintainer>Moko Consulting</maintainer>
-    <maintainerurl>https://mokoconsulting.tech</maintainerurl>
-    <targetplatform name="go" version=".*"/>
-  </update>
-  <update>
-    <name>MokoGitea</name>
-    <description>MokoGitea alpha build.</description>
-    <element>mokogitea</element>
-    <type>application</type>
-    <client>site</client>
-    <version>05.05.00-alpha</version>
-    <creationDate>2026-05-30</creationDate>
-    <infourl title="MokoGitea">https://code.mokoconsulting.tech/MokoConsulting/MokoGitea/releases/tag/alpha</infourl>
-    <downloads>
-      <downloadurl type="full" format="zip">https://code.mokoconsulting.tech/MokoConsulting/MokoGitea/releases/download/alpha/mokogitea-05.05.00-alpha.zip</downloadurl>
-    </downloads>
-    <sha256>4fee9eb03e4b819a63bce2ceb54fdce0d3eb8bf5b31460fcc42e5ecd75cc856e</sha256>
-    <tags><tag>alpha</tag></tags>
-    <changelogurl>https://code.mokoconsulting.tech/MokoConsulting/MokoGitea/raw/branch/main/CHANGELOG.md</changelogurl>
-    <maintainer>Moko Consulting</maintainer>
-    <maintainerurl>https://mokoconsulting.tech</maintainerurl>
-    <targetplatform name="go" version=".*"/>
-  </update>
-  <update>
-    <name>MokoGitea</name>
-    <description>MokoGitea beta build.</description>
-    <element>mokogitea</element>
-    <type>application</type>
-    <client>site</client>
-    <version>05.05.00-beta</version>
-    <creationDate>2026-05-30</creationDate>
-    <infourl title="MokoGitea">https://code.mokoconsulting.tech/MokoConsulting/MokoGitea/releases/tag/beta</infourl>
-    <downloads>
-      <downloadurl type="full" format="zip">https://code.mokoconsulting.tech/MokoConsulting/MokoGitea/releases/download/beta/mokogitea-05.05.00-beta.zip</downloadurl>
-    </downloads>
-    <sha256>4fee9eb03e4b819a63bce2ceb54fdce0d3eb8bf5b31460fcc42e5ecd75cc856e</sha256>
-    <tags><tag>beta</tag></tags>
-    <changelogurl>https://code.mokoconsulting.tech/MokoConsulting/MokoGitea/raw/branch/main/CHANGELOG.md</changelogurl>
-    <maintainer>Moko Consulting</maintainer>
-    <maintainerurl>https://mokoconsulting.tech</maintainerurl>
-    <targetplatform name="go" version=".*"/>
-  </update>
-  <update>
-    <name>MokoGitea</name>
-    <description>MokoGitea rc build.</description>
-    <element>mokogitea</element>
-    <type>application</type>
-    <client>site</client>
-    <version>05.05.00-rc</version>
-    <creationDate>2026-05-30</creationDate>
-    <infourl title="MokoGitea">https://code.mokoconsulting.tech/MokoConsulting/MokoGitea/releases/tag/release-candidate</infourl>
-    <downloads>
-      <downloadurl type="full" format="zip">https://code.mokoconsulting.tech/MokoConsulting/MokoGitea/releases/download/release-candidate/mokogitea-05.05.00-rc.zip</downloadurl>
-    </downloads>
-    <sha256>4fee9eb03e4b819a63bce2ceb54fdce0d3eb8bf5b31460fcc42e5ecd75cc856e</sha256>
-    <tags><tag>rc</tag></tags>
-    <changelogurl>https://code.mokoconsulting.tech/MokoConsulting/MokoGitea/raw/branch/main/CHANGELOG.md</changelogurl>
-    <maintainer>Moko Consulting</maintainer>
-    <maintainerurl>https://mokoconsulting.tech</maintainerurl>
-    <targetplatform name="go" version=".*"/>
-  </update>
-  <update>
-    <name>MokoGitea</name>
-    <description>MokoGitea stable build.</description>
-    <element>mokogitea</element>
-    <type>application</type>
-    <client>site</client>
-    <version>05.27.00</version>
-    <creationDate>2026-06-04</creationDate>
-    <infourl title='MokoGitea'>https://git.mokoconsulting.tech/MokoConsulting/MokoGitea/releases/tag/stable</infourl>
-    <downloads>
-      <downloadurl type='full' format='zip'>https://git.mokoconsulting.tech/MokoConsulting/MokoGitea/releases/download/stable/mokogitea-05.27.00.zip</downloadurl>
-    </downloads>
-    <sha256>4d89331838eb3a1ff8cfa2ca16039c7c7a30eaa14fa70893ca882c82c3f3933f</sha256>
-    <tags><tag>stable</tag></tags>
-    <changelogurl>https://git.mokoconsulting.tech/MokoConsulting/MokoGitea/raw/branch/main/CHANGELOG.md</changelogurl>
-    <maintainer>Moko Consulting</maintainer>
-    <maintainerurl>https://mokoconsulting.tech</maintainerurl>
-    <targetplatform name="go" version=".*" />
-  </update>
-</updates>

wiki/custom-fields.md

@@ -0,0 +1,136 @@
+# Custom Fields
+
+Custom fields allow organizations to define structured metadata that appears in issue sidebars and repository settings across all repos in the organization.
+
+## Overview
+
+Custom fields are defined at the **organization level** in Org Settings > Custom Fields. Each field has a scope:
+
+- **Issue scope** — appears in the issue sidebar for inline editing
+- **Repo scope** — appears in Repository Settings > Metadata for repo-level values
+
+## Field Types
+
+| Type | Description | Example |
+|------|-------------|---------|
+| `text` | Free-form text input | "Affected Component" |
+| `number` | Numeric input | "Story Points" |
+| `date` | Date picker | "Due Date" |
+| `dropdown` | Select from predefined options | "Priority: Low/Medium/High/Critical" |
+| `checkbox` | Boolean toggle | "Requires QA" |
+| `url` | URL input | "Design Link" |
+
+## Org Settings
+
+Navigate to **Organization Settings > Custom Fields** to manage field definitions.
+
+Each field has:
+
+| Field | Description |
+|-------|-------------|
+| Name | Display name |
+| Scope | `issue` (sidebar) or `repo` (metadata) |
+| Type | One of: text, number, date, dropdown, checkbox, url |
+| Options | JSON array for dropdown options (e.g., `["Low","Medium","High"]`) |
+| Description | Help text (shown as tooltip) |
+| Sort Order | Controls display order |
+| Is Active | Inactive fields are hidden from new forms but preserved on existing entities |
+
+## Issue Sidebar
+
+Issue-scoped fields appear in the sidebar between labels and milestones. Dropdown fields auto-submit on change. Text/number/date fields display their current value.
+
+Each field renders as an inline form posting to:
+```
+POST /{owner}/{repo}/issues/{issue_id}/custom-fields/{field_id}
+```
+
+## Repository Metadata
+
+Repo-scoped fields appear on the **Repository Settings > Metadata** page. All fields for the org are shown with their current values for the repository. Values are saved via form POST.
+
+## Issue Template Integration
+
+Custom fields can be pre-filled from issue template YAML frontmatter:
+
+```yaml
+name: Bug Report
+about: Report a bug
+custom_fields:
+  Priority: High
+  Affected Component: Backend
+```
+
+When a new issue is created from this template, the sidebar shows the custom fields with the specified defaults pre-selected.
+
+## API
+
+### Issue-Level Custom Fields
+
+| Method | Path | Description |
+|--------|------|-------------|
+| GET | `/api/v1/repos/{owner}/{repo}/issues/{index}/custom-fields` | Get field values for an issue |
+| PUT | `/api/v1/repos/{owner}/{repo}/issues/{index}/custom-fields` | Set field values (name-value map) |
+
+### Repo-Level Metadata
+
+| Method | Path | Description |
+|--------|------|-------------|
+| GET | `/api/v1/repos/{owner}/{repo}/metadata` | Get repo metadata field values |
+| PUT | `/api/v1/repos/{owner}/{repo}/metadata` | Set repo metadata field values |
+
+### Org-Level Definitions
+
+| Method | Path | Description |
+|--------|------|-------------|
+| GET | `/api/v1/orgs/{org}/custom-fields` | List all field definitions |
+| POST | `/api/v1/orgs/{org}/custom-fields` | Create a field definition |
+| DELETE | `/api/v1/orgs/{org}/custom-fields/{id}` | Delete a field definition |
+
+## Database
+
+### Tables
+
+**`custom_field_def`** — field definitions (org-level)
+
+| Column | Type | Description |
+|--------|------|-------------|
+| id | bigint | Primary key |
+| owner_id | bigint | Org ID (0 = legacy repo-level) |
+| repo_id | bigint | 0 for org-level definitions |
+| scope | varchar(10) | `issue` or `repo` |
+| name | varchar | Field name |
+| field_type | varchar(20) | text, number, date, dropdown, checkbox, url |
+| description | text | Help text |
+| options | text | JSON array for dropdown options |
+| required | bool | Whether the field is required |
+| sort_order | int | Display order |
+| is_active | bool | Visibility flag |
+
+**`custom_field_value`** — field values (per entity)
+
+| Column | Type | Description |
+|--------|------|-------------|
+| id | bigint | Primary key |
+| entity_id | bigint | Issue ID or Repo ID |
+| entity_type | varchar(10) | `issue` or `repo` |
+| field_id | bigint | FK to custom_field_def |
+| value | text | The stored value |
+
+### Cascade on Delete
+
+When a field definition is deleted, all associated values in `custom_field_value` are also deleted.
+
+## Relationship to Other Systems
+
+| System | Relationship |
+|--------|-------------|
+| Update Server | Repo-scoped custom fields with specific names (Extension Name, Display Name, etc.) are read by the update feed generators as the highest-priority metadata source. |
+| Manifest Settings | Manifest fields follow the moko-platform schema and are separate from custom fields. Custom fields are user-defined; manifest fields are standardized. |
+| Issue Statuses | Custom statuses are a separate feature with their own dedicated table and UI, not implemented as custom fields. |
+
+---
+
+| Revision | Date | Author | Description |
+|---|---|---|---|
+| 1.0 | 2026-06-06 | Jonathan Miller (@jmiller) | Initial version |

wiki/custom-issue-statuses.md

@@ -0,0 +1,107 @@
+# Custom Issue Statuses
+
+Custom issue statuses extend Gitea's binary Open/Closed model with org-defined workflow states. Each status has a name, color, and an optional "closes issue" flag that triggers automatic close/reopen when selected.
+
+## Overview
+
+Statuses are defined at the **organization level** and appear in the issue sidebar for all repositories under that organization. This is the same pattern as org-level labels and custom fields.
+
+### Key Concepts
+
+- **Status definitions** are managed in Org Settings > Issue Statuses
+- **Status selection** appears as a dropdown in the issue sidebar
+- **Auto close/reopen** — selecting a status with `closes_issue = true` automatically closes the issue; switching to a non-closing status reopens it
+- **Status is supplemental** — the existing Open/Closed binary state is preserved; statuses add granularity on top
+
+## Org Settings
+
+Navigate to **Organization Settings > Issue Statuses** to manage status definitions.
+
+Each status has:
+
+| Field | Description |
+|-------|-------------|
+| Name | Display name (e.g., "In Progress", "Won't Fix", "Blocked") |
+| Color | Hex color for visual distinction (e.g., `#2563eb`) |
+| Description | Help text shown to users |
+| Closes Issue | When checked, selecting this status automatically closes the issue |
+| Sort Order | Controls display order in dropdowns (ascending) |
+| Is Active | Inactive statuses are hidden from dropdowns but preserved on existing issues |
+
+### Example Statuses
+
+| Status | Color | Closes Issue | Use Case |
+|--------|-------|:------------:|----------|
+| In Progress | Blue | No | Work is actively being done |
+| Needs Info | Yellow | No | Waiting for more information from reporter |
+| Blocked | Red | No | Cannot proceed due to external dependency |
+| Won't Fix | Gray | Yes | Decided not to address this issue |
+| Duplicate | Purple | Yes | Already tracked in another issue |
+| Resolved | Green | Yes | Fix has been implemented and verified |
+
+## Issue Sidebar
+
+When an organization has custom statuses defined, a **Status** dropdown appears in the issue sidebar between labels and custom fields. The dropdown:
+
+- Shows all active status definitions for the repo's organization
+- Auto-submits on change (no save button needed)
+- Displays a colored left border on each option
+- Shows a power symbol on statuses that close the issue
+- Selecting "—" (empty) clears the status
+
+### Auto Close/Reopen Behavior
+
+| Current State | Selected Status | Result |
+|:---:|---|---|
+| Open | Status with `closes_issue = true` | Issue is closed automatically |
+| Closed | Status with `closes_issue = false` | Issue is reopened automatically |
+| Open | Status with `closes_issue = false` | Status set, issue stays open |
+| Closed | Status with `closes_issue = true` | Status set, issue stays closed |
+
+All close/reopen actions go through the standard Gitea service layer, so webhooks, notifications, and timeline events fire normally.
+
+## Database
+
+### Tables
+
+**`issue_status_def`** (migration v346) — org-level status definitions
+
+| Column | Type | Description |
+|--------|------|-------------|
+| id | bigint | Primary key |
+| org_id | bigint | Organization ID |
+| name | varchar | Status name |
+| color | varchar(7) | Hex color |
+| description | text | Help text |
+| closes_issue | bool | Auto-close flag |
+| sort_order | int | Display order |
+| is_active | bool | Visibility flag |
+
+**`issue`** table — added `status_id` column (bigint, default 0)
+
+### Cascade on Delete
+
+When a status definition is deleted, all issues referencing it have their `status_id` set to 0 (cleared). Issues are not closed or reopened during deletion.
+
+## Routes
+
+### Web Routes (Org Settings)
+
+| Method | Path | Handler |
+|--------|------|---------|
+| GET | `/org/{org}/settings/issue-statuses` | `SettingsIssueStatuses` |
+| POST | `/org/{org}/settings/issue-statuses` | `SettingsIssueStatusesCreatePost` |
+| POST | `/org/{org}/settings/issue-statuses/{id}/edit` | `SettingsIssueStatusesEditPost` |
+| POST | `/org/{org}/settings/issue-statuses/{id}/delete` | `SettingsIssueStatusesDeletePost` |
+
+### Web Routes (Issue Sidebar)
+
+| Method | Path | Handler |
+|--------|------|---------|
+| POST | `/{owner}/{repo}/issues/{id}/custom-status` | `UpdateIssueCustomStatus` |
+
+---
+
+| Revision | Date | Author | Description |
+|---|---|---|---|
+| 1.0 | 2026-06-06 | Jonathan Miller (@jmiller) | Initial version |

wiki/home.md

@@ -0,0 +1,50 @@
+# MokoGitea
+
+Moko Consulting's custom fork of [Gitea](https://gitea.com), extending the self-hosted Git service with commercial licensing, update feeds, custom issue workflows, and org-level management features.
+
+| Field | Value |
+|-----|-----|
+| **Language** | Go |
+| **License** | MIT |
+| **Upstream** | Gitea 1.26.1 |
+| **Version** | v1.26.1-moko.06.04.00 |
+| **Platform** | [Gitea](https://git.mokoconsulting.tech/MokoConsulting/MokoGitea) |
+
+---
+
+## Features
+
+- **Commercial License System** — Package-based license keys with download gating, domain restriction, key expiry, and payment webhook API
+- **Update Server** — Built-in update feeds for Joomla, WordPress, Dolibarr, Composer, Drupal, PrestaShop, and WHMCS
+- **Custom Issue Statuses** — Org-defined workflow states (In Progress, Blocked, Won't Fix) with auto close/reopen
+- **Custom Fields** — Org-level field definitions for issues (sidebar) and repos (metadata) with dropdown, text, number, date, checkbox, and URL types
+- **Manifest Settings** — Per-repo identity/governance/build metadata with REST API for CI/CD integration
+- **Well-Known File Tabs** — README/LICENSE/CONTRIBUTING/SECURITY/CHANGELOG tabs on repo home page
+- **Org-Level Branch Protection** — Organization-scoped rulesets that cascade to all repos. Supports glob patterns. Full CRUD API
+- **Enterprise Sub-Orgs** — Parent-child organization hierarchy
+- **Three-Level Visibility** — Public (200), Private (403), Hidden (404) for repositories
+- **Configurable Help/Support URLs** — Replace hardcoded docs.gitea.com links via HELP_URL and SUPPORT_URL in app.ini
+- **Project Board API** — REST API endpoints for managing project boards, columns, and cards
+- **Custom branding** — Moko Consulting visual identity (logos, colors, footer)
+
+## Pages
+
+| Page | Description |
+|---|---|
+| [Branding](Branding) | Custom branding and visual identity details |
+| [Custom Fields](Custom-Fields) | Org-level custom fields for issues and repos |
+| [Custom Issue Statuses](Custom-Issue-Statuses) | Org-defined workflow states with auto close/reopen |
+| [Deployment](Deployment) | Production deployment guide |
+| [Manifest Settings](Manifest-Settings) | Per-repo manifest settings and REST API |
+| [Org Branch Protection API](Org-Branch-Protection-API) | Org-level branch protection rulesets and API reference |
+| [Project API](Project-API) | Custom API endpoint reference for project boards |
+| [Roadmap](Roadmap) | Development roadmap and planned features |
+
+---
+
+| Revision | Date | Author | Description |
+|---|---|---|---|
+| 4.0 | 2026-06-06 | Jonathan Miller (@jmiller) | Add manifest settings, custom statuses, custom fields, well-known tabs, update version to v1.26.1-moko.06.04.00 |
+| 3.0 | 2026-05-12 | Jonathan Miller (@jmiller) | Add org branch protection, help URLs, version convention |
+| 2.0 | 2026-05-10 | Jonathan Miller (@jmiller) | Rewrite with detailed features and fork documentation |
+| 1.0 | 2026-05-09 | Jonathan Miller (@jmiller) | Initial version |

wiki/manifest-settings.md

@@ -0,0 +1,111 @@
+# Manifest Settings
+
+The manifest settings feature provides a centralized way to store and manage project identity, governance, and build metadata for each repository. Settings are stored in the database and exposed via both a web UI and REST API.
+
+## Overview
+
+Each repository can have a manifest that describes:
+
+- **Identity** — project name, organization, description, version, and license
+- **Governance** — platform type, moko-platform standards version, and standards source URL
+- **Build** — language, package type, and entry point
+
+These settings replace the legacy `.mokogitea/manifest.xml` file-based approach.
+
+## Repo Settings Page
+
+Navigate to **Repository Settings > Manifest** to view and edit manifest fields.
+
+| Section | Fields |
+|---------|--------|
+| Identity | Name, Org, Description, Version, License SPDX, License Name |
+| Governance | Platform, Standards Version, Standards Source |
+| Build | Language, Package Type, Entry Point |
+
+### Auto-Migration from manifest.xml
+
+On first visit to the Manifest settings page, if no manifest exists in the database but a `.mokogitea/manifest.xml` file exists in the repository, the system will:
+
+1. Parse the XML and extract all fields
+2. Store them in the database
+3. Display a flash message indicating migration was successful
+4. The manifest.xml file can then be manually deleted from the repository
+
+If a field already has a value in the database (e.g., from org-level custom fields), the existing value is preserved and the manifest.xml value is skipped.
+
+## REST API
+
+The manifest API allows Actions workflows and the moko-platform CLI to read and write manifest settings programmatically.
+
+### Get Manifest
+
+```
+GET /api/v1/repos/{owner}/{repo}/manifest
+Authorization: token {access_token}
+```
+
+Returns the current manifest settings. If no manifest has been saved, returns defaults derived from repository metadata (name, owner, description).
+
+**Response:**
+```json
+{
+  "name": "MokoGitea",
+  "org": "MokoConsulting",
+  "description": "Moko fork of Gitea",
+  "version": "06.04.00",
+  "license_spdx": "GPL-3.0-or-later",
+  "license_name": "GNU General Public License v3",
+  "platform": "go",
+  "standards_version": "05.00.00",
+  "standards_source": "https://code.mokoconsulting.tech/MokoConsulting/moko-platform",
+  "language": "Go",
+  "package_type": "application",
+  "entry_point": "./"
+}
+```
+
+### Update Manifest
+
+```
+PUT /api/v1/repos/{owner}/{repo}/manifest
+Authorization: token {access_token}
+Content-Type: application/json
+```
+
+Requires repo admin permission. Accepts the same JSON structure as the GET response. Creates or updates the manifest.
+
+### Usage in Actions Workflows
+
+```yaml
+steps:
+  - name: Read manifest version
+    run: |
+      VERSION=$(curl -s "$GITEA_SERVER_URL/api/v1/repos/$GITHUB_REPOSITORY/manifest" \
+        -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" | jq -r '.version')
+      echo "Current version: $VERSION"
+
+  - name: Bump version
+    run: |
+      curl -s -X PUT "$GITEA_SERVER_URL/api/v1/repos/$GITHUB_REPOSITORY/manifest" \
+        -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+        -H "Content-Type: application/json" \
+        -d "{\"version\": \"$NEW_VERSION\"}"
+```
+
+## Database
+
+Manifest settings are stored in the `repo_manifest` table (migration v347). One row per repository, keyed by `repo_id`.
+
+## Relationship to Other Systems
+
+| System | Relationship |
+|--------|-------------|
+| Update Server | The update server generators read from both manifest settings and update_stream_config. Manifest provides identity metadata; update_stream_config provides feed-specific settings. |
+| Custom Fields | Repo-scoped custom fields (org settings) are separate from manifest fields. Custom fields are user-defined; manifest fields follow the moko-platform schema. |
+| moko-platform CLI | The CLI reads manifest settings via the API for version bumping, build decisions, and cross-repo syncing (see issue #505). |
+
+---
+
+| Revision | Date | Author | Description |
+|---|---|---|---|
+| 1.0 | 2026-06-06 | Jonathan Miller (@jmiller) | Initial version |