chore: sync auto-release.yml from Template-Go [skip ci]

fix(release): skip source archive generation for Joomla repos (#853)

Closes #853

.mokogit/workflows/auto-release.yml

@@ -7,7 +7,7 @@
 # INGROUP: MokoCLI.Release
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogit/workflows/auto-release.yml
-# VERSION: 05.01.02
+# VERSION: 05.02.00
 # BRIEF: Universal build & release � detects platform from metadata API
 #
 # +=======================================================================+
@@ -39,6 +39,12 @@ on:
       - '.gitattributes'
       - '.gitmessage'
       - 'LICENSE' 
+  # Daily safety-net: catch merges whose pull_request event never created a run
+  # (e.g. this workflow file being re-synced from the template concurrently with the
+  # merge). Off-round minute to avoid a fleet-wide spike. The safety-net job below
+  # only dispatches a release when main actually has unreleased changes.
+  schedule:
+    - cron: '37 8 * * *'
   workflow_dispatch:
     inputs:
       action:
@@ -505,3 +511,51 @@ jobs:
             echo "| Tag | \`${{ steps.version.outputs.tag }}\` |" >> $GITHUB_STEP_SUMMARY
             echo "| Release | [View](${MOKOGIT_URL}/${GIT_ORG}/${GIT_REPO}/releases/tag/${{ steps.version.outputs.tag }}) |" >> $GITHUB_STEP_SUMMARY
           fi
+
+  # ── Scheduled safety-net ─────────────────────────────────────────────────────────
+  # A merge to main normally fires the `release` job via the pull_request `closed`
+  # event. If that event never creates a run (observed when this workflow file is
+  # being re-synced from the template in the same window as the merge), the release
+  # is silently skipped. This daily job self-heals that: if main's CHANGELOG
+  # [Unreleased] section still has content — which the release job empties on a
+  # successful promote — it dispatches a normal release. Dependency-free (awk only)
+  # so it runs on any runner; never touches the release job's own conditions.
+  scheduled-safety-net:
+    name: Scheduled release safety-net
+    runs-on: ubuntu-latest
+    if: github.event_name == 'schedule' && !startsWith(github.event.repository.name, 'Template-')
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          ref: main
+          fetch-depth: 1
+
+      - name: Dispatch release if main has unreleased changes
+        env:
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+        run: |
+          # [Unreleased] is non-empty precisely when changes were merged but not yet
+          # released (the release job promotes it to a version and empties it).
+          NOTES=""
+          if [ -f CHANGELOG.md ]; then
+            NOTES=$(awk '/^## \[Unreleased\]/{f=1;next} /^## \[/{if(f)exit} f{print}' CHANGELOG.md)
+          fi
+          if [ -z "$(printf '%s' "$NOTES" | tr -d '[:space:]')" ]; then
+            echo "No unreleased changes on main — safety-net has nothing to do."
+            exit 0
+          fi
+          echo "Unreleased changes detected on main — a merge release was likely missed."
+          echo "Dispatching a release via the safety-net."
+          HTTP=$(curl -s -o /dev/null -w '%{http_code}' -X POST \
+            -H "Authorization: token ${MOKOGIT_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d '{"ref":"main","inputs":{"action":"release"}}' \
+            "${MOKOGIT_URL}/api/v1/repos/${{ github.repository }}/actions/workflows/auto-release.yml/dispatches")
+          if [ "$HTTP" = "204" ] || [ "$HTTP" = "201" ] || [ "$HTTP" = "200" ]; then
+            echo "Release dispatched (HTTP $HTTP)."
+          else
+            echo "::warning::Safety-net release dispatch failed (HTTP $HTTP)"
+          fi

deploy/git/dev/docker-compose.yml

@@ -13,18 +13,22 @@ services:
     environment:
       - USER_UID=${GIT_UID}
       - USER_GID=${GIT_GID}
-      - GITEA__server__DOMAIN=${GIT_DOMAIN}
-      - GITEA__server__ROOT_URL=${GIT_ROOT_URL}
-      - GITEA__server__SSH_DOMAIN=${GIT_SSH_DOMAIN}
-      - GITEA__server__SSH_PORT=${GIT_SSH_PUBLIC_PORT}
-      - GITEA__database__DB_TYPE=mysql
-      - GITEA__database__HOST=${GIT_DB_HOST}
-      - GITEA__database__NAME=${GIT_DB_NAME}
-      - GITEA__database__USER=${GIT_DB_USER}
-      - GITEA__database__PASSWD=${GIT_DB_PASSWD}
+      - MOKOGIT__server__DOMAIN=${GIT_DOMAIN}
+      - MOKOGIT__server__ROOT_URL=${GIT_ROOT_URL}
+      - MOKOGIT__server__SSH_DOMAIN=${GIT_SSH_DOMAIN}
+      - MOKOGIT__server__SSH_PORT=${GIT_SSH_PUBLIC_PORT}
+      - MOKOGIT__database__DB_TYPE=mysql
+      - MOKOGIT__database__HOST=${GIT_DB_HOST}
+      - MOKOGIT__database__NAME=${GIT_DB_NAME}
+      - MOKOGIT__database__USER=${GIT_DB_USER}
+      - MOKOGIT__database__PASSWD=${GIT_DB_PASSWD}
     volumes:
       # RECONCILE: live app.ini at ${GIT_DATA_DIR}/conf/app.ini (/opt/mokogit/dev/conf).
-      - "${GIT_DATA_DIR}:/data"
+      # Clean disconnect layout (#839): MOKOGIT_CUSTOM=/data/mokogit is baked into the image.
+      # Parent (/data/mokogit) listed before child (/data/mokogit/conf) so Docker attaches it first.
+      - "${GIT_DATA_DIR}:/var/lib/gitea"
+      - "${GIT_DATA_DIR}:/data/mokogit"
+      - "${GIT_DATA_DIR}/conf:/data/mokogit/conf"
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
     ports:

deploy/git/prod/docker-compose.yml

@@ -17,19 +17,23 @@ services:
     environment:
       - USER_UID=${GIT_UID}
       - USER_GID=${GIT_GID}
-      - GITEA__server__DOMAIN=${GIT_DOMAIN}
-      - GITEA__server__ROOT_URL=${GIT_ROOT_URL}
-      - GITEA__server__SSH_DOMAIN=${GIT_SSH_DOMAIN}
-      - GITEA__server__SSH_PORT=${GIT_SSH_PUBLIC_PORT}
+      - MOKOGIT__server__DOMAIN=${GIT_DOMAIN}
+      - MOKOGIT__server__ROOT_URL=${GIT_ROOT_URL}
+      - MOKOGIT__server__SSH_DOMAIN=${GIT_SSH_DOMAIN}
+      - MOKOGIT__server__SSH_PORT=${GIT_SSH_PUBLIC_PORT}
       # DB is HOST MySQL (RECONCILE host reachability: host-gateway / socket / LAN IP).
-      - GITEA__database__DB_TYPE=mysql
-      - GITEA__database__HOST=${GIT_DB_HOST}
-      - GITEA__database__NAME=${GIT_DB_NAME}
-      - GITEA__database__USER=${GIT_DB_USER}
-      - GITEA__database__PASSWD=${GIT_DB_PASSWD}
+      - MOKOGIT__database__DB_TYPE=mysql
+      - MOKOGIT__database__HOST=${GIT_DB_HOST}
+      - MOKOGIT__database__NAME=${GIT_DB_NAME}
+      - MOKOGIT__database__USER=${GIT_DB_USER}
+      - MOKOGIT__database__PASSWD=${GIT_DB_PASSWD}
     volumes:
       # RECONCILE: live app.ini is at ${GIT_DATA_DIR}/conf/app.ini (/opt/mokogit/prod/conf).
-      - "${GIT_DATA_DIR}:/data"
+      # Clean disconnect layout (#839): MOKOGIT_CUSTOM=/data/mokogit is baked into the image.
+      # Parent (/data/mokogit) listed before child (/data/mokogit/conf) so Docker attaches it first.
+      - "${GIT_DATA_DIR}:/var/lib/gitea"
+      - "${GIT_DATA_DIR}:/data/mokogit"
+      - "${GIT_DATA_DIR}/conf:/data/mokogit/conf"
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
     ports:

deploy/git/rc/docker-compose.yml

@@ -13,18 +13,22 @@ services:
     environment:
       - USER_UID=${GIT_UID}
       - USER_GID=${GIT_GID}
-      - GITEA__server__DOMAIN=${GIT_DOMAIN}
-      - GITEA__server__ROOT_URL=${GIT_ROOT_URL}
-      - GITEA__server__SSH_DOMAIN=${GIT_SSH_DOMAIN}
-      - GITEA__server__SSH_PORT=${GIT_SSH_PUBLIC_PORT}
-      - GITEA__database__DB_TYPE=mysql
-      - GITEA__database__HOST=${GIT_DB_HOST}
-      - GITEA__database__NAME=${GIT_DB_NAME}
-      - GITEA__database__USER=${GIT_DB_USER}
-      - GITEA__database__PASSWD=${GIT_DB_PASSWD}
+      - MOKOGIT__server__DOMAIN=${GIT_DOMAIN}
+      - MOKOGIT__server__ROOT_URL=${GIT_ROOT_URL}
+      - MOKOGIT__server__SSH_DOMAIN=${GIT_SSH_DOMAIN}
+      - MOKOGIT__server__SSH_PORT=${GIT_SSH_PUBLIC_PORT}
+      - MOKOGIT__database__DB_TYPE=mysql
+      - MOKOGIT__database__HOST=${GIT_DB_HOST}
+      - MOKOGIT__database__NAME=${GIT_DB_NAME}
+      - MOKOGIT__database__USER=${GIT_DB_USER}
+      - MOKOGIT__database__PASSWD=${GIT_DB_PASSWD}
     volumes:
       # RECONCILE: live app.ini at ${GIT_DATA_DIR}/conf/app.ini (/opt/mokogit/rc/conf).
-      - "${GIT_DATA_DIR}:/data"
+      # Clean disconnect layout (#839): MOKOGIT_CUSTOM=/data/mokogit is baked into the image.
+      # Parent (/data/mokogit) listed before child (/data/mokogit/conf) so Docker attaches it first.
+      - "${GIT_DATA_DIR}:/var/lib/gitea"
+      - "${GIT_DATA_DIR}:/data/mokogit"
+      - "${GIT_DATA_DIR}/conf:/data/mokogit/conf"
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
     ports:

services/release/packaging.go

@@ -200,6 +200,16 @@ func GenerateReleaseArtifacts(ctx context.Context, rel *repo_model.Release) erro
 	} else if meta != nil {
 		entryPoint = meta.EntryPoint
 	}
+
+	// Joomla repos are packaged by the CI pipeline (release_package.php),
+	// which uploads the correct installable zip/tar.gz. Server-generated
+	// source archives are redundant and confuse users about which file to
+	// download, so skip them entirely.
+	if meta != nil && strings.EqualFold(meta.Platform, "joomla") {
+		log.Info("GenerateReleaseArtifacts: skipping source archives for Joomla repo %d (CI pipeline packages)", rel.RepoID)
+		return nil
+	}
+
 	wantSource := !isRootEntryPoint(entryPoint)
 
 	// Serialize the delete+attach sequence per-release so concurrent

tests/integration/api_repo_metadata_test.go

@@ -0,0 +1,63 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package integration
+
+import (
+	"net/http"
+	"net/url"
+	"testing"
+
+	auth_model "code.mokoconsulting.tech/MokoConsulting/MokoGIT/models/auth"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// apiMetadataResponse mirrors the subset of the repo manifest/metadata API
+// payload exercised by this test. The handler struct (routers/api/v1/repo)
+// is unexported, so the fields are re-declared here by their JSON tags.
+type apiMetadataResponse struct {
+	Name          string `json:"name"`
+	NodeMinimum   string `json:"node_minimum"`
+	NpmPackage    string `json:"npm_package"`
+	PublishTarget string `json:"publish_target"`
+}
+
+// TestAPIRepoMetadataNpmFieldsRoundTrip guards against regression of issue #847
+// (from #827): the npm/mcp fields node_minimum, npm_package and publish_target
+// must be persisted via PUT and returned via GET on the metadata endpoint,
+// rather than being silently dropped by the apiMetadata struct.
+func TestAPIRepoMetadataNpmFieldsRoundTrip(t *testing.T) {
+	onGiteaRun(t, func(t *testing.T, u *url.URL) {
+		// user1 is the site admin in the fixtures; the PUT route requires admin.
+		session := loginUser(t, "user1")
+		token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteRepository)
+
+		const owner, repo = "user2", "repo1"
+
+		// PUT the three npm/mcp fields.
+		req := NewRequestWithJSON(t, "PUT", "/api/v1/repos/"+owner+"/"+repo+"/metadata", map[string]string{
+			"node_minimum":   "18",
+			"npm_package":    "@moko/foo",
+			"publish_target": "npm",
+		}).AddTokenAuth(token)
+		resp := session.MakeRequest(t, req, http.StatusOK)
+
+		// The PUT response should echo the persisted fields.
+		var put apiMetadataResponse
+		DecodeJSON(t, resp, &put)
+		assert.Equal(t, "18", put.NodeMinimum)
+		assert.Equal(t, "@moko/foo", put.NpmPackage)
+		assert.Equal(t, "npm", put.PublishTarget)
+
+		// A subsequent GET should read the same values back from the DB.
+		req = NewRequest(t, "GET", "/api/v1/repos/"+owner+"/"+repo+"/metadata").AddTokenAuth(token)
+		resp = session.MakeRequest(t, req, http.StatusOK)
+
+		var got apiMetadataResponse
+		DecodeJSON(t, resp, &got)
+		assert.Equal(t, "18", got.NodeMinimum)
+		assert.Equal(t, "@moko/foo", got.NpmPackage)
+		assert.Equal(t, "npm", got.PublishTarget)
+	})
+}