release: npm/mcp metadata + platform registry + update-server + packaging hook (dev -> main) [#367] #828

Merged

jmiller merged 10 commits from dev into main 2026-07-19 04:00:40 +00:00

Conversation 1 Commits 10 Files Changed 20

+967 -29

jmiller commented 2026-07-19 03:01:32 +00:00

Owner

Copy Link

Copy Source

Promotes the four EPIC #367 forge features from dev to main. All four merged to dev and the dev deploy built + deployed successfully (deploy-dev run 4705, Verify Dev instance passed) — so this set compiles and runs on the dev forge.

Bundles:

• #827 — persist npm/mcp metadata fields (RepoMetadata + apiMetadata + migration v373).
• #826 — platform registry ([metadata] PLATFORM_REGISTRY + GET /api/v1/platforms + updateserver registry helpers).
• #825 — update server: npm/mcp return N/A (not a Joomla feed) + platform derived from metadata.
• #814 — server-side release packaging hook (full-repo + entry_point-subtree zips + sha256 on release).

Merging this to main triggers a PRODUCTION forge deploy — review + confirm before merge. Run the migration (v373) as part of deploy.

Authored-by: Moko Consulting

Promotes the four EPIC #367 forge features from `dev` to `main`. All four merged to `dev` and the **dev deploy built + deployed successfully** (deploy-dev run 4705, Verify Dev instance passed) — so this set compiles and runs on the dev forge. Bundles: - **#827** — persist npm/mcp metadata fields (`RepoMetadata` + `apiMetadata` + migration v373). - **#826** — platform registry (`[metadata] PLATFORM_REGISTRY` + `GET /api/v1/platforms` + updateserver registry helpers). - **#825** — update server: npm/mcp return N/A (not a Joomla feed) + platform derived from metadata. - **#814** — server-side release packaging hook (full-repo + entry_point-subtree zips + sha256 on release). **Merging this to `main` triggers a PRODUCTION forge deploy** — review + confirm before merge. Run the migration (v373) as part of deploy. Authored-by: Moko Consulting

jmiller added 10 commits 2026-07-19 03:01:36 +00:00

feat(release): server-side packaging — attach full-repo + entry_point subtree zips on release [#809] ... 2280f02bec

Add GenerateReleaseArtifacts in services/release/packaging.go, invoked from
CreateRelease and the UpdateRelease publish path (drafts skipped). It streams a
full-repository zip (<repo>-<tag>.zip) and, when repo metadata declares a
non-root entry_point, an entry_point subtree zip (<repo>-<tag>-source.zip) via
gitrepo.CreateArchive through an io.Pipe into attachment_service.NewAttachment,
so archives are never buffered in memory. The helper is idempotent (existing
artifacts of the same name are replaced) and runs before GenerateReleaseChecksums
so each zip receives a .sha256 sidecar automatically.

Refs #809 #812 EPIC #367

Authored-by: Moko Consulting

fix(release): mark generated artifacts, serialize + reorder attach to prevent data loss [#809] ... 19d498f6c3

Address data-safety review of the server-side packaging hook:

- DATA LOSS (HIGH): tag generated zips with UploaderID = user_model.ActionsUserID
  (-2), a built-in bot sentinel that cannot collide with human uploads (which
  always use a positive doer ID). Only attachments carrying this marker are ever
  deleted, so a user-uploaded asset sharing a generated name is never destroyed.

- CONCURRENCY (HIGH): serialize the per-release delete+attach sequence with
  globallock.LockAndDo, keyed release_packaging_<id>, matching the forge's
  existing working-lock convention. Attachments are re-read inside the lock.

- DELETE-THEN-FAIL (LOW): reorder to attach-new-then-delete-old — the fresh
  archive is stored under the canonical name first and stale generated copies
  are removed only on success, so a failed regeneration never nets asset loss.

- FILENAME (LOW): sanitize the tag segment (replace path separators) so a tag
  like release/1.0 yields a clean asset name.

- ENTRY_POINT (LOW): normalizeEntryPoint trims a leading slash (git archive
  rejects absolute paths) and treats a now-empty result as root/skip.

- CHECKSUM re-hash cost (MEDIUM): documented as a follow-up at the checksum
  call sites in release.go.

The verified-correct io.Pipe streaming is unchanged.

Refs #809 #812 EPIC #367

Authored-by: Moko Consulting

Merge pull request 'chore: cascade main -> dev (.mokogitea -> .mokogit / MOKOGIT_TOKEN)' (#796) from main into dev e24e4db542

feat(updateserver): npm/mcp return N-A instead of Joomla feed; derive platform from metadata [#810 #811] ... 9a8d9bc504

#810: The update-feed handlers no longer fall back to a Joomla feed for
unset or feedless platforms. Every Serve* handler now gates positively on
its own platform constant, so npm/mcp (and any unrecognized platform)
return NotFound instead of an (empty) Joomla updates.xml. Added npm/mcp as
recognized platform constants and an IsFeedlessPlatform helper.

#811: The effective update-stream platform (RepoUpdatePlatform) is now
resolved via ResolvePlatform(cfgPlatform, metadataPlatform): an explicit
update-stream config platform wins; otherwise it derives from the repo
metadata platform (metadata.platform); only when neither is set does it
fall back to "joomla". This stops the update-stream store and the repo
metadata store from drifting and removes the "empty => joomla" fallback
at its root (services/context/repo_public_feed.go and repo.go).

No schema/migration required: UpdateStreamConfig.Platform is a plain string
column with no DB-level enum/CHECK constraint, so npm/mcp are enforced at
the application layer only.

Authored-by: Moko Consulting

feat(platform): structured platform registry + /api/v1/platforms; update server reads registry [#367] ... 38aa4de412

Turn the flat admin [metadata] PLATFORM_OPTIONS key list into a structured
platform registry where each key carries capability attributes (family,
artifact, update_generator, feed_format, template_repo, manifest_based,
publish_target, detect_globs, aliases), and expose it so CI / the update
server / mokocli can read platform behavior from config instead of hardcoding.

Storage: new [metadata] PLATFORM_REGISTRY key in app.ini — inline JSON array
or a path to a JSON file (e.g. custom/platforms.json), parsed in
modules/setting. No DB table (idiomatic: mirrors existing app.ini + file-path
config patterns; non-secret capability config only). Built-in DEFAULT registry
(joomla, dolibarr, go, npm, mcp, generic) keeps behavior unchanged when
unconfigured, and reconciles with PLATFORM_OPTIONS.

API: GET /api/v1/platforms (whole registry) and GET /api/v1/platforms/{key}
(one), wired into the public misc group.

Update server: additive registry-driven helpers in services/updateserver
(GeneratorForPlatform / FeedFormatForPlatform / ContentTypeForPlatform /
PlatformServesGenerator) that replace hardcoded per-platform generator/feed
decisions with registry lookups. Handler bodies left untouched to avoid
conflicting with PR #825 (feature/updateserver-npm-mcp), which is concurrently
rewiring routers/web/repo/updateserver.go and adding
models/updateserver/platform.go; helpers are drop-in for adoption once #825
lands.

Admin UI: read-only resolved-registry table added to Admin -> Metadata; the
textarea still edits the flat key list. Capabilities edited via config for now.

Does NOT touch models/repo/repo_manifest.go or the per-repo apiMetadata struct
(owned by a separate PR).

Authored-by: Moko Consulting

feat(metadata): persist npm/mcp fields (node_minimum, npm_package, npm_scope, registry_url, bin, publish_target) [#363] ... 5f85b278da

Add six npm/mcp metadata columns to the repo_manifest table and round-trip
them through the /metadata API (GET response, PUT apply, PUT response) so they
are no longer silently dropped by the fixed struct property set.

Authored-by: Moko Consulting

Merge pull request 'feat(metadata): persist npm/mcp fields [#363]' (#827) from feature/npm-metadata-schema into dev adee35573e

Merge pull request 'feat(platform): structured platform registry + /api/v1/platforms; update server reads registry [#367]' (#826) from feature/platform-registry into dev 74fc2d3101

Merge pull request 'feat(updateserver): npm/mcp return N-A instead of Joomla feed; derive platform from metadata [#810 #811]' (#825) from feature/updateserver-npm-mcp into dev 0efb0eb7bc

Merge pull request 'feat(release): server-side packaging — attach full-repo + entry_point subtree zips on release [#809]' (#814) from feature/release-packaging-hook into dev df67ff07b8

jmiller commented 2026-07-19 03:06:11 +00:00

Author

Owner

Copy Link

Copy Source

Wiki reminder: docs are wiki-first -- if this PR changes behavior, usage, config, or standards, please update the repo wiki before/after merge. (non-blocking)

<!-- wiki-reminder --> **Wiki reminder:** docs are wiki-first -- if this PR changes behavior, usage, config, or standards, please update the repo wiki before/after merge. _(non-blocking)_

jmiller merged commit ae5fbc74b3 into main 2026-07-19 04:00:40 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

breaking-change

Breaking API or behavior change

ci-cd

CI/CD pipeline changes

config

Configuration changes

dependencies

Dependency updates

deploy-failure

Deployment failed

docker

Docker/container changes

documentation

Documentation changes

feature: wiki

Wiki system enhancements

good first issue

Good for newcomers

health-check

Repo health check result

help wanted

Extra attention needed

mokostandards

Related to MokoStandards framework

push-failure

Git push operation failed

security

Security vulnerability or hardening

size/l

200-500 lines changed

size/m

50-200 lines changed

size/s

10-50 lines changed

size/xl

500+ lines changed

size/xs

< 10 lines changed

standards-drift

Deviates from MokoStandards

standards-update

MokoStandards compliance update

sync-failure

Sync or mirror failed

tech-debt

Technical debt and TODO/FIXME items

upstream

upstream

Inherited from upstream Gitea

work-in-progress

Draft or incomplete work

bug

Something is not working

duplicate

This issue or pull request already exists

enhancement

New feature

help wanted

Need some help

invalid

Something is wrong

question

More information is needed

wontfix

This won't be fixed

No labels

Priority -

Type -

Milestone

No items

No Milestone

Assignees

Clear assignees

jmiller (Jonathan Miller) moko-deploy (Moko Deploy Bot)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: MokoConsulting/MokoGIT#828