chore: sync deploy-rc.yml from Template-Go [skip ci]

The repo metadata 'platform' field was a hardcoded enum; changing the
taxonomy meant a code change + redeploy. Make it admin-configurable:

- modules/setting/metadata.go: new [metadata] PLATFORM_OPTIONS setting
  (default joomla,dolibarr,go,npm,generic), loaded in loadCommonSettingsFrom
- routers/web/admin/metadata.go + templates/admin/metadata.tmpl: new
  Admin -> Metadata page to edit the list (persisted to app.ini), with a
  nav entry and route
- routers/web/repo/setting/metadata.go + template: platform dropdown now
  reads from the setting; a repo's current value stays selectable even if
  removed from the list (no silent drop)

Closes #777

.mokogitea/workflows/auto-bump.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Release
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /.mokogitea/workflows/auto-bump.yml

.mokogitea/workflows/auto-release.yml

@@ -3,11 +3,11 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Release
 # REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
 # PATH: /templates/workflows/universal/auto-release.yml.template
-# VERSION: 05.01.00
+# VERSION: 05.00.00
 # BRIEF: Universal build & release � detects platform from manifest.xml
 #
 # +=======================================================================+
@@ -64,14 +64,10 @@ jobs:
   promote-rc:
     name: Promote to RC
     runs-on: release
-    # Skip on template repos (Template-*) — they scaffold other repos and do not release.
     if: >-
-      !startsWith(github.event.repository.name, 'Template-') &&
-      (
-        (github.event.action == 'opened' && github.event.pull_request.merged != true) ||
-        (github.event.action == 'synchronize' && github.event.pull_request.merged != true) ||
-        (github.event_name == 'workflow_dispatch' && inputs.action == 'promote-rc')
-      )
+      (github.event.action == 'opened' && github.event.pull_request.merged != true) ||
+      (github.event.action == 'synchronize' && github.event.pull_request.merged != true) ||
+      (github.event_name == 'workflow_dispatch' && inputs.action == 'promote-rc')
 
     steps:
       - name: Checkout repository
@@ -79,7 +75,6 @@ jobs:
         with:
           token: ${{ secrets.MOKOGITEA_TOKEN }}
           fetch-depth: 1
-          submodules: recursive
 
       - name: Setup mokocli tools
         env:
@@ -95,7 +90,7 @@ jobs:
               sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
             fi
             rm -rf /tmp/mokocli
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoCLI.git
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
             git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
             cd /tmp/mokocli
             composer install --no-dev --no-interaction --quiet
@@ -115,44 +110,54 @@ jobs:
           SRC_SHA=$(printf '%s' "$SRC_JSON" | python3 -c "import sys, json; print(json.load(sys.stdin)['commit']['id'])" 2>/dev/null || true)
           [ -n "$SRC_SHA" ] || { echo "::error::Could not resolve HEAD of ${FROM}"; exit 1; }
 
-          # Point rc at the source commit. If rc already exists (a protected branch that
-          # cannot be deleted), force-update its ref in place instead of delete+recreate:
-          # deleting a protected branch fails, which then makes the recreate return HTTP 409.
-          if curl -sf -o /dev/null -H "$AUTH" "${API_BASE}/branches/rc"; then
-            echo "rc exists - force-updating to ${FROM} (${SRC_SHA})"
-            curl -sf -X PATCH -H "$AUTH" -H "Content-Type: application/json" \
-              "${API_BASE}/git/refs/heads/rc" -d "{\"sha\":\"${SRC_SHA}\",\"force\":true}" \
-              || { echo "::error::Failed to force-update rc (CI token needs force-push on the protected rc branch)"; exit 1; }
-          else
-            echo "Creating rc from ${FROM}"
-            curl -sf -X POST -H "$AUTH" -H "Content-Type: application/json" \
-              "${API_BASE}/branches" -d "{\"new_branch_name\":\"rc\",\"old_branch_name\":\"${FROM}\"}" \
-              || { echo "::error::Failed to create rc from ${FROM}"; exit 1; }
-          fi
+          # Point rc at the source commit via git push. Gitea's git/refs PATCH API
+          # returns HTTP 405 on ANY protected branch (force or not, even for a user in
+          # the force-push allowlist), so it cannot move a protected rc. git push honors
+          # the push + force-push allowlists and creates rc if it is absent.
+          PUSH_URL="https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@${MOKOGITEA_URL#https://}/${GITEA_ORG}/${GITEA_REPO}.git"
+          git config --global user.name "mokogitea-actions[bot]"
+          git config --global user.email "actions@mokoconsulting.tech"
+          git fetch --no-tags "$PUSH_URL" "${FROM}"
+          git push --force "$PUSH_URL" "FETCH_HEAD:refs/heads/rc" \
+            || { echo "::error::Failed to point rc at ${FROM} (${SRC_SHA}) via git push"; exit 1; }
+          echo "rc set to ${FROM} (${SRC_SHA})"
 
           # Repoint the PR at rc, then delete the old source branch (non-fatal).
           if [ -n "$PR" ]; then
             curl -s -X PATCH -H "$AUTH" -H "Content-Type: application/json" \
               "${API_BASE}/pulls/${PR}" -d '{"head":"rc"}' >/dev/null || true
           fi
-          curl -s -X DELETE -H "$AUTH" "${API_BASE}/branches/${FROM}" >/dev/null || true
+          # Never delete permanent branches (dev/main/rc/...); only ephemeral feature branches.
+          case "$FROM" in
+            dev|main|master|rc|stable|production|release|develop|staging|beta|alpha)
+              echo "Keeping permanent branch ${FROM} (not deleting)" ;;
+            *)
+              curl -s -X DELETE -H "$AUTH" "${API_BASE}/branches/${FROM}" >/dev/null || true ;;
+          esac
           echo "Renamed ${FROM} -> rc"
 
+      - name: Trigger RC deploy
+        run: |
+          # Workflow-token pushes do NOT wake downstream workflows; dispatch deploy-rc explicitly.
+          curl -sf -X POST -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \n            -H "Content-Type: application/json" \n            "${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}/actions/workflows/deploy-rc.yml/dispatches" \n            -d '{"ref":"rc"}' \n            && echo "Dispatched deploy-rc on rc" \n            || echo "::warning::deploy-rc dispatch failed (no deploy-rc.yml on rc?)"
+
       - name: Checkout rc and configure git
         run: |
           git fetch origin rc
           git checkout rc
-          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "gitea-actions[bot]"
+          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "mokogitea-actions[bot]"
           git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
 
       - name: Publish RC release
+        continue-on-error: true
         run: |
           php ${MOKO_CLI}/release_publish.php \
             --path . --stability rc --bump minor --branch rc \
             --token "${{ secrets.MOKOGITEA_TOKEN }}"
 
       - name: Update RC release notes from CHANGELOG.md
+        continue-on-error: true
         run: |
           API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
           TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
@@ -196,13 +201,9 @@ jobs:
   release:
     name: Build & Release Pipeline
     runs-on: release
-    # Skip on template repos (Template-*) — they scaffold other repos and do not release.
     if: >-
-      !startsWith(github.event.repository.name, 'Template-') &&
-      (
-        github.event.pull_request.merged == true ||
-        (github.event_name == 'workflow_dispatch' && inputs.action != 'promote-rc')
-      )
+      github.event.pull_request.merged == true ||
+      (github.event_name == 'workflow_dispatch' && inputs.action != 'promote-rc')
 
     steps:
       - name: Checkout repository
@@ -210,12 +211,11 @@ jobs:
         with:
           token: ${{ secrets.MOKOGITEA_TOKEN }}
           fetch-depth: 0
-          submodules: recursive
 
       - name: Configure git for bot pushes
         run: |
-          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "gitea-actions[bot]"
+          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "mokogitea-actions[bot]"
           git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
 
       - name: Check for merge conflict markers
@@ -246,7 +246,7 @@ jobs:
               sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
             fi
             rm -rf /tmp/mokocli
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoCLI.git
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
             git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
             cd /tmp/mokocli
             composer install --no-dev --no-interaction --quiet

.mokogitea/workflows/branch-cleanup.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: MokoStandards.Universal
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /.mokogitea/workflows/branch-cleanup.yml
@@ -33,8 +33,7 @@ jobs:
         run: |
           BRANCH="${{ github.event.pull_request.head.ref }}"
           API="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}/api/v1/repos/${{ github.repository }}/branches"
-          # URL-encode the branch name's slashes (no PHP dependency on the runner)
-          ENCODED=$(printf '%s' "${BRANCH}" | sed 's|/|%2F|g')
+          ENCODED=$(php -r "echo rawurlencode('${BRANCH}');")
 
           STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X DELETE \
             -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \

.mokogitea/workflows/ci-generic.yml

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: MokoStandards.CI
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/ci-generic.yml
+# PATH: /.gitea/workflows/ci-generic.yml
 # VERSION: 01.00.00
 # BRIEF: CI pipeline — lint, validate, and test for generic projects (PHP + Node.js)
 
@@ -32,8 +32,6 @@ jobs:
   lint:
     name: Lint & Validate
     runs-on: ubuntu-latest
-    # Skip on template repos (Template-*) — they hold placeholder scaffolding, not buildable source.
-    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}
 
     steps:
       - name: Checkout
@@ -132,9 +130,6 @@ jobs:
     name: Tests
     runs-on: ubuntu-latest
     needs: lint
-    # Run only when lint succeeded; always() forces evaluation so a skipped
-    # lint (e.g. template repos) skips this job cleanly instead of hanging.
-    if: ${{ always() && needs.lint.result == 'success' }}
 
     steps:
       - name: Checkout

.mokogitea/workflows/ci-issue-reporter.yml

@@ -3,12 +3,12 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Universal
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /.mokogitea/workflows/ci-issue-reporter.yml
 # VERSION: 01.00.00
-# BRIEF: Reusable workflow — creates/updates a Gitea issue when a CI gate fails.
+# BRIEF: Reusable workflow — creates/updates a MokoGitea issue when a CI gate fails.
 #        Clones MokoCLI and runs cli/ci_issue_reporter.sh.
 
 name: "Universal: CI Issue Reporter"

.mokogitea/workflows/cleanup.yml

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: MokoStandards.Maintenance
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
-# PATH: /.mokogitea/workflows/cleanup.yml
+# PATH: /.gitea/workflows/cleanup.yml
 # VERSION: 01.00.00
 # BRIEF: Scheduled cleanup — delete merged branches and old workflow runs
 
@@ -50,7 +50,7 @@ jobs:
           for BRANCH in $BRANCHES; do
             # Skip protected branches
             case "$BRANCH" in
-              main|master|dev|develop|rc|beta|alpha|release|release/*|production|stable|staging|hotfix/*|version/*) continue ;;
+              main|master|develop|release/*|hotfix/*) continue ;;
             esac
 
             # Check if branch is merged into main

.mokogitea/workflows/custom/deploy-dev.yml

@@ -1,109 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-# SPDX-License-Identifier: GPL-3.0-or-later
-# BRIEF: Build and deploy MokoGitea to dev environment on push to dev branch.
-#        Production deploy (deploy-mokogitea.yml) only succeeds if dev is healthy.
-
-name: Deploy MokoGitea (Dev)
-
-on:
-  push:
-    branches:
-      - dev
-
-concurrency:
-  group: deploy-mokogitea-dev
-  cancel-in-progress: true
-
-env:
-  REGISTRY: git.mokoconsulting.tech
-  IMAGE: mokoconsulting/mokogitea
-  DEPLOY_HOST: git.mokoconsulting.tech
-  DEPLOY_PORT: 2918
-  DEPLOY_USER: mokoconsulting
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-jobs:
-  deploy-dev:
-    name: "Build & Deploy to Dev"
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout source
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Determine version
-        id: config
-        run: |
-          VERSION=$(git describe --tags --always 2>/dev/null || echo "dev-$(git rev-parse --short HEAD)")
-          echo "tag=${VERSION}-dev" >> $GITHUB_OUTPUT
-          echo "Version: ${VERSION}-dev"
-
-      - name: Write deploy key
-        env:
-          DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
-        run: |
-          mkdir -p ~/.ssh
-          echo "$DEPLOY_KEY" > ~/.ssh/deploy_key
-          chmod 600 ~/.ssh/deploy_key
-
-      - name: Build and deploy to dev via SSH
-        env:
-          REGISTRY_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-          TAG: ${{ steps.config.outputs.tag }}
-        run: |
-          HEALTH_FMT='${{ '{{' }}.State.Health.Status${{ '}}' }}'
-
-          ssh -i ~/.ssh/deploy_key -p ${{ env.DEPLOY_PORT }} \
-            -o ConnectTimeout=30 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
-            -o ServerAliveInterval=30 -o ServerAliveCountMax=10 \
-            ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }} bash -s <<DEPLOY_EOF
-          set -e
-          echo 'SSH connected to dev environment'
-
-          echo 'Cleaning Docker build cache...'
-          docker builder prune -af 2>/dev/null || true
-          docker image prune -af 2>/dev/null || true
-
-          echo 'Pulling source...'
-          SOURCE_DIR=/opt/gitea-dev/source
-          if [ ! -d \$SOURCE_DIR/.git ]; then
-            git clone -b dev https://git.mokoconsulting.tech/MokoConsulting/MokoGitea-Fork.git \$SOURCE_DIR
-          fi
-          cd \$SOURCE_DIR
-          git remote set-url origin https://git.mokoconsulting.tech/MokoConsulting/MokoGitea-Fork.git 2>/dev/null || true
-          git fetch origin dev
-          git reset --hard origin/dev
-
-          echo 'Building Docker image...'
-          docker build --no-cache --build-arg GOFLAGS='-p 1' \
-            --tag ${{ env.REGISTRY }}/${{ env.IMAGE }}:\$TAG \
-            -f Dockerfile .
-
-          echo 'Pushing to registry...'
-          echo '\$REGISTRY_TOKEN' | docker login ${{ env.REGISTRY }} -u ${{ env.DEPLOY_USER }} --password-stdin
-          docker push ${{ env.REGISTRY }}/${{ env.IMAGE }}:\$TAG
-
-          echo 'Restarting dev container...'
-          cd /opt/gitea-dev
-          sed -i "s|${{ env.IMAGE }}:[^ ]*|${{ env.IMAGE }}:\$TAG|" docker-compose.yml
-          docker compose up -d mokogitea-dev
-
-          echo 'Health check...'
-          for i in 1 2 3 4 5 6 7 8; do
-            sleep 15
-            if docker inspect --format='\$HEALTH_FMT' mokogitea-dev 2>/dev/null | grep -q healthy; then
-              echo 'Dev container healthy!'
-              exit 0
-            fi
-            echo "Waiting... (attempt \$i/8)"
-          done
-          echo 'Health check failed'
-          docker logs mokogitea-dev --tail 20
-          exit 1
-          DEPLOY_EOF
-
-      - name: Verify dev instance
-        run: |
-          sleep 5
-          curl -sf https://git.dev.mokoconsulting.tech/api/healthz && echo " Dev API healthy"

.mokogitea/workflows/custom/deploy-mokogitea.yml

@@ -1,162 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-# SPDX-License-Identifier: GPL-3.0-or-later
-# BRIEF: Build MokoGitea Docker image, push to registry, and deploy
-
-name: Deploy MokoGitea
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Version tag'
-        required: true
-        default: 'latest'
-      environment:
-        description: 'Target environment'
-        required: true
-        default: 'dev'
-        type: choice
-        options:
-          - dev
-          - production
-
-concurrency:
-  group: deploy-mokogitea
-  cancel-in-progress: false
-
-env:
-  REGISTRY: git.mokoconsulting.tech
-  IMAGE: mokoconsulting/mokogitea
-  DEPLOY_HOST: git.mokoconsulting.tech
-  DEPLOY_PORT: 2918
-  DEPLOY_USER: mokoconsulting
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Verify dev environment is healthy
-        run: |
-          echo "Checking git.dev.mokoconsulting.tech health..."
-          if curl -sf --max-time 10 https://git.dev.mokoconsulting.tech/api/healthz; then
-            echo " Dev environment is healthy — proceeding with production deploy"
-          else
-            echo "::error::Dev environment is NOT healthy — blocking production deploy"
-            echo "Deploy to dev first (push to dev branch) and verify it passes before merging to main."
-            exit 1
-          fi
-
-      - name: Checkout source (for version detection)
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Determine settings
-        id: config
-        run: |
-          if [ "${{ github.event_name }}" = "push" ]; then
-            VERSION=$(git describe --tags --always 2>/dev/null || echo "dev-$(git rev-parse --short HEAD)")
-            ENV="production"
-          else
-            VERSION="${{ github.event.inputs.version }}"
-            ENV="${{ github.event.inputs.environment }}"
-          fi
-          if [ "$ENV" = "production" ]; then
-            echo "compose_dir=/opt/gitea" >> $GITHUB_OUTPUT
-            echo "container=mokogitea" >> $GITHUB_OUTPUT
-            echo "source_dir=/opt/gitea/source" >> $GITHUB_OUTPUT
-            echo "branch=main" >> $GITHUB_OUTPUT
-            echo "tag=$VERSION" >> $GITHUB_OUTPUT
-          else
-            echo "compose_dir=/opt/gitea-dev" >> $GITHUB_OUTPUT
-            echo "container=mokogitea-dev" >> $GITHUB_OUTPUT
-            echo "source_dir=/opt/gitea-dev/source" >> $GITHUB_OUTPUT
-            echo "branch=dev" >> $GITHUB_OUTPUT
-            echo "tag=$VERSION-dev" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Write deploy key
-        env:
-          DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
-        run: |
-          mkdir -p ~/.ssh
-          echo "$DEPLOY_KEY" > ~/.ssh/deploy_key
-          chmod 600 ~/.ssh/deploy_key
-
-      - name: Build and deploy via SSH
-        env:
-          REGISTRY_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-          TAG: ${{ steps.config.outputs.tag }}
-          BRANCH: ${{ steps.config.outputs.branch }}
-          SOURCE_DIR: ${{ steps.config.outputs.source_dir }}
-          COMPOSE_DIR: ${{ steps.config.outputs.compose_dir }}
-          CONTAINER: ${{ steps.config.outputs.container }}
-        run: |
-          HEALTH_FMT='${{ '{{' }}.State.Health.Status${{ '}}' }}'
-          IMAGE_FMT='Image: ${{ '{{' }}.Config.Image${{ '}}' }}'
-
-          ssh -i ~/.ssh/deploy_key -p ${{ env.DEPLOY_PORT }} \
-            -o ConnectTimeout=30 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
-            -o ServerAliveInterval=30 -o ServerAliveCountMax=10 \
-            ${{ env.DEPLOY_USER }}@${{ env.DEPLOY_HOST }} bash -s <<DEPLOY_EOF
-          set -e
-          echo 'SSH connected'
-
-          echo 'Cleaning Docker build cache...'
-          docker builder prune -af 2>/dev/null || true
-          docker image prune -af 2>/dev/null || true
-          free -m | head -3
-
-          echo 'Pulling source...'
-          if [ ! -d $SOURCE_DIR/.git ]; then
-            git clone -b $BRANCH https://git.mokoconsulting.tech/MokoConsulting/MokoGitea-Fork.git $SOURCE_DIR
-          fi
-          cd $SOURCE_DIR
-          # Ensure remote points to MokoGitea-Fork (not the upstream fork)
-          git remote set-url origin https://git.mokoconsulting.tech/MokoConsulting/MokoGitea-Fork.git 2>/dev/null || true
-          git fetch origin $BRANCH
-          git reset --hard origin/$BRANCH
-
-          echo 'Building Docker image...'
-          docker build --no-cache --build-arg GOFLAGS='-p 1' \
-            --tag ${{ env.REGISTRY }}/${{ env.IMAGE }}:$TAG \
-            --tag ${{ env.REGISTRY }}/${{ env.IMAGE }}:latest \
-            -f Dockerfile .
-
-          echo 'Pushing to registry...'
-          echo '$REGISTRY_TOKEN' | docker login ${{ env.REGISTRY }} -u ${{ env.DEPLOY_USER }} --password-stdin
-          docker push ${{ env.REGISTRY }}/${{ env.IMAGE }}:$TAG
-          docker push ${{ env.REGISTRY }}/${{ env.IMAGE }}:latest
-
-          echo 'Restarting container...'
-          cd $COMPOSE_DIR
-          sed -i 's|${{ env.IMAGE }}:[^ ]*|${{ env.IMAGE }}:$TAG|' docker-compose.yml
-          docker compose up -d $CONTAINER
-
-          echo 'Health check...'
-          for i in 1 2 3 4 5 6 7 8; do
-            sleep 15
-            if docker inspect --format='$HEALTH_FMT' $CONTAINER 2>/dev/null | grep -q healthy; then
-              echo 'Container healthy!'
-              docker inspect --format='$IMAGE_FMT' $CONTAINER
-              exit 0
-            fi
-            echo "Waiting... (attempt \$i/8)"
-          done
-          echo 'Health check failed'
-          docker logs $CONTAINER --tail 20
-          exit 1
-          DEPLOY_EOF
-
-      - name: Verify
-        run: |
-          sleep 5
-          curl -sf https://${{ env.DEPLOY_HOST }}/api/healthz && echo " API healthy"
-
-      - name: Notify on failure
-        if: failure()
-        run: echo "::error::Deploy failed for ${{ steps.config.outputs.tag }}"

.mokogitea/workflows/deploy-dev.yml

@@ -0,0 +1,136 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+# BRIEF: Build and deploy to the Dev environment on push to the dev branch.
+#        Portable across Go server repos: ALL deployment config comes from repo
+#        Actions variables (vars.*) and secrets (secrets.*), nothing hardcoded.
+#        The dev branch is the ongoing integration branch.
+# OWNER: Template-Go (canonical source; syncs to the root workflows dir). See Template-Go#3.
+#
+# Required repo VARIABLES (all tier-scoped so each environment is independent —
+# a repo may host its rc/dev/prod tiers on different machines):
+#   DEV_SSH_HOST, DEV_SSH_PORT, DEV_SSH_USERNAME - SSH deploy target for the dev tier
+#   DEV_REGISTRY, DEV_REGISTRY_USER, DEV_IMAGE   - container registry + login user + image
+#   DEV_CONTAINER                              - compose service/container to recreate
+#   DEV_COMPOSE_PROJECT                        - docker compose -p project name
+#   DEV_COMPOSE_DIR                            - dir containing docker-compose.yml on host
+#   DEV_SOURCE_DIR                             - build source checkout on host
+#   DEV_TAG_ENV                                - compose env-var name that pins the image tag
+#   DEV_HEALTH_URL                             - external URL to verify after deploy
+# Required SECRETS (already configured org-wide; reused, not re-set):
+#   DEPLOY_SSH_KEY       - deploy private key (repo/org secret)
+#   MOKOGITEA_TOKEN      - registry/API token (org secret)
+
+name: Deploy (Dev)
+
+on:
+  push:
+    branches:
+      - dev
+  # Manual trigger for isolated end-to-end tests.
+  # Runs on the ref it is dispatched from.
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-dev
+  cancel-in-progress: true
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  deploy-dev:
+    name: "Build & Deploy to Dev"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Determine version
+        id: config
+        run: |
+          VERSION=$(git describe --tags --always 2>/dev/null || echo "dev-$(git rev-parse --short HEAD)")
+          echo "tag=${VERSION}-dev" >> $GITHUB_OUTPUT
+          echo "Version: ${VERSION}-dev"
+
+      - name: Write deploy key
+        env:
+          DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$DEPLOY_KEY" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+
+      - name: Build and deploy to RC via SSH
+        env:
+          REGISTRY_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          TAG: ${{ steps.config.outputs.tag }}
+        run: |
+          # Runner-side values (TAG, REGISTRY_TOKEN) are injected into the remote shell
+          # via an env prefix; a *quoted* heredoc keeps every $var expanding once, on the
+          # remote. Repo variables (vars.*) are substituted inline by Actions before ssh.
+          ssh -i ~/.ssh/deploy_key -p ${{ vars.DEV_SSH_PORT }} \
+            -o ConnectTimeout=30 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+            -o ServerAliveInterval=30 -o ServerAliveCountMax=10 \
+            ${{ vars.DEV_SSH_USERNAME }}@${{ vars.DEV_SSH_HOST }} \
+            "TAG='$TAG' REGISTRY_TOKEN='$REGISTRY_TOKEN' bash -s" <<'DEPLOY_EOF'
+          set -e
+          echo 'SSH connected to Dev environment'
+
+          if [ -z "$TAG" ]; then
+            echo 'ERROR: TAG is empty; refusing to build an untagged image' >&2
+            exit 1
+          fi
+
+          HEALTH_FMT='{{.State.Health.Status}}'
+
+          echo 'Cleaning Docker build cache...'
+          docker builder prune -af 2>/dev/null || true
+          docker image prune -af 2>/dev/null || true
+
+          echo 'Pulling source...'
+          SOURCE_DIR='${{ vars.DEV_SOURCE_DIR }}'
+          if [ ! -d "$SOURCE_DIR/.git" ]; then
+            git clone -b dev https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git "$SOURCE_DIR"
+          fi
+          cd "$SOURCE_DIR"
+          git remote set-url origin https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git 2>/dev/null || true
+          git fetch origin dev
+          git reset --hard origin/dev
+
+          echo "Building image: ${{ vars.DEV_REGISTRY }}/${{ vars.DEV_IMAGE }}:$TAG"
+          docker build --no-cache --build-arg GOFLAGS='-p 1' \
+            --tag "${{ vars.DEV_REGISTRY }}/${{ vars.DEV_IMAGE }}:$TAG" \
+            -f Dockerfile .
+
+          echo 'Pushing to registry...'
+          echo "$REGISTRY_TOKEN" | docker login ${{ vars.DEV_REGISTRY }} -u ${{ vars.DEV_REGISTRY_USER }} --password-stdin
+          docker push "${{ vars.DEV_REGISTRY }}/${{ vars.DEV_IMAGE }}:$TAG"
+
+          echo 'Restarting Dev container...'
+          cd '${{ vars.DEV_COMPOSE_DIR }}'
+          # Drive the rc service image tag via its compose env-var (no sed on the shared
+          # file); remove any lingering fixed-name container first, then force-recreate.
+          docker rm -f '${{ vars.DEV_CONTAINER }}' 2>/dev/null || true
+          ${{ vars.DEV_TAG_ENV }}="$TAG" docker compose -p '${{ vars.DEV_COMPOSE_PROJECT }}' up -d --force-recreate '${{ vars.DEV_CONTAINER }}'
+
+          echo 'Health check...'
+          for i in 1 2 3 4 5 6 7 8; do
+            sleep 15
+            if docker inspect --format="$HEALTH_FMT" '${{ vars.DEV_CONTAINER }}' 2>/dev/null | grep -q healthy; then
+              echo 'Dev container healthy!'
+              exit 0
+            fi
+            echo "Waiting... (attempt $i/8)"
+          done
+          echo 'Health check failed'
+          docker logs '${{ vars.DEV_CONTAINER }}' --tail 20
+          exit 1
+          DEPLOY_EOF
+
+      - name: Verify Dev instance
+        continue-on-error: true
+        run: |
+          sleep 5
+          ssh -i ~/.ssh/deploy_key -p ${{ vars.DEV_SSH_PORT }} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ vars.DEV_SSH_USERNAME }}@${{ vars.DEV_SSH_HOST }} "curl -sf '${{ vars.DEV_HEALTH_URL }}'" && echo " Dev API healthy"

.mokogitea/workflows/deploy-prod.yml

@@ -0,0 +1,136 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+# BRIEF: Build and deploy to the Prod environment on push to the main branch.
+#        Portable across Go server repos: ALL deployment config comes from repo
+#        Actions variables (vars.*) and secrets (secrets.*), nothing hardcoded.
+#        Prod deploys on merge to main (dev -> rc -> main pipeline).
+# OWNER: Template-Go (canonical source; syncs to the root workflows dir). See Template-Go#3.
+#
+# Required repo VARIABLES (all tier-scoped so each environment is independent —
+# a repo may host its rc/dev/prod tiers on different machines):
+#   PROD_SSH_HOST, PROD_SSH_PORT, PROD_SSH_USERNAME - SSH deploy target for the prod tier
+#   PROD_REGISTRY, PROD_REGISTRY_USER, PROD_IMAGE   - container registry + login user + image
+#   PROD_CONTAINER                              - compose service/container to recreate
+#   PROD_COMPOSE_PROJECT                        - docker compose -p project name
+#   PROD_COMPOSE_DIR                            - dir containing docker-compose.yml on host
+#   PROD_SOURCE_DIR                             - build source checkout on host
+#   PROD_TAG_ENV                                - compose env-var name that pins the image tag
+#   PROD_HEALTH_URL                             - external URL to verify after deploy
+# Required SECRETS (already configured org-wide; reused, not re-set):
+#   DEPLOY_SSH_KEY       - deploy private key (repo/org secret)
+#   MOKOGITEA_TOKEN      - registry/API token (org secret)
+
+name: Deploy (Prod)
+
+on:
+  push:
+    branches:
+      - main
+  # Manual trigger for a prod re-deploy.
+  # Runs on the ref it is dispatched from (use main).
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-prod
+  cancel-in-progress: false
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  deploy-prod:
+    name: "Build & Deploy to Prod"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Determine version
+        id: config
+        run: |
+          VERSION=$(git describe --tags --always 2>/dev/null || echo "$(git rev-parse --short HEAD)")
+          echo "tag=${VERSION}" >> $GITHUB_OUTPUT
+          echo "Version: ${VERSION}"
+
+      - name: Write deploy key
+        env:
+          DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$DEPLOY_KEY" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+
+      - name: Build and deploy to RC via SSH
+        env:
+          REGISTRY_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          TAG: ${{ steps.config.outputs.tag }}
+        run: |
+          # Runner-side values (TAG, REGISTRY_TOKEN) are injected into the remote shell
+          # via an env prefix; a *quoted* heredoc keeps every $var expanding once, on the
+          # remote. Repo variables (vars.*) are substituted inline by Actions before ssh.
+          ssh -i ~/.ssh/deploy_key -p ${{ vars.PROD_SSH_PORT }} \
+            -o ConnectTimeout=30 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+            -o ServerAliveInterval=30 -o ServerAliveCountMax=10 \
+            ${{ vars.PROD_SSH_USERNAME }}@${{ vars.PROD_SSH_HOST }} \
+            "TAG='$TAG' REGISTRY_TOKEN='$REGISTRY_TOKEN' bash -s" <<'DEPLOY_EOF'
+          set -e
+          echo 'SSH connected to Prod environment'
+
+          if [ -z "$TAG" ]; then
+            echo 'ERROR: TAG is empty; refusing to build an untagged image' >&2
+            exit 1
+          fi
+
+          HEALTH_FMT='{{.State.Health.Status}}'
+
+          echo 'Cleaning Docker build cache...'
+          docker builder prune -af 2>/dev/null || true
+          docker image prune -af 2>/dev/null || true
+
+          echo 'Pulling source...'
+          SOURCE_DIR='${{ vars.PROD_SOURCE_DIR }}'
+          if [ ! -d "$SOURCE_DIR/.git" ]; then
+            git clone -b main https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git "$SOURCE_DIR"
+          fi
+          cd "$SOURCE_DIR"
+          git remote set-url origin https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git 2>/dev/null || true
+          git fetch origin main
+          git reset --hard origin/main
+
+          echo "Building image: ${{ vars.PROD_REGISTRY }}/${{ vars.PROD_IMAGE }}:$TAG"
+          docker build --no-cache --build-arg GOFLAGS='-p 1' \
+            --tag "${{ vars.PROD_REGISTRY }}/${{ vars.PROD_IMAGE }}:$TAG" \
+            -f Dockerfile .
+
+          echo 'Pushing to registry...'
+          echo "$REGISTRY_TOKEN" | docker login ${{ vars.PROD_REGISTRY }} -u ${{ vars.PROD_REGISTRY_USER }} --password-stdin
+          docker push "${{ vars.PROD_REGISTRY }}/${{ vars.PROD_IMAGE }}:$TAG"
+
+          echo 'Restarting Prod container...'
+          cd '${{ vars.PROD_COMPOSE_DIR }}'
+          # Drive the rc service image tag via its compose env-var (no sed on the shared
+          # file); remove any lingering fixed-name container first, then force-recreate.
+          docker rm -f '${{ vars.PROD_CONTAINER }}' 2>/dev/null || true
+          ${{ vars.PROD_TAG_ENV }}="$TAG" docker compose -p '${{ vars.PROD_COMPOSE_PROJECT }}' up -d --force-recreate '${{ vars.PROD_CONTAINER }}'
+
+          echo 'Health check...'
+          for i in 1 2 3 4 5 6 7 8; do
+            sleep 15
+            if docker inspect --format="$HEALTH_FMT" '${{ vars.PROD_CONTAINER }}' 2>/dev/null | grep -q healthy; then
+              echo 'Prod container healthy!'
+              exit 0
+            fi
+            echo "Waiting... (attempt $i/8)"
+          done
+          echo 'Health check failed'
+          docker logs '${{ vars.PROD_CONTAINER }}' --tail 20
+          exit 1
+          DEPLOY_EOF
+
+      - name: Verify Prod instance
+        continue-on-error: true
+        run: |
+          sleep 5
+          ssh -i ~/.ssh/deploy_key -p ${{ vars.PROD_SSH_PORT }} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ vars.PROD_SSH_USERNAME }}@${{ vars.PROD_SSH_HOST }} "curl -sf '${{ vars.PROD_HEALTH_URL }}'" && echo " Prod API healthy"

.mokogitea/workflows/deploy-rc.yml

@@ -0,0 +1,138 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+# BRIEF: Build and deploy to the RC environment on push to the rc branch.
+#        Portable across Go server repos: ALL deployment config comes from repo
+#        Actions variables (vars.*) and secrets (secrets.*), nothing hardcoded.
+#        The rc branch is created by promote-rc when a PR to main opens.
+# OWNER: Template-Go (canonical source; syncs to the root workflows dir). See Template-Go#3.
+#
+# Required repo VARIABLES (all tier-scoped so each environment is independent —
+# a repo may host its rc/dev/prod tiers on different machines):
+#   RC_SSH_HOST, RC_SSH_PORT, RC_SSH_USERNAME - SSH deploy target for the rc tier
+#   RC_REGISTRY, RC_REGISTRY_USER, RC_IMAGE   - container registry + login user + image
+#   RC_CONTAINER                              - compose service/container to recreate
+#   RC_COMPOSE_PROJECT                        - docker compose -p project name
+#   RC_COMPOSE_DIR                            - dir containing docker-compose.yml on host
+#   RC_SOURCE_DIR                             - build source checkout on host
+#   RC_TAG_ENV                                - compose env-var name that pins the image tag
+#   RC_HEALTH_URL                             - external URL to verify after deploy
+# Required SECRETS (already configured org-wide; reused, not re-set):
+#   DEPLOY_SSH_KEY       - deploy private key (repo/org secret)
+#   MOKOGITEA_TOKEN      - registry/API token (org secret)
+
+name: Deploy (RC)
+
+on:
+  push:
+    branches:
+      - rc
+  # Manual trigger for isolated end-to-end tests without a full RC promotion.
+  # Runs on the ref it is dispatched from; that ref must carry current source
+  # (>= the RC database migration version) or the rebuilt image will refuse the
+  # newer DB. Dispatch from `rc` once `rc` is current.
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-rc
+  cancel-in-progress: true
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  deploy-rc:
+    name: "Build & Deploy to RC"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Determine version
+        id: config
+        run: |
+          VERSION=$(git describe --tags --always 2>/dev/null || echo "rc-$(git rev-parse --short HEAD)")
+          echo "tag=${VERSION}-rc" >> $GITHUB_OUTPUT
+          echo "Version: ${VERSION}-rc"
+
+      - name: Write deploy key
+        env:
+          DEPLOY_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          echo "$DEPLOY_KEY" > ~/.ssh/deploy_key
+          chmod 600 ~/.ssh/deploy_key
+
+      - name: Build and deploy to RC via SSH
+        env:
+          REGISTRY_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          TAG: ${{ steps.config.outputs.tag }}
+        run: |
+          # Runner-side values (TAG, REGISTRY_TOKEN) are injected into the remote shell
+          # via an env prefix; a *quoted* heredoc keeps every $var expanding once, on the
+          # remote. Repo variables (vars.*) are substituted inline by Actions before ssh.
+          ssh -i ~/.ssh/deploy_key -p ${{ vars.RC_SSH_PORT }} \
+            -o ConnectTimeout=30 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
+            -o ServerAliveInterval=30 -o ServerAliveCountMax=10 \
+            ${{ vars.RC_SSH_USERNAME }}@${{ vars.RC_SSH_HOST }} \
+            "TAG='$TAG' REGISTRY_TOKEN='$REGISTRY_TOKEN' bash -s" <<'DEPLOY_EOF'
+          set -e
+          echo 'SSH connected to RC environment'
+
+          if [ -z "$TAG" ]; then
+            echo 'ERROR: TAG is empty; refusing to build an untagged image' >&2
+            exit 1
+          fi
+
+          HEALTH_FMT='{{.State.Health.Status}}'
+
+          echo 'Cleaning Docker build cache...'
+          docker builder prune -af 2>/dev/null || true
+          docker image prune -af 2>/dev/null || true
+
+          echo 'Pulling source...'
+          SOURCE_DIR='${{ vars.RC_SOURCE_DIR }}'
+          if [ ! -d "$SOURCE_DIR/.git" ]; then
+            git clone -b rc https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git "$SOURCE_DIR"
+          fi
+          cd "$SOURCE_DIR"
+          git remote set-url origin https://x-access-token:${REGISTRY_TOKEN}@git.mokoconsulting.tech/${{ github.repository }}.git 2>/dev/null || true
+          git fetch origin rc
+          git reset --hard origin/rc
+
+          echo "Building image: ${{ vars.RC_REGISTRY }}/${{ vars.RC_IMAGE }}:$TAG"
+          docker build --no-cache --build-arg GOFLAGS='-p 1' \
+            --tag "${{ vars.RC_REGISTRY }}/${{ vars.RC_IMAGE }}:$TAG" \
+            -f Dockerfile .
+
+          echo 'Pushing to registry...'
+          echo "$REGISTRY_TOKEN" | docker login ${{ vars.RC_REGISTRY }} -u ${{ vars.RC_REGISTRY_USER }} --password-stdin
+          docker push "${{ vars.RC_REGISTRY }}/${{ vars.RC_IMAGE }}:$TAG"
+
+          echo 'Restarting RC container...'
+          cd '${{ vars.RC_COMPOSE_DIR }}'
+          # Drive the rc service image tag via its compose env-var (no sed on the shared
+          # file); remove any lingering fixed-name container first, then force-recreate.
+          docker rm -f '${{ vars.RC_CONTAINER }}' 2>/dev/null || true
+          ${{ vars.RC_TAG_ENV }}="$TAG" docker compose -p '${{ vars.RC_COMPOSE_PROJECT }}' up -d --force-recreate '${{ vars.RC_CONTAINER }}'
+
+          echo 'Health check...'
+          for i in 1 2 3 4 5 6 7 8; do
+            sleep 15
+            if docker inspect --format="$HEALTH_FMT" '${{ vars.RC_CONTAINER }}' 2>/dev/null | grep -q healthy; then
+              echo 'RC container healthy!'
+              exit 0
+            fi
+            echo "Waiting... (attempt $i/8)"
+          done
+          echo 'Health check failed'
+          docker logs '${{ vars.RC_CONTAINER }}' --tail 20
+          exit 1
+          DEPLOY_EOF
+
+      - name: Verify RC instance
+        continue-on-error: true
+        run: |
+          sleep 5
+          ssh -i ~/.ssh/deploy_key -p ${{ vars.RC_SSH_PORT }} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null ${{ vars.RC_SSH_USERNAME }}@${{ vars.RC_SSH_HOST }} "curl -sf '${{ vars.RC_HEALTH_URL }}'" && echo " RC API healthy"

.mokogitea/workflows/gitleaks.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: MokoStandards.Security
 # REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/MokoStandards-API
 # PATH: /templates/workflows/gitleaks.yml.template

.mokogitea/workflows/issue-branch.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Automation
 # VERSION: 01.00.00
 # BRIEF: Auto-create feature branch when an issue is opened

.mokogitea/workflows/notify.yml

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: MokoStandards.Notifications
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
-# PATH: /.mokogitea/workflows/notify.yml
+# PATH: /.gitea/workflows/notify.yml
 # VERSION: 01.00.00
 # BRIEF: Push notifications via ntfy on release success or workflow failure
 
@@ -15,9 +15,9 @@ name: "Universal: Notifications"
 on:
   workflow_run:
     workflows:
-      - "Universal: Build & Release"
-      - "Joomla: Extension CI"
-      - "Generic: Project CI"
+      - "Joomla Build & Release"
+      - "Joomla Extension CI"
+      - "Deploy"
     types:
       - completed
 

.mokogitea/workflows/pr-check.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.CI
 # REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
 # PATH: /templates/workflows/universal/pr-check.yml.template
@@ -47,15 +47,15 @@ jobs:
               fi
               ;;
             fix/*|bugfix/*)
-              if [ "$BASE" != "dev" ] && [ "$BASE" != "main" ]; then
+              if [ "$BASE" != "dev" ]; then
                 ALLOWED=false
-                REASON="Fix branches must target 'dev' or 'main', not '${BASE}'"
+                REASON="Fix branches must target 'dev', not '${BASE}'"
               fi
               ;;
             patch/*)
-              if [ "$BASE" != "dev" ] && [ "$BASE" != "rc" ] && [ "$BASE" != "main" ]; then
+              if [ "$BASE" != "dev" ] && [ "$BASE" != "rc" ]; then
                 ALLOWED=false
-                REASON="Patch branches must target 'dev', 'rc', or 'main', not '${BASE}'"
+                REASON="Patch branches must target 'dev' or 'rc', not '${BASE}'"
               fi
               ;;
             hotfix/*)
@@ -86,8 +86,7 @@ jobs:
             echo "" >> $GITHUB_STEP_SUMMARY
             echo "### Allowed merge paths:" >> $GITHUB_STEP_SUMMARY
             echo "- \`feature/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
-            echo "- \`fix/*\` → \`dev\` or \`main\`" >> $GITHUB_STEP_SUMMARY
-            echo "- \`patch/*\` → \`dev\`, \`rc\`, or \`main\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`fix/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
             echo "- \`hotfix/*\` → \`dev\` or \`main\`" >> $GITHUB_STEP_SUMMARY
             echo "- \`dev\` → \`main\`" >> $GITHUB_STEP_SUMMARY
             echo "- \`rc/*\` → \`main\`" >> $GITHUB_STEP_SUMMARY
@@ -127,8 +126,6 @@ jobs:
   validate:
     name: Validate PR
     runs-on: ubuntu-latest
-    # Skip on template repos (Template-*) — no real manifest/source/changelog to validate.
-    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}
 
     steps:
       - name: Checkout
@@ -150,7 +147,7 @@ jobs:
       - name: Detect platform
         id: platform
         run: |
-          # Platform comes from the MokoGitea metadata API (public GET); manifest.xml is no longer used.
+          # Platform comes from the MokoGitea metadata API (public GET).
           API="${GITHUB_SERVER_URL:-https://git.mokoconsulting.tech}/api/v1/repos/${GITHUB_REPOSITORY}/metadata"
           PLATFORM="$(curl -sf "$API" 2>/dev/null | python3 -c "import sys, json; print(json.load(sys.stdin).get('platform') or '')" 2>/dev/null || true)"
           [ -z "$PLATFORM" ] && PLATFORM="generic"
@@ -289,7 +286,7 @@ jobs:
               # Block legacy raw/branch update server URLs on MokoGitea
               RAW_URLS=$(grep -n 'raw/branch' "$MANIFEST" | grep -i 'mokoconsulting\|mokogitea\|git\.mokoconsulting\.tech' || true)
               if [ -n "$RAW_URLS" ]; then
-                echo "::error::Manifest contains legacy raw/branch update server URL on MokoGitea. Use the Gitea Pages URL instead (e.g. /{REPO}/updates.xml not /{REPO}/raw/branch/main/updates.xml)"
+                echo "::error::Manifest contains legacy raw/branch update server URL on MokoGitea. Use the MokoGitea Pages URL instead (e.g. /{REPO}/updates.xml not /{REPO}/raw/branch/main/updates.xml)"
                 echo "$RAW_URLS"
                 exit 1
               fi
@@ -496,9 +493,6 @@ jobs:
     name: Build RC Package
     runs-on: ubuntu-latest
     needs: [branch-policy, validate]
-    # Run only when both gates succeeded; always() forces evaluation so a skipped
-    # validate (e.g. template repos) skips this job cleanly instead of hanging.
-    if: ${{ always() && needs.branch-policy.result == 'success' && needs.validate.result == 'success' }}
 
     steps:
       - name: Trigger RC pre-release

.mokogitea/workflows/pre-release.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Release
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /templates/workflows/universal/pre-release.yml.template
@@ -48,13 +48,9 @@ jobs:
   build:
     name: "Build Pre-Release (${{ inputs.stability || github.ref_name }})"
     runs-on: release
-    # Skip on template repos (Template-*) — they scaffold other repos and do not release.
     if: >-
-      !startsWith(github.event.repository.name, 'Template-') &&
-      (
-        github.event_name == 'workflow_dispatch' ||
-        github.event_name == 'push'
-      )
+      github.event_name == 'workflow_dispatch' ||
+      github.event_name == 'push'
 
     steps:
       - name: Checkout
@@ -156,8 +152,8 @@ jobs:
           fi
 
           # Commit version bump
-          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "gitea-actions[bot]"
+          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "mokogitea-actions[bot]"
           git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
           git add -A
           git diff --cached --quiet || {

.mokogitea/workflows/rc-revert.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Universal
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
 # PATH: /.mokogitea/workflows/rc-revert.yml

.mokogitea/workflows/repo-health.yml

@@ -6,7 +6,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Validation
 # REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
 # PATH: /templates/workflows/joomla/repo_health.yml.template
@@ -88,7 +88,7 @@ jobs:
 
           # Hardcoded authorized users — always allowed
           case "$ACTOR" in
-            jmiller|gitea-actions[bot])
+            jmiller|mokogitea-actions[bot])
               ALLOWED=true
               PERMISSION=admin
               METHOD="hardcoded allowlist"

.mokogitea/workflows/sync-on-merge.yml

@@ -1,31 +0,0 @@
-name: Sync Workflows to Repos
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - '.mokogitea/workflows/**'
-
-jobs:
-  sync:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout mokocli
-        uses: actions/checkout@v4
-        with:
-          repository: MokoConsulting/mokocli
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
-
-      - name: Setup PHP
-        uses: https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/raw/branch/main/actions/setup-php@v1
-        with:
-          php-version: '8.1'
-
-      - name: Install dependencies
-        run: composer install --no-dev --no-interaction
-
-      - name: Sync workflows to generic repos
-        run: php automation/bulk_sync.php --platform generic --org MokoConsulting --workflows-only --auto-merge --token "${{ secrets.MOKOGITEA_TOKEN }}"
-        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}

.mokogitea/workflows/version-set.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow.Template
+# DEFGROUP: MokoGitea.Workflow.Template
 # INGROUP: MokoStandards.CI
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Joomla
 # PATH: /.mokogitea/workflows/version-set.yml

.mokogitea/workflows/workflow-sync-trigger.yml

@@ -1,81 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
-# INGROUP: mokocli.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
-# PATH: /.mokogitea/workflows/workflow-sync-trigger.yml
-# VERSION: 01.01.00
-# BRIEF: Trigger workflow sync to live repos when a PR is merged to main
-
-name: "Universal: Workflow Sync Trigger"
-
-on:
-  workflow_dispatch:
-  pull_request:
-    types: [closed]
-    branches:
-      - main
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-jobs:
-  sync:
-    name: Sync workflows to live repos
-    runs-on: ubuntu-latest
-    if: >-
-      github.event_name == 'workflow_dispatch' ||
-      (github.event.pull_request.merged == true &&
-      !contains(github.event.pull_request.title, '[skip sync]'))
-
-    steps:
-      - name: Determine platform from repo name
-        id: platform
-        run: |
-          REPO="${{ github.event.repository.name }}"
-          case "$REPO" in
-            Template-Joomla)   PLATFORM="joomla" ;;
-            Template-Dolibarr) PLATFORM="dolibarr" ;;
-            Template-Go)       PLATFORM="go" ;;
-            Template-MCP)      PLATFORM="mcp" ;;
-            Template-Generic)  PLATFORM="" ;;
-            *)                 PLATFORM="" ;;
-          esac
-          echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
-          echo "Platform: ${PLATFORM:-all}"
-
-      - name: Clone mokocli
-        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-        run: |
-          MOKOGITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
-          git clone --depth 1 "${MOKOGITEA_URL}/MokoConsulting/mokocli.git" /tmp/mokocli
-
-      - name: Install PHP
-        run: |
-          if ! command -v php &> /dev/null; then
-            apt-get update -qq && apt-get install -y -qq php-cli php-json php-curl > /dev/null 2>&1
-          fi
-
-      - name: Install dependencies
-        run: |
-          cd /tmp/mokocli
-          composer install --no-dev --no-interaction --quiet 2>/dev/null || true
-
-      - name: Run workflow sync
-        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-        run: |
-          ARGS="--token ${MOKOGITEA_TOKEN}"
-          ARGS="${ARGS} --org ${{ vars.GITEA_ORG || github.repository_owner }}"
-          ARGS="${ARGS} --phase repos"
-
-          PLATFORM="${{ steps.platform.outputs.platform }}"
-          if [ -n "$PLATFORM" ]; then
-            ARGS="${ARGS} --platform-filter ${PLATFORM}"
-          fi
-
-          php /tmp/mokocli/cli/workflow_sync.php ${ARGS}

CHANGELOG.md

@@ -3,6 +3,7 @@
 ## [Unreleased]
 
 ### Added
+- Metadata platform options are now **admin-configurable** instead of hardcoded: a new **Admin → Metadata** page edits the allowed `platform` values (persisted to `app.ini` `[metadata] PLATFORM_OPTIONS`, default `joomla,dolibarr,go,npm,generic`), and the repo Settings → Metadata platform dropdown reads from it. Changing the taxonomy no longer needs a code change/redeploy. A repo's existing platform value stays selectable even if later removed from the list (#777)
 - Org branch protection: repositories now show the inherited organization rules read-only in their Branch Protection settings, with an expandable detail (direct push, force-push, branch deletion, merge restrictions, required approvals, status checks, protected files, and whitelisted teams) — like GitHub surfaces org rulesets in a repo (#727)
 - Org branch protection: org-level rules can now also protect against branch deletion (`enable_delete` + delete allowlist teams), mirroring the per-repo delete allowlist (#727)
 - Org-level tag protection: protect tag patterns org-wide (e.g. `v*`) with a team allowlist, layered on top of each repo's own protected tags — a tag is controllable only if allowed at both levels (fail-closed). API at `/orgs/{org}/tag_protections`; enforced at the git push/delete hook and the release create/delete paths; shown read-only in the repo Tag settings (#727)
@@ -63,6 +64,12 @@
 - Cherry-pick upstream v1.26.4: walk git log context error handling — regression fix (#38185)
 
 ### Fixed
+- Repo metadata `org` is now **derived from the org profile** (the repository owner) instead of being stored/editable, so it can never drift when an organization is renamed. The `org` column is dropped from `repo_manifest` (migration #368) and the field is derived on read via `Repository.DerivedOrgName` (owner display name, falling back to the handle) across the metadata API, the Settings → Metadata page (now read-only), and the Joomla update-server feed. The API `PUT` and MCP `metadata_update` now ignore `org` (read-only, like the already-derived `display_name`) (#771)
+- Admin Branding: uploading a custom **Nav Icon** now also sets the **app icon** (`logo.png`, the PWA / web-manifest icon and navbar fallback), so a branded instance shows its own installable app icon instead of the shipped default; resetting the Nav Icon reverts both (#773)
+- Fork server binary now compiles: `routers/api/v1/api.go` called `organization.HasOrgOrUserVisible`, which had been renamed to `IsOwnerVisibleToDoer`; the one missed call site broke `go build` of the entire `routers/api/v1` package (CI's Lint & Validate does not run a full build, so it went unnoticed) (#735)
+- Dev deploy workflow: the build/deploy step referenced runner-side values as `\$TAG` / `\$REGISTRY_TOKEN` inside an unquoted SSH heredoc, deferring expansion to the remote shell where those names are unset — the Docker tag collapsed to an empty `mokogitea:` and every dev deploy failed with `invalid reference format`. Runner values are now injected via an ssh env-prefix and the heredoc is quoted so each `$var` expands in exactly one place (#737)
+- Repaired unit-test compile and `go vet` failures: `CryptoRandomInt/String/Bytes` now return two values (updated `modules/util/util_test.go`), removed a redundant `&&` condition in `issue_comment.go`, and cleaned up isolated integration-test compile errors (#736)
+- Removed a stray `package-lock.json` (13.9k lines) that a `git add -A` had accidentally swept into the org-push-policy branch (#734)
 - Org-level branch protection now **layers** with per-repo rules instead of being ignored whenever a repo rule exists. When both an org rule and a repo rule match a branch, the effective rule is the most-restrictive (fail-closed) combination — the org rule is a mandatory floor a repo cannot weaken: allow flags AND'd, gate/require/block flags OR'd, required approvals max'd, status checks and protected-file patterns unioned, whitelists intersected. Previously a repo rule shadowed the org rule entirely at the enforcement choke point (`GetFirstMatchProtectedBranchRule`), letting a repo opt out of org protection (#727)
 - Org Teams page: list now renders — the handler wrote `ctx.Data["OrgListTeams"]` but the template reads `.Teams`, so the page showed header/nav but no teams (#720)
 - Issue type: now editable after creation for users with issue write permission — the sidebar gated editing on a `FieldEditFlags` data key that was never populated (always read-only); now uses `HasIssuesOrPullsWritePermission` like the priority field (#721)

README.md

@@ -1,6 +1,6 @@
 # MokoGitea
 
-Custom Gitea fork with enhanced wiki system, DLID licensing, issue statuses, cascade merge, security scanning, org metadata, CI standardization, and project board API.
+Custom Gitea fork with enhanced wiki system, DLID licensing, issue statuses, cascade merge, security scanning, org-level governance, org metadata, CI standardization, and project board API.
 
 ![Language](https://img.shields.io/badge/Go-00ADD8?style=flat-square&logo=go&logoColor=white) ![License](https://img.shields.io/badge/license-GPL--3.0--or--later-green?style=flat-square)
 
@@ -17,6 +17,7 @@ Custom Gitea fork with enhanced wiki system, DLID licensing, issue statuses, cas
 - **Default Org Teams** -- auto-create Developers, Reviewers, and CI/CD teams on org creation
 - **Org Metadata** -- per-repo metadata API (public GET, admin PUT), platform detection for versioning
 - **Branch Protection** -- delete allowlist for protected branches (per-user/team/deploy-key)
+- **Org Governance** -- organization-wide rules that layer onto every repository: branch protection as a most-restrictive floor a repo cannot weaken, tag protection (team allowlist), push policy (branch/tag naming, mandatory secret-block, max file size, blocked paths), repository defaults (force-private, PR merge settings), and member email-domain allowlists
 - **Project Board API** -- REST endpoints for project columns and cards
 - **CI Infrastructure** -- reusable workflows, centralized ci-issue-reporter, standardized MOKOGITEA_TOKEN naming
 - **Dev Deploy Gate** -- builds deploy to dev environment first, production checks dev health

models/git/org_protected_branch.go

@@ -28,19 +28,28 @@ type OrgProtectedBranch struct {
 	CanPush                       bool               `xorm:"NOT NULL DEFAULT false"`
 	EnableWhitelist               bool               `xorm:"NOT NULL DEFAULT false"`
 	WhitelistTeamIDs              []int64            `xorm:"JSON TEXT"`
+	WhitelistUserIDs              []int64            `xorm:"JSON TEXT"`
+	WhitelistActionsUser          bool               `xorm:"NOT NULL DEFAULT false"`
 	EnableMergeWhitelist          bool               `xorm:"NOT NULL DEFAULT false"`
 	MergeWhitelistTeamIDs         []int64            `xorm:"JSON TEXT"`
+	MergeWhitelistUserIDs         []int64            `xorm:"JSON TEXT"`
+	MergeWhitelistActionsUser     bool               `xorm:"NOT NULL DEFAULT false"`
 	CanForcePush                  bool               `xorm:"NOT NULL DEFAULT false"`
 	EnableForcePushAllowlist      bool               `xorm:"NOT NULL DEFAULT false"`
 	ForcePushAllowlistTeamIDs     []int64            `xorm:"JSON TEXT"`
+	ForcePushAllowlistUserIDs     []int64            `xorm:"JSON TEXT"`
+	ForcePushAllowlistActionsUser bool               `xorm:"NOT NULL DEFAULT false"`
 	CanDelete                     bool               `xorm:"NOT NULL DEFAULT false"`
 	EnableDeleteAllowlist         bool               `xorm:"NOT NULL DEFAULT false"`
 	DeleteAllowlistTeamIDs        []int64            `xorm:"JSON TEXT"`
+	DeleteAllowlistUserIDs        []int64            `xorm:"JSON TEXT"`
+	DeleteAllowlistActionsUser    bool               `xorm:"NOT NULL DEFAULT false"`
 	EnableStatusCheck             bool               `xorm:"NOT NULL DEFAULT false"`
 	StatusCheckContexts           []string           `xorm:"JSON TEXT"`
 	RequiredApprovals             int64              `xorm:"NOT NULL DEFAULT 0"`
 	EnableApprovalsWhitelist      bool               `xorm:"NOT NULL DEFAULT false"`
 	ApprovalsWhitelistTeamIDs     []int64            `xorm:"JSON TEXT"`
+	ApprovalsWhitelistUserIDs     []int64            `xorm:"JSON TEXT"`
 	BlockOnRejectedReviews        bool               `xorm:"NOT NULL DEFAULT false"`
 	BlockOnOfficialReviewRequests bool               `xorm:"NOT NULL DEFAULT false"`
 	BlockOnOutdatedBranch         bool               `xorm:"NOT NULL DEFAULT false"`
@@ -84,8 +93,9 @@ func (o *OrgProtectedBranch) Match(branchName string) bool {
 }
 
 // ToProtectedBranch converts an org-level rule to a ProtectedBranch for use
-// in the standard enforcement path. Fields that are user-scoped (WhitelistUserIDs etc.)
-// are left empty because org rules only reference teams.
+// in the standard enforcement path. Both team-scoped and user-scoped allowlists
+// (plus the Actions-bot toggles) are carried across; deploy-key allowances remain
+// repo-only because an org rule cannot express them.
 func (o *OrgProtectedBranch) ToProtectedBranch() *ProtectedBranch {
 	return &ProtectedBranch{
 		ID:                            o.ID,
@@ -94,19 +104,28 @@ func (o *OrgProtectedBranch) ToProtectedBranch() *ProtectedBranch {
 		CanPush:                       o.CanPush,
 		EnableWhitelist:               o.EnableWhitelist,
 		WhitelistTeamIDs:              o.WhitelistTeamIDs,
+		WhitelistUserIDs:              o.WhitelistUserIDs,
+		WhitelistActionsUser:          o.WhitelistActionsUser,
 		EnableMergeWhitelist:          o.EnableMergeWhitelist,
 		MergeWhitelistTeamIDs:         o.MergeWhitelistTeamIDs,
+		MergeWhitelistUserIDs:         o.MergeWhitelistUserIDs,
+		MergeWhitelistActionsUser:     o.MergeWhitelistActionsUser,
 		CanForcePush:                  o.CanForcePush,
 		EnableForcePushAllowlist:      o.EnableForcePushAllowlist,
 		ForcePushAllowlistTeamIDs:     o.ForcePushAllowlistTeamIDs,
+		ForcePushAllowlistUserIDs:     o.ForcePushAllowlistUserIDs,
+		ForcePushAllowlistActionsUser: o.ForcePushAllowlistActionsUser,
 		CanDelete:                     o.CanDelete,
 		EnableDeleteAllowlist:         o.EnableDeleteAllowlist,
 		DeleteAllowlistTeamIDs:        o.DeleteAllowlistTeamIDs,
+		DeleteAllowlistUserIDs:        o.DeleteAllowlistUserIDs,
+		DeleteAllowlistActionsUser:    o.DeleteAllowlistActionsUser,
 		EnableStatusCheck:             o.EnableStatusCheck,
 		StatusCheckContexts:           o.StatusCheckContexts,
 		RequiredApprovals:             o.RequiredApprovals,
 		EnableApprovalsWhitelist:      o.EnableApprovalsWhitelist,
 		ApprovalsWhitelistTeamIDs:     o.ApprovalsWhitelistTeamIDs,
+		ApprovalsWhitelistUserIDs:     o.ApprovalsWhitelistUserIDs,
 		BlockOnRejectedReviews:        o.BlockOnRejectedReviews,
 		BlockOnOfficialReviewRequests: o.BlockOnOfficialReviewRequests,
 		BlockOnOutdatedBranch:         o.BlockOnOutdatedBranch,

models/git/protected_branch_list.go

@@ -133,8 +133,10 @@ func getFirstMatchOrgProtectedBranchRule(ctx context.Context, repoID int64, bran
 
 	orgRule, err := FindOrgBranchRuleForBranch(ctx, owner.ID, branchName)
 	if err != nil {
+		// Fail closed: propagate the error so callers keep the org floor in force
+		// rather than silently falling back to the repo rule on a transient error.
 		log.Error("FindOrgBranchRuleForBranch: %v", err)
-		return nil, nil
+		return nil, err
 	}
 	if orgRule == nil {
 		return nil, nil

models/git/protected_branch_merge.go

@@ -26,27 +26,32 @@ func mergeMostRestrictive(repoRule, orgRule *ProtectedBranch) *ProtectedBranch {
 	eff.CanPush = repoRule.CanPush && orgRule.CanPush
 	eff.EnableWhitelist, eff.WhitelistUserIDs = mergeAllowlist(repoRule.EnableWhitelist, repoRule.WhitelistUserIDs, orgRule.EnableWhitelist, orgRule.WhitelistUserIDs)
 	_, eff.WhitelistTeamIDs = mergeAllowlist(repoRule.EnableWhitelist, repoRule.WhitelistTeamIDs, orgRule.EnableWhitelist, orgRule.WhitelistTeamIDs)
-	eff.WhitelistDeployKeys = repoRule.WhitelistDeployKeys && orgRule.WhitelistDeployKeys
-	eff.WhitelistActionsUser = repoRule.WhitelistActionsUser && orgRule.WhitelistActionsUser
+	// Deploy-key allowances are still not expressible in an OrgProtectedBranch, so the
+	// org rule imposes no constraint on them; carry the repo value through unchanged.
+	// ANDing against the org side's always-false zero value would silently lock out
+	// every deploy-key push in any org that has a matching branch rule (see #727 review).
+	// The Actions-bot toggle IS now expressible org-side, so merge it most-restrictively.
+	eff.WhitelistDeployKeys = repoRule.WhitelistDeployKeys
+	eff.WhitelistActionsUser = mergeAllowFlag(repoRule.EnableWhitelist, repoRule.WhitelistActionsUser, orgRule.EnableWhitelist, orgRule.WhitelistActionsUser)
 
 	// Force push.
 	eff.CanForcePush = repoRule.CanForcePush && orgRule.CanForcePush
 	eff.EnableForcePushAllowlist, eff.ForcePushAllowlistUserIDs = mergeAllowlist(repoRule.EnableForcePushAllowlist, repoRule.ForcePushAllowlistUserIDs, orgRule.EnableForcePushAllowlist, orgRule.ForcePushAllowlistUserIDs)
 	_, eff.ForcePushAllowlistTeamIDs = mergeAllowlist(repoRule.EnableForcePushAllowlist, repoRule.ForcePushAllowlistTeamIDs, orgRule.EnableForcePushAllowlist, orgRule.ForcePushAllowlistTeamIDs)
-	eff.ForcePushAllowlistDeployKeys = repoRule.ForcePushAllowlistDeployKeys && orgRule.ForcePushAllowlistDeployKeys
-	eff.ForcePushAllowlistActionsUser = repoRule.ForcePushAllowlistActionsUser && orgRule.ForcePushAllowlistActionsUser
+	eff.ForcePushAllowlistDeployKeys = repoRule.ForcePushAllowlistDeployKeys
+	eff.ForcePushAllowlistActionsUser = mergeAllowFlag(repoRule.EnableForcePushAllowlist, repoRule.ForcePushAllowlistActionsUser, orgRule.EnableForcePushAllowlist, orgRule.ForcePushAllowlistActionsUser)
 
 	// Delete.
 	eff.CanDelete = repoRule.CanDelete && orgRule.CanDelete
 	eff.EnableDeleteAllowlist, eff.DeleteAllowlistUserIDs = mergeAllowlist(repoRule.EnableDeleteAllowlist, repoRule.DeleteAllowlistUserIDs, orgRule.EnableDeleteAllowlist, orgRule.DeleteAllowlistUserIDs)
 	_, eff.DeleteAllowlistTeamIDs = mergeAllowlist(repoRule.EnableDeleteAllowlist, repoRule.DeleteAllowlistTeamIDs, orgRule.EnableDeleteAllowlist, orgRule.DeleteAllowlistTeamIDs)
-	eff.DeleteAllowlistDeployKeys = repoRule.DeleteAllowlistDeployKeys && orgRule.DeleteAllowlistDeployKeys
-	eff.DeleteAllowlistActionsUser = repoRule.DeleteAllowlistActionsUser && orgRule.DeleteAllowlistActionsUser
+	eff.DeleteAllowlistDeployKeys = repoRule.DeleteAllowlistDeployKeys
+	eff.DeleteAllowlistActionsUser = mergeAllowFlag(repoRule.EnableDeleteAllowlist, repoRule.DeleteAllowlistActionsUser, orgRule.EnableDeleteAllowlist, orgRule.DeleteAllowlistActionsUser)
 
 	// Merge whitelist.
 	eff.EnableMergeWhitelist, eff.MergeWhitelistUserIDs = mergeAllowlist(repoRule.EnableMergeWhitelist, repoRule.MergeWhitelistUserIDs, orgRule.EnableMergeWhitelist, orgRule.MergeWhitelistUserIDs)
 	_, eff.MergeWhitelistTeamIDs = mergeAllowlist(repoRule.EnableMergeWhitelist, repoRule.MergeWhitelistTeamIDs, orgRule.EnableMergeWhitelist, orgRule.MergeWhitelistTeamIDs)
-	eff.MergeWhitelistActionsUser = repoRule.MergeWhitelistActionsUser && orgRule.MergeWhitelistActionsUser
+	eff.MergeWhitelistActionsUser = mergeAllowFlag(repoRule.EnableMergeWhitelist, repoRule.MergeWhitelistActionsUser, orgRule.EnableMergeWhitelist, orgRule.MergeWhitelistActionsUser)
 
 	// Status checks.
 	eff.EnableStatusCheck = repoRule.EnableStatusCheck || orgRule.EnableStatusCheck
@@ -89,6 +94,25 @@ func mergeAllowlist(aEnabled bool, aIDs []int64, bEnabled bool, bIDs []int64) (b
 	}
 }
 
+// mergeAllowFlag combines two "allow the Actions bot" toggles under most-restrictive
+// semantics, mirroring mergeAllowlist. A toggle only grants access when its Enable flag
+// is set; a disabled allowlist means "everyone", so it imposes no constraint. Therefore:
+// if both allowlists are enabled the bot is allowed only when BOTH sides allow it; if
+// only one is enabled that side's flag governs; if neither is enabled the flag is
+// irrelevant (fall back to the repo/a value).
+func mergeAllowFlag(aEnabled, aFlag, bEnabled, bFlag bool) bool {
+	switch {
+	case aEnabled && bEnabled:
+		return aFlag && bFlag
+	case aEnabled:
+		return aFlag
+	case bEnabled:
+		return bFlag
+	default:
+		return aFlag
+	}
+}
+
 func intersectInt64(a, b []int64) []int64 {
 	if len(a) == 0 || len(b) == 0 {
 		return nil

models/git/protected_branch_merge_test.go

@@ -0,0 +1,100 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package git
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestMergeAllowFlag(t *testing.T) {
+	cases := []struct {
+		name     string
+		aEnabled bool
+		aFlag    bool
+		bEnabled bool
+		bFlag    bool
+		expected bool
+	}{
+		// Both allowlists enabled: bot allowed only when BOTH allow it.
+		{"both enabled, both allow", true, true, true, true, true},
+		{"both enabled, a denies", true, false, true, true, false},
+		{"both enabled, b denies", true, true, true, false, false},
+		{"both enabled, both deny", true, false, true, false, false},
+		// Only one side enabled: that side governs.
+		{"only a enabled, a allows", true, true, false, false, true},
+		{"only a enabled, a denies", true, false, false, true, false},
+		{"only b enabled, b allows", false, false, true, true, true},
+		{"only b enabled, b denies", false, true, true, false, false},
+		// Neither enabled: flag irrelevant, falls back to a's flag.
+		{"neither enabled, a true", false, true, false, false, true},
+		{"neither enabled, a false", false, false, false, true, false},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			assert.Equal(t, c.expected, mergeAllowFlag(c.aEnabled, c.aFlag, c.bEnabled, c.bFlag))
+		})
+	}
+}
+
+func TestMergeMostRestrictiveUserIDsIntersect(t *testing.T) {
+	repoRule := &ProtectedBranch{
+		EnableWhitelist:  true,
+		WhitelistUserIDs: []int64{1, 2, 3},
+		// Deploy keys are repo-only and must always pass through unchanged.
+		WhitelistDeployKeys:          true,
+		ForcePushAllowlistDeployKeys: true,
+		DeleteAllowlistDeployKeys:    true,
+	}
+	orgRule := &ProtectedBranch{
+		EnableWhitelist:  true,
+		WhitelistUserIDs: []int64{2, 3, 4},
+		// Org rule cannot express deploy keys; these zero values must NOT override repo.
+	}
+
+	eff := mergeMostRestrictive(repoRule, orgRule)
+
+	// User IDs are intersected when both allowlists are enabled.
+	assert.True(t, eff.EnableWhitelist)
+	assert.ElementsMatch(t, []int64{2, 3}, eff.WhitelistUserIDs)
+
+	// Deploy-key allowances still pass through from the repo rule.
+	assert.True(t, eff.WhitelistDeployKeys)
+	assert.True(t, eff.ForcePushAllowlistDeployKeys)
+	assert.True(t, eff.DeleteAllowlistDeployKeys)
+}
+
+func TestMergeMostRestrictiveActionsUserFlags(t *testing.T) {
+	// Both sides enable their allowlist and both allow the bot -> allowed.
+	repoRule := &ProtectedBranch{
+		EnableWhitelist:          true,
+		WhitelistActionsUser:     true,
+		EnableForcePushAllowlist: true,
+		// force-push: org denies -> effective deny.
+		ForcePushAllowlistActionsUser: true,
+		EnableDeleteAllowlist:         true,
+		DeleteAllowlistActionsUser:    true,
+		// merge: repo allowlist disabled, org enabled+denies -> org governs (deny).
+		EnableMergeWhitelist:      false,
+		MergeWhitelistActionsUser: true,
+	}
+	orgRule := &ProtectedBranch{
+		EnableWhitelist:               true,
+		WhitelistActionsUser:          true,
+		EnableForcePushAllowlist:      true,
+		ForcePushAllowlistActionsUser: false,
+		EnableDeleteAllowlist:         true,
+		DeleteAllowlistActionsUser:    true,
+		EnableMergeWhitelist:          true,
+		MergeWhitelistActionsUser:     false,
+	}
+
+	eff := mergeMostRestrictive(repoRule, orgRule)
+
+	assert.True(t, eff.WhitelistActionsUser, "push: both allow")
+	assert.False(t, eff.ForcePushAllowlistActionsUser, "force-push: org denies")
+	assert.True(t, eff.DeleteAllowlistActionsUser, "delete: both allow")
+	assert.False(t, eff.MergeWhitelistActionsUser, "merge: org enabled and denies")
+}

models/migrations/migrations.go

@@ -444,6 +444,8 @@ func prepareMigrationTasks() []*migration {
 		newMigration(364, "Add org push policy table", v1_27.AddOrgPushPolicyTable),
 		newMigration(365, "Add org repo defaults table", v1_27.AddOrgRepoDefaultsTable),
 		newMigration(366, "Add org email domain policy table", v1_27.AddOrgEmailDomainPolicyTable),
+		newMigration(367, "Add user allowlists to org protected branch", v1_27.AddUserAllowlistsToOrgProtectedBranch),
+		newMigration(368, "Drop org from repo manifest (derived from org profile)", v1_27.DropOrgFromRepoManifest),
 	}
 	return preparedMigrations
 }

models/migrations/v1_27/v347.go

@@ -8,7 +8,7 @@ import (
 )
 
 // AddRepoManifestTable creates the repo_manifest table for storing
-// mokoplatform manifest settings per repository.
+// mokocli manifest settings per repository.
 func AddRepoManifestTable(x *xorm.Engine) error {
 	type RepoManifest struct {
 		ID               int64  `xorm:"pk autoincr"`

models/migrations/v1_27/v368.go

@@ -0,0 +1,26 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package v1_27
+
+import "xorm.io/xorm"
+
+// AddUserAllowlistsToOrgProtectedBranch adds per-user allowlist columns (username or
+// email resolved to user IDs) plus the "allow Actions bot" toggles to org-level branch
+// protection rules for the push, merge, force-push and delete categories, mirroring the
+// per-repo user allowlists so an org rule can also grant access to individual users and
+// the Actions bot. See issue #727.
+func AddUserAllowlistsToOrgProtectedBranch(x *xorm.Engine) error {
+	type OrgProtectedBranch struct {
+		WhitelistUserIDs              []int64 `xorm:"JSON TEXT"`
+		WhitelistActionsUser          bool    `xorm:"NOT NULL DEFAULT false"`
+		MergeWhitelistUserIDs         []int64 `xorm:"JSON TEXT"`
+		MergeWhitelistActionsUser     bool    `xorm:"NOT NULL DEFAULT false"`
+		ForcePushAllowlistUserIDs     []int64 `xorm:"JSON TEXT"`
+		ForcePushAllowlistActionsUser bool    `xorm:"NOT NULL DEFAULT false"`
+		DeleteAllowlistUserIDs        []int64 `xorm:"JSON TEXT"`
+		DeleteAllowlistActionsUser    bool    `xorm:"NOT NULL DEFAULT false"`
+		ApprovalsWhitelistUserIDs     []int64 `xorm:"JSON TEXT"`
+	}
+	return x.Sync(new(OrgProtectedBranch))
+}

models/migrations/v1_27/v369.go

@@ -0,0 +1,19 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package v1_27
+
+import (
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/migrations/base"
+
+	"xorm.io/xorm"
+)
+
+// DropOrgFromRepoManifest removes the org column from repo_manifest. The
+// organization is now derived from the org profile (repository owner) on read
+// rather than stored, so it never drifts on rename. See issue #771.
+func DropOrgFromRepoManifest(x *xorm.Engine) error {
+	sess := x.NewSession()
+	defer sess.Close()
+	return base.DropTableColumns(sess, "repo_manifest", "org")
+}

models/repo/repo.go

@@ -486,6 +486,23 @@ func (repo *Repository) LoadOwner(ctx context.Context) (err error) {
 	return err
 }
 
+// DerivedOrgName returns the organization name derived from the org profile
+// (the repository owner). It prefers the owner's display name (FullName) and
+// falls back to the owner handle (Name / OwnerName). The organization is always
+// derived from the profile rather than stored, so it never drifts on rename.
+func (repo *Repository) DerivedOrgName(ctx context.Context) string {
+	if err := repo.LoadOwner(ctx); err != nil || repo.Owner == nil {
+		return repo.OwnerName
+	}
+	if repo.Owner.FullName != "" {
+		return repo.Owner.FullName
+	}
+	if repo.Owner.Name != "" {
+		return repo.Owner.Name
+	}
+	return repo.OwnerName
+}
+
 // MustOwner always returns a valid *user_model.User object to avoid
 // conceptually impossible error handling.
 // It creates a fake object that contains error details

models/repo/repo_manifest.go

@@ -15,50 +15,52 @@ func init() {
 	db.RegisterModel(new(RepoMetadata))
 }
 
-// RepoMetadata stores mokoplatform metadata settings for a repository.
-// These fields correspond to the .mokogitea/manifest.xml schema and are
-// exposed via API for use by Actions workflows and the mokoplatform CLI.
+// RepoMetadata stores mokocli metadata settings for a repository.
+// These first-class fields are the authoritative repository metadata,
+// exposed via API for use by Actions workflows and mokocli.
 type RepoMetadata struct {
-	ID        int64              `xorm:"pk autoincr"`
-	RepoID    int64              `xorm:"UNIQUE INDEX NOT NULL 'repo_id'"`
+	ID     int64 `xorm:"pk autoincr"`
+	RepoID int64 `xorm:"UNIQUE INDEX NOT NULL 'repo_id'"`
 
 	// identity section
-	Name        string `xorm:"TEXT 'name'"`         // project name
-	Org         string `xorm:"TEXT 'org'"`           // organization name
-	Description string `xorm:"TEXT 'description'"`   // project description
+	// NOTE: organization is intentionally NOT stored here. It is derived from
+	// the org profile (repository owner) on read via Repository.DerivedOrgName,
+	// so it can never drift from the owner on rename. See issue #771.
+	Name        string `xorm:"TEXT 'name'"`                // project name
+	Description string `xorm:"TEXT 'description'"`         // project description
 	LicenseSPDX string `xorm:"VARCHAR(50) 'license_spdx'"` // SPDX identifier, e.g. "GPL-3.0-or-later"
-	LicenseName string `xorm:"TEXT 'license_name'"`  // human-readable license name
+	LicenseName string `xorm:"TEXT 'license_name'"`        // human-readable license name
 
 	// governance section
 	Platform         string `xorm:"VARCHAR(50) 'platform'"`          // go, php, node, python, etc.
-	StandardsVersion string `xorm:"VARCHAR(20) 'standards_version'"` // mokoplatform standards version
-	StandardsSource  string `xorm:"TEXT 'standards_source'"`          // URL to standards repo
+	StandardsVersion string `xorm:"VARCHAR(20) 'standards_version'"` // mokocli standards version
+	StandardsSource  string `xorm:"TEXT 'standards_source'"`         // URL to standards repo
 
 	// versioning
-	VersionPrefix string `xorm:"TEXT 'version_prefix'"`  // tag prefix stripped for version display, e.g. "v1.26.1-moko."
-	ElementName   string `xorm:"TEXT 'element_name'"`    // full element name override, e.g. "pkg_mokowaas" (auto-constructed if empty)
+	VersionPrefix string `xorm:"TEXT 'version_prefix'"` // tag prefix stripped for version display, e.g. "v1.26.1-moko."
+	ElementName   string `xorm:"TEXT 'element_name'"`   // full element name override, e.g. "pkg_mokowaas" (auto-constructed if empty)
 
 	// distribution metadata (used by update server feed generation)
-	Maintainer    string `xorm:"TEXT 'maintainer'"`      // maintainer/author name
-	MaintainerURL string `xorm:"TEXT 'maintainer_url'"`  // maintainer website
-	InfoURL       string `xorm:"TEXT 'info_url'"`        // extension info/product page URL
-	TargetVersion string `xorm:"TEXT 'target_version'"`  // target platform version regex, e.g. "(5|6)\..*"
+	Maintainer    string `xorm:"TEXT 'maintainer'"`         // maintainer/author name
+	MaintainerURL string `xorm:"TEXT 'maintainer_url'"`     // maintainer website
+	InfoURL       string `xorm:"TEXT 'info_url'"`           // extension info/product page URL
+	TargetVersion string `xorm:"TEXT 'target_version'"`     // target platform version regex, e.g. "(5|6)\..*"
 	PHPMinimum    string `xorm:"VARCHAR(20) 'php_minimum'"` // minimum PHP version, e.g. "8.1"
 
 	// build section
-	Language    string `xorm:"VARCHAR(50) 'language'"`     // Go, PHP, TypeScript, etc.
+	Language      string `xorm:"VARCHAR(50) 'language'"`       // Go, PHP, TypeScript, etc.
 	ExtensionType string `xorm:"VARCHAR(50) 'extension_type'"` // component, module, plugin, package, template, library, file
-	EntryPoint  string `xorm:"TEXT 'entry_point'"`          // build entry point path
+	EntryPoint    string `xorm:"TEXT 'entry_point'"`           // build entry point path
 
 	// deploy section
 	DeployHost     string `xorm:"VARCHAR(255) 'deploy_host'"`     // SSH host for deploy
 	DeployPort     string `xorm:"VARCHAR(10) 'deploy_port'"`      // SSH port (default 2918)
 	DeployUser     string `xorm:"VARCHAR(100) 'deploy_user'"`     // SSH user
-	DeployPath     string `xorm:"TEXT 'deploy_path'"`              // remote path for source/compose
+	DeployPath     string `xorm:"TEXT 'deploy_path'"`             // remote path for source/compose
 	DockerImage    string `xorm:"VARCHAR(255) 'docker_image'"`    // e.g. mokoconsulting/mokogitea
 	DockerRegistry string `xorm:"VARCHAR(255) 'docker_registry'"` // e.g. git.mokoconsulting.tech
 	ContainerName  string `xorm:"VARCHAR(100) 'container_name'"`  // Docker container name
-	HealthURL      string `xorm:"TEXT 'health_url'"`               // health check URL after deploy
+	HealthURL      string `xorm:"TEXT 'health_url'"`              // health check URL after deploy
 
 	CreatedUnix timeutil.TimeStamp `xorm:"INDEX CREATED 'created_unix'"`
 	UpdatedUnix timeutil.TimeStamp `xorm:"UPDATED 'updated_unix'"`

modules/setting/metadata.go

@@ -0,0 +1,22 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package setting
+
+// Metadata holds instance-level settings for the repository metadata feature.
+var Metadata = struct {
+	// PlatformOptions is the admin-configurable list of allowed values for the
+	// repo metadata "platform" field. Editable via Admin -> Metadata (persisted
+	// to app.ini [metadata] PLATFORM_OPTIONS) so changing the taxonomy needs no
+	// code change or redeploy. See issue #777.
+	PlatformOptions []string
+}{
+	PlatformOptions: []string{"joomla", "dolibarr", "go", "npm", "generic"},
+}
+
+func loadMetadataFrom(rootCfg ConfigProvider) {
+	sec := rootCfg.Section("metadata")
+	if opts := sec.Key("PLATFORM_OPTIONS").Strings(","); len(opts) > 0 {
+		Metadata.PlatformOptions = opts
+	}
+}

modules/setting/setting.go

@@ -168,6 +168,7 @@ func loadCommonSettingsFrom(cfg ConfigProvider) error {
 	}
 	loadUIFrom(cfg)
 	loadAdminFrom(cfg)
+	loadMetadataFrom(cfg)
 	loadAPIFrom(cfg)
 	loadMetricsFrom(cfg)
 	loadCamoFrom(cfg)

modules/structs/org_branch.go

@@ -14,19 +14,28 @@ type OrgBranchProtection struct {
 	EnablePush                    bool     `json:"enable_push"`
 	EnablePushWhitelist           bool     `json:"enable_push_whitelist"`
 	PushWhitelistTeams            []string `json:"push_whitelist_teams"`
+	PushWhitelistUsernames        []string `json:"push_whitelist_usernames"`
+	PushWhitelistActionsUser      bool     `json:"push_whitelist_actions_user"`
 	EnableForcePush               bool     `json:"enable_force_push"`
 	EnableForcePushAllowlist      bool     `json:"enable_force_push_allowlist"`
 	ForcePushAllowlistTeams       []string `json:"force_push_allowlist_teams"`
+	ForcePushAllowlistUsernames   []string `json:"force_push_allowlist_usernames"`
+	ForcePushAllowlistActionsUser bool     `json:"force_push_allowlist_actions_user"`
 	EnableDelete                  bool     `json:"enable_delete"`
 	EnableDeleteAllowlist         bool     `json:"enable_delete_allowlist"`
 	DeleteAllowlistTeams          []string `json:"delete_allowlist_teams"`
+	DeleteAllowlistUsernames      []string `json:"delete_allowlist_usernames"`
+	DeleteAllowlistActionsUser    bool     `json:"delete_allowlist_actions_user"`
 	EnableMergeWhitelist          bool     `json:"enable_merge_whitelist"`
 	MergeWhitelistTeams           []string `json:"merge_whitelist_teams"`
+	MergeWhitelistUsernames       []string `json:"merge_whitelist_usernames"`
+	MergeWhitelistActionsUser     bool     `json:"merge_whitelist_actions_user"`
 	EnableStatusCheck             bool     `json:"enable_status_check"`
 	StatusCheckContexts           []string `json:"status_check_contexts"`
 	RequiredApprovals             int64    `json:"required_approvals"`
 	EnableApprovalsWhitelist      bool     `json:"enable_approvals_whitelist"`
 	ApprovalsWhitelistTeams       []string `json:"approvals_whitelist_teams"`
+	ApprovalsWhitelistUsernames   []string `json:"approvals_whitelist_username"`
 	BlockOnRejectedReviews        bool     `json:"block_on_rejected_reviews"`
 	BlockOnOfficialReviewRequests bool     `json:"block_on_official_review_requests"`
 	BlockOnOutdatedBranch         bool     `json:"block_on_outdated_branch"`
@@ -49,19 +58,28 @@ type CreateOrgBranchProtectionOption struct {
 	EnablePush                    bool     `json:"enable_push"`
 	EnablePushWhitelist           bool     `json:"enable_push_whitelist"`
 	PushWhitelistTeams            []string `json:"push_whitelist_teams"`
+	PushWhitelistUsernames        []string `json:"push_whitelist_usernames"`
+	PushWhitelistActionsUser      bool     `json:"push_whitelist_actions_user"`
 	EnableForcePush               bool     `json:"enable_force_push"`
 	EnableForcePushAllowlist      bool     `json:"enable_force_push_allowlist"`
 	ForcePushAllowlistTeams       []string `json:"force_push_allowlist_teams"`
+	ForcePushAllowlistUsernames   []string `json:"force_push_allowlist_usernames"`
+	ForcePushAllowlistActionsUser bool     `json:"force_push_allowlist_actions_user"`
 	EnableDelete                  bool     `json:"enable_delete"`
 	EnableDeleteAllowlist         bool     `json:"enable_delete_allowlist"`
 	DeleteAllowlistTeams          []string `json:"delete_allowlist_teams"`
+	DeleteAllowlistUsernames      []string `json:"delete_allowlist_usernames"`
+	DeleteAllowlistActionsUser    bool     `json:"delete_allowlist_actions_user"`
 	EnableMergeWhitelist          bool     `json:"enable_merge_whitelist"`
 	MergeWhitelistTeams           []string `json:"merge_whitelist_teams"`
+	MergeWhitelistUsernames       []string `json:"merge_whitelist_usernames"`
+	MergeWhitelistActionsUser     bool     `json:"merge_whitelist_actions_user"`
 	EnableStatusCheck             bool     `json:"enable_status_check"`
 	StatusCheckContexts           []string `json:"status_check_contexts"`
 	RequiredApprovals             int64    `json:"required_approvals"`
 	EnableApprovalsWhitelist      bool     `json:"enable_approvals_whitelist"`
 	ApprovalsWhitelistTeams       []string `json:"approvals_whitelist_teams"`
+	ApprovalsWhitelistUsernames   []string `json:"approvals_whitelist_username"`
 	BlockOnRejectedReviews        bool     `json:"block_on_rejected_reviews"`
 	BlockOnOfficialReviewRequests bool     `json:"block_on_official_review_requests"`
 	BlockOnOutdatedBranch         bool     `json:"block_on_outdated_branch"`
@@ -79,19 +97,28 @@ type EditOrgBranchProtectionOption struct {
 	EnablePush                    *bool    `json:"enable_push"`
 	EnablePushWhitelist           *bool    `json:"enable_push_whitelist"`
 	PushWhitelistTeams            []string `json:"push_whitelist_teams"`
+	PushWhitelistUsernames        []string `json:"push_whitelist_usernames"`
+	PushWhitelistActionsUser      *bool    `json:"push_whitelist_actions_user"`
 	EnableForcePush               *bool    `json:"enable_force_push"`
 	EnableForcePushAllowlist      *bool    `json:"enable_force_push_allowlist"`
 	ForcePushAllowlistTeams       []string `json:"force_push_allowlist_teams"`
+	ForcePushAllowlistUsernames   []string `json:"force_push_allowlist_usernames"`
+	ForcePushAllowlistActionsUser *bool    `json:"force_push_allowlist_actions_user"`
 	EnableDelete                  *bool    `json:"enable_delete"`
 	EnableDeleteAllowlist         *bool    `json:"enable_delete_allowlist"`
 	DeleteAllowlistTeams          []string `json:"delete_allowlist_teams"`
+	DeleteAllowlistUsernames      []string `json:"delete_allowlist_usernames"`
+	DeleteAllowlistActionsUser    *bool    `json:"delete_allowlist_actions_user"`
 	EnableMergeWhitelist          *bool    `json:"enable_merge_whitelist"`
 	MergeWhitelistTeams           []string `json:"merge_whitelist_teams"`
+	MergeWhitelistUsernames       []string `json:"merge_whitelist_usernames"`
+	MergeWhitelistActionsUser     *bool    `json:"merge_whitelist_actions_user"`
 	EnableStatusCheck             *bool    `json:"enable_status_check"`
 	StatusCheckContexts           []string `json:"status_check_contexts"`
 	RequiredApprovals             *int64   `json:"required_approvals"`
 	EnableApprovalsWhitelist      *bool    `json:"enable_approvals_whitelist"`
 	ApprovalsWhitelistTeams       []string `json:"approvals_whitelist_teams"`
+	ApprovalsWhitelistUsernames   []string `json:"approvals_whitelist_username"`
 	BlockOnRejectedReviews        *bool    `json:"block_on_rejected_reviews"`
 	BlockOnOfficialReviewRequests *bool    `json:"block_on_official_review_requests"`
 	BlockOnOutdatedBranch         *bool    `json:"block_on_outdated_branch"`

modules/util/util_test.go

@@ -86,31 +86,35 @@ func Test_NormalizeEOL(t *testing.T) {
 }
 
 func Test_RandomInt(t *testing.T) {
-	randInt := CryptoRandomInt(255)
+	randInt, err := CryptoRandomInt(255)
+	assert.NoError(t, err)
 	assert.GreaterOrEqual(t, randInt, int64(0))
 	assert.LessOrEqual(t, randInt, int64(255))
 }
 
 func Test_RandomString(t *testing.T) {
-	str1 := CryptoRandomString(32)
-	var err error
+	str1, err := CryptoRandomString(32)
+	assert.NoError(t, err)
 	matches, err := regexp.MatchString(`^[a-zA-Z0-9]{32}$`, str1)
 	assert.NoError(t, err)
 	assert.True(t, matches)
 
-	str2 := CryptoRandomString(32)
+	str2, err := CryptoRandomString(32)
+	assert.NoError(t, err)
 	matches, err = regexp.MatchString(`^[a-zA-Z0-9]{32}$`, str1)
 	assert.NoError(t, err)
 	assert.True(t, matches)
 
 	assert.NotEqual(t, str1, str2)
 
-	str3 := CryptoRandomString(256)
+	str3, err := CryptoRandomString(256)
+	assert.NoError(t, err)
 	matches, err = regexp.MatchString(`^[a-zA-Z0-9]{256}$`, str3)
 	assert.NoError(t, err)
 	assert.True(t, matches)
 
-	str4 := CryptoRandomString(256)
+	str4, err := CryptoRandomString(256)
+	assert.NoError(t, err)
 	matches, err = regexp.MatchString(`^[a-zA-Z0-9]{256}$`, str4)
 	assert.NoError(t, err)
 	assert.True(t, matches)
@@ -119,15 +123,19 @@ func Test_RandomString(t *testing.T) {
 }
 
 func Test_RandomBytes(t *testing.T) {
-	bytes1 := CryptoRandomBytes(32)
+	bytes1, err := CryptoRandomBytes(32)
+	assert.NoError(t, err)
 
-	bytes2 := CryptoRandomBytes(32)
+	bytes2, err := CryptoRandomBytes(32)
+	assert.NoError(t, err)
 
 	assert.NotEqual(t, bytes1, bytes2)
 
-	bytes3 := CryptoRandomBytes(256)
+	bytes3, err := CryptoRandomBytes(256)
+	assert.NoError(t, err)
 
-	bytes4 := CryptoRandomBytes(256)
+	bytes4, err := CryptoRandomBytes(256)
+	assert.NoError(t, err)
 
 	assert.NotEqual(t, bytes3, bytes4)
 }

options/locale/locale_en-US.json

@@ -2436,31 +2436,6 @@
   "repo.settings.org_protected_tag": "Organization Tag Protection",
   "repo.settings.org_protected_tag_desc": "These tag protection rules are defined by the organization and are enforced on top of this repository's own rules. They cannot be edited here.",
   "repo.settings.org_protected_tag.read_only": "Read-only",
-  "repo.settings.org_push_policy": "Organization Push Policy",
-  "repo.settings.org_push_policy_desc": "This push policy is defined by the organization and enforced on every push to this repository. It cannot be edited here.",
-  "repo.settings.org_push_policy.inherited": "Organization",
-  "repo.settings.org_push_policy.read_only": "Read-only",
-  "repo.settings.org_push_policy.branch_pattern": "Allowed branch names",
-  "repo.settings.org_push_policy.tag_pattern": "Allowed tag names",
-  "repo.settings.org_push_policy.require_secret_block": "Block pushes containing secrets",
-  "repo.settings.org_push_policy.max_file_size": "Maximum file size",
-  "repo.settings.org_push_policy.blocked_files": "Blocked file paths",
-  "repo.settings.org_push_policy.enabled": "Enabled",
-  "repo.settings.org_repo_defaults": "Organization Repository Defaults",
-  "repo.settings.org_repo_defaults_desc": "These defaults are defined by the organization and were applied to this repository when it was created or transferred into the organization. They are shown for reference and cannot be edited here.",
-  "repo.settings.org_repo_defaults.inherited": "Organization",
-  "repo.settings.org_repo_defaults.read_only": "Read-only",
-  "repo.settings.org_repo_defaults.force_private": "Force private repositories",
-  "repo.settings.org_repo_defaults.merge_styles": "Allowed merge styles",
-  "repo.settings.org_repo_defaults.default_merge_style": "Default merge style",
-  "repo.settings.org_repo_defaults.delete_branch_after_merge": "Delete branch after merge",
-  "repo.settings.org_repo_defaults.style_merge": "Merge commits",
-  "repo.settings.org_repo_defaults.style_rebase": "Rebase",
-  "repo.settings.org_repo_defaults.style_rebase_merge": "Rebase with merge commit",
-  "repo.settings.org_repo_defaults.style_squash": "Squash",
-  "repo.settings.org_repo_defaults.style_fast_forward_only": "Fast-forward only",
-  "repo.settings.org_repo_defaults.enabled": "Enabled",
-  "repo.settings.org_repo_defaults.disabled": "Disabled",
   "repo.settings.protected_branch_can_push": "Allow push?",
   "repo.settings.protected_branch_can_push_yes": "You can push",
   "repo.settings.protected_branch_can_push_no": "You cannot push",
@@ -2489,7 +2464,7 @@
   "repo.settings.protect_force_push_allowlist_teams": "Allowlisted teams for force pushing:",
   "repo.settings.protect_force_push_allowlist_deploy_keys": "Allowlist deploy keys with push access to force push.",
   "repo.settings.protect_force_push_allowlist_actions_user": "Allowlist actions bot user to force push.",
-  "repo.settings.event_delete": "Branch Deletion",
+  "repo.settings.protect_branch_deletion": "Branch Deletion",
   "repo.settings.protect_disable_delete": "Disable Deletion",
   "repo.settings.protect_disable_delete_desc": "This branch cannot be deleted.",
   "repo.settings.protect_enable_delete_all": "Enable Deletion",
@@ -2797,7 +2772,7 @@
   "repo.settings.support_url_help": "Shown when downloads are gated. Can point to your wiki, product page, or external support site.",
   "repo.settings.custom_fields": "Custom Fields",
   "repo.settings.manifest": "Manifest",
-  "repo.settings.manifest_desc": "Project identity, governance, and build settings from the MokoPlatform manifest. These are accessible via API for Actions workflows and the MokoPlatform CLI.",
+  "repo.settings.manifest_desc": "Project identity, governance, and build settings for the repository. These are accessible via API for Actions workflows and MokoCLI.",
   "repo.settings.manifest_identity": "Identity",
   "repo.settings.manifest_name": "Project Name",
   "repo.settings.manifest_element_name": "Element Name",

routers/api/v1/api.go

@@ -516,7 +516,7 @@ func reqOrgVisible() func(ctx *context.APIContext) {
 			ctx.APIErrorInternal(errors.New("reqOrgVisible: unprepared context"))
 			return
 		}
-		if !organization.HasOrgOrUserVisible(ctx, ctx.Org.Organization.AsUser(), ctx.Doer) {
+		if !organization.IsOwnerVisibleToDoer(ctx, ctx.Org.Organization.AsUser(), ctx.Doer) {
 			ctx.APIErrorNotFound()
 			return
 		}
@@ -1543,8 +1543,6 @@ func Routes() *web.Router {
 				}, reqAnyRepoReader())
 				m.Get("/metadata", repo.GetRepoMetadata)
 				m.Put("/metadata", reqToken(), reqAdmin(), repo.UpdateRepoMetadata)
-				m.Get("/manifest", repo.GetRepoMetadata) // backward compat
-				m.Put("/manifest", reqToken(), reqAdmin(), repo.UpdateRepoMetadata)
 				// MokoGitea badge engine
 				m.Get("/badge/{type}.svg", repo.GetRepoBadge)
 				m.Get("/issue_templates", reqRepoReader(unit.TypeCode), context.ReferencesGitRepo(), repo.GetIssueTemplates)
@@ -1698,29 +1696,29 @@ func Routes() *web.Router {
 						Patch(reqToken(), reqRepoWriter(unit.TypeIssues, unit.TypePullRequests), bind(api.EditMilestoneOption{}), repo.EditMilestone).
 						Delete(reqToken(), reqRepoWriter(unit.TypeIssues, unit.TypePullRequests), repo.DeleteMilestone)
 				})
-//				m.Group("/projects", func() {
-//					m.Combo("").Get(repo.ListProjects).
-//						Post(reqToken(), reqRepoWriter(unit.TypeProjects), bind(api.CreateProjectOption{}), repo.CreateProject)
-//					m.Group("/{id}", func() {
-//						m.Combo("").Get(repo.GetProject).
-//							Patch(reqToken(), reqRepoWriter(unit.TypeProjects), bind(api.EditProjectOption{}), repo.EditProject).
-//							Delete(reqToken(), reqRepoWriter(unit.TypeProjects), repo.DeleteProject)
-//						m.Post("/{action}", reqToken(), reqRepoWriter(unit.TypeProjects), repo.ChangeProjectStatus)
-//						m.Group("/columns", func() {
-//							m.Combo("").Get(repo.ListProjectColumns).
-//								Post(reqToken(), reqRepoWriter(unit.TypeProjects), bind(api.CreateProjectColumnOption{}), repo.CreateProjectColumn)
-//							m.Group("/{columnId}", func() {
-//								m.Delete("", reqToken(), reqRepoWriter(unit.TypeProjects), repo.DeleteProjectColumn)
-//								m.Combo("/issues").Get(repo.ListProjectColumnIssues).
-//									Post(reqToken(), reqRepoWriter(unit.TypeProjects), bind(api.AddProjectColumnIssueOption{}), repo.AddIssueToColumn)
-//							})
-//						})
-//						m.Group("/issues/{issueId}", func() {
-//							m.Patch("/move", reqToken(), reqRepoWriter(unit.TypeProjects), bind(api.MoveProjectColumnIssueOption{}), repo.MoveIssueOnColumn)
-//							m.Delete("", reqToken(), reqRepoWriter(unit.TypeProjects), repo.RemoveIssueFromProject)
-//						})
-//					})
-//				})
+				//				m.Group("/projects", func() {
+				//					m.Combo("").Get(repo.ListProjects).
+				//						Post(reqToken(), reqRepoWriter(unit.TypeProjects), bind(api.CreateProjectOption{}), repo.CreateProject)
+				//					m.Group("/{id}", func() {
+				//						m.Combo("").Get(repo.GetProject).
+				//							Patch(reqToken(), reqRepoWriter(unit.TypeProjects), bind(api.EditProjectOption{}), repo.EditProject).
+				//							Delete(reqToken(), reqRepoWriter(unit.TypeProjects), repo.DeleteProject)
+				//						m.Post("/{action}", reqToken(), reqRepoWriter(unit.TypeProjects), repo.ChangeProjectStatus)
+				//						m.Group("/columns", func() {
+				//							m.Combo("").Get(repo.ListProjectColumns).
+				//								Post(reqToken(), reqRepoWriter(unit.TypeProjects), bind(api.CreateProjectColumnOption{}), repo.CreateProjectColumn)
+				//							m.Group("/{columnId}", func() {
+				//								m.Delete("", reqToken(), reqRepoWriter(unit.TypeProjects), repo.DeleteProjectColumn)
+				//								m.Combo("/issues").Get(repo.ListProjectColumnIssues).
+				//									Post(reqToken(), reqRepoWriter(unit.TypeProjects), bind(api.AddProjectColumnIssueOption{}), repo.AddIssueToColumn)
+				//							})
+				//						})
+				//						m.Group("/issues/{issueId}", func() {
+				//							m.Patch("/move", reqToken(), reqRepoWriter(unit.TypeProjects), bind(api.MoveProjectColumnIssueOption{}), repo.MoveIssueOnColumn)
+				//							m.Delete("", reqToken(), reqRepoWriter(unit.TypeProjects), repo.RemoveIssueFromProject)
+				//						})
+				//					})
+				//				})
 				// Repo custom fields (repo-scoped key-value metadata)
 				m.Group("/custom-fields", func() {
 					m.Get("", repo.GetRepoCustomFields)

routers/api/v1/org/branch_protection.go

@@ -8,6 +8,7 @@ import (
 
 	git_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/git"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/organization"
+	user_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/user"
 	api "code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/structs"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/web"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
@@ -36,6 +37,18 @@ func toAPIOrgBranchProtection(ctx *context.APIContext, rule *git_model.OrgProtec
 		return names
 	}
 
+	resolveUserNames := func(ids []int64) []string {
+		names := make([]string, 0, len(ids))
+		for _, id := range ids {
+			u, err := user_model.GetUserByID(ctx, id)
+			if err != nil {
+				continue
+			}
+			names = append(names, u.Name)
+		}
+		return names
+	}
+
 	return &api.OrgBranchProtection{
 		ID:                            rule.ID,
 		OrgID:                         rule.OrgID,
@@ -44,19 +57,28 @@ func toAPIOrgBranchProtection(ctx *context.APIContext, rule *git_model.OrgProtec
 		EnablePush:                    rule.CanPush,
 		EnablePushWhitelist:           rule.EnableWhitelist,
 		PushWhitelistTeams:            resolveTeamNames(rule.WhitelistTeamIDs),
+		PushWhitelistUsernames:        resolveUserNames(rule.WhitelistUserIDs),
+		PushWhitelistActionsUser:      rule.WhitelistActionsUser,
 		EnableForcePush:               rule.CanForcePush,
 		EnableForcePushAllowlist:      rule.EnableForcePushAllowlist,
 		ForcePushAllowlistTeams:       resolveTeamNames(rule.ForcePushAllowlistTeamIDs),
+		ForcePushAllowlistUsernames:   resolveUserNames(rule.ForcePushAllowlistUserIDs),
+		ForcePushAllowlistActionsUser: rule.ForcePushAllowlistActionsUser,
 		EnableDelete:                  rule.CanDelete,
 		EnableDeleteAllowlist:         rule.EnableDeleteAllowlist,
 		DeleteAllowlistTeams:          resolveTeamNames(rule.DeleteAllowlistTeamIDs),
+		DeleteAllowlistUsernames:      resolveUserNames(rule.DeleteAllowlistUserIDs),
+		DeleteAllowlistActionsUser:    rule.DeleteAllowlistActionsUser,
 		EnableMergeWhitelist:          rule.EnableMergeWhitelist,
 		MergeWhitelistTeams:           resolveTeamNames(rule.MergeWhitelistTeamIDs),
+		MergeWhitelistUsernames:       resolveUserNames(rule.MergeWhitelistUserIDs),
+		MergeWhitelistActionsUser:     rule.MergeWhitelistActionsUser,
 		EnableStatusCheck:             rule.EnableStatusCheck,
 		StatusCheckContexts:           rule.StatusCheckContexts,
 		RequiredApprovals:             rule.RequiredApprovals,
 		EnableApprovalsWhitelist:      rule.EnableApprovalsWhitelist,
 		ApprovalsWhitelistTeams:       resolveTeamNames(rule.ApprovalsWhitelistTeamIDs),
+		ApprovalsWhitelistUsernames:   resolveUserNames(rule.ApprovalsWhitelistUserIDs),
 		BlockOnRejectedReviews:        rule.BlockOnRejectedReviews,
 		BlockOnOfficialReviewRequests: rule.BlockOnOfficialReviewRequests,
 		BlockOnOutdatedBranch:         rule.BlockOnOutdatedBranch,
@@ -88,6 +110,41 @@ func resolveTeamIDs(ctx *context.APIContext, orgID int64, names []string) ([]int
 	return ids, true
 }
 
+// resolveUserIDs converts a list of user identifiers (each a username or an email
+// address) to deduped user IDs, returning 422 on the first unknown identifier. Each
+// entry is looked up by username first, then falls back to an activated email address.
+func resolveUserIDs(ctx *context.APIContext, names []string) ([]int64, bool) {
+	if len(names) == 0 {
+		return nil, true
+	}
+	seen := make(map[int64]struct{}, len(names))
+	ids := make([]int64, 0, len(names))
+	for _, name := range names {
+		u, err := user_model.GetUserByName(ctx, name)
+		if err != nil {
+			if !user_model.IsErrUserNotExist(err) {
+				ctx.APIErrorInternal(err)
+				return nil, false
+			}
+			u, err = user_model.GetUserByEmail(ctx, name)
+			if err != nil {
+				if user_model.IsErrUserNotExist(err) {
+					ctx.APIError(http.StatusUnprocessableEntity, "unknown user: "+name)
+				} else {
+					ctx.APIErrorInternal(err)
+				}
+				return nil, false
+			}
+		}
+		if _, dup := seen[u.ID]; dup {
+			continue
+		}
+		seen[u.ID] = struct{}{}
+		ids = append(ids, u.ID)
+	}
+	return ids, true
+}
+
 // ListOrgBranchProtections list org-level branch protection rules
 func ListOrgBranchProtections(ctx *context.APIContext) {
 	// swagger:operation GET /orgs/{org}/branch_protections organization orgListBranchProtections
@@ -218,6 +275,26 @@ func CreateOrgBranchProtection(ctx *context.APIContext) {
 	if !ok {
 		return
 	}
+	pushUsers, ok := resolveUserIDs(ctx, form.PushWhitelistUsernames)
+	if !ok {
+		return
+	}
+	forcePushUsers, ok := resolveUserIDs(ctx, form.ForcePushAllowlistUsernames)
+	if !ok {
+		return
+	}
+	mergeUsers, ok := resolveUserIDs(ctx, form.MergeWhitelistUsernames)
+	if !ok {
+		return
+	}
+	approvalsUsers, ok := resolveUserIDs(ctx, form.ApprovalsWhitelistUsernames)
+	if !ok {
+		return
+	}
+	deleteUsers, ok := resolveUserIDs(ctx, form.DeleteAllowlistUsernames)
+	if !ok {
+		return
+	}
 
 	rule := &git_model.OrgProtectedBranch{
 		OrgID:                         orgID,
@@ -226,19 +303,28 @@ func CreateOrgBranchProtection(ctx *context.APIContext) {
 		CanPush:                       form.EnablePush,
 		EnableWhitelist:               form.EnablePush && form.EnablePushWhitelist,
 		WhitelistTeamIDs:              pushTeams,
+		WhitelistUserIDs:              pushUsers,
+		WhitelistActionsUser:          form.EnablePush && form.EnablePushWhitelist && form.PushWhitelistActionsUser,
 		CanForcePush:                  form.EnablePush && form.EnableForcePush,
 		EnableForcePushAllowlist:      form.EnablePush && form.EnableForcePush && form.EnableForcePushAllowlist,
 		ForcePushAllowlistTeamIDs:     forcePushTeams,
+		ForcePushAllowlistUserIDs:     forcePushUsers,
+		ForcePushAllowlistActionsUser: form.EnablePush && form.EnableForcePush && form.EnableForcePushAllowlist && form.ForcePushAllowlistActionsUser,
 		CanDelete:                     form.EnableDelete,
 		EnableDeleteAllowlist:         form.EnableDelete && form.EnableDeleteAllowlist,
 		DeleteAllowlistTeamIDs:        deleteTeams,
+		DeleteAllowlistUserIDs:        deleteUsers,
+		DeleteAllowlistActionsUser:    form.EnableDelete && form.EnableDeleteAllowlist && form.DeleteAllowlistActionsUser,
 		EnableMergeWhitelist:          form.EnableMergeWhitelist,
 		MergeWhitelistTeamIDs:         mergeTeams,
+		MergeWhitelistUserIDs:         mergeUsers,
+		MergeWhitelistActionsUser:     form.EnableMergeWhitelist && form.MergeWhitelistActionsUser,
 		EnableStatusCheck:             form.EnableStatusCheck,
 		StatusCheckContexts:           form.StatusCheckContexts,
 		RequiredApprovals:             form.RequiredApprovals,
 		EnableApprovalsWhitelist:      form.EnableApprovalsWhitelist,
 		ApprovalsWhitelistTeamIDs:     approvalsTeams,
+		ApprovalsWhitelistUserIDs:     approvalsUsers,
 		BlockOnRejectedReviews:        form.BlockOnRejectedReviews,
 		BlockOnOfficialReviewRequests: form.BlockOnOfficialReviewRequests,
 		BlockOnOutdatedBranch:         form.BlockOnOutdatedBranch,
@@ -320,6 +406,16 @@ func EditOrgBranchProtection(ctx *context.APIContext) {
 		}
 		rule.WhitelistTeamIDs = ids
 	}
+	if form.PushWhitelistUsernames != nil {
+		ids, ok := resolveUserIDs(ctx, form.PushWhitelistUsernames)
+		if !ok {
+			return
+		}
+		rule.WhitelistUserIDs = ids
+	}
+	if form.PushWhitelistActionsUser != nil {
+		rule.WhitelistActionsUser = *form.PushWhitelistActionsUser
+	}
 	if form.EnableForcePush != nil {
 		rule.CanForcePush = *form.EnableForcePush
 	}
@@ -333,6 +429,16 @@ func EditOrgBranchProtection(ctx *context.APIContext) {
 		}
 		rule.ForcePushAllowlistTeamIDs = ids
 	}
+	if form.ForcePushAllowlistUsernames != nil {
+		ids, ok := resolveUserIDs(ctx, form.ForcePushAllowlistUsernames)
+		if !ok {
+			return
+		}
+		rule.ForcePushAllowlistUserIDs = ids
+	}
+	if form.ForcePushAllowlistActionsUser != nil {
+		rule.ForcePushAllowlistActionsUser = *form.ForcePushAllowlistActionsUser
+	}
 	if form.EnableDelete != nil {
 		rule.CanDelete = *form.EnableDelete
 	}
@@ -346,6 +452,16 @@ func EditOrgBranchProtection(ctx *context.APIContext) {
 		}
 		rule.DeleteAllowlistTeamIDs = ids
 	}
+	if form.DeleteAllowlistUsernames != nil {
+		ids, ok := resolveUserIDs(ctx, form.DeleteAllowlistUsernames)
+		if !ok {
+			return
+		}
+		rule.DeleteAllowlistUserIDs = ids
+	}
+	if form.DeleteAllowlistActionsUser != nil {
+		rule.DeleteAllowlistActionsUser = *form.DeleteAllowlistActionsUser
+	}
 	if form.EnableMergeWhitelist != nil {
 		rule.EnableMergeWhitelist = *form.EnableMergeWhitelist
 	}
@@ -356,6 +472,16 @@ func EditOrgBranchProtection(ctx *context.APIContext) {
 		}
 		rule.MergeWhitelistTeamIDs = ids
 	}
+	if form.MergeWhitelistUsernames != nil {
+		ids, ok := resolveUserIDs(ctx, form.MergeWhitelistUsernames)
+		if !ok {
+			return
+		}
+		rule.MergeWhitelistUserIDs = ids
+	}
+	if form.MergeWhitelistActionsUser != nil {
+		rule.MergeWhitelistActionsUser = *form.MergeWhitelistActionsUser
+	}
 	if form.EnableStatusCheck != nil {
 		rule.EnableStatusCheck = *form.EnableStatusCheck
 	}
@@ -375,6 +501,13 @@ func EditOrgBranchProtection(ctx *context.APIContext) {
 		}
 		rule.ApprovalsWhitelistTeamIDs = ids
 	}
+	if form.ApprovalsWhitelistUsernames != nil {
+		ids, ok := resolveUserIDs(ctx, form.ApprovalsWhitelistUsernames)
+		if !ok {
+			return
+		}
+		rule.ApprovalsWhitelistUserIDs = ids
+	}
 	if form.BlockOnRejectedReviews != nil {
 		rule.BlockOnRejectedReviews = *form.BlockOnRejectedReviews
 	}

routers/api/v1/org/email_domain.go

@@ -24,6 +24,23 @@ func toAPIOrgEmailDomainPolicy(policy *git_model.OrgEmailDomainPolicy, orgID int
 
 // GetOrgEmailDomainPolicy get the organization's email domain policy
 func GetOrgEmailDomainPolicy(ctx *context.APIContext) {
+	// swagger:operation GET /orgs/{org}/email_domain_policy organization orgGetEmailDomainPolicy
+	// ---
+	// summary: Get the organization's email domain policy
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: org
+	//   in: path
+	//   description: name of the organization
+	//   type: string
+	//   required: true
+	// responses:
+	//   "200":
+	//     "$ref": "#/responses/OrgEmailDomainPolicy"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+
 	orgID := ctx.Org.Organization.ID
 	policy, err := git_model.GetOrgEmailDomainPolicy(ctx, orgID)
 	if err != nil {
@@ -35,6 +52,31 @@ func GetOrgEmailDomainPolicy(ctx *context.APIContext) {
 
 // EditOrgEmailDomainPolicy create or update the organization's email domain policy
 func EditOrgEmailDomainPolicy(ctx *context.APIContext) {
+	// swagger:operation PATCH /orgs/{org}/email_domain_policy organization orgEditEmailDomainPolicy
+	// ---
+	// summary: Create or update the organization's email domain policy. Only fields that are set will be changed
+	// consumes:
+	// - application/json
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: org
+	//   in: path
+	//   description: name of the organization
+	//   type: string
+	//   required: true
+	// - name: body
+	//   in: body
+	//   schema:
+	//     "$ref": "#/definitions/EditOrgEmailDomainPolicyOption"
+	// responses:
+	//   "200":
+	//     "$ref": "#/responses/OrgEmailDomainPolicy"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+	//   "422":
+	//     "$ref": "#/responses/validationError"
+
 	form := web.GetForm(ctx).(*api.EditOrgEmailDomainPolicyOption)
 	orgID := ctx.Org.Organization.ID
 
@@ -59,6 +101,21 @@ func EditOrgEmailDomainPolicy(ctx *context.APIContext) {
 
 // DeleteOrgEmailDomainPolicy remove the organization's email domain policy
 func DeleteOrgEmailDomainPolicy(ctx *context.APIContext) {
+	// swagger:operation DELETE /orgs/{org}/email_domain_policy organization orgDeleteEmailDomainPolicy
+	// ---
+	// summary: Remove the organization's email domain policy
+	// parameters:
+	// - name: org
+	//   in: path
+	//   description: name of the organization
+	//   type: string
+	//   required: true
+	// responses:
+	//   "204":
+	//     "$ref": "#/responses/empty"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+
 	if err := git_model.DeleteOrgEmailDomainPolicy(ctx, ctx.Org.Organization.ID); err != nil {
 		ctx.APIErrorInternal(err)
 		return

routers/api/v1/org/push_policy.go

@@ -32,6 +32,23 @@ func toAPIOrgPushPolicy(policy *git_model.OrgPushPolicy, orgID int64) *api.OrgPu
 
 // GetOrgPushPolicy get the organization's push policy
 func GetOrgPushPolicy(ctx *context.APIContext) {
+	// swagger:operation GET /orgs/{org}/push_policy organization orgGetPushPolicy
+	// ---
+	// summary: Get the organization's push policy
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: org
+	//   in: path
+	//   description: name of the organization
+	//   type: string
+	//   required: true
+	// responses:
+	//   "200":
+	//     "$ref": "#/responses/OrgPushPolicy"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+
 	orgID := ctx.Org.Organization.ID
 	policy, err := git_model.GetOrgPushPolicy(ctx, orgID)
 	if err != nil {
@@ -43,6 +60,31 @@ func GetOrgPushPolicy(ctx *context.APIContext) {
 
 // EditOrgPushPolicy create or update the organization's push policy
 func EditOrgPushPolicy(ctx *context.APIContext) {
+	// swagger:operation PATCH /orgs/{org}/push_policy organization orgEditPushPolicy
+	// ---
+	// summary: Create or update the organization's push policy. Only fields that are set will be changed
+	// consumes:
+	// - application/json
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: org
+	//   in: path
+	//   description: name of the organization
+	//   type: string
+	//   required: true
+	// - name: body
+	//   in: body
+	//   schema:
+	//     "$ref": "#/definitions/EditOrgPushPolicyOption"
+	// responses:
+	//   "200":
+	//     "$ref": "#/responses/OrgPushPolicy"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+	//   "422":
+	//     "$ref": "#/responses/validationError"
+
 	form := web.GetForm(ctx).(*api.EditOrgPushPolicyOption)
 	orgID := ctx.Org.Organization.ID
 
@@ -80,6 +122,21 @@ func EditOrgPushPolicy(ctx *context.APIContext) {
 
 // DeleteOrgPushPolicy remove the organization's push policy
 func DeleteOrgPushPolicy(ctx *context.APIContext) {
+	// swagger:operation DELETE /orgs/{org}/push_policy organization orgDeletePushPolicy
+	// ---
+	// summary: Remove the organization's push policy
+	// parameters:
+	// - name: org
+	//   in: path
+	//   description: name of the organization
+	//   type: string
+	//   required: true
+	// responses:
+	//   "204":
+	//     "$ref": "#/responses/empty"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+
 	if err := git_model.DeleteOrgPushPolicy(ctx, ctx.Org.Organization.ID); err != nil {
 		ctx.APIErrorInternal(err)
 		return

routers/api/v1/org/repo_defaults.go

@@ -42,6 +42,23 @@ func toAPIOrgRepoDefaults(d *git_model.OrgRepoDefaults, orgID int64) *api.OrgRep
 
 // GetOrgRepoDefaults get the organization's default repository settings
 func GetOrgRepoDefaults(ctx *context.APIContext) {
+	// swagger:operation GET /orgs/{org}/repo_defaults organization orgGetRepoDefaults
+	// ---
+	// summary: Get the organization's default repository settings
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: org
+	//   in: path
+	//   description: name of the organization
+	//   type: string
+	//   required: true
+	// responses:
+	//   "200":
+	//     "$ref": "#/responses/OrgRepoDefaults"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+
 	orgID := ctx.Org.Organization.ID
 	defaults, err := git_model.GetOrgRepoDefaults(ctx, orgID)
 	if err != nil {
@@ -53,6 +70,31 @@ func GetOrgRepoDefaults(ctx *context.APIContext) {
 
 // EditOrgRepoDefaults create or update the organization's default repository settings
 func EditOrgRepoDefaults(ctx *context.APIContext) {
+	// swagger:operation PATCH /orgs/{org}/repo_defaults organization orgEditRepoDefaults
+	// ---
+	// summary: Create or update the organization's default repository settings. Only fields that are set will be changed
+	// consumes:
+	// - application/json
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: org
+	//   in: path
+	//   description: name of the organization
+	//   type: string
+	//   required: true
+	// - name: body
+	//   in: body
+	//   schema:
+	//     "$ref": "#/definitions/EditOrgRepoDefaultsOption"
+	// responses:
+	//   "200":
+	//     "$ref": "#/responses/OrgRepoDefaults"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+	//   "422":
+	//     "$ref": "#/responses/validationError"
+
 	form := web.GetForm(ctx).(*api.EditOrgRepoDefaultsOption)
 	orgID := ctx.Org.Organization.ID
 
@@ -109,6 +151,21 @@ func EditOrgRepoDefaults(ctx *context.APIContext) {
 
 // DeleteOrgRepoDefaults remove the organization's default repository settings
 func DeleteOrgRepoDefaults(ctx *context.APIContext) {
+	// swagger:operation DELETE /orgs/{org}/repo_defaults organization orgDeleteRepoDefaults
+	// ---
+	// summary: Remove the organization's default repository settings
+	// parameters:
+	// - name: org
+	//   in: path
+	//   description: name of the organization
+	//   type: string
+	//   required: true
+	// responses:
+	//   "204":
+	//     "$ref": "#/responses/empty"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+
 	if err := git_model.DeleteOrgRepoDefaults(ctx, ctx.Org.Organization.ID); err != nil {
 		ctx.APIErrorInternal(err)
 		return

routers/api/v1/org/tag_protection.go

@@ -41,6 +41,23 @@ func toAPIOrgTagProtection(ctx *context.APIContext, rule *git_model.OrgProtected
 
 // ListOrgTagProtections list org-level tag protection rules
 func ListOrgTagProtections(ctx *context.APIContext) {
+	// swagger:operation GET /orgs/{org}/tag_protections organization orgListTagProtections
+	// ---
+	// summary: List an organization's tag protection rules
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: org
+	//   in: path
+	//   description: name of the organization
+	//   type: string
+	//   required: true
+	// responses:
+	//   "200":
+	//     "$ref": "#/responses/OrgTagProtectionList"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+
 	rules, err := git_model.FindOrgProtectedTags(ctx, ctx.Org.Organization.ID)
 	if err != nil {
 		ctx.APIErrorInternal(err)
@@ -55,6 +72,29 @@ func ListOrgTagProtections(ctx *context.APIContext) {
 
 // GetOrgTagProtection get a specific org-level tag protection rule
 func GetOrgTagProtection(ctx *context.APIContext) {
+	// swagger:operation GET /orgs/{org}/tag_protections/{id} organization orgGetTagProtection
+	// ---
+	// summary: Get a specific org-level tag protection rule
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: org
+	//   in: path
+	//   description: name of the organization
+	//   type: string
+	//   required: true
+	// - name: id
+	//   in: path
+	//   description: id of the tag protection rule
+	//   type: integer
+	//   format: int64
+	//   required: true
+	// responses:
+	//   "200":
+	//     "$ref": "#/responses/OrgTagProtection"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+
 	rule, err := git_model.GetOrgProtectedTagByID(ctx, ctx.Org.Organization.ID, ctx.PathParamInt64("id"))
 	if err != nil {
 		ctx.APIErrorInternal(err)
@@ -69,6 +109,33 @@ func GetOrgTagProtection(ctx *context.APIContext) {
 
 // CreateOrgTagProtection create an org-level tag protection rule
 func CreateOrgTagProtection(ctx *context.APIContext) {
+	// swagger:operation POST /orgs/{org}/tag_protections organization orgCreateTagProtection
+	// ---
+	// summary: Create an org-level tag protection rule
+	// consumes:
+	// - application/json
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: org
+	//   in: path
+	//   description: name of the organization
+	//   type: string
+	//   required: true
+	// - name: body
+	//   in: body
+	//   schema:
+	//     "$ref": "#/definitions/CreateOrgTagProtectionOption"
+	// responses:
+	//   "201":
+	//     "$ref": "#/responses/OrgTagProtection"
+	//   "403":
+	//     "$ref": "#/responses/forbidden"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+	//   "422":
+	//     "$ref": "#/responses/validationError"
+
 	form := web.GetForm(ctx).(*api.CreateOrgTagProtectionOption)
 	orgID := ctx.Org.Organization.ID
 
@@ -101,6 +168,37 @@ func CreateOrgTagProtection(ctx *context.APIContext) {
 
 // EditOrgTagProtection edit an org-level tag protection rule
 func EditOrgTagProtection(ctx *context.APIContext) {
+	// swagger:operation PATCH /orgs/{org}/tag_protections/{id} organization orgEditTagProtection
+	// ---
+	// summary: Edit an org-level tag protection rule. Only fields that are set will be changed
+	// consumes:
+	// - application/json
+	// produces:
+	// - application/json
+	// parameters:
+	// - name: org
+	//   in: path
+	//   description: name of the organization
+	//   type: string
+	//   required: true
+	// - name: id
+	//   in: path
+	//   description: id of the tag protection rule
+	//   type: integer
+	//   format: int64
+	//   required: true
+	// - name: body
+	//   in: body
+	//   schema:
+	//     "$ref": "#/definitions/EditOrgTagProtectionOption"
+	// responses:
+	//   "200":
+	//     "$ref": "#/responses/OrgTagProtection"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+	//   "422":
+	//     "$ref": "#/responses/validationError"
+
 	form := web.GetForm(ctx).(*api.EditOrgTagProtectionOption)
 	orgID := ctx.Org.Organization.ID
 
@@ -134,6 +232,27 @@ func EditOrgTagProtection(ctx *context.APIContext) {
 
 // DeleteOrgTagProtection delete an org-level tag protection rule
 func DeleteOrgTagProtection(ctx *context.APIContext) {
+	// swagger:operation DELETE /orgs/{org}/tag_protections/{id} organization orgDeleteTagProtection
+	// ---
+	// summary: Delete an org-level tag protection rule
+	// parameters:
+	// - name: org
+	//   in: path
+	//   description: name of the organization
+	//   type: string
+	//   required: true
+	// - name: id
+	//   in: path
+	//   description: id of the tag protection rule
+	//   type: integer
+	//   format: int64
+	//   required: true
+	// responses:
+	//   "204":
+	//     "$ref": "#/responses/empty"
+	//   "404":
+	//     "$ref": "#/responses/notFound"
+
 	orgID := ctx.Org.Organization.ID
 	rule, err := git_model.GetOrgProtectedTagByID(ctx, orgID, ctx.PathParamInt64("id"))
 	if err != nil {

routers/api/v1/repo/manifest.go

@@ -14,7 +14,7 @@ import (
 // apiMetadata is the JSON representation of a repo manifest.
 type apiMetadata struct {
 	Name             string `json:"name"`
-	Org              string `json:"org"`
+	Org              string `json:"org"` // read-only, derived from the org profile (repo owner)
 	Description      string `json:"description"`
 	LicenseSPDX      string `json:"license_spdx"`
 	LicenseName      string `json:"license_name"`
@@ -30,7 +30,7 @@ type apiMetadata struct {
 	TargetVersion    string `json:"target_version"`
 	PHPMinimum       string `json:"php_minimum"`
 	Language         string `json:"language"`
-	ExtensionType      string `json:"extension_type"`
+	ExtensionType    string `json:"extension_type"`
 	EntryPoint       string `json:"entry_point"`
 
 	// deploy
@@ -44,6 +44,13 @@ type apiMetadata struct {
 	HealthURL      string `json:"health_url,omitempty"`
 }
 
+// Manifest
+// swagger:response Manifest
+type swaggerResponseManifest struct {
+	// in:body
+	Body apiMetadata `json:"body"`
+}
+
 // GetRepoMetadata returns the manifest settings for a repository.
 func GetRepoMetadata(ctx *context.APIContext) {
 	// swagger:operation GET /repos/{owner}/{repo}/manifest repository repoGetManifest
@@ -51,6 +58,17 @@ func GetRepoMetadata(ctx *context.APIContext) {
 	// summary: Get repo manifest settings
 	// produces:
 	// - application/json
+	// parameters:
+	// - name: owner
+	//   in: path
+	//   description: owner of the repo
+	//   type: string
+	//   required: true
+	// - name: repo
+	//   in: path
+	//   description: name of the repo
+	//   type: string
+	//   required: true
 	// responses:
 	//   "200":
 	//     "$ref": "#/responses/Manifest"
@@ -65,15 +83,15 @@ func GetRepoMetadata(ctx *context.APIContext) {
 		// Return defaults from repo metadata.
 		ctx.JSON(http.StatusOK, &apiMetadata{
 			Name:        ctx.Repo.Repository.Name,
-			Org:         ctx.Repo.Repository.OwnerName,
+			Org:         ctx.Repo.Repository.DerivedOrgName(ctx),
 			Description: ctx.Repo.Repository.Description,
 		})
 		return
 	}
 	ctx.JSON(http.StatusOK, &apiMetadata{
-		Name:             m.Name,
-		Org:              m.Org,
-		Description:      m.Description,
+		Name:        m.Name,
+		Org:         ctx.Repo.Repository.DerivedOrgName(ctx),
+		Description: m.Description,
 
 		LicenseSPDX:      m.LicenseSPDX,
 		LicenseName:      m.LicenseName,
@@ -89,7 +107,7 @@ func GetRepoMetadata(ctx *context.APIContext) {
 		TargetVersion:    m.TargetVersion,
 		PHPMinimum:       m.PHPMinimum,
 		Language:         m.Language,
-		ExtensionType:      m.ExtensionType,
+		ExtensionType:    m.ExtensionType,
 		EntryPoint:       m.EntryPoint,
 		DeployHost:       m.DeployHost,
 		DeployPort:       m.DeployPort,
@@ -111,9 +129,21 @@ func UpdateRepoMetadata(ctx *context.APIContext) {
 	// - application/json
 	// produces:
 	// - application/json
+	// parameters:
+	// - name: owner
+	//   in: path
+	//   description: owner of the repo
+	//   type: string
+	//   required: true
+	// - name: repo
+	//   in: path
+	//   description: name of the repo
+	//   type: string
+	//   required: true
 	// responses:
 	//   "200":
 	//     "$ref": "#/responses/Manifest"
+
 	// Decode into a map to detect which fields were actually sent.
 	var raw map[string]any
 	if err := json.NewDecoder(ctx.Req.Body).Decode(&raw); err != nil {
@@ -127,7 +157,6 @@ func UpdateRepoMetadata(ctx *context.APIContext) {
 		m = &repo_model.RepoMetadata{
 			RepoID:      ctx.Repo.Repository.ID,
 			Name:        ctx.Repo.Repository.Name,
-			Org:         ctx.Repo.Repository.OwnerName,
 			Description: ctx.Repo.Repository.Description,
 		}
 	}
@@ -141,7 +170,8 @@ func UpdateRepoMetadata(ctx *context.APIContext) {
 		}
 	}
 	setStr("name", &m.Name)
-	setStr("org", &m.Org)
+	// org is intentionally ignored: it is derived from the org profile
+	// (repository owner) on read, not stored. See issue #771.
 	setStr("description", &m.Description)
 	setStr("license_spdx", &m.LicenseSPDX)
 	setStr("license_name", &m.LicenseName)
@@ -173,9 +203,9 @@ func UpdateRepoMetadata(ctx *context.APIContext) {
 	}
 
 	ctx.JSON(http.StatusOK, &apiMetadata{
-		Name:             m.Name,
-		Org:              m.Org,
-		Description:      m.Description,
+		Name:        m.Name,
+		Org:         ctx.Repo.Repository.DerivedOrgName(ctx),
+		Description: m.Description,
 
 		LicenseSPDX:      m.LicenseSPDX,
 		LicenseName:      m.LicenseName,
@@ -191,7 +221,7 @@ func UpdateRepoMetadata(ctx *context.APIContext) {
 		TargetVersion:    m.TargetVersion,
 		PHPMinimum:       m.PHPMinimum,
 		Language:         m.Language,
-		ExtensionType:      m.ExtensionType,
+		ExtensionType:    m.ExtensionType,
 		EntryPoint:       m.EntryPoint,
 		DeployHost:       m.DeployHost,
 		DeployPort:       m.DeployPort,

routers/api/v1/swagger/options.go

@@ -159,6 +159,44 @@ type swaggerParameterBodies struct {
 	// in:body
 	UpdateBranchProtectionPriories api.UpdateBranchProtectionPriories
 
+	// in:body
+	CreateOrgBranchProtectionOption api.CreateOrgBranchProtectionOption
+	// in:body
+	EditOrgBranchProtectionOption api.EditOrgBranchProtectionOption
+
+	// in:body
+	CreateOrgTagProtectionOption api.CreateOrgTagProtectionOption
+	// in:body
+	EditOrgTagProtectionOption api.EditOrgTagProtectionOption
+
+	// in:body
+	EditOrgPushPolicyOption api.EditOrgPushPolicyOption
+
+	// in:body
+	EditOrgRepoDefaultsOption api.EditOrgRepoDefaultsOption
+
+	// in:body
+	EditOrgEmailDomainPolicyOption api.EditOrgEmailDomainPolicyOption
+
+	// in:body
+	EditAccessTokenOption api.EditAccessTokenOption
+
+	// in:body
+	IssueBulkAssigneesOption api.IssueBulkAssigneesOption
+	// in:body
+	IssueBulkLabelsOption api.IssueBulkLabelsOption
+	// in:body
+	IssueBulkMilestoneOption api.IssueBulkMilestoneOption
+	// in:body
+	IssueBulkStateOption api.IssueBulkStateOption
+
+	// in:body
+	IssuePriorityDef api.IssuePriorityDef
+	// in:body
+	IssueStatusDef api.IssueStatusDef
+	// in:body
+	IssueTypeDef api.IssueTypeDef
+
 	// in:body
 	CreateOAuth2ApplicationOptions api.CreateOAuth2ApplicationOptions
 

routers/api/v1/swagger/org.go

@@ -41,3 +41,52 @@ type swaggerResponseOrganizationPermissions struct {
 	// in:body
 	Body api.OrganizationPermissions `json:"body"`
 }
+
+// OrgBranchProtection
+// swagger:response OrgBranchProtection
+type swaggerResponseOrgBranchProtection struct {
+	// in:body
+	Body api.OrgBranchProtection `json:"body"`
+}
+
+// OrgBranchProtectionList
+// swagger:response OrgBranchProtectionList
+type swaggerResponseOrgBranchProtectionList struct {
+	// in:body
+	Body []*api.OrgBranchProtection `json:"body"`
+}
+
+// OrgTagProtection
+// swagger:response OrgTagProtection
+type swaggerResponseOrgTagProtection struct {
+	// in:body
+	Body api.OrgTagProtection `json:"body"`
+}
+
+// OrgTagProtectionList
+// swagger:response OrgTagProtectionList
+type swaggerResponseOrgTagProtectionList struct {
+	// in:body
+	Body []*api.OrgTagProtection `json:"body"`
+}
+
+// OrgPushPolicy
+// swagger:response OrgPushPolicy
+type swaggerResponseOrgPushPolicy struct {
+	// in:body
+	Body api.OrgPushPolicy `json:"body"`
+}
+
+// OrgRepoDefaults
+// swagger:response OrgRepoDefaults
+type swaggerResponseOrgRepoDefaults struct {
+	// in:body
+	Body api.OrgRepoDefaults `json:"body"`
+}
+
+// OrgEmailDomainPolicy
+// swagger:response OrgEmailDomainPolicy
+type swaggerResponseOrgEmailDomainPolicy struct {
+	// in:body
+	Body api.OrgEmailDomainPolicy `json:"body"`
+}

routers/private/hook_pre_receive.go

@@ -646,7 +646,7 @@ func (ctx *preReceiveContext) checkOrgPushPolicyBranch(oldCommitID, newCommitID,
 	}
 
 	if policy.MaxFileSize > 0 {
-		if path, size := ctx.largestBlobOverLimit(newCommitID, policy.MaxFileSize); path != "" {
+		if path, size := ctx.largestBlobOverLimit(oldCommitID, newCommitID, policy.MaxFileSize); path != "" {
 			ctx.JSON(http.StatusForbidden, private.Response{
 				UserMsg: fmt.Sprintf("Push rejected by the organization push policy: %q is %d bytes, over the %d-byte limit", path, size, policy.MaxFileSize),
 			})
@@ -673,34 +673,90 @@ func (ctx *preReceiveContext) checkOrgPushPolicyTag(tagName string) bool {
 	return true
 }
 
-// largestBlobOverLimit returns the first file (and its size) in the pushed tip tree
-// that exceeds limit bytes, or ("", 0) if none — or on any error (fail open).
-func (ctx *preReceiveContext) largestBlobOverLimit(commitID string, limit int64) (string, int64) {
-	output, _, err := gitrepo.RunCmdString(ctx,
-		ctx.Repo.Repository,
-		gitcmd.NewCommand("ls-tree", "-r", "--long").
-			AddDynamicArguments(commitID).
-			WithEnv(ctx.env),
-	)
-	if err != nil {
-		log.Error("org push policy ls-tree for %-v: %v", ctx.Repo.Repository, err)
+// largestBlobOverLimit returns the first file (and its size) added or modified by the
+// push (oldCommitID..newCommitID) whose blob exceeds limit bytes, or ("", 0) if none —
+// or on any error (fail open). Only the pushed delta is inspected so a pre-existing
+// oversized file committed before the policy existed cannot permanently block unrelated
+// pushes. For a new branch (no old commit) the full new tree is scanned, since every
+// blob is effectively introduced by the push.
+func (ctx *preReceiveContext) largestBlobOverLimit(oldCommitID, newCommitID string, limit int64) (string, int64) {
+	emptyID := ctx.Repo.GetObjectFormat().EmptyObjectID().String()
+
+	// New branch: no base commit to diff against, so scan the full tip tree. ls-tree
+	// --long carries the blob size inline, so no extra sizing pass is needed.
+	if oldCommitID == "" || oldCommitID == emptyID {
+		output, _, err := gitrepo.RunCmdString(ctx, ctx.Repo.Repository,
+			gitcmd.NewCommand("ls-tree", "-r", "--long").AddDynamicArguments(newCommitID).WithEnv(ctx.env))
+		if err != nil {
+			log.Error("org push policy ls-tree for %-v: %v", ctx.Repo.Repository, err)
+			return "", 0
+		}
+		for _, line := range strings.Split(output, "\n") {
+			tab := strings.IndexByte(line, '\t')
+			if tab < 0 {
+				continue
+			}
+			fields := strings.Fields(line[:tab]) // mode, type, hash, size
+			if len(fields) < 4 || fields[1] != "blob" {
+				continue
+			}
+			if size, perr := strconv.ParseInt(fields[3], 10, 64); perr == nil && size > limit {
+				return line[tab+1:], size
+			}
+		}
 		return "", 0
 	}
+
+	// Existing branch: inspect only blobs added or modified by this push. diff-tree
+	// gives the changed paths and their new object ids but not sizes, so collect the
+	// candidate blob ids and size them in a single cat-file --batch-check pass.
+	output, _, err := gitrepo.RunCmdString(ctx, ctx.Repo.Repository,
+		gitcmd.NewCommand("diff-tree", "--no-commit-id", "-r").AddDynamicArguments(oldCommitID, newCommitID).WithEnv(ctx.env))
+	if err != nil {
+		log.Error("org push policy diff-tree for %-v: %v", ctx.Repo.Repository, err)
+		return "", 0
+	}
+	shaToPath := make(map[string]string)
+	var order []string
 	for _, line := range strings.Split(output, "\n") {
 		tab := strings.IndexByte(line, '\t')
 		if tab < 0 {
 			continue
 		}
-		fields := strings.Fields(line[:tab]) // mode, type, hash, size
-		if len(fields) < 4 || fields[1] != "blob" {
+		fields := strings.Fields(line[:tab]) // ":oldmode newmode oldsha newsha status"
+		if len(fields) < 5 {
 			continue
 		}
-		size, perr := strconv.ParseInt(fields[3], 10, 64)
-		if perr != nil {
+		newMode, newSha, status := fields[1], fields[3], fields[4]
+		// Only regular, executable, or symlink blobs; skip submodule gitlinks (160000).
+		if newMode != "100644" && newMode != "100755" && newMode != "120000" {
 			continue
 		}
-		if size > limit {
-			return line[tab+1:], size
+		if status == "D" || newSha == emptyID {
+			continue
+		}
+		if _, seen := shaToPath[newSha]; !seen {
+			order = append(order, newSha)
+		}
+		shaToPath[newSha] = line[tab+1:]
+	}
+	if len(order) == 0 {
+		return "", 0
+	}
+
+	output, _, err = gitrepo.RunCmdString(ctx, ctx.Repo.Repository,
+		gitcmd.NewCommand("cat-file", "--batch-check").WithStdinBytes([]byte(strings.Join(order, "\n")+"\n")).WithEnv(ctx.env))
+	if err != nil {
+		log.Error("org push policy cat-file for %-v: %v", ctx.Repo.Repository, err)
+		return "", 0
+	}
+	for _, line := range strings.Split(output, "\n") {
+		fields := strings.Fields(line) // "<sha> <type> <size>" or "<sha> missing"
+		if len(fields) != 3 || fields[1] != "blob" {
+			continue
+		}
+		if size, perr := strconv.ParseInt(fields[2], 10, 64); perr == nil && size > limit {
+			return shaToPath[fields[0]], size
 		}
 	}
 	return "", 0

routers/web/admin/branding.go

@@ -137,27 +137,49 @@ func BrandingUpload(ctx *context.Context) {
 		return
 	}
 
-	destPath := filepath.Join(imgDir, filename)
-	dest, err := os.Create(destPath)
-	if err != nil {
-		ctx.Flash.Error("Failed to save image")
-		log.Error("Create %s: %v", destPath, err)
-		ctx.Redirect(setting.AppSubURL + "/-/admin/branding")
-		return
-	}
-	defer dest.Close()
-
-	if _, err := io.Copy(dest, file); err != nil {
-		ctx.Flash.Error("Failed to write image")
-		log.Error("Copy to %s: %v", destPath, err)
-		ctx.Redirect(setting.AppSubURL + "/-/admin/branding")
-		return
+	// The nav icon doubles as the app icon (logo.png) — used as the PWA / web
+	// manifest icon and the navbar fallback — so branding the nav icon brands
+	// the app icon too. Write the uploaded image to both in a single pass. See #773.
+	targets := []string{filename}
+	if imageType == "nav-icon" {
+		targets = append(targets, "logo.png")
 	}
 
-	// Remove SVG override if present
-	svgPath := filepath.Join(imgDir, filename[:len(filename)-4]+".svg")
-	if fileExists(svgPath) {
-		os.Remove(svgPath)
+	// Write the uploaded image to each target independently (rewinding the
+	// stream between targets) so a failure on a later target never leaves an
+	// earlier one truncated/empty.
+	for i, name := range targets {
+		if i > 0 {
+			if _, err := file.Seek(0, io.SeekStart); err != nil {
+				ctx.Flash.Error("Failed to write image")
+				log.Error("Seek branding image %s: %v", name, err)
+				ctx.Redirect(setting.AppSubURL + "/-/admin/branding")
+				return
+			}
+		}
+
+		destPath := filepath.Join(imgDir, name)
+		dest, err := os.Create(destPath)
+		if err != nil {
+			ctx.Flash.Error("Failed to save image")
+			log.Error("Create %s: %v", destPath, err)
+			ctx.Redirect(setting.AppSubURL + "/-/admin/branding")
+			return
+		}
+		if _, err := io.Copy(dest, file); err != nil {
+			dest.Close()
+			ctx.Flash.Error("Failed to write image")
+			log.Error("Copy to %s: %v", destPath, err)
+			ctx.Redirect(setting.AppSubURL + "/-/admin/branding")
+			return
+		}
+		dest.Close()
+
+		// Remove any SVG override so the uploaded PNG takes effect.
+		svgPath := filepath.Join(imgDir, name[:len(name)-4]+".svg")
+		if fileExists(svgPath) {
+			os.Remove(svgPath)
+		}
 	}
 
 	ctx.Flash.Success("Branding image updated: " + imageType)
@@ -183,16 +205,36 @@ func BrandingReset(ctx *context.Context) {
 		return
 	}
 
-	path := filepath.Join(brandingImageDir(), filename)
-	if fileExists(path) {
+	// The nav icon also sets the app icon (logo.png), so resetting it reverts
+	// both back to the built-in default. See #773.
+	targets := []string{filename}
+	if imageType == "nav-icon" {
+		targets = append(targets, "logo.png")
+	}
+
+	removedAny := false
+	failed := false
+	for _, name := range targets {
+		path := filepath.Join(brandingImageDir(), name)
+		if !fileExists(path) {
+			continue
+		}
 		if err := os.Remove(path); err != nil {
 			ctx.Flash.Error("Failed to remove custom image")
 			log.Error("Remove %s: %v", path, err)
+			failed = true
 		} else {
-			ctx.Flash.Success("Reset to default: " + imageType)
-			log.Info("Branding reset to default: %s", filename)
+			removedAny = true
+			log.Info("Branding reset to default: %s", name)
 		}
-	} else {
+	}
+
+	switch {
+	case failed:
+		// error flash already set
+	case removedAny:
+		ctx.Flash.Success("Reset to default: " + imageType)
+	default:
 		ctx.Flash.Info("Already using default: " + imageType)
 	}
 

routers/web/admin/metadata.go

@@ -0,0 +1,71 @@
+// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package admin
+
+import (
+	"net/http"
+	"strings"
+
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/log"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/setting"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/templates"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
+)
+
+const tplMetadata templates.TplName = "admin/metadata"
+
+// Metadata shows the admin metadata-settings page.
+func Metadata(ctx *context.Context) {
+	ctx.Data["Title"] = "Metadata"
+	ctx.Data["PageIsAdminMetadata"] = true
+	ctx.Data["PlatformOptions"] = strings.Join(setting.Metadata.PlatformOptions, "\n")
+	ctx.HTML(http.StatusOK, tplMetadata)
+}
+
+// parsePlatformOptions normalizes admin input (comma- or newline-separated) into
+// a clean, lowercased, de-duplicated, order-preserving list of platform values.
+func parsePlatformOptions(raw string) []string {
+	seen := make(map[string]bool)
+	var out []string
+	for _, tok := range strings.FieldsFunc(raw, func(r rune) bool { return r == ',' || r == '\n' || r == '\r' }) {
+		v := strings.ToLower(strings.TrimSpace(tok))
+		if v == "" || seen[v] {
+			continue
+		}
+		seen[v] = true
+		out = append(out, v)
+	}
+	return out
+}
+
+// MetadataSettings persists the admin metadata settings.
+func MetadataSettings(ctx *context.Context) {
+	opts := parsePlatformOptions(ctx.FormString("platform_options"))
+	if len(opts) == 0 {
+		ctx.Flash.Error("Platform options cannot be empty")
+		ctx.Redirect(setting.AppSubURL + "/-/admin/metadata")
+		return
+	}
+
+	// Apply in-memory so the change takes effect without a restart.
+	setting.Metadata.PlatformOptions = opts
+
+	// Persist to app.ini [metadata] PLATFORM_OPTIONS.
+	cfg, err := setting.NewConfigProviderFromFile(setting.CustomConf)
+	if err != nil {
+		ctx.Flash.Error("Failed to load config: " + err.Error())
+		ctx.Redirect(setting.AppSubURL + "/-/admin/metadata")
+		return
+	}
+	cfg.Section("metadata").Key("PLATFORM_OPTIONS").SetValue(strings.Join(opts, ","))
+	if err := cfg.SaveTo(setting.CustomConf); err != nil {
+		ctx.Flash.Error("Failed to save config: " + err.Error())
+		log.Error("SaveTo %s: %v", setting.CustomConf, err)
+	} else {
+		ctx.Flash.Success("Metadata settings saved")
+		log.Info("Metadata platform options updated: %v", opts)
+	}
+
+	ctx.Redirect(setting.AppSubURL + "/-/admin/metadata")
+}

routers/web/repo/issue_comment.go

@@ -185,7 +185,7 @@ func NewComment(ctx *context.Context) {
 	} // end if: handle close or reopen
 
 	// Handle custom status from the status dropdown (replaces close button for issues with org statuses).
-	if statusIDStr := ctx.Req.FormValue("status_id"); statusIDStr != "" && statusIDStr != "" {
+	if statusIDStr := ctx.Req.FormValue("status_id"); statusIDStr != "" {
 		if statusIDStr == "reopen" {
 			// Reopen via dropdown
 			if issue.IsClosed {

routers/web/repo/setting/metadata.go

@@ -10,6 +10,7 @@ import (
 
 	issues_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/issues"
 	repo_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/setting"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/templates"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
 )
@@ -35,11 +36,32 @@ func Metadata(ctx *context.Context) {
 		manifest = &repo_model.RepoMetadata{
 			RepoID:      repoID,
 			Name:        ctx.Repo.Repository.Name,
-			Org:         ctx.Repo.Repository.OwnerName,
 			Description: ctx.Repo.Repository.Description,
 		}
 	}
 	ctx.Data["Manifest"] = manifest
+	// Organization is derived from the org profile (repo owner), not stored.
+	// It is displayed read-only. See issue #771.
+	ctx.Data["DerivedOrg"] = ctx.Repo.Repository.DerivedOrgName(ctx)
+
+	// Platform dropdown options come from the admin-configurable setting
+	// (Admin -> Metadata). Keep the repo's current value selectable even if it
+	// was later removed from the list, so saving does not silently drop it.
+	// See issue #777.
+	platformOpts := append([]string(nil), setting.Metadata.PlatformOptions...)
+	if manifest.Platform != "" {
+		found := false
+		for _, p := range platformOpts {
+			if p == manifest.Platform {
+				found = true
+				break
+			}
+		}
+		if !found {
+			platformOpts = append([]string{manifest.Platform}, platformOpts...)
+		}
+	}
+	ctx.Data["PlatformOptions"] = platformOpts
 
 	// Load repo-scoped custom fields.
 	fields, _ := issues_model.GetCustomFieldsByOwner(ctx, ownerID, issues_model.CustomFieldScopeRepo)
@@ -100,9 +122,9 @@ func saveMetadata(ctx *context.Context) {
 	existing, _ := repo_model.GetRepoMetadata(ctx, ctx.Repo.Repository.ID)
 
 	manifest := &repo_model.RepoMetadata{
-		RepoID:        ctx.Repo.Repository.ID,
-		Name:          ctx.FormString("name"),
-		Org:           ctx.FormString("org"),
+		RepoID: ctx.Repo.Repository.ID,
+		Name:   ctx.FormString("name"),
+		// org is not stored: it is derived from the org profile on read. See issue #771.
 		Description:   ctx.Repo.Repository.Description,
 		LicenseSPDX:   spdx,
 		LicenseName:   licenseName,
@@ -111,7 +133,7 @@ func saveMetadata(ctx *context.Context) {
 		InfoURL:       ctx.FormString("info_url"),
 		TargetVersion: ctx.FormString("target_version"),
 		PHPMinimum:    ctx.FormString("php_minimum"),
-		ExtensionType:   ctx.FormString("extension_type"),
+		ExtensionType: ctx.FormString("extension_type"),
 		EntryPoint:    ctx.FormString("entry_point"),
 	}
 
@@ -158,4 +180,3 @@ func saveCustomFields(ctx *context.Context) {
 	ctx.Flash.Success("Custom fields saved")
 	ctx.Redirect(ctx.Repo.RepoLink + "/settings/metadata")
 }
-

routers/web/repo/setting/org_inherited_settings.go

@@ -1,51 +0,0 @@
-// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
-// SPDX-License-Identifier: GPL-3.0-or-later
-
-package setting
-
-import (
-	git_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/git"
-	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
-)
-
-// prepareOrgPushPolicyView surfaces the owning organization's push policy (if any)
-// as a read-only informational section on the repo's branch protection settings page.
-// The policy is enforced org-wide in the pre-receive hook and cannot be edited from
-// the repository. Template data is only populated when the repo is owned by an
-// organization that has a push policy configured (nil policy renders nothing).
-// See issue #738.
-func prepareOrgPushPolicyView(ctx *context.Context) error {
-	if !ctx.Repo.Owner.IsOrganization() {
-		return nil
-	}
-	policy, err := git_model.GetOrgPushPolicyForRepo(ctx, ctx.Repo.Repository)
-	if err != nil {
-		return err
-	}
-	if policy == nil {
-		return nil
-	}
-	ctx.Data["OrgPushPolicy"] = policy
-	return nil
-}
-
-// prepareOrgRepoDefaultsView surfaces the owning organization's repository defaults
-// (if any) as a read-only informational section. These defaults are applied when a
-// repository is created in, or transferred into, the organization; they are shown
-// for reference only and are not editable here. Template data is only populated when
-// the repo is owned by an organization that has repo defaults configured (nil renders
-// nothing). See issue #738.
-func prepareOrgRepoDefaultsView(ctx *context.Context) error {
-	if !ctx.Repo.Owner.IsOrganization() {
-		return nil
-	}
-	defaults, err := git_model.GetOrgRepoDefaultsForRepo(ctx, ctx.Repo.Repository)
-	if err != nil {
-		return err
-	}
-	if defaults == nil {
-		return nil
-	}
-	ctx.Data["OrgRepoDefaults"] = defaults
-	return nil
-}

routers/web/repo/setting/protected_branch.go

@@ -112,16 +112,6 @@ func ProtectedBranchRules(ctx *context.Context) {
 			ctx.ServerError("prepareOrgProtectedBranches", err)
 			return
 		}
-		// Surface the org-wide push policy and the org repo defaults that apply to
-		// this repo (read-only, informational). See issue #738.
-		if err := prepareOrgPushPolicyView(ctx); err != nil {
-			ctx.ServerError("prepareOrgPushPolicyView", err)
-			return
-		}
-		if err := prepareOrgRepoDefaultsView(ctx); err != nil {
-			ctx.ServerError("prepareOrgRepoDefaultsView", err)
-			return
-		}
 	}
 
 	repo.PrepareBranchList(ctx)

routers/web/web.go

@@ -786,6 +786,11 @@ func registerWebRoutes(m *web.Router, webAuth *AuthMiddleware) {
 			m.Get("/reset", admin.BrandingReset)
 		})
 
+		m.Group("/metadata", func() {
+			m.Get("", admin.Metadata)
+			m.Post("/settings", admin.MetadataSettings)
+		})
+
 		m.Group("/monitor", func() {
 			m.Get("/stats", admin.MonitorStats)
 			m.Get("/cron", admin.CronTasks)
@@ -1239,7 +1244,7 @@ func registerWebRoutes(m *web.Router, webAuth *AuthMiddleware) {
 		}, repo_setting.SettingsCtxData)
 		m.Combo("/metadata").Get(repo_setting.Metadata).Post(repo_setting.MetadataPost)
 		m.Combo("/updateserver").Get(repo_setting.UpdateServerSettings).Post(repo_setting.UpdateServerSettingsPost)
-		m.Combo("/manifest").Get(repo_setting.LicensingSettings).Post(repo_setting.LicensingSettingsPost) // redirect
+		m.Combo("/manifest").Get(repo_setting.LicensingSettings).Post(repo_setting.LicensingSettingsPost)  // redirect
 		m.Combo("/licensing").Get(repo_setting.LicensingSettings).Post(repo_setting.LicensingSettingsPost) // redirect
 		m.Group("/security", func() {
 			m.Combo("").Get(repo_setting.SecuritySettings).Post(repo_setting.SecuritySettingsPost)

services/release/release.go

@@ -11,8 +11,8 @@ import (
 
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/db"
 	git_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/git"
-	updateserver_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/updateserver"
 	repo_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
+	updateserver_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/updateserver"
 	user_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/user"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/container"
 	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/git"

services/repository/manifest_sync.go

@@ -1,115 +0,0 @@
-// Copyright 2026 Moko Consulting <hello@mokoconsulting.tech>
-// SPDX-License-Identifier: GPL-3.0-or-later
-
-package repository
-
-import (
-	"context"
-	"encoding/xml"
-
-	repo_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/repo"
-	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/git"
-	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/log"
-)
-
-// manifestXML mirrors the .mokogitea/manifest.xml schema for XML parsing.
-type manifestXML struct {
-	XMLName      xml.Name             `xml:"mokoplatform"`
-	Identity     manifestIdentity     `xml:"identity"`
-	Governance   manifestGovernance   `xml:"governance"`
-	Distribution manifestDistribution `xml:"distribution"`
-	Build        manifestBuild        `xml:"build"`
-}
-
-type manifestDistribution struct {
-	DisplayName   string `xml:"display-name"`
-	Maintainer    string `xml:"maintainer"`
-	MaintainerURL string `xml:"maintainer-url"`
-	InfoURL       string `xml:"info-url"`
-	TargetVersion string `xml:"target-version"`
-	PHPMinimum    string `xml:"php-minimum"`
-}
-
-type manifestIdentity struct {
-	Name          string          `xml:"name"`
-	Org           string          `xml:"org"`
-	Description   string          `xml:"description"`
-	VersionPrefix string          `xml:"version-prefix"`
-	ElementName   string          `xml:"element-name"`
-	License       manifestLicense `xml:"license"`
-}
-
-type manifestLicense struct {
-	SPDX string `xml:"spdx,attr"`
-	Name string `xml:",chardata"`
-}
-
-type manifestGovernance struct {
-	Platform         string `xml:"platform"`
-	StandardsVersion string `xml:"standards-version"`
-	StandardsSource  string `xml:"standards-source"`
-}
-
-type manifestBuild struct {
-	Language    string `xml:"language"`
-	ExtensionType string `xml:"package-type"`
-	EntryPoint  string `xml:"entry-point"`
-}
-
-// SyncMetadataFromCommit reads .mokogitea/manifest.xml from the given commit
-// and upserts the values into the repo_manifest database table.
-// This is called on push to the default branch to keep the database in sync
-// with the XML file. If no manifest.xml exists, this is a no-op.
-func SyncMetadataFromCommit(ctx context.Context, repo *repo_model.Repository, commit *git.Commit) {
-	if commit == nil {
-		return
-	}
-
-	entry, err := commit.GetTreeEntryByPath(".mokogitea/manifest.xml")
-	if err != nil || entry == nil {
-		return // no manifest.xml — not an error
-	}
-
-	reader, err := entry.Blob().DataAsync()
-	if err != nil {
-		log.Error("SyncMetadata: read blob for %s: %v", repo.FullName(), err)
-		return
-	}
-	defer reader.Close()
-
-	var mxml manifestXML
-	decoder := xml.NewDecoder(reader)
-	if err := decoder.Decode(&mxml); err != nil {
-		log.Error("SyncMetadata: parse XML for %s: %v", repo.FullName(), err)
-		return
-	}
-
-	manifest := &repo_model.RepoMetadata{
-		RepoID:           repo.ID,
-		Name:             mxml.Identity.Name,
-		Org:              mxml.Identity.Org,
-		Description:      mxml.Identity.Description,
-		VersionPrefix:    mxml.Identity.VersionPrefix,
-		ElementName:      mxml.Identity.ElementName,
-		LicenseSPDX:      mxml.Identity.License.SPDX,
-		LicenseName:      mxml.Identity.License.Name,
-		Platform:         mxml.Governance.Platform,
-		StandardsVersion: mxml.Governance.StandardsVersion,
-		StandardsSource:  mxml.Governance.StandardsSource,
-		Maintainer:       mxml.Distribution.Maintainer,
-		MaintainerURL:    mxml.Distribution.MaintainerURL,
-		InfoURL:          mxml.Distribution.InfoURL,
-		TargetVersion:    mxml.Distribution.TargetVersion,
-		PHPMinimum:       mxml.Distribution.PHPMinimum,
-		Language:         mxml.Build.Language,
-		ExtensionType:      mxml.Build.ExtensionType,
-		EntryPoint:       mxml.Build.EntryPoint,
-	}
-
-	if err := repo_model.CreateOrUpdateRepoMetadata(ctx, manifest); err != nil {
-		log.Error("SyncMetadata: save for %s: %v", repo.FullName(), err)
-		return
-	}
-
-	log.Info("SyncMetadata: synced .mokogitea/manifest.xml for %s", repo.FullName())
-}

services/repository/push.go

@@ -194,8 +194,6 @@ func pushUpdates(optsList []*repo_module.PushUpdateOptions) error {
 					if err := DelRepoDivergenceFromCache(ctx, repo.ID); err != nil {
 						log.Error("DelRepoDivergenceFromCache: %v", err)
 					}
-					// Auto-sync .mokogitea/manifest.xml to database on default branch push
-					SyncMetadataFromCommit(ctx, repo, newCommit)
 					// Run security scanners on default branch push
 					security_service.ScanOnPush(ctx, repo, newCommit)
 				} else {

services/security/code_scanner.go

@@ -160,7 +160,7 @@ var DefaultCodeRules = []CodeRule{
 	{
 		ID: "deserialize-yaml-py", Title: "Insecure Deserialization: yaml.load() (Python)",
 		Severity: security_model.SeverityHigh, CWE: "CWE-502",
-		Pattern:     regexp.MustCompile(`yaml\.load\s*\([^)]*(?:Loader\s*=\s*yaml\.(?:Unsafe|Full)Loader|[^)]*\)(?!\s*#))`),
+		Pattern:     regexp.MustCompile(`(?i)yaml\.load\s*\(`),
 		Description: "yaml.load() without SafeLoader allows arbitrary code execution — use yaml.safe_load()",
 		Languages:   []string{".py"},
 	},

services/security/code_scanner_test.go

@@ -0,0 +1,23 @@
+// Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package security
+
+import "testing"
+
+// TestDefaultCodeRulesCompile forces the package init, which builds every scanner
+// rule's regexp via regexp.MustCompile, and asserts each pattern is present. Go's
+// regexp engine is RE2 and rejects Perl-only constructs (lookahead/lookbehind/
+// backreferences) by panicking in MustCompile at init — which crash-loops the
+// server at startup. This test executes that init so such a pattern fails CI here
+// instead of on a live deploy.
+func TestDefaultCodeRulesCompile(t *testing.T) {
+	if len(DefaultCodeRules) == 0 {
+		t.Fatal("DefaultCodeRules is empty")
+	}
+	for _, r := range DefaultCodeRules {
+		if r.Pattern == nil {
+			t.Errorf("rule %q has a nil Pattern", r.ID)
+		}
+	}
+}

services/updateserver/joomla.go

@@ -269,11 +269,8 @@ func GenerateJoomlaXML(ctx context.Context, repo *repo_model.Repository, require
 	phpMinimum := meta.PHPMinimum
 	feedDescription := meta.Description
 
-	// Maintainer and URL always come from the org profile.
-	maintainer := repo.Owner.FullName
-	if maintainer == "" {
-		maintainer = repo.Owner.Name
-	}
+	// Maintainer/organization and URL always come from the org profile.
+	maintainer := repo.DerivedOrgName(ctx)
 	maintainerURL := repo.Owner.Website
 	if maintainerURL == "" {
 		maintainerURL = fmt.Sprintf("%s/%s", baseURL, repo.Owner.Name)

templates/admin/branding.tmpl

@@ -54,7 +54,7 @@
 					<tr>
 						<td>
 							<strong>Nav Icon</strong> {{if .HasNavIcon}}<span class="ui mini green label">Custom</span>{{else}}<span class="ui mini grey label">Default</span>{{end}}
-							<div class="tw-text-text-light tw-text-sm tw-mt-1">Top-left corner across all pages. Square, 30x30px.</div>
+							<div class="tw-text-text-light tw-text-sm tw-mt-1">Top-left corner across all pages. Square, 30x30px. Also sets the app icon (PWA / web manifest); use at least 512x512px for a crisp installed icon.</div>
 						</td>
 						<td>
 							<form method="post" action="{{AppSubUrl}}/-/admin/branding/upload" enctype="multipart/form-data">

templates/admin/metadata.tmpl

@@ -0,0 +1,19 @@
+{{template "admin/layout_head" (dict "pageClass" "admin metadata")}}
+	<div class="admin-setting-content">
+		<h4 class="ui top attached header">
+			{{svg "octicon-list-unordered" 16}} Metadata
+		</h4>
+		<div class="ui attached segment">
+			<h5>Platform Options</h5>
+			<p class="tw-text-text-light tw-text-sm">Allowed values for the repository metadata <strong>Platform</strong> field. One per line (or comma-separated). Changes take effect immediately and are saved to <code>app.ini</code> <code>[metadata] PLATFORM_OPTIONS</code>.</p>
+			<form method="post" action="{{AppSubUrl}}/-/admin/metadata/settings">
+				{{.CsrfTokenHtml}}
+				<div class="field">
+					<textarea name="platform_options" rows="6" class="tw-w-full tw-font-mono" placeholder="joomla&#10;dolibarr&#10;go&#10;npm&#10;generic">{{.PlatformOptions}}</textarea>
+				</div>
+				<button type="submit" class="ui primary small button tw-mt-2">{{svg "octicon-check" 14}} Save Settings</button>
+			</form>
+			<p class="tw-text-text-light tw-text-sm tw-mt-3">Existing repositories keep their stored platform value even if it is later removed from this list; it simply won't be offered to other repos.</p>
+		</div>
+	</div>
+{{template "admin/layout_footer" .}}

templates/admin/navbar.tmpl

@@ -87,6 +87,9 @@
 		<a class="{{if .PageIsAdminBranding}}active {{end}}item" href="{{AppSubUrl}}/-/admin/branding">
 			{{svg "octicon-paintbrush" 16}} Branding
 		</a>
+		<a class="{{if .PageIsAdminMetadata}}active {{end}}item" href="{{AppSubUrl}}/-/admin/metadata">
+			{{svg "octicon-list-unordered" 16}} Metadata
+		</a>
 		<a class="{{if .PageIsAdminLicenseTiers}}active {{end}}item" href="{{AppSubUrl}}/-/admin/license-tiers">
 			{{svg "octicon-key" 16}} License Tiers
 		</a>

templates/repo/settings/branches.tmpl

@@ -144,98 +144,6 @@
 					</div>
 				</div>
 			{{end}}
-
-			{{if .OrgPushPolicy}}
-				<h4 class="ui top attached header">
-					{{ctx.Locale.Tr "repo.settings.org_push_policy"}}
-				</h4>
-				<div class="ui attached segment">
-					<p class="tw-mb-3">
-						{{svg "octicon-organization" 12}} {{ctx.Locale.Tr "repo.settings.org_push_policy.inherited"}}
-						<span class="text grey tw-text-sm tw-ml-2">{{svg "octicon-lock" 12}} {{ctx.Locale.Tr "repo.settings.org_push_policy.read_only"}}</span>
-					</p>
-					<p class="tw-mb-3">{{ctx.Locale.Tr "repo.settings.org_push_policy_desc"}}</p>
-					<table class="ui very basic compact table tw-w-auto">
-						<tbody>
-							{{if .OrgPushPolicy.BranchNamePattern}}
-								<tr>
-									<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_push_policy.branch_pattern"}}</td>
-									<td><code>{{.OrgPushPolicy.BranchNamePattern}}</code></td>
-								</tr>
-							{{end}}
-							{{if .OrgPushPolicy.TagNamePattern}}
-								<tr>
-									<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_push_policy.tag_pattern"}}</td>
-									<td><code>{{.OrgPushPolicy.TagNamePattern}}</code></td>
-								</tr>
-							{{end}}
-							{{if .OrgPushPolicy.RequireSecretBlock}}
-								<tr>
-									<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_push_policy.require_secret_block"}}</td>
-									<td>{{svg "octicon-check" 14}} {{ctx.Locale.Tr "repo.settings.org_push_policy.enabled"}}</td>
-								</tr>
-							{{end}}
-							{{if gt .OrgPushPolicy.MaxFileSize 0}}
-								<tr>
-									<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_push_policy.max_file_size"}}</td>
-									<td>{{FileSize .OrgPushPolicy.MaxFileSize}}</td>
-								</tr>
-							{{end}}
-							{{if .OrgPushPolicy.BlockedFilePatterns}}
-								<tr>
-									<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_push_policy.blocked_files"}}</td>
-									<td><code>{{.OrgPushPolicy.BlockedFilePatterns}}</code></td>
-								</tr>
-							{{end}}
-						</tbody>
-					</table>
-				</div>
-			{{end}}
-
-			{{if .OrgRepoDefaults}}
-				<h4 class="ui top attached header">
-					{{ctx.Locale.Tr "repo.settings.org_repo_defaults"}}
-				</h4>
-				<div class="ui attached segment">
-					<p class="tw-mb-3">
-						{{svg "octicon-organization" 12}} {{ctx.Locale.Tr "repo.settings.org_repo_defaults.inherited"}}
-						<span class="text grey tw-text-sm tw-ml-2">{{svg "octicon-lock" 12}} {{ctx.Locale.Tr "repo.settings.org_repo_defaults.read_only"}}</span>
-					</p>
-					<p class="tw-mb-3">{{ctx.Locale.Tr "repo.settings.org_repo_defaults_desc"}}</p>
-					<table class="ui very basic compact table tw-w-auto">
-						<tbody>
-							<tr>
-								<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.force_private"}}</td>
-								<td>{{if .OrgRepoDefaults.ForcePrivate}}{{ctx.Locale.Tr "repo.settings.org_repo_defaults.enabled"}}{{else}}{{ctx.Locale.Tr "repo.settings.org_repo_defaults.disabled"}}{{end}}</td>
-							</tr>
-							{{if .OrgRepoDefaults.ApplyPRDefaults}}
-								<tr>
-									<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.merge_styles"}}</td>
-									<td>
-										<div class="tw-flex tw-gap-1 tw-flex-wrap">
-											{{if .OrgRepoDefaults.AllowMerge}}<span class="ui tiny basic label">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.style_merge"}}</span>{{end}}
-											{{if .OrgRepoDefaults.AllowRebase}}<span class="ui tiny basic label">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.style_rebase"}}</span>{{end}}
-											{{if .OrgRepoDefaults.AllowRebaseMerge}}<span class="ui tiny basic label">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.style_rebase_merge"}}</span>{{end}}
-											{{if .OrgRepoDefaults.AllowSquash}}<span class="ui tiny basic label">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.style_squash"}}</span>{{end}}
-											{{if .OrgRepoDefaults.AllowFastForwardOnly}}<span class="ui tiny basic label">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.style_fast_forward_only"}}</span>{{end}}
-										</div>
-									</td>
-								</tr>
-								{{if .OrgRepoDefaults.DefaultMergeStyle}}
-									<tr>
-										<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.default_merge_style"}}</td>
-										<td><code>{{.OrgRepoDefaults.DefaultMergeStyle}}</code></td>
-									</tr>
-								{{end}}
-								<tr>
-									<td class="tw-font-semibold tw-align-top">{{ctx.Locale.Tr "repo.settings.org_repo_defaults.delete_branch_after_merge"}}</td>
-									<td>{{if .OrgRepoDefaults.DeleteBranchAfterMerge}}{{ctx.Locale.Tr "repo.settings.org_repo_defaults.enabled"}}{{else}}{{ctx.Locale.Tr "repo.settings.org_repo_defaults.disabled"}}{{end}}</td>
-								</tr>
-							{{end}}
-						</tbody>
-					</table>
-				</div>
-			{{end}}
 		{{end}}
 	</div>
 

templates/repo/settings/metadata.tmpl

@@ -18,7 +18,8 @@
 			</div>
 			<div class="field">
 				<label>Organization</label>
-				<input name="org" value="{{.Manifest.Org}}" placeholder="Organization">
+				<input value="{{.DerivedOrg}}" placeholder="Organization" readonly>
+				<p class="help">Derived from the organization profile (repository owner).</p>
 			</div>
 		</div>
 		<div class="three fields">
@@ -54,7 +55,7 @@
 				<select name="platform" class="ui dropdown">
 					<option value="">—</option>
 					{{$platform := .Manifest.Platform}}
-					{{range $val := StringUtils.Split "joomla,wordpress,dolibarr,go,mcp,platform,generic" ","}}
+					{{range $val := .PlatformOptions}}
 						<option value="{{$val}}" {{if eq $val $platform}}selected{{end}}>{{$val}}</option>
 					{{end}}
 				</select>

templates/repo/settings/protected_branch.tmpl

@@ -172,7 +172,7 @@
 						</div>
 					</div>
 				</div>
-				<h5 class="ui dividing header">{{ctx.Locale.Tr "repo.settings.event_delete"}}</h5>
+				<h5 class="ui dividing header">{{ctx.Locale.Tr "repo.settings.protect_branch_deletion"}}</h5>
 				<div class="field">
 					<div class="ui radio checkbox">
 						<input type="radio" name="enable_delete" value="none" class="toggle-target-disabled" data-target="#delete_allowlist_box" {{if not .Rule.CanDelete}}checked{{end}}>

tests/integration/api_license_keys_test.go

@@ -6,6 +6,7 @@ package integration
 import (
 	"fmt"
 	"net/http"
+	"strings"
 	"testing"
 
 	auth_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/auth"
@@ -36,7 +37,7 @@ func TestAPILicensePackages(t *testing.T) {
 
 	t.Run("CreatePackage", func(t *testing.T) {
 		body := `{"name":"Test Pro Annual","description":"Annual pro subscription","duration_days":365,"max_sites":5}`
-		req := NewRequestWithBody(t, "POST", urlPrefix+"/license-packages", []byte(body)).
+		req := NewRequestWithBody(t, "POST", urlPrefix+"/license-packages", strings.NewReader(body)).
 			AddTokenAuth(token).
 			SetHeader("Content-Type", "application/json")
 		resp := MakeRequest(t, req, http.StatusCreated)
@@ -51,7 +52,7 @@ func TestAPILicensePackages(t *testing.T) {
 
 	t.Run("CreatePackageNoName", func(t *testing.T) {
 		body := `{"description":"Missing name"}`
-		req := NewRequestWithBody(t, "POST", urlPrefix+"/license-packages", []byte(body)).
+		req := NewRequestWithBody(t, "POST", urlPrefix+"/license-packages", strings.NewReader(body)).
 			AddTokenAuth(token).
 			SetHeader("Content-Type", "application/json")
 		MakeRequest(t, req, http.StatusUnprocessableEntity)
@@ -68,7 +69,7 @@ func TestAPILicenseKeys(t *testing.T) {
 
 	// Create a package first.
 	body := `{"name":"Test Package","duration_days":30}`
-	req := NewRequestWithBody(t, "POST", urlPrefix+"/license-packages", []byte(body)).
+	req := NewRequestWithBody(t, "POST", urlPrefix+"/license-packages", strings.NewReader(body)).
 		AddTokenAuth(token).
 		SetHeader("Content-Type", "application/json")
 	resp := MakeRequest(t, req, http.StatusCreated)
@@ -80,7 +81,7 @@ func TestAPILicenseKeys(t *testing.T) {
 
 	t.Run("CreateKey", func(t *testing.T) {
 		body := fmt.Sprintf(`{"package_id":%d,"licensee_name":"John Doe","licensee_email":"john@example.com"}`, pkg.ID)
-		req := NewRequestWithBody(t, "POST", urlPrefix+"/license-keys", []byte(body)).
+		req := NewRequestWithBody(t, "POST", urlPrefix+"/license-keys", strings.NewReader(body)).
 			AddTokenAuth(token).
 			SetHeader("Content-Type", "application/json")
 		resp := MakeRequest(t, req, http.StatusCreated)
@@ -104,7 +105,7 @@ func TestAPILicenseKeys(t *testing.T) {
 
 	t.Run("EditKey", func(t *testing.T) {
 		body := `{"licensee_name":"Jane Doe","domain_restriction":"example.com,test.com"}`
-		req := NewRequestWithBody(t, "PATCH", fmt.Sprintf("%s/license-keys/%d", urlPrefix, createdKeyID), []byte(body)).
+		req := NewRequestWithBody(t, "PATCH", fmt.Sprintf("%s/license-keys/%d", urlPrefix, createdKeyID), strings.NewReader(body)).
 			AddTokenAuth(token).
 			SetHeader("Content-Type", "application/json")
 		resp := MakeRequest(t, req, http.StatusOK)
@@ -124,7 +125,7 @@ func TestAPILicenseKeys(t *testing.T) {
 
 	t.Run("ValidateKey", func(t *testing.T) {
 		body := fmt.Sprintf(`{"key":"%s","domain":"example.com"}`, rawKey)
-		req := NewRequestWithBody(t, "POST", urlPrefix+"/license-keys/validate", []byte(body)).
+		req := NewRequestWithBody(t, "POST", urlPrefix+"/license-keys/validate", strings.NewReader(body)).
 			SetHeader("Content-Type", "application/json")
 		// Note: no token — this is a public endpoint.
 		resp := MakeRequest(t, req, http.StatusOK)
@@ -136,7 +137,7 @@ func TestAPILicenseKeys(t *testing.T) {
 
 	t.Run("ValidateInvalidKey", func(t *testing.T) {
 		body := `{"key":"MOKO-XXXX-XXXX-XXXX-XXXX","domain":"example.com"}`
-		req := NewRequestWithBody(t, "POST", urlPrefix+"/license-keys/validate", []byte(body)).
+		req := NewRequestWithBody(t, "POST", urlPrefix+"/license-keys/validate", strings.NewReader(body)).
 			SetHeader("Content-Type", "application/json")
 		resp := MakeRequest(t, req, http.StatusOK)
 		var result api.ValidateLicenseKeyResponse
@@ -161,7 +162,7 @@ func TestAPILicensePurchaseWebhook(t *testing.T) {
 
 	// Create a package.
 	body := `{"name":"Purchase Test","duration_days":90}`
-	req := NewRequestWithBody(t, "POST", urlPrefix+"/license-packages", []byte(body)).
+	req := NewRequestWithBody(t, "POST", urlPrefix+"/license-packages", strings.NewReader(body)).
 		AddTokenAuth(token).
 		SetHeader("Content-Type", "application/json")
 	resp := MakeRequest(t, req, http.StatusCreated)
@@ -170,7 +171,7 @@ func TestAPILicensePurchaseWebhook(t *testing.T) {
 
 	t.Run("PurchaseNewKey", func(t *testing.T) {
 		body := fmt.Sprintf(`{"package_id":%d,"licensee_name":"Buyer","licensee_email":"buyer@shop.com","domain":"shop.com","payment_ref":"stripe_pi_test123"}`, pkg.ID)
-		req := NewRequestWithBody(t, "POST", urlPrefix+"/license-keys/purchase", []byte(body)).
+		req := NewRequestWithBody(t, "POST", urlPrefix+"/license-keys/purchase", strings.NewReader(body)).
 			AddTokenAuth(token).
 			SetHeader("Content-Type", "application/json")
 		resp := MakeRequest(t, req, http.StatusCreated)
@@ -183,7 +184,7 @@ func TestAPILicensePurchaseWebhook(t *testing.T) {
 	t.Run("PurchaseIdempotent", func(t *testing.T) {
 		// Same payment_ref should return existing key without raw_key.
 		body := fmt.Sprintf(`{"package_id":%d,"licensee_name":"Buyer","payment_ref":"stripe_pi_test123"}`, pkg.ID)
-		req := NewRequestWithBody(t, "POST", urlPrefix+"/license-keys/purchase", []byte(body)).
+		req := NewRequestWithBody(t, "POST", urlPrefix+"/license-keys/purchase", strings.NewReader(body)).
 			AddTokenAuth(token).
 			SetHeader("Content-Type", "application/json")
 		resp := MakeRequest(t, req, http.StatusOK)

tests/integration/api_packages_composer_test.go

@@ -255,7 +255,7 @@ func TestPackageComposer(t *testing.T) {
 			AddBasicAuth(user.Name)
 		resp = MakeRequest(t, req, http.StatusOK)
 
-		result = composer.PackageMetadataResponse{}
+		result = &composer.PackageMetadataResponse{}
 		DecodeJSON(t, resp, &result)
 		pkgs = result.Packages[packageName]
 		assert.Len(t, pkgs, 1)
@@ -268,7 +268,7 @@ func TestPackageComposer(t *testing.T) {
 			AddBasicAuth(otherUser.Name)
 		resp = MakeRequest(t, req, http.StatusOK)
 
-		result = composer.PackageMetadataResponse{}
+		result = &composer.PackageMetadataResponse{}
 		DecodeJSON(t, resp, &result)
 		pkgs = result.Packages[packageName]
 		assert.Len(t, pkgs, 1)

tests/integration/auth_oauth2_test.go

@@ -253,7 +253,7 @@ func TestOAuth2CallbackReactivationGating(t *testing.T) {
 	defer test.MockVariableValue(&setting.OAuth2Client.EnableAutoRegistration, true)()
 	defer test.MockVariableValue(&setting.OAuth2Client.Username, setting.OAuth2UsernameUserid)()
 
-	srv := newFakeOIDCServer(t, FakeOIDCConfig{Sub: "test-sub", Email: "test@example.com", Name: "Test User"})
+	srv := newFakeOIDCServerWithConfig(t, FakeOIDCConfig{Sub: "test-sub", Email: "test@example.com", Name: "Test User"})
 	addOAuth2Source(t, "test-oauth-source", oauth2.Source{
 		Provider:                      "openidConnect",
 		ClientID:                      "test-client-id",
@@ -308,7 +308,7 @@ type FakeOIDCConfig struct {
 }
 
 // newFakeOIDCServer starts a httptest.Server that implements the minimum OIDC endpoints needed to complete a sign-in flow
-func newFakeOIDCServer(t *testing.T, cfg FakeOIDCConfig) *httptest.Server {
+func newFakeOIDCServerWithConfig(t *testing.T, cfg FakeOIDCConfig) *httptest.Server {
 	t.Helper()
 
 	var srv *httptest.Server

tests/integration/oauth_avatar_test.go

@@ -7,16 +7,16 @@ import (
 	"net/http"
 	"testing"
 
-	auth_model "code.gitea.io/gitea/models/auth"
-	"code.gitea.io/gitea/models/unittest"
-	user_model "code.gitea.io/gitea/models/user"
-	"code.gitea.io/gitea/modules/setting"
-	"code.gitea.io/gitea/modules/test"
-	"code.gitea.io/gitea/modules/web"
-	"code.gitea.io/gitea/routers/web/auth"
-	"code.gitea.io/gitea/services/auth/source/oauth2"
-	"code.gitea.io/gitea/services/context"
-	"code.gitea.io/gitea/tests"
+	auth_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/auth"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/unittest"
+	user_model "code.mokoconsulting.tech/MokoConsulting/MokoGitea/models/user"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/setting"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/test"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/modules/web"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/routers/web/auth"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/auth/source/oauth2"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/services/context"
+	"code.mokoconsulting.tech/MokoConsulting/MokoGitea/tests"
 
 	"github.com/markbates/goth"
 	"github.com/markbates/goth/gothic"

wiki/branding.md

@@ -25,7 +25,7 @@ Custom CSS themes at `/var/lib/gitea/custom/public/assets/css/`:
 
 ---
 
-*Repo: [MokoGitea](https://git.mokoconsulting.tech/MokoConsulting/MokoGitea) · [moko-platform](https://git.mokoconsulting.tech/MokoConsulting/moko-platform/wiki/Home)*
+*Repo: [MokoGitea](https://git.mokoconsulting.tech/MokoConsulting/MokoGitea) · [mokocli](https://git.mokoconsulting.tech/MokoConsulting/mokocli/wiki/Home)*
 
 | Revision | Date | Author | Description |
 |---|---|---|---|

wiki/custom-fields.md

@@ -126,7 +126,7 @@ When a field definition is deleted, all associated values in `custom_field_value
 | System | Relationship |
 |--------|-------------|
 | Update Server | Repo-scoped custom fields with specific names (Extension Name, Display Name, etc.) are read by the update feed generators as the highest-priority metadata source. |
-| Manifest Settings | Manifest fields follow the moko-platform schema and are separate from custom fields. Custom fields are user-defined; manifest fields are standardized. |
+| Manifest Settings | Manifest fields follow the mokocli schema and are separate from custom fields. Custom fields are user-defined; manifest fields are standardized. |
 | Issue Statuses | Custom statuses are a separate feature with their own dedicated table and UI, not implemented as custom fields. |
 
 ---

wiki/deployment.md

@@ -41,7 +41,7 @@ Located at `/var/lib/gitea/custom/`:
 
 ---
 
-*Repo: [MokoGitea](https://git.mokoconsulting.tech/MokoConsulting/MokoGitea) · [moko-platform](https://git.mokoconsulting.tech/MokoConsulting/moko-platform/wiki/Home)*
+*Repo: [MokoGitea](https://git.mokoconsulting.tech/MokoConsulting/MokoGitea) · [mokocli](https://git.mokoconsulting.tech/MokoConsulting/mokocli/wiki/Home)*
 
 | Revision | Date | Author | Description |
 |---|---|---|---|

wiki/license-management.md

@@ -309,8 +309,8 @@ Packages can be **archived** instead of permanently deleted. This is the recomme
 
 In **Organization Settings → Licensing & Update Streams**, under **Extension Metadata**:
 1. Set the **Platform** (Joomla, Dolibarr, WordPress, etc.)
-2. Set the **Extension Name** (e.g., `pkg_mokowaas`) — this becomes the `<element>` in the XML feed
-3. Set the **Display Name** (e.g., "Package - MokoWaaS") — shown in Joomla update manager
+2. Set the **Extension Name** (e.g., `pkg_mokosuite`) — this becomes the `<element>` in the XML feed
+3. Set the **Display Name** (e.g., "Package - MokoSuite") — shown in Joomla update manager
 4. Set the **Extension Type** (component, module, plugin, package, template, library)
 5. Set the **Target Version** regex (e.g., `(5|6)\..*` for Joomla 5 and 6)
 6. Set the **PHP Minimum** if applicable (e.g., `8.1`)

wiki/manifest-settings.md

@@ -7,7 +7,7 @@ The manifest settings feature provides a centralized way to store and manage pro
 Each repository can have a manifest that describes:
 
 - **Identity** — project name, organization, description, version, and license
-- **Governance** — platform type, moko-platform standards version, and standards source URL
+- **Governance** — platform type, mokocli standards version, and standards source URL
 - **Build** — language, package type, and entry point
 
 These settings replace the legacy `.mokogitea/manifest.xml` file-based approach.
@@ -35,7 +35,7 @@ If a field already has a value in the database (e.g., from org-level custom fiel
 
 ## REST API
 
-The manifest API allows Actions workflows and the moko-platform CLI to read and write manifest settings programmatically.
+The manifest API allows Actions workflows and the mokocli CLI to read and write manifest settings programmatically.
 
 ### Get Manifest
 
@@ -57,7 +57,7 @@ Returns the current manifest settings. If no manifest has been saved, returns de
   "license_name": "GNU General Public License v3",
   "platform": "go",
   "standards_version": "05.00.00",
-  "standards_source": "https://code.mokoconsulting.tech/MokoConsulting/moko-platform",
+  "standards_source": "https://code.mokoconsulting.tech/MokoConsulting/mokocli",
   "language": "Go",
   "package_type": "application",
   "entry_point": "./"
@@ -101,8 +101,8 @@ Manifest settings are stored in the `repo_manifest` table (migration v347). One
 | System | Relationship |
 |--------|-------------|
 | Update Server | The update server generators read from both manifest settings and update_stream_config. Manifest provides identity metadata; update_stream_config provides feed-specific settings. |
-| Custom Fields | Repo-scoped custom fields (org settings) are separate from manifest fields. Custom fields are user-defined; manifest fields follow the moko-platform schema. |
-| moko-platform CLI | The CLI reads manifest settings via the API for version bumping, build decisions, and cross-repo syncing (see issue #505). |
+| Custom Fields | Repo-scoped custom fields (org settings) are separate from manifest fields. Custom fields are user-defined; manifest fields follow the mokocli schema. |
+| mokocli CLI | The CLI reads manifest settings via the API for version bumping, build decisions, and cross-repo syncing (see issue #505). |
 
 ---
 

wiki/project-api.md

@@ -195,7 +195,7 @@ curl -X POST -H "Authorization: token TOKEN" \
 
 ---
 
-*Repo: [MokoGitea](https://git.mokoconsulting.tech/MokoConsulting/MokoGitea) · [moko-platform](https://git.mokoconsulting.tech/MokoConsulting/moko-platform/wiki/Home)*
+*Repo: [MokoGitea](https://git.mokoconsulting.tech/MokoConsulting/MokoGitea) · [mokocli](https://git.mokoconsulting.tech/MokoConsulting/mokocli/wiki/Home)*
 
 | Revision | Date | Author | Description |
 |---|---|---|---|

wiki/roadmap.md

@@ -23,9 +23,9 @@
 
 ## In Progress
 
-- Rename moko-platform to MokoPlatform
+- Rename mokocli to MokoCLI
 - Granular role-based permissions for all features (#9)
-- Wire moko-platform CLI to manifest API (#505)
+- Wire mokocli CLI to manifest API (#505)
 - Bulk migrate remaining 41 flat wikis to folders
 
 ## Planned