.mokogitea/workflows/update-server.yml

@@ -0,0 +1,660 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: MokoStandards.Universal
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
+# PATH: /templates/workflows/update-server.yml
+# VERSION: 04.07.00
+# BRIEF: Update server XML feed with stable/rc/beta/alpha/dev entries (universal)
+#
+# Writes updates.xml with multiple <update> entries:
+#   - <tag>stable</tag>     on push to main (from auto-release)
+#   - <tag>rc</tag>         on push to rc/**
+#   - <tag>development</tag> on push to dev or dev/**
+#
+# Joomla filters by user's "Minimum Stability" setting.
+
+name: "Update Server"
+
+on:
+  push:
+    branches:
+      - 'dev'
+      - 'dev/**'
+      - 'alpha/**'
+      - 'beta/**'
+      - 'rc/**'
+    paths:
+      - 'src/**'
+      - 'htdocs/**'
+  pull_request:
+    types: [closed]
+    branches:
+      - 'dev'
+      - 'dev/**'
+      - 'alpha/**'
+      - 'beta/**'
+      - 'rc/**'
+    paths:
+      - 'src/**'
+      - 'htdocs/**'
+  workflow_dispatch:
+    inputs:
+      stability:
+        description: 'Stability tag'
+        required: true
+        default: 'development'
+        type: choice
+        options:
+          - development
+          - alpha
+          - beta
+          - rc
+          - stable
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  GITEA_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
+  GITEA_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
+
+permissions:
+  contents: write
+
+jobs:
+  update-xml:
+    name: Update updates.xml
+    runs-on: release
+    if: >-
+      github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch' || github.event_name == 'push'
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.GA_TOKEN }}
+          fetch-depth: 0
+
+      - name: Setup moko-platform tools
+        env:
+          MOKO_CLONE_TOKEN: ${{ secrets.GA_TOKEN }}
+          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
+          COMPOSER_AUTH: '{"http-basic":{"git.mokoconsulting.tech":{"username":"token","password":"${{ secrets.GA_TOKEN }}"}}}'
+        run: |
+          if ! command -v composer &> /dev/null; then
+            sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
+          fi
+          if [ -d "/tmp/moko-platform" ]; then
+            echo "moko-platform already available — skipping clone"
+          else
+            git clone --depth 1 --branch main --quiet \
+              "https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/moko-platform.git" \
+              /tmp/moko-platform 2>/dev/null || true
+          fi
+          if [ -d "/tmp/moko-platform" ] && [ -f "/tmp/moko-platform/composer.json" ]; then
+            cd /tmp/moko-platform && composer install --no-dev --no-interaction --quiet 2>/dev/null || true
+          fi
+
+      - name: Generate updates.xml entry
+        id: update
+        run: |
+          BRANCH="${{ github.ref_name }}"
+          REPO="${{ github.repository }}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          VERSION=$(php /tmp/moko-platform/cli/version_read.php --path . 2>/dev/null || echo "0.0.0")
+
+          # Auto-bump patch on all branches (dev, alpha, beta, rc)
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "gitea-actions[bot]"
+          BUMPED=$(php /tmp/moko-platform/cli/version_bump.php --path . 2>/dev/null || true)
+          if [ -n "$BUMPED" ]; then
+            VERSION=$(php /tmp/moko-platform/cli/version_read.php --path . 2>/dev/null || echo "$VERSION")
+            git add -A
+            git commit -m "chore(version): auto-bump patch ${VERSION} [skip ci]" \
+              --author="gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>" 2>/dev/null || true
+            git push 2>/dev/null || true
+          fi
+
+          # Determine stability from branch or input
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            STABILITY="${{ inputs.stability }}"
+          elif [[ "$BRANCH" == rc/* ]]; then
+            STABILITY="rc"
+          elif [[ "$BRANCH" == beta/* ]]; then
+            STABILITY="beta"
+          elif [[ "$BRANCH" == alpha/* ]]; then
+            STABILITY="alpha"
+          elif [[ "$BRANCH" == dev/* ]] || [[ "$BRANCH" == "dev" ]]; then
+            STABILITY="development"
+          else
+            STABILITY="stable"
+          fi
+
+          echo "stability=${STABILITY}" >> "$GITHUB_OUTPUT"
+
+          # Parse manifest (portable — no grep -P)
+          MANIFEST=$(find . -maxdepth 3 -name "*.xml" ! -path "./.git/*" ! -path "./build/*" -exec grep -l '<extension' {} \; 2>/dev/null | head -1)
+          if [ -z "$MANIFEST" ]; then
+            echo "No Joomla manifest found — skipping"
+            exit 0
+          fi
+
+          # Extract fields using sed (works on all runners)
+          EXT_NAME=$(sed -n 's/.*<name>\([^<]*\)<\/name>.*/\1/p' "$MANIFEST" | head -1)
+          EXT_TYPE=$(sed -n 's/.*<extension[^>]*type="\([^"]*\)".*/\1/p' "$MANIFEST" | head -1)
+          EXT_ELEMENT=$(sed -n 's/.*<element>\([^<]*\)<\/element>.*/\1/p' "$MANIFEST" | head -1)
+          EXT_CLIENT=$(sed -n 's/.*<extension[^>]*client="\([^"]*\)".*/\1/p' "$MANIFEST" | head -1)
+          EXT_FOLDER=$(sed -n 's/.*<extension[^>]*group="\([^"]*\)".*/\1/p' "$MANIFEST" | head -1)
+          EXT_VERSION=$(sed -n 's/.*<version>\([^<]*\)<\/version>.*/\1/p' "$MANIFEST" | head -1)
+          TARGET_PLATFORM=$(sed -n 's/.*\(<targetplatform[^/]*\/>\).*/\1/p' "$MANIFEST" | head -1)
+          PHP_MINIMUM=$(sed -n 's/.*<php_minimum>\([^<]*\)<\/php_minimum>.*/\1/p' "$MANIFEST" | head -1)
+
+          # Fallbacks
+          [ -z "$EXT_NAME" ] && EXT_NAME="${{ github.event.repository.name }}"
+          [ -z "$EXT_TYPE" ] && EXT_TYPE="component"
+
+          # Derive element if not in manifest: try XML filename, then repo name
+          if [ -z "$EXT_ELEMENT" ]; then
+            EXT_ELEMENT=$(basename "$MANIFEST" .xml | tr '[:upper:]' '[:lower:]')
+            case "$EXT_ELEMENT" in
+              templatedetails|manifest|*.xml) EXT_ELEMENT=$(echo "${{ github.event.repository.name }}" | tr '[:upper:]' '[:lower:]' | tr -d ' -') ;;
+            esac
+          fi
+
+          # Use manifest version if README version is empty
+          [ "$VERSION" = "0.0.0" ] && [ -n "$EXT_VERSION" ] && VERSION="$EXT_VERSION"
+
+          [ -z "$TARGET_PLATFORM" ] && TARGET_PLATFORM=$(printf '<targetplatform name="joomla" version="((5.[0-9])|(6.[0-9]))" %s>' "/")
+
+          # Joomla requires <client> on ALL extension types for update matching
+          if [ -n "$EXT_CLIENT" ]; then
+            CLIENT_TAG="<client>${EXT_CLIENT}</client>"
+          else
+            CLIENT_TAG="<client>site</client>"
+          fi
+
+          FOLDER_TAG=""
+          [ -n "$EXT_FOLDER" ] && [ "$EXT_TYPE" = "plugin" ] && FOLDER_TAG="<folder>${EXT_FOLDER}</folder>"
+
+          PHP_TAG=""
+          [ -n "$PHP_MINIMUM" ] && PHP_TAG="<php_minimum>${PHP_MINIMUM}</php_minimum>"
+
+          # Version suffix for non-stable
+          DISPLAY_VERSION="$VERSION"
+          case "$STABILITY" in
+            development) DISPLAY_VERSION="${VERSION}-dev" ;;
+            alpha)       DISPLAY_VERSION="${VERSION}-alpha" ;;
+            beta)        DISPLAY_VERSION="${VERSION}-beta" ;;
+            rc)          DISPLAY_VERSION="${VERSION}-rc" ;;
+          esac
+
+          MAJOR=$(echo "$VERSION" | awk -F. '{print $1}')
+
+          # Each stability level has its own release tag
+          case "$STABILITY" in
+            development) RELEASE_TAG="development" ;;
+            alpha)       RELEASE_TAG="alpha" ;;
+            beta)        RELEASE_TAG="beta" ;;
+            rc)          RELEASE_TAG="release-candidate" ;;
+            *)           RELEASE_TAG="v${MAJOR}" ;;
+          esac
+
+          PACKAGE_NAME="${EXT_ELEMENT}-${DISPLAY_VERSION}.zip"
+          DOWNLOAD_URL="${GITEA_URL}/${GITEA_ORG}/${GITEA_REPO}/releases/download/${RELEASE_TAG}/${PACKAGE_NAME}"
+          INFO_URL="${GITEA_URL}/${GITEA_ORG}/${GITEA_REPO}"
+
+          # -- Build install packages (ZIP + tar.gz) --------------------
+          SOURCE_DIR="src"
+          [ ! -d "$SOURCE_DIR" ] && SOURCE_DIR="htdocs"
+          if [ -d "$SOURCE_DIR" ]; then
+            EXCLUDES=".ftpignore sftp-config* *.ppk *.pem *.key .env*"
+            TAR_NAME="${EXT_ELEMENT}-${DISPLAY_VERSION}.tar.gz"
+
+            cd "$SOURCE_DIR"
+            zip -r "/tmp/${PACKAGE_NAME}" . -x $EXCLUDES
+            cd ..
+            tar -czf "/tmp/${TAR_NAME}" -C "$SOURCE_DIR" \
+              --exclude='.ftpignore' --exclude='sftp-config*' \
+              --exclude='*.ppk' --exclude='*.pem' --exclude='*.key' --exclude='.env*' .
+
+            SHA256=$(sha256sum "/tmp/${PACKAGE_NAME}" | cut -d' ' -f1)
+
+            # Ensure release exists on Gitea
+            RELEASE_JSON=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
+              "${API_BASE}/releases/tags/${RELEASE_TAG}" 2>/dev/null || true)
+            RELEASE_ID=$(echo "$RELEASE_JSON" | python3 -c "import sys,json; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
+
+            if [ -z "$RELEASE_ID" ]; then
+              # Create release
+              RELEASE_JSON=$(curl -sf -X POST -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
+                -H "Content-Type: application/json" \
+                "${API_BASE}/releases" \
+                -d "$(python3 -c "import json; print(json.dumps({
+                  'tag_name': '${RELEASE_TAG}',
+                  'name': '${RELEASE_TAG} (${DISPLAY_VERSION})',
+                  'body': '${STABILITY} release',
+                  'prerelease': True,
+                  'target_commitish': 'main'
+                }))")" 2>/dev/null || true)
+              RELEASE_ID=$(echo "$RELEASE_JSON" | python3 -c "import sys,json; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
+            fi
+
+            if [ -n "$RELEASE_ID" ]; then
+              # Delete existing assets with same name before uploading
+              ASSETS=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
+                "${API_BASE}/releases/${RELEASE_ID}/assets" 2>/dev/null || echo "[]")
+              for ASSET_FILE in "$PACKAGE_NAME" "$TAR_NAME"; do
+                ASSET_ID=$(echo "$ASSETS" | python3 -c "
+          import sys,json
+          assets = json.load(sys.stdin)
+          for a in assets:
+              if a['name'] == '${ASSET_FILE}':
+                  print(a['id']); break
+          " 2>/dev/null || true)
+                if [ -n "$ASSET_ID" ]; then
+                  curl -sf -X DELETE -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
+                    "${API_BASE}/releases/${RELEASE_ID}/assets/${ASSET_ID}" 2>/dev/null || true
+                fi
+              done
+
+              # Upload both formats
+              curl -sf -X POST -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
+                -H "Content-Type: application/octet-stream" \
+                --data-binary @"/tmp/${PACKAGE_NAME}" \
+                "${API_BASE}/releases/${RELEASE_ID}/assets?name=${PACKAGE_NAME}" > /dev/null 2>&1 || true
+
+              curl -sf -X POST -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
+                -H "Content-Type: application/octet-stream" \
+                --data-binary @"/tmp/${TAR_NAME}" \
+                "${API_BASE}/releases/${RELEASE_ID}/assets?name=${TAR_NAME}" > /dev/null 2>&1 || true
+            fi
+
+            echo "Packages: ${PACKAGE_NAME} + ${TAR_NAME} (SHA: ${SHA256})" >> $GITHUB_STEP_SUMMARY
+          else
+            SHA256=""
+          fi
+
+          # -- Build the new entry (canonical format matching release.yml) --
+          NEW_ENTRY=""
+          NEW_ENTRY="${NEW_ENTRY}  <update>\n"
+          NEW_ENTRY="${NEW_ENTRY}    <name>${EXT_NAME}</name>\n"
+          NEW_ENTRY="${NEW_ENTRY}    <description>${EXT_NAME} ${STABILITY} build.</description>\n"
+          NEW_ENTRY="${NEW_ENTRY}    <element>${EXT_ELEMENT}</element>\n"
+          NEW_ENTRY="${NEW_ENTRY}    <type>${EXT_TYPE}</type>\n"
+          [ -n "$CLIENT_TAG" ] && NEW_ENTRY="${NEW_ENTRY}    ${CLIENT_TAG}\n"
+          [ -n "$FOLDER_TAG" ] && NEW_ENTRY="${NEW_ENTRY}    ${FOLDER_TAG}\n"
+          NEW_ENTRY="${NEW_ENTRY}    <version>${VERSION}</version>\n"
+          NEW_ENTRY="${NEW_ENTRY}    <creationDate>$(date +%Y-%m-%d)</creationDate>\n"
+          NEW_ENTRY="${NEW_ENTRY}    <infourl title='${EXT_NAME}'>https://git.mokoconsulting.tech/${GITEA_ORG}/${GITEA_REPO}/releases/tag/${RELEASE_TAG}</infourl>\n"
+          NEW_ENTRY="${NEW_ENTRY}    <downloads>\n"
+          NEW_ENTRY="${NEW_ENTRY}      <downloadurl type='full' format='zip'>${DOWNLOAD_URL}</downloadurl>\n"
+          NEW_ENTRY="${NEW_ENTRY}    </downloads>\n"
+          [ -n "$SHA256" ] && NEW_ENTRY="${NEW_ENTRY}    <sha256>${SHA256}</sha256>\n"
+          NEW_ENTRY="${NEW_ENTRY}    <tags><tag>${STABILITY}</tag></tags>\n"
+          NEW_ENTRY="${NEW_ENTRY}    <maintainer>Moko Consulting</maintainer>\n"
+          NEW_ENTRY="${NEW_ENTRY}    <maintainerurl>https://mokoconsulting.tech</maintainerurl>\n"
+          NEW_ENTRY="${NEW_ENTRY}    <targetplatform name='joomla' version='(5|6).*'/>\n"
+          [ -n "$PHP_MINIMUM" ] && NEW_ENTRY="${NEW_ENTRY}    <php_minimum>${PHP_MINIMUM}</php_minimum>\n"
+          NEW_ENTRY="${NEW_ENTRY}  </update>"
+
+          # -- Write new entry to temp file --------------------------------
+          printf '%b' "$NEW_ENTRY" > /tmp/new_entry.xml
+
+          # -- Merge into updates.xml ----------------------------------------
+          # Cascade: stable→all | rc→rc+lower | beta→beta+lower | alpha→alpha+dev | dev→dev
+          CASCADE_MAP="stable:development,alpha,beta,rc,stable rc:development,alpha,beta,rc beta:development,alpha,beta alpha:development,alpha development:development"
+          TARGETS=""
+          for entry in $CASCADE_MAP; do
+            key="${entry%%:*}"
+            vals="${entry#*:}"
+            if [ "$key" = "${STABILITY}" ]; then
+              TARGETS="$vals"
+              break
+            fi
+          done
+          [ -z "$TARGETS" ] && TARGETS="${STABILITY}"
+
+          echo "Cascade: ${STABILITY} → ${TARGETS}"
+
+          # Create updates.xml if missing
+          if [ ! -f "updates.xml" ]; then
+            printf '%s\n' "<?xml version='1.0' encoding='UTF-8'?>" > updates.xml
+            printf '%s\n' "<!-- Copyright (C) $(date +%Y) Moko Consulting -->" >> updates.xml
+            printf '%s\n' "<updates>" >> updates.xml
+            printf '%s\n' "</updates>" >> updates.xml
+          fi
+
+          # Update existing blocks or create missing ones
+          export PY_TARGETS="$TARGETS" PY_VERSION="$VERSION" PY_DATE="$(date +%Y-%m-%d)"
+          python3 << 'PYEOF'
+          import re, os
+
+          targets = os.environ["PY_TARGETS"].split(",")
+          version = os.environ["PY_VERSION"]
+          date = os.environ["PY_DATE"]
+
+          with open("updates.xml") as f:
+              content = f.read()
+          with open("/tmp/new_entry.xml") as f:
+              new_entry_template = f.read()
+
+          for tag in targets:
+              tag = tag.strip()
+              # Build entry with this tag's name
+              new_entry = re.sub(r"<tag>[^<]*</tag>", f"<tag>{tag}</tag>", new_entry_template)
+
+              # Try to find existing block (handles both single-line and multi-line <tags>)
+              block_pattern = r"(<update>(?:(?!</update>).)*?<tag>" + re.escape(tag) + r"</tag>.*?</update>)"
+              match = re.search(block_pattern, content, re.DOTALL)
+
+              if match:
+                  # Update in place — replace entire block
+                  content = content.replace(match.group(1), new_entry.strip())
+                  print(f"  UPDATED: <tag>{tag}</tag> → {version}")
+              else:
+                  # Create — insert before </updates>
+                  content = content.replace("</updates>", "\n" + new_entry.strip() + "\n\n</updates>")
+                  print(f"  CREATED: <tag>{tag}</tag> → {version}")
+
+          # Clean up excessive blank lines
+          content = re.sub(r"\n{3,}", "\n\n", content)
+
+          with open("updates.xml", "w") as f:
+              f.write(content)
+          PYEOF
+
+          # Commit
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "gitea-actions[bot]"
+          git add updates.xml
+          git diff --cached --quiet || {
+            git commit -m "chore: update updates.xml (${STABILITY}: ${DISPLAY_VERSION}) [skip ci]" \
+              --author="gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>"
+            git push
+          }
+
+      # -- Sync updates.xml to main (for non-main branches) ----------------------
+      - name: Sync updates.xml to main
+        if: github.ref_name != 'main'
+        run: |
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          GA_TOKEN="${{ secrets.GA_TOKEN }}"
+
+          FILE_SHA=$(curl -sf -H "Authorization: token ${GA_TOKEN}" \
+            "${API_BASE}/contents/updates.xml?ref=main" | python3 -c "import sys,json; print(json.load(sys.stdin).get('sha',''))" 2>/dev/null || true)
+
+          if [ -n "$FILE_SHA" ] && [ -f "updates.xml" ]; then
+            python3 -c "
+          import base64, json, urllib.request, sys
+          with open('updates.xml', 'rb') as f:
+              content = base64.b64encode(f.read()).decode()
+          payload = json.dumps({
+              'content': content,
+              'sha': '${FILE_SHA}',
+              'message': 'chore: sync updates.xml from ${STABILITY} [skip ci]',
+              'branch': 'main'
+          }).encode()
+          req = urllib.request.Request(
+              '${API_BASE}/contents/updates.xml',
+              data=payload, method='PUT',
+              headers={
+                  'Authorization': 'token ${GA_TOKEN}',
+                  'Content-Type': 'application/json'
+              })
+          try:
+              urllib.request.urlopen(req)
+              print('updates.xml synced to main')
+          except Exception as e:
+              print(f'ERROR: failed to sync updates.xml to main: {e}', file=sys.stderr)
+              sys.exit(1)
+          " \
+              && echo "updates.xml synced to main (${STABILITY})" >> $GITHUB_STEP_SUMMARY \
+              || echo "::error::failed to sync updates.xml to main" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "::error::could not get updates.xml SHA from main — file may not exist on main yet" >> $GITHUB_STEP_SUMMARY
+          fi
+
+      - name: SFTP deploy to dev server
+        if: contains(github.ref, 'dev/') || github.ref == 'refs/heads/dev'
+        env:
+          DEV_HOST: ${{ vars.DEV_FTP_HOST }}
+          DEV_PATH: ${{ vars.DEV_FTP_PATH }}
+          DEV_SUFFIX: ${{ vars.DEV_FTP_SUFFIX }}
+          DEV_USER: ${{ vars.DEV_FTP_USERNAME }}
+          DEV_PORT: ${{ vars.DEV_FTP_PORT }}
+          DEV_KEY: ${{ secrets.DEV_FTP_KEY }}
+          DEV_PASS: ${{ secrets.DEV_FTP_PASSWORD }}
+        run: |
+          # -- Permission check: admin or maintain role required --------
+          ACTOR="${{ github.actor }}"
+          REPO="${{ github.repository }}"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+
+          PERMISSION=$(curl -sf -H "Authorization: token ${{ secrets.GA_TOKEN }}" \
+            "${API_BASE}/collaborators/${ACTOR}/permission" 2>/dev/null | \
+            python3 -c "import sys,json; print(json.load(sys.stdin).get('permission','read'))" 2>/dev/null || echo "read")
+          case "$PERMISSION" in
+            admin|maintain|write) ;;
+            *)
+              echo "Deploy denied: ${ACTOR} has '${PERMISSION}' — requires admin, maintain, or write"
+              exit 0
+              ;;
+          esac
+
+          [ -z "$DEV_HOST" ] || [ -z "$DEV_PATH" ] && { echo "DEV FTP not configured — skipping SFTP"; exit 0; }
+
+          SOURCE_DIR="src"
+          [ ! -d "$SOURCE_DIR" ] && SOURCE_DIR="htdocs"
+          [ ! -d "$SOURCE_DIR" ] && exit 0
+
+          PORT="${DEV_PORT:-22}"
+          REMOTE="${DEV_PATH%/}"
+          [ -n "$DEV_SUFFIX" ] && REMOTE="${REMOTE}/${DEV_SUFFIX#/}"
+
+          printf '{"host":"%s","port":%s,"username":"%s","remotePath":"%s"' \
+            "$DEV_HOST" "$PORT" "$DEV_USER" "$REMOTE" > /tmp/sftp-config.json
+          if [ -n "$DEV_KEY" ]; then
+            echo "$DEV_KEY" > /tmp/deploy_key && chmod 600 /tmp/deploy_key
+            printf ',"privateKeyPath":"/tmp/deploy_key"}' >> /tmp/sftp-config.json
+          else
+            printf ',"password":"%s"}' "$DEV_PASS" >> /tmp/sftp-config.json
+          fi
+
+          PLATFORM=$(php /tmp/moko-platform/cli/platform_detect.php --path . 2>/dev/null || true)
+          if [ "$PLATFORM" = "waas-component" ] && [ -f "/tmp/moko-platform/deploy/deploy-joomla.php" ]; then
+            php /tmp/moko-platform/deploy/deploy-joomla.php --path . --src-dir "$SOURCE_DIR" --config /tmp/sftp-config.json
+          elif [ -f "/tmp/moko-platform/deploy/deploy-sftp.php" ]; then
+            php /tmp/moko-platform/deploy/deploy-sftp.php --path . --src-dir "$SOURCE_DIR" --config /tmp/sftp-config.json
+          fi
+          rm -f /tmp/deploy_key /tmp/sftp-config.json
+          echo "SFTP deploy to dev complete" >> $GITHUB_STEP_SUMMARY
+
+      - name: Validate updates.xml integrity
+        run: |
+          ERRORS=0
+
+          if [ ! -f "updates.xml" ]; then
+            echo "::error::updates.xml not found"
+            exit 1
+          fi
+
+          # Well-formed XML
+          if ! python3 -c "import xml.etree.ElementTree as ET; ET.parse('updates.xml')" 2>/dev/null; then
+            echo "::error::updates.xml is not valid XML"
+            ERRORS=$((ERRORS+1))
+          fi
+
+          python3 << 'PYEOF'
+          import xml.etree.ElementTree as ET, sys, re, os
+
+          tree = ET.parse("updates.xml")
+          root = tree.getroot()
+          updates = root.findall("update")
+          errors = 0
+          warnings = 0
+          seen_tags = set()
+
+          # All 5 channels MUST be present
+          REQUIRED_CHANNELS = {"stable", "rc", "beta", "alpha", "dev"}
+          VALID_TAGS = REQUIRED_CHANNELS | {"development"}  # accept legacy alias
+          REPO = os.environ.get("GITEA_REPO", "")
+          ORG = os.environ.get("GITEA_ORG", "MokoConsulting")
+          REPO_BASE = f"https://git.mokoconsulting.tech/{ORG}/"
+
+          # Gitea release tag names per channel (Moko standard)
+          RELEASE_TAG_MAP = {
+              "stable": "stable",
+              "rc": "release-candidate",
+              "beta": "beta",
+              "alpha": "alpha",
+              "dev": "development",
+              "development": "development",
+          }
+
+          # Joomla update XML required fields per
+          # https://docs.joomla.org/Deploying_an_Update_Server
+          REQUIRED_FIELDS = ["name", "element", "type", "version", "infourl"]
+
+          for i, u in enumerate(updates):
+              tag_el = u.find("tags/tag")
+              tag = tag_el.text.strip() if tag_el is not None and tag_el.text else None
+              label = f"Entry {i+1} (<tag>{tag or '?'}</tag>)"
+
+              # -- Required Joomla fields --
+              for field in REQUIRED_FIELDS:
+                  el = u.find(field)
+                  if el is None or not (el.text or "").strip():
+                      print(f"::error::{label}: missing required <{field}>")
+                      errors += 1
+
+              # -- <downloads><downloadurl> --
+              dl = u.find("downloads/downloadurl")
+              if dl is None or not (dl.text or "").strip():
+                  print(f"::error::{label}: missing <downloads><downloadurl>")
+                  errors += 1
+              else:
+                  dl_url = dl.text.strip()
+                  # Must point to org repo
+                  if REPO_BASE not in dl_url:
+                      print(f"::error::{label}: download URL not under {REPO_BASE}: {dl_url}")
+                      errors += 1
+                  # Must end in .zip
+                  if not dl_url.endswith(".zip"):
+                      print(f"::error::{label}: download URL must end in .zip: {dl_url}")
+                      errors += 1
+                  # Must use correct Gitea release tag in path
+                  if tag and tag in RELEASE_TAG_MAP:
+                      expected_tag = RELEASE_TAG_MAP[tag]
+                      if f"/download/{expected_tag}/" not in dl_url:
+                          print(f"::error::{label}: download URL should contain /download/{expected_tag}/ but got: {dl_url}")
+                          errors += 1
+
+              # -- <client> (required for Joomla to match update) --
+              client = u.find("client")
+              if client is None or not (client.text or "").strip():
+                  print(f"::error::{label}: missing <client> (required for Joomla update matching)")
+                  errors += 1
+
+              # -- <targetplatform> --
+              tp = u.find("targetplatform")
+              if tp is None:
+                  print(f"::error::{label}: missing <targetplatform>")
+                  errors += 1
+              else:
+                  tp_name = tp.get("name", "")
+                  tp_ver = tp.get("version", "")
+                  if tp_name != "joomla":
+                      print(f"::error::{label}: targetplatform name should be 'joomla', got '{tp_name}'")
+                      errors += 1
+                  if not tp_ver:
+                      print(f"::error::{label}: targetplatform missing version regex")
+                      errors += 1
+                  elif "5" not in tp_ver or "6" not in tp_ver:
+                      print(f"::warning::{label}: targetplatform version may not cover Joomla 5+6: {tp_ver}")
+                      warnings += 1
+
+              # -- <type> must be valid Joomla type --
+              type_el = u.find("type")
+              if type_el is not None and type_el.text:
+                  valid_types = {"component", "module", "plugin", "template", "library", "package", "file"}
+                  if type_el.text.strip() not in valid_types:
+                      print(f"::error::{label}: invalid type '{type_el.text}' (expected: {valid_types})")
+                      errors += 1
+
+              # -- <version> format (XX.YY.ZZ with optional suffix) --
+              ver_el = u.find("version")
+              if ver_el is not None and ver_el.text:
+                  if not re.match(r"^\d{2}\.\d{2}\.\d{2}(-\w+)?$", ver_el.text.strip()):
+                      print(f"::warning::{label}: version '{ver_el.text}' does not match XX.YY.ZZ format")
+                      warnings += 1
+
+              # -- <maintainer> and <maintainerurl> --
+              for field in ["maintainer", "maintainerurl"]:
+                  el = u.find(field)
+                  if el is None or not (el.text or "").strip():
+                      print(f"::warning::{label}: missing <{field}>")
+                      warnings += 1
+
+              # -- Valid stability tag --
+              if tag is None:
+                  print(f"::error::{label}: missing <tags><tag>")
+                  errors += 1
+              elif tag not in VALID_TAGS:
+                  print(f"::error::{label}: invalid tag '{tag}' (expected: {VALID_TAGS})")
+                  errors += 1
+
+              # -- Duplicate tag check --
+              norm_tag = "dev" if tag == "development" else tag
+              if norm_tag in seen_tags:
+                  print(f"::error::{label}: duplicate channel '{tag}'")
+                  errors += 1
+              if norm_tag:
+                  seen_tags.add(norm_tag)
+
+          # -- All 5 channels must exist --
+          missing = REQUIRED_CHANNELS - seen_tags
+          if missing:
+              print(f"::error::Missing required update channels: {', '.join(sorted(missing))}")
+              errors += 1
+
+          # -- Version ordering: higher stability must not exceed dev version --
+          channel_versions = {}
+          for u in updates:
+              tag_el = u.find("tags/tag")
+              ver_el = u.find("version")
+              if tag_el is not None and ver_el is not None and tag_el.text and ver_el.text:
+                  norm = "dev" if tag_el.text.strip() == "development" else tag_el.text.strip()
+                  # Strip suffix for comparison (01.00.18-dev -> 01.00.18)
+                  base_ver = re.sub(r"-\w+$", "", ver_el.text.strip())
+                  channel_versions[norm] = base_ver
+
+          # Cascade check: dev >= alpha >= beta >= rc >= stable
+          ORDER = ["dev", "alpha", "beta", "rc", "stable"]
+          for j in range(1, len(ORDER)):
+              current = ORDER[j]
+              previous = ORDER[j - 1]
+              if current in channel_versions and previous in channel_versions:
+                  if channel_versions[current] > channel_versions[previous]:
+                      print(f"::error::{current} version ({channel_versions[current]}) is ahead of {previous} ({channel_versions[previous]})")
+                      errors += 1
+
+          # -- Summary --
+          print(f"\nupdates.xml validation: {len(updates)} entries, {errors} error(s), {warnings} warning(s)")
+          if errors > 0:
+              sys.exit(1)
+          PYEOF
+
+      - name: Summary
+        if: always()
+        run: |
+          echo "## Joomla Update Server" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY
+          echo "|-------|-------|" >> $GITHUB_STEP_SUMMARY
+          echo "| Stability | \`${STABILITY}\` |" >> $GITHUB_STEP_SUMMARY
+          echo "| Version | \`${DISPLAY_VERSION}\` |" >> $GITHUB_STEP_SUMMARY
+          echo "| Element | \`${EXT_ELEMENT}\` |" >> $GITHUB_STEP_SUMMARY
+          echo "| Download | [ZIP](${DOWNLOAD_URL}) |" >> $GITHUB_STEP_SUMMARY

cli/manifest_read.php

@@ -103,6 +103,7 @@ if ($xml === false) {
         'language'          => (string)($xml->build->language ?? ''),
         'package-type'      => (string)($xml->build->{"package-type"} ?? ''),
         'entry-point'       => (string)($xml->build->{"entry-point"} ?? ''),
+        'version'           => (string)($xml->identity->version ?? ''),
         'source-dir'        => (string)($xml->deploy->{"source-dir"} ?? ''),
         'remote-subdir'     => (string)($xml->deploy->{"remote-subdir"} ?? ''),
         'excludes'          => (string)($xml->deploy->excludes ?? ''),

cli/version_bump.php

@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/version_bump.php
- * BRIEF: Auto-increment patch version — checks both README.md and manifest XML, uses the higher version as base
+ * BRIEF: Auto-increment version — manifest.xml is canonical, also updates README.md and Joomla XML
  */
 
 declare(strict_types=1);
@@ -24,7 +24,18 @@ foreach ($argv as $i => $arg) {
 
 $root = realpath($path) ?: $path;
 
-// ── Read version from README.md ──────────────────────────────────────────────
+// -- 1. Read version from .mokogitea/manifest.xml (canonical) --
+$mokoVersion = null;
+$mokoManifest = "{$root}/.mokogitea/manifest.xml";
+$mokoContent = '';
+if (file_exists($mokoManifest)) {
+    $mokoContent = file_get_contents($mokoManifest);
+    if (preg_match('|<version>(\d{2}\.\d{2}\.\d{2})</version>|', $mokoContent, $m)) {
+        $mokoVersion = $m[1];
+    }
+}
+
+// -- 2. Fallback: README.md --
 $readmeVersion = null;
 $readme = "{$root}/README.md";
 $readmeContent = '';
@@ -35,10 +46,8 @@ if (file_exists($readme)) {
     }
 }
 
-// ── Read version from Joomla manifest XML ────────────────────────────────────
+// -- 3. Fallback: Joomla manifest XML --
 $manifestVersion = null;
-
-// Check package manifest first (pkg_*.xml), then sub-extension manifests
 $manifestFiles = array_merge(
     glob("{$root}/src/pkg_*.xml") ?: [],
     glob("{$root}/src/*.xml") ?: [],
@@ -60,23 +69,21 @@ foreach ($manifestFiles as $xmlFile) {
     }
 }
 
-// ── Use the higher version as base ───────────────────────────────────────────
+// -- Use the highest version as base --
 $baseVersion = null;
-
-if ($readmeVersion !== null && $manifestVersion !== null) {
-    $baseVersion = version_compare($manifestVersion, $readmeVersion, '>') ? $manifestVersion : $readmeVersion;
-} elseif ($manifestVersion !== null) {
-    $baseVersion = $manifestVersion;
-} elseif ($readmeVersion !== null) {
-    $baseVersion = $readmeVersion;
+$candidates = array_filter([$mokoVersion, $readmeVersion, $manifestVersion]);
+foreach ($candidates as $v) {
+    if ($baseVersion === null || version_compare($v, $baseVersion, '>')) {
+        $baseVersion = $v;
+    }
 }
 
 if ($baseVersion === null) {
-    fwrite(STDERR, "No version found in README.md or manifest XML\n");
+    fwrite(STDERR, "No version found in manifest.xml, README.md, or Joomla XML\n");
     exit(1);
 }
 
-// ── Parse and bump ───────────────────────────────────────────────────────────
+// -- Parse and bump --
 if (!preg_match('/^(\d{2})\.(\d{2})\.(\d{2})$/', $baseVersion, $parts)) {
     fwrite(STDERR, "Invalid version format: {$baseVersion}\n");
     exit(1);
@@ -99,7 +106,18 @@ switch ($type) {
 
 $new = sprintf('%02d.%02d.%02d', $major, $minor, $patch);
 
-// ── Update README.md ─────────────────────────────────────────────────────────
+// -- Update .mokogitea/manifest.xml (canonical target) --
+if (file_exists($mokoManifest) && !empty($mokoContent)) {
+    $updated = preg_replace(
+        '|<version>\d{2}\.\d{2}\.\d{2}</version>|',
+        "<version>{$new}</version>",
+        $mokoContent,
+        1
+    );
+    file_put_contents($mokoManifest, $updated);
+}
+
+// -- Update README.md --
 if (file_exists($readme) && !empty($readmeContent)) {
     $updated = preg_replace(
         '/(VERSION:\s*)\d{2}\.\d{2}\.\d{2}/m',
@@ -110,5 +128,5 @@ if (file_exists($readme) && !empty($readmeContent)) {
     file_put_contents($readme, $updated);
 }
 
-echo "{$old} → {$new}\n";
+echo "{$old} -> {$new}\n";
 exit(0);

cli/version_read.php

@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/version_read.php
- * BRIEF: Read version from README.md or manifest XML — outputs the higher of the two
+ * BRIEF: Read version — manifest.xml is canonical, falls back to README.md and Joomla XML
  */
 
 declare(strict_types=1);
@@ -23,7 +23,26 @@ foreach ($argv as $i => $arg) {
 
 $root = realpath($path) ?: $path;
 
-// ── Read from README.md ──────────────────────────────────────────────────────
+// -- 1. Read from .mokogitea/manifest.xml (canonical source) --
+$mokoVersion = null;
+$mokoManifest = "{$root}/.mokogitea/manifest.xml";
+if (file_exists($mokoManifest)) {
+    $xml = @simplexml_load_file($mokoManifest);
+    if ($xml !== false) {
+        $v = (string)($xml->identity->version ?? '');
+        if (preg_match('/^\d{2}\.\d{2}\.\d{2}$/', $v)) {
+            $mokoVersion = $v;
+        }
+    }
+}
+
+// If manifest.xml has a version, that is authoritative
+if ($mokoVersion !== null) {
+    echo $mokoVersion . "\n";
+    exit(0);
+}
+
+// -- 2. Fallback: README.md --
 $readmeVersion = null;
 $readme = "{$root}/README.md";
 if (file_exists($readme)) {
@@ -33,7 +52,7 @@ if (file_exists($readme)) {
     }
 }
 
-// ── Read from Joomla manifest XML ────────────────────────────────────────────
+// -- 3. Fallback: Joomla manifest XML --
 $manifestVersion = null;
 $manifestFiles = array_merge(
     glob("{$root}/src/pkg_*.xml") ?: [],
@@ -55,7 +74,7 @@ foreach ($manifestFiles as $xmlFile) {
     }
 }
 
-// ── Output the higher version ────────────────────────────────────────────────
+// -- Output the higher version --
 $version = null;
 if ($readmeVersion !== null && $manifestVersion !== null) {
     $version = version_compare($manifestVersion, $readmeVersion, '>') ? $manifestVersion : $readmeVersion;
@@ -66,7 +85,7 @@ if ($readmeVersion !== null && $manifestVersion !== null) {
 }
 
 if ($version === null) {
-    fwrite(STDERR, "No version found in README.md or manifest XML\n");
+    fwrite(STDERR, "No version found in manifest.xml, README.md, or Joomla XML\n");
     exit(1);
 }