decap-cms-widget-bulk-github-images

Custom Decap CMS widget that supports bulk gallery workflows while keeping media in your GitHub repository.

What it does

• Bulk upload multiple local images to your repo media_folder
• Multi-select existing images from that same folder
• Store gallery values as public paths (for example /uploads/example.jpg)
• Works with GitHub backend and local Decap proxy (decap-server)

Install

npm install decap-cms-widget-bulk-github-images

Use in /admin/index.html

For production, prefer self-hosting pinned assets (recommended):

<script src="/admin/vendor/decap-cms-3.0.0.js"></script>
<script src="/admin/vendor/decap-cms-widget-bulk-github-images-0.1.0.js"></script>

If you use a CDN, pin exact versions and add SRI:

<script
  src="https://unpkg.com/[email protected]/dist/decap-cms.js"
  integrity="sha384-REPLACE_WITH_REAL_HASH"
  crossorigin="anonymous"
></script>
<script
  src="https://unpkg.com/[email protected]/dist/index.js"
  integrity="sha384-REPLACE_WITH_REAL_HASH"
  crossorigin="anonymous"
></script>

config.yml field config

- label: Gallery Images
  name: gallery
  widget: bulkGithubImages
  required: false
  repo: YOUR_OWNER/YOUR_REPO
  branch: main
  proxy_url: http://localhost:8081/api/v1
  allow_remote_proxy: false
  strict_proxy_security: true
  media_folder: src/uploads
  public_folder: /uploads
  max_file_size_mb: 10
  max_files_per_upload: 25
  max_total_upload_mb: 50
  allowed_extensions: [".jpg", ".jpeg", ".png", ".gif", ".webp", ".avif", ".bmp"]

Security notes:

• proxy_url must be same-origin or localhost by default.
• Non-local proxy_url requires https.
• Set allow_remote_proxy: true only when you intentionally trust a remote proxy endpoint.
• strict_proxy_security: true (default) only allows localhost proxy_url.
• On non-local hosts, the widget always uses GitHub API mode and does not auto-fallback through proxy calls.
• media_folder and returned media paths are validated to reject unsafe path segments like ...
• Upload validation enforces allowed_extensions, max_file_size_mb, max_files_per_upload, and max_total_upload_mb.

Local development

This is a source-first repo:

• Edit src/index.js
• Run npm run build to generate dist/index.js
• Run npm test to execute security regression tests

When using local_backend: true, run both:

npm run build
npm run dev
npm run dev:cms

The widget uses proxy_url for local media operations.

Publish

cd packages/decap-cms-widget-bulk-github-images
npm publish