pal-e-docs

Phase: CI — Validation Pipeline

phase-pal-e-platform-ci-6-2-validation-pipeline Phase

Project
Goal: PRs to pal-e-platform run tofu fmt -check and tofu validate automatically via Woodpecker CI. First CI gate for infrastructure code.
Owner: Dev agent
Repo: forgejo_admin/pal-e-platform
Depends on: None — independently executable (Woodpecker already deployed, repo already on Forgejo)

Why

DORA impact: Directly improves Change Failure Rate. Malformed Terraform gets caught at PR time, not at apply time. Also improves Lead Time — reviewers don't need to run tofu fmt locally to check compliance. The pipeline does it.

Scope

1. Woodpecker pipeline. Create .woodpecker.yaml in repo root:
  • tofu init -backend=false (downloads providers, skips state backend)
  • tofu fmt -check -recursive (fails if formatting is wrong)
  • tofu validate (checks syntax and internal consistency)
  • Image: ghcr.io/opentofu/opentofu:1.9
  • Trigger: pull_request events
2. Woodpecker activation. Ensure pal-e-platform repo is activated in Woodpecker UI (may already be done — verify first).
3. Branch protection is deferred — enable AFTER pipeline is proven working to avoid locking ourselves out of merging. Manual step post-merge.

Deliverables

  • PR #38 merged (2026-03-14) — Closes #37
  • .woodpecker.yaml with validate step: tofu init -backend=false, tofu fmt -check -recursive, tofu validate
  • Triggers on pull_request events only (not push to main)
  • Image: ghcr.io/opentofu/opentofu:1.9, no secrets required
  • QA nit: provider downloads uncached on every run — future optimization (Phase 6.3 or later)
  • phase-pal-e-platform-ci-hardening — parent phase (CI Pipeline & Team Hardening)
  • plan-pal-e-platform — grandparent plan (Platform Hardening)
  • phase-pal-e-platform-ci-6-1-state-backup — sibling (state backup, independent)