Phase 6.4: Apply-on-Merge Pipeline

phase-pal-e-platform-ci-6-4-apply-on-merge Phase

Project

Goal: Merge to main triggers tofu apply -auto-approve, eliminating the laptop SPOF and state lock contention. Merge = deploy.

Owner: Dev agent

Repo: forgejo_admin/pal-e-platform

Depends on: phase-pal-e-platform-ci-6-3-plan-on-pr (COMPLETED)

Scope

Update .woodpecker.yaml: add apply step on push-to-main events
Apply uses same secrets as plan step (already configured in 6.3)
Apply triggers on event: push, branch: main only

Deliverables

PR #50 merged (squash) — .woodpecker.yaml includes apply step
Apply step: writes kubeconfig from secret, inits with backend override, runs tofu apply -auto-approve -no-color
Forgejo Issue #49 closed
Verification pending: merge of PR #50 itself triggers the first apply-on-merge pipeline

Deferred Scope

Apply failure notification (Telegram alert or Forgejo comment on failure) — not implemented yet
Developer onboarding SOP for new CI workflow — Phase 6.5
Break-glass procedure for manual tofu apply — needs documentation

plan-pal-e-platform -- parent plan
phase-pal-e-platform-ci-6-3-plan-on-pr -- prerequisite phase