Review: .woodpecker.yaml: kaniko build → Harbor → kustomize tag bump

Verdict: NEEDS_REFINEMENT

Template Completeness

• [x] Type — Task
• [x] Lineage — depends on scaffolding + Dockerfile tickets
• [x] Repo — forgejo_admin/westside-admin
• [x] User Story — story-westside-admin-admin-row-crud (foundational)
• [x] Context — clear 4-step pipeline mirror description
• [x] Scope — detailed step-by-step intent
• [x] Acceptance Criteria — 8 criteria, mostly testable
• [x] Test Expectations — manual verification path defined
• [x] Constraints — version pins + secrets noted
• [x] Checklist — present
• [x] Related — references reference repo + arch + project

Traceability

• [x] story:admin-row-crud label — admin row CRUD story
• [ ] story note MISSING — no project-westside-admin page found in pal-e-docs (search returned no results). [SCOPE] Create user story entry on project-westside-admin user-stories section, OR confirm the project page exists under a different slug.
• [x] arch:woodpecker-ci label — Woodpecker CI pipeline component
• [ ] arch note MISSING — no arch-woodpecker-ci note found in pal-e-docs. [SCOPE] Create architecture note arch-woodpecker-ci for the CI component (or rename label to match an existing arch note such as arch-deployment-westside-admin referenced in the issue body).
• [x] Forgejo issue — https://forgejo.tail5b443a.ts.net/forgejo_admin/westside-admin/issues/8, open

File Targets

• [x] ~/westside-app/.woodpecker.yaml (reference) — verified exists, 4 steps as described (clone, validate, build-and-push, update-kustomize-tag)
• [x] ~/pal-e-platform/scripts/update-kustomize-tag.sh — verified exists, env contract matches (FORGEJO_TOKEN, OVERLAY, IMAGE_TAG required; OVERLAY_ENV default prod)
• [x] Target file ~/westside-admin/.woodpecker.yaml — repo cloned locally; file does not yet exist (this ticket creates it). Correct.
• [ ] Implied target overlay overlays/westside-admin/prod in pal-e-deployments — does NOT yet exist (sibling ticket #1095 / pal-e-deployments#133 creates it). The update-kustomize-tag step will fail until #1095 lands. The "must NOT block the pipeline if it fails" requirement covers this, but document the explicit blocker dep.

Repo Placement

Dependencies

• Blocked by: scaffolding ticket (westside-admin#6, board #1087) and Dockerfile ticket — without a Dockerfile, kaniko build will fail. Lineage section names them but does not link issue numbers.
• Blocked by: deployment overlay ticket (pal-e-deployments#133, board #1095) — update-kustomize-tag step has nothing to update until the overlay's kustomization.yaml with a newTag field exists.
• Blocked by: service-registry onboarding for westside-admin in pal-e-services/terraform/k3s.tfvars — required to provision the Harbor project + CI robot account before kaniko can push. NOT mentioned in the ticket. [SCOPE]
• Required secrets: ticket assumes harbor_username, harbor_password, forgejo_token exist as repo or global secrets in Woodpecker. Per service-onboarding-sop, per-service Harbor robot creds are provisioned by tofu apply on services.tf — agent must verify the secrets are wired to the westside-admin repo in Woodpecker before merge, not after.

Acceptance Criteria

• AC "Harbor project: forgejo_admin (matches repo owner per feedback_harbor_project_naming)" — this is wrong. See Blast Radius below. Convention is "service key = Harbor project = image_repo prefix" (per pal-e-services/terraform/services.tf line 7), NOT repo owner. The reference westside-app uses repo: westsidekingsandqueens/app (Harbor project = westsidekingsandqueens), not forgejo_admin/westside-app.
• AC "OVERLAY env var = westside-admin" — assumes overlay name; depends on #1095 using that exact name (verify consistency across tickets).
• AC "image tag = ${CI_COMMIT_SHA} (full SHA)" — matches reference. OK.
• AC "update-kustomize-tag failure does NOT break the pipeline" — reference uses depends_on: build-and-push + when: event=push branch=main. There is no explicit failure: ignore in the reference. The cited precedent commit 1d54939 ("run update-kustomize-tag step even when test step fails") changed when-conditions, not failure tolerance for the tag step itself. Dev agent must verify the actual mechanism (likely needs failure: ignore on the step) and not assume it is implicit. [BODY]

Blast Radius

• Service registry needs a westside-admin entry with image_repo = "westside-admin/app" (or similar) to provision a westside-admin Harbor project.
• If kaniko pushes to harbor.harbor.svc.cluster.local with repo: forgejo_admin/westside-admin, push will fail (no forgejo_admin project) OR create a forgejo_admin Harbor project (drift from convention; failed migration would mirror the 36-hour outage cited in the convention).
• The kustomize overlay's image reference will need to match whatever Harbor path is chosen — if #1095 hardcodes a different path, ArgoCD will pull-fail.

Decomposition Assessment

Recommendation

• [BODY] Fix the Harbor project AC: replace "Harbor project: forgejo_admin (matches repo owner)" with the chosen service key (likely westside-admin, matching image_repo prefix per services.tf convention). Update kaniko repo: setting in Scope to match.
• [BODY] Add explicit failure: ignore (or equivalent step-level pattern) to update-kustomize-tag in the Scope, since reference repo's "non-blocking" behavior is not actually enforced by structure — verify how it currently behaves and document explicitly.
• [BODY] Document the dependency on service-registry onboarding (new entry in pal-e-services/terraform/k3s.tfvars + tofu apply) before this pipeline can succeed end-to-end. Either add it as a Lineage item or open a sibling ticket.
• [SCOPE] Create user story entry on project-westside-admin user-stories section (or create the project page if missing).
• [SCOPE] Create architecture note arch-woodpecker-ci (or relabel the board item to arch:deployment-westside-admin matching the Related section in the issue body).
• [LABEL] Confirm the board's arch label resolves to a real arch note before todo→next_up.