pal-e-docs

Review v2: .woodpecker.yaml: kaniko build → Harbor → kustomize tag bump

review-1094-2026-04-25-v2 Review

review ready
Project

Verdict: APPROVED

Re-review of review-1094-2026-04-25 (NEEDS_REFINEMENT). All previously flagged issues have been addressed in the refined Forgejo issue body.

Diff vs Previous Review

  • [BODY] Harbor project naming — FIXED. Body now explicitly states repo: westside-admin/app with rationale "service key = Harbor project = image_repo prefix" matching pal-e-services/terraform/services.tf:7 convention. Acceptance Criteria includes "project = westside-admin, NOT forgejo_admin". Constraints section reinforces.
  • [BODY] failure: ignore on update-kustomize-tag — FIXED. Step 4 in Scope explicitly says "Add failure: ignore per Woodpecker pipeline syntax so a failed kustomize tag bump does NOT mark the pipeline as failed". AC restates it.
  • [BODY] Service-registry onboarding dep — FIXED. Lineage names forgejo_admin/pal-e-services#<NEW>, board now has #1098 → pal-e-services#64 ("Onboard westside-admin: Harbor project + CI robot account via terraform"), state: open.
  • [LABEL] Arch label canonical — FIXED. Label changed from arch:woodpecker-ci to arch:ci-pipeline, which matches convention-architecture-ids "Deployment Components" table.
  • [SCOPE] Story + project page — RESOLVED. project-westside-admin exists with user-stories section listing admin-row-crud → story-westside-admin-admin-row-crud (verified via get_section).

Template Completeness

  • [x] Type — Task
  • [x] Lineage — names #6, #7, pal-e-services#<NEW>
  • [x] Repo — forgejo_admin/westside-admin
  • [x] User Story — story-westside-admin-admin-row-crud
  • [x] Context — Harbor naming critical-block called out
  • [x] Scope — 4 steps fully specified, including failure: ignore
  • [x] Acceptance Criteria — 9 testable criteria
  • [x] Test Expectations — manual verification path defined
  • [x] Constraints — version pins, secrets, Harbor project name
  • [x] Checklist
  • [x] Related — references project, arch, feedback memory, reference repo, deps

Traceability

  • [x] story:admin-row-crud label — admin row CRUD story
  • [x] story note verified — story-westside-admin-admin-row-crud exists, listed in project-westside-admin user-stories section
  • [x] arch:ci-pipeline label — Woodpecker CI per convention-architecture-ids Deployment Components table
  • [x] arch entry verified — arch:ci-pipeline documented in canonical convention note (Woodpecker CI). No standalone arch- note required; convention table is the source of truth.
  • [x] type:infra label — correct (CI pipeline config)
  • [x] Forgejo issue — https://forgejo.tail5b443a.ts.net/forgejo_admin/westside-admin/issues/8, open

File Targets

  • [x] ~/westside-app/.woodpecker.yaml (reference) — verified: 4 steps (clone, validate, build-and-push with repo: westsidekingsandqueens/app, update-kustomize-tag with OVERLAY: westsidekingsandqueens) confirms structure to mirror
  • [x] ~/pal-e-platform/scripts/update-kustomize-tag.sh — verified exists; required env: FORGEJO_TOKEN, OVERLAY, IMAGE_TAG; defaults: OVERLAY_ENV=prod, FORGEJO_HOST=forgejo-http.forgejo.svc.cluster.local, DEPLOY_REPO=forgejo_admin/pal-e-deployments. Path written by ticket: overlays/westside-admin/prod/kustomization.yaml — matches sibling #1095.
  • [x] pal-e-services/terraform/services.tf — verified line 7 comment "Convention: service key = Harbor project name = image_repo prefix" + sibling examples (westsidekingsandqueens/app, basketball-api/api, mcd-tracker-app/app). New westside-admin/app entry follows pattern.
  • [x] Target file ~/westside-admin/.woodpecker.yaml — repo not yet cloned locally (scaffold ticket #6 not landed). Acceptable: this ticket is blocked-by #6 + #7, will be created after scaffold lands.

Repo Placement

OK — .woodpecker.yaml belongs in forgejo_admin/westside-admin. Single-repo target. Cross-repo coordination (overlay creation, service registry entry, robot account) is handled by sibling tickets (#1095, #1098) per the lineage section.

Dependencies

  • Hard blocked-by: #1087 (westside-admin#6 scaffolding) — kaniko needs buildable code
  • Hard blocked-by: #1088 (westside-admin#7 Dockerfile) — kaniko needs build instructions
  • Hard blocked-by: #1098 (pal-e-services#64 service onboarding) — Harbor project westside-admin + CI robot account must exist before kaniko can push
  • Soft dep: #1095 (pal-e-deployments#133 overlay) — without overlay, update-kustomize-tag step fails; failure: ignore covers this so the build itself isn't blocked, but end-to-end ArgoCD deploy needs the overlay
  • All deps explicitly named in Lineage + Related sections.

Acceptance Criteria

9 criteria, all testable post-merge in Woodpecker UI + Harbor UI + pal-e-deployments commit history. YAML parse-validation criterion is mechanically verifiable. Image-path AC explicitly disambiguates the convention. Branch behavior (push/PR/manual) is enumerable. No untestable assertions.

Blast Radius

Low. The ticket's primary risk (Harbor naming drift causing the 36-hour outage scenario) is now explicitly defended-against in three places (Context paragraph, AC, Constraints). Service onboarding dep prevents kaniko from pushing into a non-existent project. The failure: ignore on the tag-bump step prevents this pipeline from breaking other pipelines via shared deployment-repo race conditions.

Decomposition Assessment

1 file, 4 pipeline steps, 9 AC. ~5 min agent work. No decomposition needed.

Recommendation

No action needed. Ready to advance backlog → todo.
  • review-1094-2026-04-25 — previous verdict (NEEDS_REFINEMENT)
  • convention-architecture-ids — confirms arch:ci-pipeline canonical
  • feedback_harbor_project_naming — Harbor naming convention enforced
  • feedback_yaml_parse_validation — YAML parse-validation enforced in body