pal-e-docs

Review v2: Onboard westside-admin: Harbor project + CI robot account via terraform

review-1098-2026-04-25-v2 Review

review ready
Project

Verdict: READY

All v1 refinements have been applied and verified. Ticket is ready to advance backlog → todo per feedback_todo_means_reviewed.

v1 Refinements Verified

  • [x] [LABEL] Label changed arch:k8s-deploy → arch:harbor — confirmed via list_board_items: item #1098 labels = story:admin-row-crud,arch:harbor,type:infra. Matches sibling #1088 convention.
  • [x] [BODY] Port 3000 explicit — confirmed in Scope ("port: 3000") and AC #2 ("Entry specifies port 3000 and image_repo westside-admin/app").
  • [x] [BODY] Woodpecker secret model documentation required — confirmed in Scope ("Document in the PR description whether the new service uses the existing global secrets..."), AC #3 ("PR description documents which Woodpecker secret model is used"), and Checklist ("PR description documents Woodpecker secret model choice").
  • [x] [SCOPE] arch-deployment-westside-admin doc drift fixed — verified directly:

Template Completeness

  • [x] Type — Task
  • [x] Lineage — cites #1094 scope review + reviewer pre-investigation of services.tf:7
  • [x] Repo — forgejo_admin/pal-e-services
  • [x] User Story — story-westside-admin-admin-row-crud
  • [x] Context — existing pattern + reference entries cited
  • [x] Scope — clear, port 3000 + Woodpecker secret model both addressed
  • [x] Acceptance Criteria — 8 criteria, all testable
  • [x] Test Expectations — tofu plan + Harbor UI + first kaniko push
  • [x] Constraints — tofu, -lock=false, naming convention
  • [x] Checklist — present, includes secret model documentation gate
  • [x] Related — project, arch, conventions, blocks linkage

Traceability

  • [x] story:admin-row-crud label — admin row CRUD story
  • [x] story note verified — story-westside-admin-admin-row-crud exists; listed in project-westside-admin user-stories table (single v1 story)
  • [x] arch:harbor label — Harbor registry component, backed by the "Harbor registry" row in arch-deployment-westside-admin Components table (per fractal arch convention used by sibling #1088)
  • [~] No standalone arch-harbor note exists in pal-e-docs — OBSERVATION not blocker. The Harbor component is documented as a row inside the deployment-level arch note, which is the convention this board uses (sibling #1088 also labels arch:harbor with the same backing). If platform-wide standalone arch-harbor note is desired, file as a separate doc-cleanup ticket. Does NOT block #1098.
  • [x] Forgejo issue — https://forgejo.tail5b443a.ts.net/forgejo_admin/pal-e-services/issues/64, open

File Targets

Task type — file targets verified during v1 review and unchanged:
  • [x] ~/pal-e-services/terraform/k3s.tfvars — reference entry westsidekingsandqueens (lines 224-231) confirmed; schema (forgejo_repo, image_repo, port, funnel, source_repo, source_path) confirmed.
  • [x] ~/pal-e-services/terraform/services.tf — for_each over var.services, key drives Harbor project name + robot accounts (line 7 comment, line 13 name = each.key).

Repo Placement

OK — single-repo change in forgejo_admin/pal-e-services.

Dependencies

  • Blocks: #1094 (westside-admin .woodpecker.yaml), #1095 (pal-e-deployments overlay).
  • No upstream blockers. Independent of #1087 (scaffolding), #1088 (Dockerfile).
  • Only #1093 in todo; rest of board is todo or backlog. No conflicts.

Acceptance Criteria

All 8 ACs are testable. AC #3 (Woodpecker secret model documented in PR) and AC #2 (port 3000 + image_repo) directly address the v1 [BODY] flags. AC #8 verifies end-to-end via kaniko push test. The previous ambiguity around "(or document how the new project authenticates)" is resolved — the PR description must explicitly state which model (global vs per-repo).

Blast Radius

Harbor naming correct (verified v1). Doc drift in arch-deployment-westside-admin resolved — downstream tickets (#1094 .woodpecker.yaml, #1095 overlay) will now read consistent harbor.tail5b443a.ts.net/westside-admin/app:<sha> from the arch note. No risk of divergence at runtime.

Decomposition Assessment

1 file edit (k3s.tfvars), 8 AC (mostly post-apply verifications, not separate work units), ~5-10 min agent work. No decomposition needed. Single-pass agent task.

Recommendation

READY — advance #1098 backlog → todo. No action needed on this ticket.
  • Optional follow-up (not blocking): Consider filing a low-priority doc-cleanup ticket to create a standalone arch-harbor note for platform-wide reuse. Currently the Harbor component lives only as rows in per-deployment arch notes. This is a convention question for Ava, not a #1098 blocker.