pal-e-docs

Review: T3: Arch Linux Ruby base image in Harbor

review-1201-2026-05-10 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Type -- present (Infra)
  • [x] Lineage -- present
  • [x] Repo -- present (ldraney/pal-e-platform)
  • [x] User Story -- present
  • [x] Context -- present, thorough
  • [x] File Targets -- present (2 creates, 1 conditional modify)
  • [x] Acceptance Criteria -- present (7 items)
  • [x] Test Expectations -- present (4 items)
  • [x] Constraints -- present
  • [x] Related -- present
  • [x] Dockerfile Shape -- present (bonus: inline code reference)
  • [x] Pipeline Shape -- present (bonus: inline description)
  • [ ] Checklist -- missing (PR opened, tests pass, no unrelated changes)

Traceability

  • [x] story:infra-overhaul label -- present on board item
  • [ ] story note MISSING -- [SCOPE] The infra-overhaul story is not listed in the project-pal-enterprises user-stories table. Current stories: landing-page, sso-gateway, tool-dashboard, client-portal. Add infra-overhaul row.
  • [x] arch:harbor label -- present on board item
  • [ ] arch note MISSING -- [SCOPE] No arch-harbor note found in pal-e-docs. Create architecture note for the Harbor component.
  • [x] Forgejo issue -- https://forgejo.tail5b443a.ts.net/ldraney/pal-e-platform/issues/360, state: open

File Targets

  • [x] docker/ruby-arch/Dockerfile -- to be CREATED in pal-e-platform. Directory does not exist yet (expected for new file). Dockerfile shape provided inline.
  • [x] docker/ruby-arch/.woodpecker.yaml -- to be CREATED in pal-e-platform. Pipeline shape described inline.
  • [x] terraform/modules/harbor/main.tf -- VERIFIED EXISTS in pal-e-platform. Currently defines Harbor Helm release, OIDC config, and portal proxy. No Harbor project resource exists yet -- the issue correctly notes "add pal-e Harbor project (if not exists)".

Repo Placement

OK. Issue is filed on ldraney/pal-e-platform and all file targets (docker/, terraform/) are pal-e-platform paths. The board item is on board-pal-enterprises which is correct since this infra work supports the pal-enterprises app. No cross-repo issues.

Dependencies

The issue is Ticket 3 of a 5-ticket infra overhaul sequence (T1-T5). Dependencies found but NOT documented in the issue body:
  • T4 (Dockerfile migration to Arch base, #1198) -- directly depends on T3. Cannot migrate app Dockerfiles to Arch base until the base image exists in Harbor.
  • T2 (Dev overlay with Arch base, #1197) -- depends on T3. Dev overlay references "Arch base" which is this image.
  • T1 (Keycloak dev redirect, #1200) -- independent, no dependency on T3.
  • T5 (Woodpecker CI with test gates, #1199) -- loosely related. CI pipeline conventions from T5 may affect T3's pipeline yaml, but T3 should be done first.
[BODY] Add a Dependencies section listing T4 and T2 as downstream dependents.

Acceptance Criteria

7 AC items are specific and testable. 4 test expectations are concrete with runnable commands. However:
  • The Constraints section flags a potential Kaniko compatibility issue with pacman -Syu but this is not reflected in the AC. If Kaniko cannot run pacman, the entire approach changes (buildah or docker-in-docker). This should be validated first or added as AC.
  • No AC for Harbor project creation via Terraform (the pal-e project in Harbor).

Blast Radius

Low immediate blast radius -- this creates new files only. The existing pal-enterprises Dockerfile (ruby:3.4.8-slim Debian base) is untouched by this ticket. Future consumers listed in the issue (pal-enterprises, westside-ror, pal-e-ror, westside-docs) will be migrated by T4 separately. No existing pipelines are modified.
The existing .woodpecker.yaml in pal-enterprises uses Kaniko for builds (plugin-kaniko:2.3.0). The pal-e-platform .woodpecker.yaml uses OpenTofu, not container builds. The new pipeline in docker/ruby-arch/.woodpecker.yaml would be a new Woodpecker pipeline definition -- verify whether Woodpecker auto-discovers yaml files in subdirectories or if this needs explicit registration.

Decomposition Assessment

3 file targets in 1 repo. 7 AC + 4 test expectations. Estimated agent work is within 5 minutes -- the Dockerfile and pipeline yaml are straightforward with shapes provided. No decomposition needed.

Recommendations

  • [SCOPE] Add infra-overhaul user story entry to project-pal-enterprises user-stories table.
  • [SCOPE] Create architecture note arch-harbor for the Harbor component in pal-e-docs.
  • [BODY] Add Checklist section (PR opened, tests pass, no unrelated changes).
  • [BODY] Add Dependencies section documenting T4 and T2 as downstream dependents.
  • [BODY] Add AC for Harbor project creation: "[ ] Harbor project pal-e exists (created via Terraform if needed)."
  • [BODY] Add AC or spike note for Kaniko + pacman compatibility: "[ ] Verify pacman -Syu works inside Kaniko build (or document alternative build tool)."