Review: Set up Woodpecker CI pipeline for westside-basketball

Verdict: NEEDS_REFINEMENT

Template Completeness

• [x] Type — Feature
• [x] Lineage — discovered during sprint:2 validation
• [x] Repo — ldraney/westside-basketball
• [x] User Story — present and well-formed
• [x] Context — comprehensive, explains the gap
• [x] File Targets — present with create/modify/don't-touch sections
• [x] Feature Flag — none (correct for infra work)
• [x] Acceptance Criteria — 4 criteria, all measurable
• [x] Test Expectations — integration test and kubectl verification
• [x] Constraints — references paldocs pattern, Harbor registry, base-images
• [x] Checklist — standard PR checklist present
• [x] Related — project page and blocking PRs referenced

Traceability

• [x] story:WS-S1 label — "As superadmin, I want to deploy platform changes via IaC so that infrastructure is reproducible and auditable"
• [x] story note verified — found in project-westside-basketball user-stories section under Superadmin (Lucas)
• [x] arch:ci-cd label — CI/CD pipeline component
• [ ] arch note MISSING — [SCOPE] search for "arch-ci-cd" returned no results. Create architecture note arch-ci-cd documenting the Woodpecker CI/CD pattern across repos.
• [x] Forgejo issue — ldraney/westside-basketball#53, state: open

File Targets

• [x] .woodpecker.yaml (create) — verified: file does not exist yet in westside-basketball. Correct target.
• [x] ~/pal-e-deployments/overlays/westside-ror/prod/kustomization.yaml (modify) — verified: file exists, currently uses ruby:3.4-slim as image with no Harbor reference. Confirmed this is the right file to switch to Harbor image.
• [ ] ~/pal-e-deployments/overlays/westside-ror/prod/deployment-patch.yaml — ISSUE: not mentioned in file targets but MUST be modified. Currently has hostPath: /home/ldraney/westside-ror volume mount (line 58) and inline apt-get install && bundle install in the command (line 14). When switching to a Harbor-built image, this hostPath mount becomes invalid and the inline build command is redundant — the Dockerfile handles all of this. The agent needs to know this file needs changes too.
• [ ] ~/pal-e-deployments/overlays/westside-ror/prod/kustomization.yaml line 32-33 — ISSUE: the kustomization explicitly removes imagePullSecrets because it uses a public ruby image. When switching to Harbor, imagePullSecrets must be KEPT (Harbor requires auth). This patch removal must be reversed, and a harbor-creds.enc.yaml resource may be needed (the westsidekingsandqueens overlay already has one as reference).

Repo Placement

Dependencies

• No explicit depends: label on board item — correct, this is foundational infrastructure.
• Other sprint:3 items (email #1598, domain #1607, email #1580) do NOT depend on this CI pipeline — they can proceed independently.
• However, sprint:2 merged PRs #50 and #51 are undeployed BECAUSE this pipeline doesn't exist. This ticket unblocks their deployment.
• Woodpecker CI secrets (forgejo_token, harbor_username, harbor_password) must exist in Woodpecker for the westside-basketball repo. The issue does not mention creating these secrets. Paldocs and pal-e-docs already have them — the agent needs to know whether these are global secrets (shared) or per-repo secrets that need creation.

Acceptance Criteria

• [x] AC1 "pipeline triggers on push to main and pull_request" — verifiable via Woodpecker UI, well-defined
• [x] AC2 "Pipeline runs lint, test, build-and-push, update-kustomize-tag" — verifiable BUT the test step must use rails test (Minitest), NOT rspec. The paldocs reference uses rspec. Also, westside-basketball has no db/ci_schema.sql — the test step needs rails db:schema:load instead of psql -f db/ci_schema.sql.
• [x] AC3 "ArgoCD auto-syncs new image" — verifiable via ArgoCD UI / kubectl
• [x] AC4 "Pod runs Harbor-built image" — verifiable via kubectl describe pod

Blast Radius

• The westsidekingsandqueens overlay in pal-e-deployments is "being replaced by westside-ror" per its README. It already has Harbor creds and a different deployment pattern. Changes to westside-ror overlay do not affect westsidekingsandqueens.
• The update-kustomize-tag.sh script is shared across all pipelines (fetched from pal-e-platform/scripts/). It uses the OVERLAY env var to target the right overlay directory. No blast radius concern here — standard pattern.
• No other repos reference westside-basketball's CI config.
• The Dockerfile currently uses ruby:3.4.8-slim directly. The constraints say "Base image should come from base-images repo." The base-images repo has a Dockerfile at ~/base-images/Dockerfile using ruby:3.4.9-slim. If the ticket means the CI build step should use harbor.tail5b443a.ts.net/library/ruby-rails-build:latest (like paldocs CI), that's fine. But if it also means the production Dockerfile should be rebased onto the Harbor base image, that's additional scope not captured in file targets.

Decomposition Assessment

Recommendations

• [BODY] Add deployment-patch.yaml to File Targets (modify section): "Remove hostPath volume mount and inline build command — the Harbor image handles all of this via the Dockerfile. Remove the volume and volumeMounts entries."
• [BODY] Add note to File Targets (modify section) for kustomization.yaml: "Reverse the imagePullSecrets removal patch — Harbor requires auth. Add harbor-creds.enc.yaml resource if not already present (see westsidekingsandqueens overlay as reference)."
• [BODY] Add note to Constraints or Context: "westside-basketball uses Minitest (test/ directory), not RSpec. CI test step should use rails test and rails db:schema:load, not rspec and ci_schema.sql."
• [BODY] Add to Context or Dependencies: "Verify Woodpecker CI secrets (forgejo_token, harbor_username, harbor_password) exist as global secrets or create per-repo secrets for westside-basketball."
• [SCOPE] Create architecture note arch-ci-cd documenting the Woodpecker CI/CD pattern (pipeline stages, shared scripts, Harbor registry, kustomize tag updates).