Review: Set up Woodpecker CI pipeline for westside-basketball (re-review)

Verdict: APPROVED

Prior BODY Fixes Verified

• [x] deployment-patch.yaml added to File Targets — now listed under modify with clear instructions: remove hostPath volume mount, remove inline apt-get/bundle command, keep env vars, probes, resource limits
• [x] imagePullSecrets reversal documented — kustomization.yaml modify entry now says "reverse the imagePullSecrets removal (re-add harbor-creds)". Verified: base standard/deployment.yaml already has imagePullSecrets: harbor-creds at line 20-21, so removing the removal patch is sufficient
• [x] Minitest vs RSpec clarified — Context states "test framework is Minitest (test/ directory), not RSpec". Constraints adds "Test step must use rails test + rails db:schema:load (Minitest), NOT rspec". AC2 specifies "rails test, not rspec". Verified: westside-basketball/test/ exists with controllers/, models/, services/, test_helper.rb; no spec/ directory
• [x] Woodpecker CI secrets documented — Constraints: "Woodpecker CI secrets (forgejo_token, harbor_username, harbor_password) must be verified or created for this repo". Test Expectations: "Verify: Woodpecker CI secrets exist for this repo"

Template Completeness

• [x] Type — Feature
• [x] Lineage — discovered during sprint:2 validation
• [x] Repo — ldraney/westside-basketball + ldraney/pal-e-deployments (both identified)
• [x] User Story — well-formed (developer role, CI/CD pipeline, automated deploy)
• [x] Context — comprehensive: gap explanation, current dev-mode pattern, Minitest note, 4 specific problems to fix
• [x] File Targets — create (.woodpecker.yaml), modify (kustomization.yaml, deployment-patch.yaml), verify (harbor-creds.enc.yaml), don't-touch (application code)
• [x] Feature Flag — none (correct for infra work)
• [x] Acceptance Criteria — 6 criteria, all measurable and agent-verifiable
• [x] Test Expectations — integration test + kubectl verification + secrets check + run command
• [x] Constraints — pattern reference, Harbor registry, base-images, Minitest, secrets
• [x] Checklist — standard PR checklist
• [x] Related — project page, blocking PRs, reference overlay

Traceability

• [x] story:WS-S1 label — "As superadmin, I want to deploy platform changes via IaC so that infrastructure is reproducible and auditable"
• [x] story note verified — found in project-westside-basketball user-stories section under Superadmin (Lucas)
• [x] arch:ci-cd label — CI/CD pipeline component
• [ ] arch note MISSING — [SCOPE] search for "arch-ci-cd" returned no results. Create architecture note arch-ci-cd documenting the Woodpecker CI/CD pattern across repos. (Carried forward from prior review — does not block implementation, the issue body documents the pattern sufficiently for agent execution)
• [x] Forgejo issue — ldraney/westside-basketball#53, state: open

File Targets

• [x] .woodpecker.yaml (create) — verified: file does not exist in westside-basketball. Correct target.
• [x] ~/pal-e-deployments/overlays/westside-ror/prod/kustomization.yaml (modify) — verified: exists, currently uses ruby:3.4-slim (line 61-62), has explicit imagePullSecrets removal at lines 31-33. Both changes correctly scoped.
• [x] ~/pal-e-deployments/overlays/westside-ror/prod/deployment-patch.yaml (modify) — verified: exists, has hostPath mount at lines 52-59 and inline apt-get/bundle command at line 14. Both correctly identified for removal.
• [x] harbor-creds.enc.yaml (verify/create) — verified: does NOT exist in westside-ror overlay yet. westsidekingsandqueens overlay has one as reference (confirmed). Base deployment already references harbor-creds secret name.

Repo Placement

Dependencies

• No explicit depends: label on board item — correct, this is foundational infrastructure.
• Other sprint:3 items (email #1598 5pts next_up, domain #1607 2pts next_up, email #1580 3pts next_up) do NOT depend on this CI pipeline — they can proceed independently.
• Sprint:2 merged PRs #50 and #51 are undeployed because this pipeline does not exist. This ticket unblocks their deployment.
• Woodpecker CI secrets requirement is now documented in Constraints and Test Expectations.

Acceptance Criteria

• [x] AC1: pipeline triggers on push to main and pull_request — verifiable via Woodpecker UI
• [x] AC2: pipeline runs lint, test (rails test), build-and-push, update-kustomize-tag — verifiable, correctly specifies rails test not rspec
• [x] AC3: deployment-patch.yaml no longer has hostPath or inline apt-get — verifiable via file diff
• [x] AC4: kustomization.yaml references Harbor image with imagePullSecrets — verifiable via file diff
• [x] AC5: ArgoCD auto-syncs new image — verifiable via ArgoCD UI / kubectl
• [x] AC6: Pod runs Harbor-built image — verifiable via kubectl describe pod

Blast Radius

• westsidekingsandqueens overlay is separate and unaffected — different namespace, different image path.
• update-kustomize-tag.sh is a shared script from pal-e-platform/scripts/ using OVERLAY env var. No blast radius.
• Base standard/deployment.yaml is not modified — only overlay patches change.
• No other repos reference westside-basketball CI config.

Decomposition Assessment

Recommendations

• [SCOPE] Create architecture note arch-ci-cd documenting the Woodpecker CI/CD pattern (pipeline stages, shared scripts, Harbor registry, kustomize tag updates). Carried forward from prior review — does not block implementation.