Review: Fix CI test failures and gem audit for initial Harbor image build

Verdict: APPROVED

Template Completeness

• [x] Type -- Bug
• [x] Lineage -- Sprint 5 blocking, discovered during pipeline validation
• [x] Repo -- ldraney/westside-basketball
• [x] What Broke -- Detailed description of pipeline failures (test + audit blocking build-and-push)
• [x] Repro Steps -- 6-step reproduction with specific pipeline output
• [x] Expected Behavior -- Clear target state
• [x] Acceptance Criteria -- 7 test fixes, 6 gem audit fixes, 4 pipeline criteria
• [x] Environment -- Woodpecker 3.13.0, Ruby 3.4, Rails 8.1.3
• [x] Related -- Sprint 5 tickets and dependencies listed

Traceability

• [x] story:WS-S1 label -- "As superadmin, I want to deploy platform changes via IaC so that infrastructure is reproducible and auditable." Correct match for CI/pipeline infrastructure work. (Fixed from previous review's story:admin-player-management.)
• [x] story note verified -- WS-S1 found in project-westside-basketball user-stories section under Superadmin (Lucas).
• [x] arch:ci-pipeline label -- CI pipeline architecture component.
• [ ] arch note MISSING -- search_notes("arch-ci-pipeline") returned no results. Known gap across multiple board items (items #1612, #578 also reference arch:ci-pipeline). Not blocking per user direction -- this is a cross-cutting gap, not a scoping deficiency of this ticket.
• [x] Forgejo issue -- ldraney/westside-basketball#69, state: open.

File Targets

• [x] test/controllers/admin/players_controller_test.rb -- verified: file exists (2.3k), contains all 3 failing test methods. CSS selectors (.status-badge, a.player-list-link, .player-list-table-wrap) match the view at app/views/admin/players/index.html.erb (L51, L66, L77). Failures likely stem from DB/fixture issues preventing player data from rendering.
• [x] test/mailers/tournament_mailer_test.rb -- verified: file exists (5.8k). Contains 3 failing tests. Transportation content mismatch CONFIRMED: test asserts "15-passenger van" (L54) but mailer view says "We will not be traveling as a team, and there will be no team transportation" (PR #64 content update). Tenant lookup uses Tenant.find_by!(slug: "westside-kings-queens") (L108, L124) with no fixture/seed data.
• [x] .woodpecker.yaml -- verified: pipeline config exists (3.4k), build-and-push depends on lint, test, audit (L97-100).
• [x] Gemfile.lock -- vulnerable versions confirmed: concurrent-ruby 1.3.6, faraday 2.14.1, jwt 3.1.2, net-imap 0.6.4, nokogiri 1.19.3, puma 8.0.1. All match issue claims.

Repo Placement

Dependencies

• This ticket is an implicit BLOCKER for all Sprint 5 deployment: #55 (player list, 5pts, backlog) and #58 (player detail, 5pts, todo) cannot deploy without a passing pipeline.
• Dependency chain: #69 (pipeline fix) -> #55 (player list) -> #58 (player detail).
• Board item #1612 (1pt, backlog, arch:ci-pipeline, sprint:4) targets pal-e-services#144 -- different repo, no overlap with this ticket.
• No items in next_up, needs_approval, or qa columns. Only #1609 (#58, player detail) in todo.
• No explicit depends: labels reference #69, but the blocking relationship is clear from the issue body.

Acceptance Criteria

• 7 test fix criteria with specific test method names -- verifiable via bundle exec rails test.
• 6 gem audit criteria with specific version targets -- verifiable via Gemfile.lock inspection and bundle-audit check.
• 4 pipeline criteria -- pipeline pass and Harbor image push are CI-verifiable. ArgoCD sync and site 200 are post-deploy validation (better suited for skill-validate-ticket than AC, but acceptable as aspirational criteria).

Blast Radius

Decomposition Assessment

Recommendation

• [LABEL] story label -- Fixed: changed from story:admin-player-management to story:WS-S1.
• arch:ci-pipeline note gap -- Acknowledged as cross-cutting gap, not blocking for individual tickets. Will be addressed separately.