pal-e-docs

Review: Terraform: App Store Connect API key secret for westside-basketball

review-1643-2026-06-27 Review

review ready
Project

Verdict: READY

Re-review (round 2) of board item #1643 (pal-e-services#153). All sections present, traceability complete, file targets verified, scope fits a single agent pass.

Template Completeness

  • [x] Type — Feature
  • [x] Lineage — Child of westside-basketball#78
  • [x] Repo — ldraney/pal-e-services
  • [x] User Story — present
  • [x] Context — present, clear motivation (API key for receipt validation + Fastlane auth)
  • [x] File Targets — present with modify and do-not-touch lists
  • [x] Feature Flag — None (infrastructure, appropriate)
  • [x] Acceptance Criteria — 3 items
  • [x] Test Expectations — 2 items
  • [x] Constraints — present (pattern, git safety, namespace)
  • [x] Checklist — present
  • [x] Related — present (arch note, project, parent, consumer)

Traceability

  • [x] story:WS-S34 label — "As a parent, I want to subscribe to my child's team program through the iOS app so that Apple handles monthly billing and automatically enforces the delinquency gate if I fall behind on payments"
  • [x] story note verified — found in project-westside-basketball user-stories section (Parent list)
  • [x] arch:app-store label — App Store Billing architecture
  • [x] arch note verified — arch-app-store note exists in pal-e-docs (ID 2224, slug "arch-app-store")
  • [x] Forgejo issue — ldraney/pal-e-services#153, open

File Targets

  • [x] terraform/main.tf or terraform/services.tf — verified: both exist. Existing kubernetes_secret_v1.westside_rails_env in services.tf is the closest analog (standalone per-service secret with hardcoded namespace reference). Agent should follow that pattern.
  • [x] terraform/k3s.tfvars — verified: file is gitignored (sensitive), k3s.tfvars.example exists as the tracked template. Agent will need to update both the real tfvars and the example.
  • [x] Do-not-touch list correct: Fastlane config (westside-basketball-ios) and Rails webhook code (westside-basketball#65) are in other repos.

Repo Placement

Correct. The Apple API key is infrastructure managed by pal-e-services Terraform. The consuming code lives in westside-basketball (Rails) and westside-basketball-ios (Fastlane), both separate repos as documented.

Dependencies

  • No depends: label on board item #1643 — correct, this ticket has no upstream blockers. It provisions infrastructure that downstream tickets consume.
  • Board item #1641 (Fastlane IaC) has depends:65 and is a sibling under parent:78, but does not depend on this ticket directly (Fastlane reads from local filesystem via SSH, per arch-app-store).
  • westside-basketball#65 (webhook endpoint) consumes this secret at runtime — documented in Related section.

Acceptance Criteria

3 ACs, all verifiable by an agent:
  • AC1: Terraform resource defines K8s secret — verifiable via code inspection
  • AC2: Secret in westside-basketball namespace — verifiable via namespace reference in code
  • AC3: terraform plan succeeds — verifiable via command execution
Test expectations (plan + kubectl) are real and executable. No missing criteria.

Blast Radius

Low. No other services need Apple Developer credentials. The secret is scoped to the westside-basketball namespace. Existing secret patterns (westside_rails_env, harbor_creds, sops_age_key) are unaffected. The new variable declarations in variables.tf and values in k3s.tfvars add new entries without modifying existing ones.

Decomposition Assessment

No decomposition needed. 1-2 file targets (services.tf + variables.tf + k3s.tfvars), 3 acceptance criteria, estimated agent work ~2-3 minutes. Well within the 5-minute rule.

Recommendation

No action needed. Scope is solid for agent execution.