pal-e-docs

Review: CI minitest/mock LoadError + placeholder k8s secrets block all deployments

review-1875-2026-07-17 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Type — Bug
  • [x] Lineage — Standalone, discovered during Sprint B validation sweep (2026-07-17)
  • [x] Repo — Two repos identified (intelligentstaffingsystems + pal-e-deployments)
  • [x] What Broke — Detailed description of both blockers with error messages
  • [x] Repro Steps — Present for both blockers with kubectl commands
  • [x] Expected Behavior — Present
  • [x] Environment — Present (Woodpecker CI, ArgoCD, k8s, Ruby 3.4)
  • [x] Acceptance Criteria — 7 items present
  • [x] Related — Present with pipeline number, PR, commit, and blocked tickets
  • [x] Production Risk — Extra section, valuable addition documenting ordering constraint
  • [x] Validation Evidence — Extra section listing 7 blocked validation tickets

Traceability

  • [x] story:project-setup label — verified in project-iss user-stories section
  • [ ] arch:rails label — arch note MISSING — [SCOPE] Create architecture note arch-rails for component rails
  • [ ] arch:infra label — arch note MISSING — [SCOPE] Create architecture note arch-infra for component infra
  • [x] Forgejo issue — ldraney/intelligentstaffingsystems#85, open

File Targets

  • [x] test/test_helper.rb line 4 — verified: require "minitest/mock" present at line 4
  • [x] Gemfile — verified: no explicit gem "minitest" declaration
  • [x] Gemfile.lock — note: minitest 6.0.6 IS present as transitive dependency of activesupport. Root cause explanation may need refinement — under bundle exec, transitive deps should resolve.
  • [x] Commit 93b9a79 — verified exists: "fix: align pipeline push repo with Argo CD Image Updater annotation". However, this commit did NOT introduce the minitest/mock require — that was added in a later commit.
  • [x] minitest/mock usage — verified: stub method used in test/models/message_test.rb:141, so the require is needed
  • [ ] pal-e-deployments secrets manifest — CANNOT verify from this repo. Issue references PR #234 introducing placeholder values.

Repo Placement

Issue correctly identifies two repos: ldraney/intelligentstaffingsystems (CI fix) and ldraney/pal-e-deployments (k8s secrets fix). The Forgejo issue is filed only on intelligentstaffingsystems. No corresponding issue exists on pal-e-deployments for the secrets fix. This is a multi-repo bug that requires separate PRs in each repo.

Dependencies

  • 7 validation tickets blocked: #49, #50, #51, #52, #58, #59, #69
  • Critical ordering constraint: k8s secrets MUST be fixed before CI fix merges to main. If CI fix ships first, ArgoCD will roll out a new pod with broken secrets, replacing the surviving old pod — full production outage.
  • Board item 1858 (pal-e-deployments#231, type:bug, done) may be related to deployment issues — verify whether it already addressed secrets.
  • Board item 1868 (#77, deployment overlays, todo) is in the same infrastructure area.

Acceptance Criteria

7 criteria — all testable but span multiple systems:
  • AC 1-2: CI verification (pipeline pass, build+push) — verifiable via Woodpecker
  • AC 3-5: k8s verification (secrets, pods, ArgoCD rollout) — verifiable via kubectl/argocd CLI
  • AC 6: Production health (site live) — verifiable via curl/browser
  • AC 7: Deployment completeness (8+ commits deployed) — verifiable via version check
AC 7 ("all 8+ undeployed commits deployed") is a consequence of the fix, not a criterion the implementer controls directly. Consider rewording to "verify latest main commit is deployed."

Blast Radius

  • minitest/mock — only required in test_helper.rb; webmock/minitest also used in keycloak_admin_service_test.rb (webmock handles its own minitest integration, but benefits from explicit gem declaration)
  • CI fix unblocks ALL future PRs and deployments — high positive impact
  • Secrets fix restores production deployment capability — critical path item
  • Other Ruby 3.4 repos on the platform may have the same minitest issue if they use require "minitest/mock" without an explicit gem declaration — check platform-wide

Decomposition Assessment

NEEDS DECOMPOSITION — triggers on two criteria:
  • File targets across 2 repos (intelligentstaffingsystems + pal-e-deployments)
  • 7 acceptance criteria spanning CI, k8s, ArgoCD, and production
Recommended split:
  • Sub-ticket A (pal-e-deployments): Fix k8s secret intelligentstaffingsystems-secrets — replace placeholder values with real credentials. AC: secrets contain real values, migrate init container connects, pods start. Must complete first.
  • Sub-ticket B (intelligentstaffingsystems): Add gem "minitest" to Gemfile (test group), verify CI passes. AC: test step passes, pipeline completes end-to-end, new image pushed. Depends on Sub-ticket A.
  • Verification of AC 5-7 (ArgoCD rollout, site live, commits deployed) follows naturally from both fixes landing.
Route to skill-decompose-ticket for sub-ticket creation.

Recommendation

  • [SCOPE] Create architecture note arch-rails for component rails
  • [SCOPE] Create architecture note arch-infra for component infra
  • [BODY] Refine root cause for Blocker 1: minitest 6.0.6 is in Gemfile.lock as transitive dep of activesupport. Under bundle exec, it should resolve. Adding explicit gem "minitest" is still the correct fix, but the explanation "Ruby 3.4 moved minitest out of the standard library" may not fully explain the CI failure. Verify actual error against CI logs.
  • [BODY] Correct commit reference: 93b9a79 is "align pipeline push repo," not the commit that introduced the minitest/mock require. The require was added in a subsequent commit.
  • [DECOMPOSE] 7 AC across 2 repos — split into 2 sub-tickets with ordering constraint (secrets first, then CI fix). Route to skill-decompose-ticket.