pal-e-docs

Review: Replace ISS prod auto-deploy with manual Woodpecker promotion pipeline

review-1894-2026-07-20 Review

review ready
Project

Verdict: READY

Template Completeness

  • [x] Type (Feature)
  • [x] Lineage
  • [x] Repo
  • [x] User Story
  • [x] Context
  • [x] File Targets
  • [x] Feature Flag (none)
  • [x] Acceptance Criteria (6)
  • [x] Test Expectations
  • [x] Constraints
  • [x] Checklist
  • [x] Related
  • [x] PRs Required (bonus section, clearly separates two-repo scope)

Traceability

  • [x] story:dev-environment label -- verified in project-iss user-stories section. Backing: "#192 / #193 / #194 + docs/pipeline.md"
  • [x] story note verified -- found in project-iss user-stories table (key: dev-environment, role: Developer)
  • [x] arch:argocd label -- ArgoCD + Image Updater Deployment Pattern
  • [x] arch note verified -- arch-argocd note exists in pal-e-docs (doc type, tags: architecture, argocd, platform)
  • [x] Forgejo issue -- ldraney/pal-e-services#194, open

File Targets

  • [x] terraform/variables.tf (pal-e-services, line 269-282) -- verified: variable "services" is a map(object({...})) with fields forgejo_repo, image_repo, port, funnel, target_revision, source_repo, source_path, cmp_plugin. No image_updater field yet. Ticket correctly identifies adding image_updater = optional(bool, true).
  • [x] terraform/services.tf (pal-e-services, lines 196-207) -- verified: image updater annotations are applied unconditionally to all services in argocd_application.service. Ticket correctly identifies adding conditional logic gated on var.services[key].image_updater.
  • [x] terraform/k3s.tfvars.example (pal-e-services, lines 517-524) -- verified: ISS prod entry exists at key intelligentstaffingsystems with source_repo/source_path overlay pattern. No image_updater field. Ticket correctly identifies setting image_updater = false.
  • [x] .woodpecker.yaml (intelligentstaffingsystems) -- verified: 94-line CI pipeline with lint/security/test/build-and-push steps. Build-and-push fires on push to main. No manual promotion pipeline exists yet. Ticket correctly identifies adding a manual event pipeline.

Repo Placement

Issue filed on pal-e-services (#194). Ticket explicitly documents two repos and two PRs in the "PRs Required" section:
  • PR 1: pal-e-services (terraform changes: variables.tf, services.tf, k3s.tfvars.example)
  • PR 2: intelligentstaffingsystems (.woodpecker.yaml manual promotion pipeline)
Cross-repo scope is clearly delineated. No additional Forgejo issues needed -- the single issue serves as the spec for both PRs.

Dependencies

  • #193 (board item 1893, backlog) -- staging auto-deploy. Explicitly documented as a blocker: "This ticket depends on #193 (staging must exist before removing auto-deploy from prod)." #193 is also open and in backlog. Sequencing is correct: staging must exist before prod can switch to manual.
  • #192 (board item 1892, backlog) -- dev environment. Related but independent; no blocking relationship with #194.
  • All three tickets (#192, #193, #194) share labels: type:feature, scope:iss, arch:argocd, story:dev-environment.

Acceptance Criteria

6 criteria, all verifiable:
  • AC 1-2: Deployment behavior (auto-deploy to staging, NOT to prod) -- verifiable after both #193 and #194 are deployed
  • AC 3-4: Manual pipeline existence and triggerability -- verifiable in Woodpecker UI/CLI
  • AC 5: ArgoCD health -- verifiable via argocd app get
  • AC 6: End-to-end promotion -- verifiable by running the pipeline
Test expectations include terraform plan -var-file=k3s.tfvars for clean plan verification. All criteria are agent-testable.

Blast Radius

The image_updater flag defaults to true, preserving existing auto-deploy behavior for all other services. 10+ services use the overlay pattern via source_repo = "ldraney/pal-e-deployments"; none are affected because the flag only changes behavior when explicitly set to false. Only the ISS prod entry opts out. The change to services.tf wraps existing annotation logic in a conditional, which is safe for all other entries.

Decomposition Assessment

4 file targets across 2 repos. 6 acceptance criteria (exceeds 5 threshold). However, the work is tightly cohesive: the terraform changes are 3 small edits to existing files, and the Woodpecker pipeline is a single new step definition. The PRs Required section already provides natural two-repo separation. Per project preference: no decomposition needed. Fits within a single agent pass per repo.

Recommendation

No action needed.