Review: CI clone broken — Forgejo internal URL unreachable

Verdict: NEEDS_REFINEMENT

Template Completeness

• [x] Type — present
• [x] Lineage — present
• [x] Repo — present
• [x] What Broke (Context equivalent) — present, well-written with error output
• [x] Repro Steps — present
• [x] Expected Behavior — present
• [x] Environment — present, includes PR provenance
• [x] Investigation so far — present, thorough
• [x] Acceptance Criteria — present (3 items)
• [x] Related — present with linked issues and PRs
• [ ] File Targets — MISSING. Agent needs to know which files to modify.
• [ ] Test Expectations — MISSING. No verification commands specified.
• [ ] Constraints — MISSING. Should document what NOT to change (e.g., don't revert to Tailscale funnel URL).
• [ ] Checklist — MISSING.

File Targets

• [x] .woodpecker.yaml — verified: line 5 uses http://forgejo-http.forgejo.svc.cluster.local:80/${CI_REPO}.git for clone
• [x] terraform/main.tf — verified: line 720 sets WOODPECKER_FORGEJO_URL to internal URL, line 748 sets WOODPECKER_BACKEND_K8S_NAMESPACE = "woodpecker"
• [x] terraform/network-policies.tf — verified: lines 31-50, Forgejo NetworkPolicy already allows ingress from woodpecker namespace

Repo Placement

Dependencies

• Board item #187 (issue #107, TLS clone failures) — done. PR #118 was the fix that introduced the internal URL override. This bug is a regression from that fix.
• Board item #188 (issue #109, platform cleanup, 8pts) — in_progress. This bug blocks resolution of that umbrella.
• PR #117 (Keycloak NetworkPolicy fix) — open, directly blocked by this bug (can't pass CI checks).
• No explicit dependency documentation in the issue body, but Related section covers it.

Acceptance Criteria

• "Pipeline clone step succeeds" — verifiable by pushing a commit and observing Woodpecker
• "PR #117 CI checks pass" — verifiable by checking PR status after fix deploys
• "apply-on-merge pipeline fires after next merge" — verifiable but requires a merge event

Blast Radius

• basketball-api — uses same internal URL clone override in .woodpecker.yaml (line 15). Equally affected.
• westside-app — uses same internal URL clone override in .woodpecker.yaml (line 16). Equally affected.
• mcd-tracker-api — does NOT have the internal URL override. Uses default Woodpecker clone (Tailscale funnel URL). Not directly affected by this bug, but may still have the original TLS clone issue (#107).
• All repos using internal URL clone will recover once this fix lands — no per-repo changes needed if the root cause is infrastructure-level.

Recommendation

• Add File Targets section. Likely candidates: terraform/network-policies.tf (if NetworkPolicy needs updating), terraform/main.tf (if Woodpecker config needs changes), or .woodpecker.yaml (if clone step needs fallback logic).
• Correct the investigation hypothesis. The issue suggests pipeline pods may run in a different namespace, but WOODPECKER_BACKEND_K8S_NAMESPACE = "woodpecker" is explicitly set in terraform/main.tf:748. The Forgejo NetworkPolicy already allows ingress from the woodpecker namespace. The root cause is NOT a namespace mismatch. Further investigation needed: Is the Forgejo service endpoint actually reachable? Has the service IP changed? Is there a DNS resolution failure? Is this a post-move network issue (board item #176, "Post-Move Network Recovery", is in_progress)?
• Add Test Expectations. Include a connectivity verification command (e.g., kubectl run -n woodpecker --rm -it --image=busybox test -- wget -qO- http://forgejo-http.forgejo.svc.cluster.local:80).
• Add Constraints. Document that reverting to Tailscale funnel URL is not acceptable (that was the original bug #107).
• Document blast radius. Note that basketball-api and westside-app are equally affected.