pal-e-docs

Review: Phase 30 Mac CI Agent

review-287-2026-03-27 Review

review block
Project

Verdict: BLOCK

Template Completeness (Phase Note)

  • [x] Goal — Mac-based CI for iOS builds
  • [x] Owner — Lucas (hardware) + Dev agent (config)
  • [x] Repo — forgejo_admin/pal-e-platform
  • [x] Depends on — Apple Developer Program enrollment ($99/yr, 24-48hr approval) — manual, Lucas
  • [x] Scope — 5 bullet points covering agent, tools, Fastlane match, pipeline template
  • [x] Pipeline Skeleton — concrete YAML example
  • [x] Acceptance Criteria — 4 criteria
  • [x] Related — links to plan and Capacitor project

Traceability

  • [x] story:superuser-deploy — present on board item labels (via related issue #391 in next_up)
  • [ ] arch:X label — board item #287 has type:infra,scope:ci,scope:capacitor,scope:mobile-pipeline,blocked-by:apple-dev-enrollment. Should add arch:ci-pipeline for consistency with other CI items.
  • [x] Phase note — phase-pal-e-platform-30-mac-ci-agent, exists
  • [ ] No Forgejo issue — phase uses phase note. Acceptable. However, related issue #391 (board item #391, "Mac build agent — Salt managed with observability") exists in next_up column and is a Forgejo issue (pal-e-platform#174). This creates ambiguity — are these the same work or different?

File Targets

Phase note references:
  • [ ] .woodpecker/ios.yml — does not exist yet (to be created). This is expected for a new feature.
  • [ ] Woodpecker agent binary on MacBook Air M1 — hardware setup, not a filesystem target. Requires physical access.
  • [ ] Fastlane match git repo forgejo_admin/ios-certificates — does not exist yet. Must be created as part of this phase.
  • [ ] Salt states for Mac agent — the phase note mentions Salt in scope via related issue #391 title, but the phase note itself does not mention Salt. The phase says "Woodpecker agent binary (native, not Docker)" but doesn't specify how it's installed/managed.

Repo Placement

Partially correct. The pipeline template (.woodpecker/ios.yml) belongs in pal-e-platform. But the Woodpecker agent installation on the Mac is infrastructure work that might need Salt states (the related issue #391 title says "Salt managed with observability"). There are already Salt states being added: salt/states/mac-agent/ and salt/pillar/mac-agent.sls are untracked in git status. The phase note doesn't mention Salt at all — scope gap.

Dependencies

  • HARD BLOCK: Apple Developer Program enrollment — correctly labeled blocked-by:apple-dev-enrollment. Without this, Fastlane match won't work, Xcode signing won't work, TestFlight upload won't work. 3 of 4 acceptance criteria are blocked.
  • Related issue overlap — board item #391 (pal-e-platform#174, "Mac build agent — Salt managed with observability") is in next_up. This appears to be the same work described differently. One is a phase (#287), one is an issue (#391). Dual-tracking creates confusion.
  • Hardware dependency — requires MacBook Air M1 physical setup. Lucas-only dependency.

Acceptance Criteria

  • "Woodpecker admin shows Mac agent with platform=darwin label" — verifiable after hardware setup. Blocked by hardware.
  • "Test pipeline runs xcodebuild successfully" — blocked by Apple Developer enrollment (Xcode requires signing identity).
  • "Fastlane match fetches creds from Forgejo ios-certificates repo" — blocked by Apple Developer enrollment (certs don't exist yet).
  • "TestFlight receives the uploaded build" — blocked by Apple Developer enrollment.
Only criterion 1 (agent registration) could potentially be done without Apple Developer enrollment. The rest are hard-blocked.

Blast Radius

Low — this is additive infrastructure. The Mac agent uses label routing (platform=darwin), so it won't affect existing Linux CI pipelines. Label routing was already implemented (board item #425, done).

Decomposition Assessment

The phase is already appropriately scoped for a single infrastructure setup. However, it combines hardware work (Lucas) with config work (agent). Could split into: (a) Mac setup + agent registration (Lucas, hardware), (b) pipeline template + Fastlane match config (agent, code).

Recommendation

  • Keep in todo with blocked-by label — correctly positioned. Cannot move to next_up until Apple Developer enrollment completes.
  • Resolve dual-tracking — clarify relationship between phase #287 and issue #391 (pal-e-platform#174). Are they the same work? If so, one should reference the other. If different, scope boundaries need to be explicit.
  • Incorporate Salt scope — the phase note doesn't mention Salt, but untracked files salt/states/mac-agent/ and salt/pillar/mac-agent.sls suggest Salt config is part of the work. Update the phase note.
  • Add arch label — add arch:ci-pipeline to board item #287.