pal-e-docs

Review: Rotate Woodpecker API token in Salt pillar + consumers

review-333-2026-03-27 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [ ] ### Type — missing. Should be Task (or Security if that's a recognized type). Title uses fix: prefix but board labels say type:security.
  • [x] ### Lineage — present: plan-pal-e-platform → Phase 17a → 17a-6
  • [x] ### Repo — present: forgejo_admin/pal-e-platform
  • [x] ### User Story — present and well-formed
  • [x] ### Context — present: explains stale token / 401 root cause
  • [x] ### File Targets — present: 2 PR files + 3 manual updates, clearly separated
  • [x] ### Acceptance Criteria — present: 3 criteria
  • [x] ### Test Expectations — present: 2 test commands
  • [x] ### Constraints — present: GPG key ID + no-plaintext rule
  • [x] ### Checklist — present: 6 items
  • [x] ### Related — present: parent phase + SOP reference

Traceability

  • [ ] story:X label — missing. Foundational secrets rotation — acceptable for infrastructure work, but could use story:superuser-deploy for consistency with related board items (#256, #399).
  • [x] arch:ci-pipeline label — present on board item
  • [x] Forgejo issue — forgejo_admin/pal-e-platform#86, open

File Targets

  • [x] salt/pillar/secrets/platform.sls — verified: woodpecker_api_token PGP block exists at line 145
  • [x] terraform/k3s.tfvars — verified: woodpecker_api_token exists at line 14 (gitignored, local-only — generated by make tofu-secrets)
  • [x] ~/.mcp.json (manual) — verified: WOODPECKER_TOKEN at line 103
  • [x] dora-exporter k8s secret (manual) — verified: managed by Terraform at terraform/modules/monitoring/main.tf:447
  • [x] Woodpecker CI repo secret tf_var_woodpecker_api_token (manual) — verified: referenced in .woodpecker.yaml lines 58-59, 147-148

Repo Placement

Correct. All PR file targets are in forgejo_admin/pal-e-platform. Manual updates are local filesystem + k8s + Woodpecker UI. No cross-repo PRs needed.

Dependencies

  • Board item #101 (phase-platform-17a-woodpecker-secrets) — parent phase, in done
  • Board item #256 (Woodpecker agent secret drift #137) — related secrets work, in done
  • Board item #264 (Secrets pillar validation gate #140) — related, in done
  • No blocking dependencies. No downstream items waiting on this.

Acceptance Criteria

All 3 criteria are agent-verifiable with concrete commands. Test expectations include salt-call pillar.get and curl — both executable. The manual update checklist covers all consumers identified in the codebase grep. No missing criteria detected.

Blast Radius

  • woodpecker_api_token appears in 6 non-worktree locations: Salt pillar, k3s.tfvars, .woodpecker.yaml (2x as CI secret ref), terraform variables.tf, terraform modules/monitoring (dora-exporter secret). All consumers are accounted for in the issue.
  • The secrets_registry.sls documents this token with origin, description, and provider — no update needed there unless the rotation date should be tracked.
  • No sibling services share this token. The blast radius is contained to the DORA exporter and Woodpecker CI pipeline auth.

Decomposition

2 PR file targets in 1 repo, 3 acceptance criteria, 3 manual updates. Single agent pass, well under 5 minutes. No decomposition needed.

Recommendation

Two minor fixes before moving to next_up:
  • Add ### Type header to the Forgejo issue: Task (token rotation is operational, not a bug fix despite the fix: prefix).
  • Add story:superuser-deploy label to the board item for traceability consistency — related items #256 and #399 both carry this label.
Note: the k3s.tfvars file target is an unusual case — it's gitignored and generated locally by make tofu-secrets. The agent should understand that "updating" this file means re-running the Salt-to-tfvars generation, not editing it directly. The issue could clarify this, but the Context section provides enough background for an experienced agent.