pal-e-docs

Review: Rename westside-app repo to westside-landing

review-450-2026-03-26 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Type -- Feature
  • [x] Lineage -- standalone, architectural decision from 2026-03-27 session
  • [x] Repo -- forgejo_admin/westside-app
  • [x] User Story -- superadmin wants clear repo naming for landing vs app
  • [x] Context -- thorough, explains 3-phase split strategy
  • [x] File Targets -- present, 6 modify targets + 3 do-not-touch targets
  • [x] Acceptance Criteria -- 6 criteria listed
  • [x] Test Expectations -- 3 manual tests + curl verification command
  • [x] Constraints -- 5 constraints, including atomicity and Harbor naming convention
  • [x] Checklist -- present
  • [x] Related -- project reference + future phase tickets noted
All required template sections are present.

Traceability

  • [x] story:WS-S26 label -- Westside Spring 2026 story
  • [x] arch:landing-site label -- landing site architecture component
  • [x] Forgejo issue -- forgejo_admin/westside-app#109, open
All three traceability legs are complete.

File Targets

  • [x] pal-e-services/terraform/k3s.tfvars -- verified: line 130 has forgejo_repo = "forgejo_admin/westside-app" under the westsidekingsandqueens service block. Must change to forgejo_admin/westside-landing.
  • [x] pal-e-deployments/overlays/westsidekingsandqueens/ -- verified: 30+ references to westside-app across kustomization.yaml (k8s resource names), ingress.yaml (ingress + service name), deployment-patch.yaml (secret refs). These are k8s resource names, not repo names.
  • [x] pal-e-platform/terraform/main.tf -- verified: lines 498-500 have blackbox probe named westside-app with label service = "westside-app". URL uses k8s service DNS, independent of repo name.
  • [x] .woodpecker.yaml -- verified: line 16 uses ${CI_REPO} for clone URL (auto-adjusts). Line 38 has hardcoded repo: westsidekingsandqueens/app for Harbor (image_repo is independent of Forgejo repo name, no change needed).
  • [ ] westside-app/k8s/deployment.yaml -- MISSING FROM ISSUE: contains hardcoded westside-app deployment/service names. May be dev-only manifests but should be acknowledged in scope.
  • [ ] westside-app/k8s/ingress.yaml -- MISSING FROM ISSUE: contains westside-app-funnel ingress name. Same concern as above.
  • [ ] pal-e-services/terraform/keycloak-import.sh -- MISSING FROM ISSUE: references westside-app as a Keycloak client key (lines 13, 28-29). These are Keycloak identifiers, not repo names, so no change needed -- but should be explicitly listed as "do not touch" with rationale.
  • [x] basketball-api -- correctly listed as "do not touch." Verified: only comment-level references (public.py line 4, register.py line 1075), no functional code references.
  • [x] Keycloak config -- correctly listed as "do not touch." The Keycloak client_id westside-app is a Keycloak-level identifier independent of the Forgejo repo name. Changing the terraform map key would cause a destroy+recreate cycle.

Repo Placement

Issue is correctly filed on forgejo_admin/westside-app (the repo being renamed). The work touches 4 repos total:
  • westside-app -- Forgejo rename API call + verify .woodpecker.yaml
  • pal-e-services -- k3s.tfvars forgejo_repo reference
  • pal-e-deployments -- ArgoCD source references (but these are k8s names, not repo names -- see decision ambiguity below)
  • pal-e-platform -- blackbox probe name/label (cosmetic, not functional)
The checklist mentions PRs for pal-e-services + pal-e-deployments, which is correct. However, it is unclear whether pal-e-platform changes also need a PR or are deferred.

Dependencies

  • No blocking items found. No in_progress items on the westside board are related.
  • Board item #438 ("CI image repo mismatch -- westside-app vs westsidekingsandqueens") is done, but documents a prior lesson about repo naming confusion -- directly relevant context for this rename.
  • pal-e-services#35 (dead funnel ingress) is listed as related cleanup -- appropriate.
  • Phase 2 (extract app routes) and Phase 3 (separate funnels) are explicitly deferred to future tickets -- good.

Acceptance Criteria

  • [x] "Repo renamed to westside-landing on Forgejo" -- verifiable via Forgejo API
  • [x] "CI pipeline builds and pushes successfully" -- verifiable via Woodpecker
  • [x] "ArgoCD syncs under new repo reference" -- verifiable via ArgoCD
  • [x] "Site remains live" -- verifiable via curl command provided
  • [x] "No broken webhooks or secrets" -- verifiable via Woodpecker UI
  • [ ] "Harbor project updated or new project created" -- AMBIGUOUS: the image_repo is westsidekingsandqueens/app, which is derived from the service key, NOT the Forgejo repo name. Harbor should NOT need changes. This criterion should be clarified or removed to avoid confusion.
Missing acceptance criteria: no criterion for verifying that tofu plan shows zero drift after the rename (the k3s.tfvars change must be applied and verified).

Blast Radius

  • westside-contracts: no references to westside-app found -- safe.
  • basketball-api: only code comments reference westside-app -- no functional impact. Comments should be updated eventually but not in this ticket.
  • Keycloak: client_id stays westside-app. Renaming the Keycloak client would require a migration (destroy+recreate) -- correctly out of scope.
  • k8s resource names: Deployment, Service, Ingress, and Secret names all use westside-app. These are NOT tied to the Forgejo repo name and do NOT need to change for a repo rename. However, Phase 2 (extracting app routes to a new westside-app repo) will create a naming collision if k8s resources keep the westside-app name. The issue should explicitly note that k8s resource renaming is deferred to Phase 2.
  • westside-app-scaffold: a local directory at ~/westside-app-scaffold/ with its own .woodpecker.yaml referencing westside-app. Unknown provenance -- may be a dead scaffold. Should be acknowledged.

Recommendation

Four refinements needed before this ticket is READY:
  • Add missing file targets: Add westside-app/k8s/deployment.yaml and westside-app/k8s/ingress.yaml to the "do not touch" list (or the modify list if they should be renamed). Add keycloak-import.sh to the "do not touch" list with rationale.
  • Clarify Harbor criterion: The acceptance criterion "Harbor project updated or new project created" is misleading. The Harbor project is westsidekingsandqueens (derived from image_repo prefix), not from the Forgejo repo name. Clarify that no Harbor changes are expected, or remove the criterion.
  • Add tofu plan acceptance criterion: After updating k3s.tfvars, add a criterion: "tofu plan -var-file=k3s.tfvars -lock=false shows no unplanned changes after apply."
  • (Minor) Explicitly state that k8s resource names (Deployment, Service, Ingress, Secret) remain westside-app in Phase 1 and will be renamed in Phase 2 to avoid future confusion.