pal-e-docs

Review: Bug: image tag automation not firing -- manual deploys required

review-453-2026-03-26 Review

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Type -- Bug
  • [x] Lineage -- Standalone, discovered during deploys
  • [x] Repo -- forgejo_admin/pal-e-platform
  • [x] What Broke -- clear description of missing automation
  • [x] Repro Steps -- concrete 4-step reproduction
  • [x] Expected Behavior -- clear target state
  • [x] Environment -- CI, registry, deployment stack identified
  • [x] Acceptance Criteria -- 3 criteria present
  • [x] Related -- references project and parent issue #148
  • [x] User Story (bonus, from feature template)
  • [x] Context (bonus)
  • [x] File Targets (bonus)
  • [x] Test Expectations (bonus)
  • [x] Constraints (bonus)
  • [x] Checklist (bonus)
All required bug template sections present. Extra sections from the feature template are bonus content.

Traceability

  • [x] story:superuser-deploy label -- present on board item
  • [x] arch:ci-pipeline label -- present on board item
  • [x] Forgejo issue -- forgejo_admin/pal-e-platform#204, open
Traceability triangle complete.

File Targets

  • [x] .woodpecker.yaml in westside-app -- verified: exists at /home/ldraney/westside-app/.woodpecker.yaml. Has build-and-push step but NO post-build tag update step. Confirms the bug.
  • [x] .woodpecker.yaml in basketball-api -- verified: exists at /home/ldraney/basketball-api/.woodpecker.yaml. Same pattern: build-and-push only, no tag update. Confirms the bug.
  • [x] pal-e-deployments/ -- verified: exists at /home/ldraney/pal-e-deployments/. Contains 10 overlay directories with hardcoded newTag values. No automation scripts found.
  • [ ] ArgoCD Image Updater config -- ISSUE: Ticket says to check "if installed" but grep across pal-e-platform terraform and pal-e-deployments finds zero references to argocd-image-updater. It was never installed. Ticket should state this explicitly.

Repo Placement

ISSUE: The issue is filed on forgejo_admin/pal-e-platform but the fix will likely touch multiple repos:
  • pal-e-platform -- if ArgoCD Image Updater is deployed via Terraform
  • Every app repo's .woodpecker.yaml -- if the solution is a CI post-build step
  • pal-e-deployments -- if automation scripts or annotations are needed
The ticket acknowledges this implicitly in File Targets ("each app repo") but does not explicitly state whether one issue covers all repos or if child issues are needed per repo. A single issue is acceptable if the solution is centralized (ArgoCD Image Updater) but NOT if the solution requires per-repo pipeline changes.

Dependencies

  • Board item #447 (in_progress): "Eliminate Tailscale hairpin -- ArgoCD + image updater internal URLs" (issue #200). Directly related -- if the solution involves ArgoCD Image Updater, internal URLs must work first.
  • Board item #306 (done): Issue #148 "Automate image tag updates in pal-e-deployments" is marked done but automation does not exist in any codebase. This is a false-done -- the predecessor was closed without completing its acceptance criteria.
  • Board item #428 (in_progress): "Kaniko HTTPS probe timeout -- insecure-registry fix" (issue #193). CI builds must succeed before tag automation matters.
  • The ticket's own Constraints section mentions "Depends on ArgoCD source URL fix (sibling issue) for full end-to-end flow" which is appropriate.

Acceptance Criteria

Assessment of testability:
  • "After CI build succeeds, kustomize overlay newTag is updated automatically" -- testable via manual commit + observe, but no specific command given. Agent would need to know which file to check.
  • "ArgoCD syncs the new tag without manual intervention" -- testable via kubectl but no specific verification command.
  • "Works for all services with CI pipelines" -- broad. Should enumerate which services (there are at least 7 with overlays).
ISSUE: Acceptance criteria are outcome-oriented (good) but lack specific verification commands. The Test Expectations section partially covers this but says "Manual" for all items. An agent implementing this will need clearer verification steps.

Blast Radius

Verified all app repos with CI pipelines. None have tag update automation:
  • westside-app -- no update step
  • basketball-api -- no update step
  • pal-e-docs -- no update step
  • mcd-tracker-api -- no update step
  • mcd-tracker-app -- no update step
  • pal-e-mail -- no update step
  • pal-e-app -- no update step
All 7 repos are affected. The fix is not isolated -- it is a platform-wide gap. Additionally, some overlays still use newTag: latest (mcd-tracker, mcd-tracker-app) which suggests those services may have never had proper tag management.

Recommendation

Verdict: NEEDS_REFINEMENT. Specific actions before moving to next_up:
  • Clarify solution approach. The ticket lists three options (ArgoCD Image Updater, CI writes to pal-e-deployments, Woodpecker post-build step) but does not select one. The implementing agent needs a decision or at minimum a spike to evaluate. Consider converting to a Spike first.
  • Address the false-done on #148. Issue #148 is closed but its acceptance criteria are unmet. Either reopen #148 or explicitly note in #204 that it supersedes #148 and why #148 was closed prematurely.
  • State ArgoCD Image Updater status explicitly. The ticket says "check if installed" -- it is not installed. State this as a known fact so the agent does not waste time investigating.
  • Clarify multi-repo scope. If the solution requires per-repo .woodpecker.yaml changes, either document that this single issue covers all repos, or plan for child issues.
  • Add verification commands. Test Expectations should include specific kubectl/git commands an agent can run to verify success.