pal-e-docs

Review: CI pipeline: Woodpecker build + Harbor push

review-801-2026-04-03 Doc

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Template Completeness

  • [x] Type — Feature
  • [x] Lineage — "Prerequisite for #21 (validation). Enables automated builds."
  • [x] Repo — forgejo_admin/twitch-2k-wager
  • [x] User Story — clear developer-facing story for CI automation
  • [x] Context — references existing patterns, names Harbor project, links to sibling repos
  • [x] File Targets — .woodpecker.yaml to create; Dockerfile explicitly excluded
  • [x] Acceptance Criteria — 6 testable items
  • [x] Test Expectations — 3 items covering trigger, completion, and image visibility
  • [x] Constraints — pattern matching, Harbor credentials, Woodpecker activation noted
  • [x] Checklist — standard 3-item checklist
  • [x] Related — project page, arch note, downstream issue, SOP linked
All template sections present and filled.

Traceability

  • [x] story:challenger-auth label — Challenger Twitch Login
  • [x] story note verified — story-twitch-2k-wager-challenger-auth (id 1157) exists in pal-e-docs; challenger-auth key listed in project-twitch-2k-wager user-stories table
  • [x] arch:deployment-twitch-2k-wager label — Deployment architecture
  • [x] arch note verified — arch-deployment-twitch-2k-wager (id 1156) exists in pal-e-docs with full Mermaid diagram and component table
  • [x] Forgejo issue — forgejo_admin/twitch-2k-wager#22, state: open
Traceability triangle complete. All backing notes exist.

File Targets

  • [x] .woodpecker.yaml — confirmed does NOT exist in repo (create target valid). Repo root contains: Dockerfile, package.json, src/, svelte.config.js, etc.
  • [x] Dockerfile — confirmed exists in repo (do-not-touch constraint valid, created by #8)
Targets are specific. Agent knows exactly what to create and what not to touch.

Repo Placement

OK. Issue filed on forgejo_admin/twitch-2k-wager, file target (.woodpecker.yaml) belongs in the same repo. No cross-repo file changes needed. The update-kustomize-tag step (see Dependencies) modifies pal-e-deployments at runtime via script, not as a code change in this PR.

Dependencies

  • [x] #21 (Validation: end-to-end flow) — documented downstream dependency (depends on this ticket). Open. Correct.
  • [x] #8 (SvelteKit scaffold + Dockerfile) — board item #794, in needs_approval. Provides the Dockerfile this pipeline builds. Implicitly referenced ("Dockerfile already exists from #8") but not listed as a blocking dependency.
  • [ ] #3 (Kustomize overlay in pal-e-deployments) — board item #788, in needs_approval. UNDOCUMENTED DEPENDENCY. Reference pipelines (basketball-api, westside-app) all include an update-kustomize-tag step that pushes the new image tag to the pal-e-deployments kustomize overlay. This step requires the overlay directory to exist. The issue does not mention this step or this dependency.

Acceptance Criteria

6 AC items evaluated:
  • [x] ".woodpecker.yaml follows existing platform CI pattern" — testable by diff against reference pipelines
  • [x] "Pipeline triggers on push to main" — testable via Woodpecker MCP tools
  • [x] "Docker image builds using existing Dockerfile" — testable via pipeline status
  • [ ] "Image pushed to playme2k/app:latest and playme2k/app:{commit-sha}" — ISSUE: reference pipelines (basketball-api, westside-app) only tag with ${CI_COMMIT_SHA}. No :latest tag. Either AC is wrong or this is an intentional deviation that should be documented in Constraints.
  • [x] "Woodpecker repo activated with Harbor robot credentials as secrets" — testable via mcp__woodpecker tools
  • [x] "First pipeline run succeeds" — testable via pipeline trigger + status check
Missing AC: No criterion for the update-kustomize-tag step. Every platform pipeline includes this step (downloads shared script from pal-e-platform, pushes new tag to pal-e-deployments overlay). This is a standard platform pattern omitted from scope.

Blast Radius

Low. .woodpecker.yaml is self-contained to this repo. Harbor project playme2k and robot accounts already provisioned per pal-e-services PR #54. No downstream services consume this image yet (kustomize overlay not yet deployed). No sibling services affected. Rollback is trivial (revert one file).

Decomposition Assessment

Apply three-thing limit and five-minute rule:
  • Discrete changes: 1 file to create + Woodpecker repo activation + secret setup = 3 things. At the limit but acceptable.
  • Estimated agent time: Under 5 minutes. Standard CI onboarding pattern, well-documented by reference pipelines.
  • Parallelizable subtasks: None — file creation, activation, and verification are sequential.
No decomposition needed.

Recommendation

  • [BODY] Fix AC: remove :latest tag reference or explicitly add :latest as a second Kaniko tag and document the deviation from reference pipelines in Constraints.
  • [BODY] Add AC for update-kustomize-tag step: "Pipeline includes update-kustomize-tag step that pushes image tag to pal-e-deployments overlay."
  • [BODY] Add dependency on #3 (Kustomize overlay) in Lineage or Related section. The update-kustomize-tag step will fail if the overlay directory does not exist in pal-e-deployments.
  • [BODY] Add constraint: "Must include update-kustomize-tag step matching platform pattern (downloads shared script from pal-e-platform, requires OVERLAY and IMAGE_TAG env vars, depends_on build-and-push)."