pal-e-docs

Review: CI pipeline: Woodpecker build + Harbor push

review-801-2026-04-04 Doc

review needs-refinement
Project

Verdict: NEEDS_REFINEMENT

Re-review of board item #801 (Forgejo issue #22). Previous review flagged 4 body issues -- all confirmed fixed. This re-review found 1 new issue: Harbor image path mismatch.

Template Completeness

  • [x] Type -- Feature
  • [x] Lineage -- prerequisite for #21, depends on #3
  • [x] Repo -- forgejo_admin/twitch-2k-wager
  • [x] User Story -- clear developer story about CI automation
  • [x] Context -- references existing platform CI pattern with specific repos
  • [x] File Targets -- .woodpecker.yaml to create, Dockerfile listed as do-not-touch
  • [x] Acceptance Criteria -- 7 testable criteria
  • [x] Test Expectations -- 4 verification steps
  • [x] Constraints -- pattern matching, tag format, credentials, overlay dependency, token
  • [x] Checklist -- PR opened, tests pass, no unrelated changes
  • [x] Related -- project page, arch note, dependency #3, dependent #21

Traceability

  • [x] story:challenger-auth label -- Challenger Twitch Login
  • [x] story note verified -- found in project-twitch-2k-wager user-stories table (key: challenger-auth, note: story-twitch-2k-wager-challenger-auth id 1157)
  • [x] arch:deployment-twitch-2k-wager label -- Deployment architecture
  • [x] arch note verified -- arch-deployment-twitch-2k-wager (id 1156) exists with full Mermaid diagram including ArgoCD + Kustomize components
  • [x] Forgejo issue -- forgejo_admin/twitch-2k-wager#22, open

File Targets

  • [x] .woodpecker.yaml -- to create. Verified does NOT exist yet in repo.
  • [x] Dockerfile -- listed as do-not-touch. Verified EXISTS in repo (from #8, closed/merged).
Targets are specific enough for an agent to act on. Reference pattern in basketball-api/.woodpecker.yaml is explicitly called out in Context.

Repo Placement

OK. Issue filed on forgejo_admin/twitch-2k-wager. Primary file target (.woodpecker.yaml) belongs in same repo. The update-kustomize-tag step writes to pal-e-deployments but uses the shared platform script downloaded at runtime -- no cross-repo PR needed.

Dependencies

  • [x] #3 (kustomize overlay) -- satisfied. Issue closed. Overlay at overlays/twitch-2k-wager/prod/kustomization.yaml confirmed to exist in pal-e-deployments.
  • [x] #8 (SvelteKit scaffold + Dockerfile) -- satisfied. Issue closed. Dockerfile confirmed to exist in repo.
  • [x] #21 (validation) -- depends on this ticket. Correctly documented in Lineage. No blocker.

Acceptance Criteria

7 AC, all testable. Agent can verify programmatically:
  • AC 1-3: file content inspection + Woodpecker pipeline trigger
  • AC 4: Harbor image check (but path is wrong -- see Blast Radius)
  • AC 5: kustomization.yaml update verification
  • AC 6: Woodpecker secret activation via MCP tool
  • AC 7: end-to-end pipeline run verification
No ambiguous language. All criteria are specific and observable.

Blast Radius

Harbor image path mismatch. AC #4 says image pushed to harbor.tail5b443a.ts.net/playme2k/app:${CI_COMMIT_SHA}. But the kustomization.yaml in pal-e-deployments defines the image as harbor.tail5b443a.ts.net/twitch-2k-wager/app. The Harbor project is twitch-2k-wager, not playme2k. An agent following the issue body would configure Kaniko to push to the wrong Harbor project. ArgoCD would never find the image, causing a failed deployment.
The reference pattern in basketball-api/.woodpecker.yaml uses basketball-api/api as the Harbor repo (matching the overlay directory name), confirming the convention is {overlay-name}/{image-name}. Correct path: twitch-2k-wager/app.
Rollback is straightforward -- revert the .woodpecker.yaml commit. No data migration or state change involved.

Decomposition Assessment

Apply three-thing limit and five-minute rule:
  • 1 file target in 1 repo -- well under the 3-file threshold
  • 7 AC but all focused on a single .woodpecker.yaml configuration plus Woodpecker secret activation via MCP tool
  • No independent subtasks that need parallelization -- this is a single coherent unit
  • Estimated agent time: under 5 minutes
No decomposition needed.

Recommendation

  • [BODY] Fix Harbor image path in AC #4: harbor.tail5b443a.ts.net/playme2k/app:${CI_COMMIT_SHA} to harbor.tail5b443a.ts.net/twitch-2k-wager/app:${CI_COMMIT_SHA}