pal-e-docs

TODO: Add CI secrets verification to DB migration recovery SOP

todo-db-migration-ci-secrets-checklist Todo

todo done
Project

TODO: Add CI secrets verification to DB migration recovery SOP

Context

The Woodpecker Postgres migration (pal-e-platform PR #59) intentionally accepted data loss — "All SQLite data (history, secrets, activations) lost as expected." But the operational impact wasn't fully scoped. Harbor push credentials had to be manually re-provisioned for pal-e-docs before CI could build-and-push. This was discovered during Phase 7a when the build-and-push step failed with UNAUTHORIZED.

Scope

  • Update sop-db-migration-recovery to include a post-migration checklist item: "verify all CI secrets for affected repos"
  • Document the pattern: tofu output ci_robot_usernames + tofu output ci_robot_passwords → update Woodpecker repo secrets
  • Consider a script or make target that re-provisions all Woodpecker secrets from terraform state

Trigger

Discovered 2026-03-14 during Phase 7a. Harbor credentials were stale after Woodpecker Postgres migration, causing build-and-push UNAUTHORIZED errors across all repos.
  • sop-db-migration-recovery
  • incident-paledocs-alembic-drift-2026-03-14 — the incident where this was discovered
  • plan-pal-e-platform — Phase 7a context