Validation: T5 Woodpecker CI with test gates (2026-05-10)
Validation: T5 — Woodpecker CI with test gates
Issue: ldraney/pal-enterprises#19
Date: 2026-05-10
Verdict: PASS
Evidence
- Pipeline #26 (main branch): all 4 steps green — clone, test, build-and-push, update-kustomize-tag
- Test gates validated: bundle-audit (0 CVEs), brakeman (0 warnings), rubocop (0 offenses)
- Docker image pushed to harbor.tail5b443a.ts.net/pal-enterprises/app:d8900c1e
- Kustomize tag updated in pal-e-deployments, ArgoCD picks up new image
Issues resolved during validation
- Woodpecker agents cannot pull from Harbor cluster-internal URL — switched to external Tailscale URL
- Harbor pal-e project made public for unauthenticated base image pulls
- harbor-portal-proxy missing client_max_body_size (413 on push) — fixed ConfigMap
- omniauth 1.9.2 → 2.1.4 (CVE-2015-9284)
- Kaniko layer caching added for faster subsequent builds
PRs merged
- #22: Add Woodpecker CI pipeline with test gates
- #24: Fix CI pipeline: use Docker Hub image + fix security audit
- #25: Fix kaniko insecure pull (interim, superseded by #26)
- #26: Switch kaniko to external Harbor URL
- #27: Add kaniko layer caching