Fix Woodpecker clone failure: override clone URL to use internal Forgejo service #14

New issue

Closed

opened 2026-03-06 15:22:21 +00:00 by forgejo_admin · 0 comments

forgejo_admin commented

2026-03-06 15:22:21 +00:00

Owner

Plan

todo-woodpecker-tls-clone-fix -- platform bug fix

Repo

forgejo_admin/pal-e-docs-mcp

User Story

As a platform operator
I want Woodpecker CI pipelines to clone via the internal Forgejo service URL
So that pipelines stop failing with TLS EOF errors through the Tailscale funnel

Context

Woodpecker's clone plugin gets the clone URL from Forgejo's API, which returns the external https://forgejo.tail5b443a.ts.net URL. Git's HTTP transport hits a TLS EOF when connecting through the Tailscale funnel proxy. Clone via internal service (http://forgejo-http.forgejo.svc.cluster.local) works fine.

File Targets

Files the agent should modify:

.woodpecker.yaml -- add clone section to override remote URL to http://forgejo-http.forgejo.svc.cluster.local/forgejo_admin/pal-e-docs-mcp.git

Files the agent should NOT touch:

Any other files

Acceptance Criteria

.woodpecker.yaml has a clone section with remote set to the internal Forgejo URL
Existing steps, when filters are unchanged

Test Expectations

Push to main triggers a successful pipeline (clone step passes)
YAML syntax: validate with python3 -c "import yaml; yaml.safe_load(open('.woodpecker.yaml'))"

Constraints

Clone section format: clone: [{name: clone, image: woodpeckerci/plugin-git, settings: {remote: "http://forgejo-http.forgejo.svc.cluster.local/forgejo_admin/pal-e-docs-mcp.git"}}]
Do NOT change any step logic, images, or secrets
Do NOT access pal-e-docs MCP tools

Checklist

PR opened
No unrelated changes

todo-woodpecker-tls-clone-fix -- documented root cause
project-pal-e-platform -- platform stability

### Plan `todo-woodpecker-tls-clone-fix` -- platform bug fix ### Repo `forgejo_admin/pal-e-docs-mcp` ### User Story As a platform operator I want Woodpecker CI pipelines to clone via the internal Forgejo service URL So that pipelines stop failing with TLS EOF errors through the Tailscale funnel ### Context Woodpecker's clone plugin gets the clone URL from Forgejo's API, which returns the external `https://forgejo.tail5b443a.ts.net` URL. Git's HTTP transport hits a TLS EOF when connecting through the Tailscale funnel proxy. Clone via internal service (`http://forgejo-http.forgejo.svc.cluster.local`) works fine. ### File Targets Files the agent should modify: - `.woodpecker.yaml` -- add `clone` section to override remote URL to `http://forgejo-http.forgejo.svc.cluster.local/forgejo_admin/pal-e-docs-mcp.git` Files the agent should NOT touch: - Any other files ### Acceptance Criteria - [ ] `.woodpecker.yaml` has a `clone` section with `remote` set to the internal Forgejo URL - [ ] Existing `steps`, `when` filters are unchanged ### Test Expectations - [ ] Push to main triggers a successful pipeline (clone step passes) - YAML syntax: validate with `python3 -c "import yaml; yaml.safe_load(open('.woodpecker.yaml'))"` ### Constraints - Clone section format: `clone: [{name: clone, image: woodpeckerci/plugin-git, settings: {remote: "http://forgejo-http.forgejo.svc.cluster.local/forgejo_admin/pal-e-docs-mcp.git"}}]` - Do NOT change any step logic, images, or secrets - Do NOT access pal-e-docs MCP tools ### Checklist - [ ] PR opened - [ ] No unrelated changes ### Related - `todo-woodpecker-tls-clone-fix` -- documented root cause - `project-pal-e-platform` -- platform stability