forgejo_admin/pal-e-platform
1
0
Fork 0
Code Issues 31 Pull requests Projects Releases Packages Wiki Activity Actions

Rollout: wire update-kustomize-tag step into all 8 app repos #206

New issue
Open
opened 2026-03-27 20:39:51 +00:00 by forgejo_admin · 5 comments
forgejo_admin commented 2026-03-27 20:39:51 +00:00
Owner
Copy link

Type

Feature

Lineage

Discovered scope from #204 implementation (PR #205). The reusable script and Woodpecker step template are in pal-e-platform — this ticket covers wiring them into each consumer repo.

Repo

forgejo_admin/pal-e-platform (tracking issue — child work spans 8 repos)

User Story

As a platform operator,
I want every app repo to automatically update its kustomize overlay tag after a successful build,
So that deploys are fully automated end-to-end without manual image tag bumps.

Context

PR #205 adds scripts/update-kustomize-tag.sh and a Woodpecker step template. Each app repo needs:

  1. Add the update-kustomize-tag step to .woodpecker.yaml
  2. Ensure forgejo_token secret exists
  3. pal-e-app specifically: replace broken update-deployment-tag step that targets wrong repo Done (PR #67)

Rollout Status

Repo Status PR Notes
pal-e-app ✅ Complete #67 Replaced broken step
pal-e-docs ✅ Complete #221 (was listed as "pal-e-api" — that repo does not exist)
basketball-api ✅ Complete #192
westside-app ✅ Complete #124
westside-contracts ❌ Blocked — Not in Woodpecker CI yet (prerequisite)
minio-api ❌ Blocked — Not in Woodpecker CI yet (prerequisite)
mcd-tracker-api ❔ Decision needed — Archive candidate per feedback_archive_mcd_palemail.md
mcd-tracker-app ❔ Decision needed — Archive candidate per feedback_archive_mcd_palemail.md

Completed: 4 of 8 repos.

forgejo_token Audit (Complete)

Repo Has forgejo_token?
pal-e-app ✅ Yes
pal-e-docs ✅ Yes
basketball-api ✅ Yes (added during rollout)
westside-app ✅ Yes (added during rollout)
westside-contracts N/A — not in Woodpecker
minio-api N/A — not in Woodpecker
mcd-tracker-api ❌ Needs secret
mcd-tracker-app ❌ Needs secret

Woodpecker Onboarding Prerequisite

westside-contracts and minio-api are not registered in Woodpecker CI. Before the kustomize-tag step can be wired, they need:

  1. Repo activated in Woodpecker
  2. .woodpecker.yaml pipeline created (build + push)
  3. Required secrets provisioned (forgejo_token, registry creds)

This is out-of-scope for this issue and requires separate prerequisite tickets.

pal-e-mail Exclusion

Note: pal-e-mail is an archive candidate (per feedback_archive_mcd_palemail.md). It is NOT included in this rollout.

pal-e-api Correction

Note: The original issue listed pal-e-api as a separate repo. This repo does not exist — it IS pal-e-docs (the backend). Repo count corrected from 9 to 8.

Decisions Needed

Resolved: Exclude mcd-tracker repos. Per feedback_archive_mcd_palemail, mcd-tracker-api and mcd-tracker-app are archive candidates. Do not invest CI onboarding effort in repos headed for archival.

Resolved: Separate prerequisite tickets for Woodpecker onboarding of westside-contracts and minio-api. Each gets its own Forgejo issue covering repo activation, pipeline creation, and secret provisioning. This issue tracks only the kustomize-tag step wiring.

Rollout Order Strategy

Suggested rollout order for remaining repos (after decisions above):

  1. westside-contracts and minio-api — after Woodpecker onboarding prerequisite is resolved
  2. mcd-tracker-api and mcd-tracker-app — only if decision is to include

File Targets

Per-repo: .woodpecker.yaml in each app repo.
Secret setup: Woodpecker admin UI or mcp__woodpecker__create_repo_secret.

Acceptance Criteria

  • pal-e-app: update-kustomize-tag step wired (PR #67)
  • pal-e-docs: update-kustomize-tag step wired (PR #221)
  • basketball-api: update-kustomize-tag step wired (PR #192)
  • westside-app: update-kustomize-tag step wired (PR #124)
  • pal-e-app broken step replaced (PR #67)
  • forgejo_token secret provisioned in westside-app and basketball-api
  • westside-contracts: Woodpecker onboarding + kustomize-tag step
  • minio-api: Woodpecker onboarding + kustomize-tag step
  • mcd-tracker-api: kustomize-tag step (pending decision)
  • mcd-tracker-app: kustomize-tag step (pending decision)
  • One successful end-to-end deploy verified (push → build → tag update → ArgoCD sync)

Test Expectations

  • Push a trivial change to one completed repo, verify kustomize overlay tag updates automatically
  • Run command: kubectl get application -n argocd to verify sync

Constraints

  • Depends on #204 (PR #205) being merged first Satisfied (#204 closed)
  • Each repo gets its own PR (per feedback_smaller_scopes_parallel)
  • westside-contracts and minio-api blocked on Woodpecker CI onboarding

Checklist

  • Run forgejo_token audit across repos
  • Wire 4 active repos (pal-e-app, pal-e-docs, basketball-api, westside-app)
  • Add forgejo_token secrets where missing (westside-app, basketball-api)
  • Replace pal-e-app broken step
  • Resolve decisions on mcd-tracker and Woodpecker onboarding
  • Create child issues for remaining repos (after decisions)
  • Verify end-to-end

Related

  • forgejo_admin/pal-e-platform#204 — parent issue (closed)
  • board-pal-e-platform — project board
  • feedback_archive_mcd_palemail.md — pal-e-mail and mcd-tracker exclusion rationale
### Type Feature ### Lineage Discovered scope from #204 implementation (PR #205). The reusable script and Woodpecker step template are in pal-e-platform — this ticket covers wiring them into each consumer repo. ### Repo `forgejo_admin/pal-e-platform` (tracking issue — child work spans 8 repos) ### User Story As a platform operator, I want every app repo to automatically update its kustomize overlay tag after a successful build, So that deploys are fully automated end-to-end without manual image tag bumps. ### Context PR #205 adds `scripts/update-kustomize-tag.sh` and a Woodpecker step template. Each app repo needs: 1. Add the `update-kustomize-tag` step to `.woodpecker.yaml` 2. Ensure `forgejo_token` secret exists 3. ~~pal-e-app specifically: replace broken `update-deployment-tag` step that targets wrong repo~~ **Done** (PR #67) ### Rollout Status | Repo | Status | PR | Notes | |------|--------|----|-------| | pal-e-app | :white_check_mark: Complete | #67 | Replaced broken step | | pal-e-docs | :white_check_mark: Complete | #221 | (was listed as "pal-e-api" — that repo does not exist) | | basketball-api | :white_check_mark: Complete | #192 | | | westside-app | :white_check_mark: Complete | #124 | | | westside-contracts | :x: Blocked | — | Not in Woodpecker CI yet (prerequisite) | | minio-api | :x: Blocked | — | Not in Woodpecker CI yet (prerequisite) | | mcd-tracker-api | :grey_question: Decision needed | — | Archive candidate per `feedback_archive_mcd_palemail.md` | | mcd-tracker-app | :grey_question: Decision needed | — | Archive candidate per `feedback_archive_mcd_palemail.md` | **Completed: 4 of 8 repos.** ### forgejo_token Audit (Complete) | Repo | Has `forgejo_token`? | |------|---------------------| | pal-e-app | :white_check_mark: Yes | | pal-e-docs | :white_check_mark: Yes | | basketball-api | :white_check_mark: Yes (added during rollout) | | westside-app | :white_check_mark: Yes (added during rollout) | | westside-contracts | N/A — not in Woodpecker | | minio-api | N/A — not in Woodpecker | | mcd-tracker-api | :x: Needs secret | | mcd-tracker-app | :x: Needs secret | ### Woodpecker Onboarding Prerequisite westside-contracts and minio-api are **not registered in Woodpecker CI**. Before the kustomize-tag step can be wired, they need: 1. Repo activated in Woodpecker 2. `.woodpecker.yaml` pipeline created (build + push) 3. Required secrets provisioned (`forgejo_token`, registry creds) This is out-of-scope for this issue and requires separate prerequisite tickets. ### pal-e-mail Exclusion > **Note:** `pal-e-mail` is an archive candidate (per `feedback_archive_mcd_palemail.md`). It is NOT included in this rollout. ### pal-e-api Correction > **Note:** The original issue listed `pal-e-api` as a separate repo. This repo does not exist — it IS `pal-e-docs` (the backend). Repo count corrected from 9 to 8. ### Decisions Needed **Resolved:** Exclude mcd-tracker repos. Per feedback_archive_mcd_palemail, mcd-tracker-api and mcd-tracker-app are archive candidates. Do not invest CI onboarding effort in repos headed for archival. **Resolved:** Separate prerequisite tickets for Woodpecker onboarding of westside-contracts and minio-api. Each gets its own Forgejo issue covering repo activation, pipeline creation, and secret provisioning. This issue tracks only the kustomize-tag step wiring. ### Rollout Order Strategy > Suggested rollout order for remaining repos (after decisions above): > 1. **westside-contracts** and **minio-api** — after Woodpecker onboarding prerequisite is resolved > 2. **mcd-tracker-api** and **mcd-tracker-app** — only if decision is to include ### File Targets Per-repo: `.woodpecker.yaml` in each app repo. Secret setup: Woodpecker admin UI or `mcp__woodpecker__create_repo_secret`. ### Acceptance Criteria - [x] pal-e-app: update-kustomize-tag step wired (PR #67) - [x] pal-e-docs: update-kustomize-tag step wired (PR #221) - [x] basketball-api: update-kustomize-tag step wired (PR #192) - [x] westside-app: update-kustomize-tag step wired (PR #124) - [x] pal-e-app broken step replaced (PR #67) - [x] `forgejo_token` secret provisioned in westside-app and basketball-api - [ ] westside-contracts: Woodpecker onboarding + kustomize-tag step - [ ] minio-api: Woodpecker onboarding + kustomize-tag step - [ ] mcd-tracker-api: kustomize-tag step (pending decision) - [ ] mcd-tracker-app: kustomize-tag step (pending decision) - [ ] One successful end-to-end deploy verified (push → build → tag update → ArgoCD sync) ### Test Expectations - [ ] Push a trivial change to one completed repo, verify kustomize overlay tag updates automatically - Run command: `kubectl get application -n argocd` to verify sync ### Constraints - ~~Depends on #204 (PR #205) being merged first~~ **Satisfied** (#204 closed) - Each repo gets its own PR (per feedback_smaller_scopes_parallel) - westside-contracts and minio-api blocked on Woodpecker CI onboarding ### Checklist - [x] Run forgejo_token audit across repos - [x] Wire 4 active repos (pal-e-app, pal-e-docs, basketball-api, westside-app) - [x] Add forgejo_token secrets where missing (westside-app, basketball-api) - [x] Replace pal-e-app broken step - [ ] Resolve decisions on mcd-tracker and Woodpecker onboarding - [ ] Create child issues for remaining repos (after decisions) - [ ] Verify end-to-end ### Related - `forgejo_admin/pal-e-platform#204` — parent issue (closed) - `board-pal-e-platform` — project board - `feedback_archive_mcd_palemail.md` — pal-e-mail and mcd-tracker exclusion rationale
forgejo_admin commented 2026-03-27 21:12:08 +00:00
Author
Owner
Copy link

Rollout Complete

All 4 active repos now have the update-kustomize-tag Woodpecker step:

Repo PR Status
pal-e-app #67 Merged (replaced broken step)
pal-e-api #221 Merged
westside-app #124 Merged
basketball-api #192 Merged

Secrets provisioned: forgejo_token added to westside-app and basketball-api.

Skipped repos: mcd-tracker-api, mcd-tracker-app, pal-e-mail (archive candidates), westside-contracts and minio-api (not in Woodpecker CI).

Remaining: Verify end-to-end by pushing a trivial change to one repo and confirming the kustomize overlay tag updates automatically.

## Rollout Complete All 4 active repos now have the `update-kustomize-tag` Woodpecker step: | Repo | PR | Status | |------|----|--------| | pal-e-app | #67 | Merged (replaced broken step) | | pal-e-api | #221 | Merged | | westside-app | #124 | Merged | | basketball-api | #192 | Merged | **Secrets provisioned:** `forgejo_token` added to westside-app and basketball-api. **Skipped repos:** mcd-tracker-api, mcd-tracker-app, pal-e-mail (archive candidates), westside-contracts and minio-api (not in Woodpecker CI). **Remaining:** Verify end-to-end by pushing a trivial change to one repo and confirming the kustomize overlay tag updates automatically.
forgejo_admin commented 2026-03-27 22:09:24 +00:00
Author
Owner
Copy link

Scope Review: NEEDS_REFINEMENT

Review note: review-464-2026-03-27

Well-structured tracking issue with correct decomposition strategy (9 child issues, one per repo). Dependency #204 is satisfied (closed). Template is complete with clear acceptance criteria.

Key issues:

  • forgejo_token audit needed — issue says "only 3/9 repos have it today" but doesn't specify which 3. Audit needed before creating child issues.
  • Archive candidate inclusion — pal-e-mail is an archive candidate (per project memory). Wiring CI into an archived project is wasted work. Confirm whether to include or reduce to 8 repos.
  • Rollout order missing — recommend starting with lowest-risk repo and verifying end-to-end before wiring all 9. Don't dispatch all simultaneously on first rollout.
  • Child issues don't exist yet — this ticket is a coordination artifact, not directly executable. Next step is creating the 9 child issues.
  • File targets verified — scripts/update-kustomize-tag.sh, scripts/woodpecker-update-tag-step.yaml, and all 9 repos confirmed to have .woodpecker.yaml.
  • Ready to move from backlog to todo — dependency satisfied, ready for planning work (child issue creation).
## Scope Review: NEEDS_REFINEMENT Review note: `review-464-2026-03-27` Well-structured tracking issue with correct decomposition strategy (9 child issues, one per repo). Dependency #204 is satisfied (closed). Template is complete with clear acceptance criteria. **Key issues:** - **forgejo_token audit needed** — issue says "only 3/9 repos have it today" but doesn't specify which 3. Audit needed before creating child issues. - **Archive candidate inclusion** — pal-e-mail is an archive candidate (per project memory). Wiring CI into an archived project is wasted work. Confirm whether to include or reduce to 8 repos. - **Rollout order missing** — recommend starting with lowest-risk repo and verifying end-to-end before wiring all 9. Don't dispatch all simultaneously on first rollout. - **Child issues don't exist yet** — this ticket is a coordination artifact, not directly executable. Next step is creating the 9 child issues. - **File targets verified** — `scripts/update-kustomize-tag.sh`, `scripts/woodpecker-update-tag-step.yaml`, and all 9 repos confirmed to have `.woodpecker.yaml`. - **Ready to move from backlog to todo** — dependency satisfied, ready for planning work (child issue creation).
forgejo_admin commented 2026-03-27 22:14:31 +00:00
Author
Owner
Copy link

Issue body updated per scope review corrections.

Issue body updated per scope review corrections.
forgejo_admin commented 2026-03-28 05:46:46 +00:00
Author
Owner
Copy link

Scope Review: NEEDS_REFINEMENT

Review note: review-464-2026-03-27

Issue body is stale — 4/8 repos already done on main, acceptance criteria and repo count need updating.

Key issues:

  • pal-e-api does not exist — it IS pal-e-docs. Repo count is 8, not 9. Remove from list.
  • 4 repos already complete — pal-e-app (PR #67), pal-e-docs (PR #221), basketball-api (PR #192), westside-app (PR #124) all merged on main. pal-e-app broken step already fixed.
  • 2 repos not in Woodpecker — westside-contracts and minio-api need CI onboarding first (undocumented prerequisite).
  • 2 repos archive-adjacent — mcd-tracker-api and mcd-tracker-app per feedback_archive_mcd_palemail.md. Decision needed on inclusion.
  • forgejo_token audit complete — 4 repos have it; mcd-tracker-api/app need it; westside-contracts/minio-api not in Woodpecker.
  • Board #411 (Harbor timeout) — in_progress, potential blocker for e2e verification AC.

Decisions needed before moving to next_up:

  1. Include mcd-tracker repos (archive-adjacent) or exclude?
  2. Woodpecker onboarding for westside-contracts/minio-api: prerequisite child issues here or standalone?

Body updates needed: repo count, AC progress, audit results, onboarding prerequisites.

## Scope Review: NEEDS_REFINEMENT Review note: `review-464-2026-03-27` Issue body is stale — 4/8 repos already done on main, acceptance criteria and repo count need updating. **Key issues:** - **pal-e-api does not exist** — it IS pal-e-docs. Repo count is 8, not 9. Remove from list. - **4 repos already complete** — pal-e-app (PR #67), pal-e-docs (PR #221), basketball-api (PR #192), westside-app (PR #124) all merged on main. pal-e-app broken step already fixed. - **2 repos not in Woodpecker** — westside-contracts and minio-api need CI onboarding first (undocumented prerequisite). - **2 repos archive-adjacent** — mcd-tracker-api and mcd-tracker-app per `feedback_archive_mcd_palemail.md`. Decision needed on inclusion. - **forgejo_token audit complete** — 4 repos have it; mcd-tracker-api/app need it; westside-contracts/minio-api not in Woodpecker. - **Board #411 (Harbor timeout)** — in_progress, potential blocker for e2e verification AC. **Decisions needed before moving to next_up:** 1. Include mcd-tracker repos (archive-adjacent) or exclude? 2. Woodpecker onboarding for westside-contracts/minio-api: prerequisite child issues here or standalone? **Body updates needed:** repo count, AC progress, audit results, onboarding prerequisites.
forgejo_admin changed title from Rollout: wire update-kustomize-tag step into all 9 app repos to Rollout: wire update-kustomize-tag step into all 8 app repos 2026-03-28 05:49:25 +00:00
forgejo_admin commented 2026-03-28 11:41:07 +00:00
Author
Owner
Copy link

Scope Review: READY

Review note: review-464-2026-03-28

Re-review after refinement. All 6 prior NEEDS_REFINEMENT items addressed: repo count corrected (8 not 9), rollout status updated (4/8 done), forgejo_token audit complete, Woodpecker onboarding prerequisite documented, mcd-tracker excluded, decisions resolved.

Cosmetic nits (non-blocking):

  • Remove or mark N/A the 2 mcd-tracker AC items (decision resolved: exclude)
  • Add note that westside-contracts and minio-api also need kustomize overlay directories in pal-e-deployments (neither exists today)
  • Board item title still says "all 9 repos" -- should reflect current state

Ready to move from backlog to todo.

## Scope Review: READY Review note: `review-464-2026-03-28` Re-review after refinement. All 6 prior NEEDS_REFINEMENT items addressed: repo count corrected (8 not 9), rollout status updated (4/8 done), forgejo_token audit complete, Woodpecker onboarding prerequisite documented, mcd-tracker excluded, decisions resolved. **Cosmetic nits (non-blocking):** - Remove or mark N/A the 2 mcd-tracker AC items (decision resolved: exclude) - Add note that westside-contracts and minio-api also need kustomize overlay directories in pal-e-deployments (neither exists today) - Board item title still says "all 9 repos" -- should reflect current state Ready to move from backlog to todo.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
188-cross-repo-worktree-isolation-for-parall
111-fix-keycloak-probe
86-fix-rotate-woodpecker-api-token-in-salt
71-feat-deploy-pyrra-slo-manager-with-servi
64-hotfix-woodpecker-oauth-login-broken-for
18-fix-grafana-duplicate-default-datasource-v2
18-fix-grafana-duplicate-default-datasource
13-fix-cnpg-all-parameters
No results found.
Labels
Clear labels   
domain:backend

   
domain:devops

   
domain:frontend

   
status:approved

QA passed, awaiting merge approval

  
status:in-progress

Dev agent is actively working

  
status:needs-fix

QA found issues, back to dev

  
status:qa

PR submitted, awaiting QA review

  
type:bug

Bug fix

  
type:devops

Infrastructure/CI/config work

  
type:feature

New functionality

No labels
domain:backend
domain:devops
domain:frontend
status:approved
status:in-progress
status:needs-fix
status:qa
type:bug
type:devops
type:feature
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
forgejo_admin/pal-e-platform#206
No description provided.