Fix update-kustomize-tag wget auth for private pal-e-platform repo #226

New issue

Closed

opened 2026-03-28 16:30:30 +00:00 by forgejo_admin · 0 comments

forgejo_admin commented

2026-03-28 16:30:30 +00:00

Owner

Type

Feature

Lineage

Board: board-pal-e-platform
Story: story:superuser-deploy
Arch: arch:ci-pipeline

Repo

Cross-repo: pal-e-api, basketball-api, pal-e-app, westside-app (4 repos)

User Story

As the superuser, I need CI pipelines to successfully download update-kustomize-tag.sh from pal-e-platform so that merged code triggers ArgoCD deployments. Currently ALL repos fail with 404 because pal-e-platform is private and wget has no auth header.

Context

The update-kustomize-tag step in .woodpecker.yaml downloads the script via raw URL:

wget -O /tmp/update-kustomize-tag.sh "http://forgejo-http.forgejo.svc.cluster.local:80/forgejo_admin/pal-e-platform/raw/branch/main/scripts/update-kustomize-tag.sh"

pal-e-platform is private. wget gets 404 (Forgejo masks 401 as 404 for private repos).

Scope

Add auth header to wget in 4 repos:

wget -O /tmp/update-kustomize-tag.sh --header="Authorization: token ${FORGEJO_TOKEN}" "http://..."

FORGEJO_TOKEN is already available in the step environment (used for pushing to pal-e-deployments).

File Targets

pal-e-api: .woodpecker.yaml
basketball-api: .woodpecker.yaml
pal-e-app: .woodpecker.yaml
westside-app: .woodpecker.yaml

Constraints

One PR per repo (4 parallel PRs)
Do NOT change the script URL or any other pipeline step
Only add the --header flag to the wget line

Acceptance Criteria

All 4 repos download the script successfully in CI
update-kustomize-tag step passes (not just the download)

Checklist

Fix pal-e-api .woodpecker.yaml
Fix basketball-api .woodpecker.yaml
Fix pal-e-app .woodpecker.yaml
Fix westside-app .woodpecker.yaml

Test Expectations

Pipeline passes update-kustomize-tag step on next main push

Blocks: #232 (pal-e-api NoteType deployment)
Blocks: all GitOps deployments across platform
Root cause: pal-e-platform repo is private (visibility: private)

### Type Feature ### Lineage - Board: board-pal-e-platform - Story: story:superuser-deploy - Arch: arch:ci-pipeline ### Repo Cross-repo: pal-e-api, basketball-api, pal-e-app, westside-app (4 repos) ### User Story As the superuser, I need CI pipelines to successfully download update-kustomize-tag.sh from pal-e-platform so that merged code triggers ArgoCD deployments. Currently ALL repos fail with 404 because pal-e-platform is private and wget has no auth header. ### Context The update-kustomize-tag step in .woodpecker.yaml downloads the script via raw URL: ``` wget -O /tmp/update-kustomize-tag.sh "http://forgejo-http.forgejo.svc.cluster.local:80/forgejo_admin/pal-e-platform/raw/branch/main/scripts/update-kustomize-tag.sh" ``` pal-e-platform is private. wget gets 404 (Forgejo masks 401 as 404 for private repos). ### Scope Add auth header to wget in 4 repos: ```yaml wget -O /tmp/update-kustomize-tag.sh --header="Authorization: token ${FORGEJO_TOKEN}" "http://..." ``` FORGEJO_TOKEN is already available in the step environment (used for pushing to pal-e-deployments). ### File Targets - pal-e-api: .woodpecker.yaml - basketball-api: .woodpecker.yaml - pal-e-app: .woodpecker.yaml - westside-app: .woodpecker.yaml ### Constraints - One PR per repo (4 parallel PRs) - Do NOT change the script URL or any other pipeline step - Only add the --header flag to the wget line ### Acceptance Criteria - [ ] All 4 repos download the script successfully in CI - [ ] update-kustomize-tag step passes (not just the download) ### Checklist - [ ] Fix pal-e-api .woodpecker.yaml - [ ] Fix basketball-api .woodpecker.yaml - [ ] Fix pal-e-app .woodpecker.yaml - [ ] Fix westside-app .woodpecker.yaml ### Test Expectations - Pipeline passes update-kustomize-tag step on next main push ### Related - Blocks: #232 (pal-e-api NoteType deployment) - Blocks: all GitOps deployments across platform - Root cause: pal-e-platform repo is private (visibility: private)