ci: add .woodpecker.yaml (kaniko → Harbor → kustomize tag bump) #11
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "8-woodpecker-yaml"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Adds the 4-step Woodpecker pipeline for
westside-admin, mirroring the proven westside-app pattern. Push to main triggers: clone → validate → kaniko build+push to Harbor → bump kustomize tag in pal-e-deployments. PRs run validate only.Changes
.woodpecker.yaml— new file, mirrors~/westside-app/.woodpecker.yamlstructure with admin-specific substitutions:westside-admin/app(perfeedback_harbor_project_naming— service key, not owner namespace)westside-adminupdate-kustomize-tagstep hasfailure: ignore(image is already pushed; tag bump is best-effort and re-runnable)${CI_COMMIT_SHA}(not short)Sibling Pattern Fidelity
Structurally diffed against
~/westside-app/.woodpecker.yaml. Identical shape; deltas are limited to the four substitutions above plus the AC-mandated clone retry. Same kaniko plugin version (woodpeckerci/plugin-kaniko:2.3.0), same Harbor internal registry, same sharedupdate-kustomize-tag.shfrompal-e-platform/scripts/, same secret names (harbor_username,harbor_password,forgejo_token).Test Plan
python3 -c "import yaml; yaml.safe_load(open('.woodpecker.yaml'))"harbor.tail5b443a.ts.net/westside-admin/app:<sha>Secret-Name Audit
References three Woodpecker secrets:
harbor_username,harbor_password,forgejo_token(all global, shared with westside-app). Per ticket #65's PR, thewestside-admin-ciHarbor robot was provisioned. If Woodpecker stores per-repo Harbor secrets under different names,from_secret:references need updating before first run. Verify viamcp__woodpecker__list_repo_secretsafter enabling.Discovered Scope
None new. Repo-enable in Woodpecker is a one-time manual step already noted in issue #8.
Review Checklist
python3 -c "import yaml; yaml.safe_load(...)")~/westside-app/.woodpecker.yamlverifiedfeedback_harbor_project_naming(service key, not owner namespace)failure: ignoreon tag-bump step per issue ACwestside-admin/app:<sha>Related Notes
feedback_harbor_project_naming— drives Harbor repo path (westside-admin/app, notforgejo_admin/westside-admin)feedback_yaml_parse_validation— drives the parse-validate gatefeedback_woodpecker_quote_heavy_scripts— applied where wget retry needed$$iescapingarch-deployment-westside-admin— architecture component this CI feedsproject-westside-admin— parent project~/westside-app/.woodpecker.yamlpal-e-platform/scripts/update-kustomize-tag.shRelated
Closes #8
PR #11 Review
DOMAIN REVIEW
Stack: Woodpecker CI YAML (kaniko -> Harbor -> kustomize tag bump in pal-e-deployments). Single-file PR, +80 lines.
YAML parse: Confirmed via structural read of
/tmp/westside-admin-ci/.woodpecker.yaml. Valid shape. Perfeedback_woodpecker_quote_heavy_scripts, the two multi-line- |blocks (clone retry loop, wget retry loop) use simple shell with$$iescaping for Woodpecker var-interpolation; no nested quote hazards.Sibling fidelity vs
~/westside-app/.woodpecker.yaml: High. Acceptable deltas confirmed:repo: westside-admin/app(sibling:westsidekingsandqueens/app) — matchesfeedback_harbor_project_naming(service-key prefix).OVERLAY: "westside-admin"(sibling:westsidekingsandqueens).failure: ignoreon tag-bump step — matches AC and recent platform fix (commit 1d54939 pattern).2.3.0, same internal Harbor registry, same secret names.BLOCKERS
None on the YAML itself. The file is correct.
NITS / OPERATIONAL GAPS (post-merge gates, not code blockers)
Secret provisioning gap (HIGHEST RISK). Verified via
mcp__woodpecker__list_global_secretsandmcp__woodpecker__list_repo_secretsforforgejo_admin/westside-app:forgejo_user,forgejo_password,forgejo_url,forgejo_publish_user,forgejo_publish_token,forgejo_pypi_url. Noharbor_*globals, noforgejo_tokenglobal.harbor_username,harbor_password,forgejo_token— these are repo-scoped, not global. The PR body's claim that they are "global Woodpecker secrets per dev report" is incorrect.OVERLAY directory must exist.
update-kustomize-tag.shexits 1 ifoverlays/westside-admin/prod/kustomization.yamlis missing inforgejo_admin/pal-e-deployments. The header comment inpal-e-platform/scripts/woodpecker-update-tag-step.yamlenumerates known overlays andwestside-adminis NOT listed. Because the step hasfailure: ignore, this won't block the pipeline (image still pushes), but ArgoCD won't pick up new tags until the overlay exists. Track as discovered scope: "create overlays/westside-admin/prod in pal-e-deployments."Repo-enable required. Confirmed
forgejo_admin/westside-adminis NOT in the Woodpecker active-repos list. One-time manual enable required post-merge (already noted in PR body).(Style nit)
${CI_REPO}in the clone URL may double-encode if repo name has unusual chars; not an issue here.SOP COMPLIANCE
8-woodpecker-yaml(issue-number-kebab purpose)feedback_yaml_parse_validationfeedback_woodpecker_quote_heavy_scriptsPROCESS OBSERVATIONS
overlays/westside-admin/prod/created inpal-e-deployments. Recommend filing both as immediate follow-up tickets so they are not lost.VERDICT: APPROVED
The YAML is correct and matches the established westside-app pattern with the AC-mandated deltas. Merge is safe. The two post-merge gates (secret creation, overlay creation) are operational, not code defects, but they MUST be completed before the first push to main can produce a deployed image.