.woodpecker.yaml: kaniko build → Harbor → kustomize tag bump #8
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Type
Task
Lineage
Hard depends on
forgejo_admin/westside-admin#6(scaffolding — needspackage.json+ buildable code),#7(Dockerfile — kaniko needs something to build), andforgejo_admin/pal-e-services#<NEW>(service onboarding — provisions the Harbor project + CI robot account this pipeline pushes to). Without service onboarding, kaniko has no project to push to.Repo
forgejo_admin/westside-adminUser Story
story-westside-admin-admin-row-crud. Foundational — without CI, no deploys.Context
Mirror the proven 4-step pipeline from
~/westside-app/.woodpecker.yaml: clone (cluster-internal forgejo URL with retry), validate (npm ci + check + build), build-and-push (kaniko → harbor.harbor.svc.cluster.local), update-kustomize-tag (wgets shared script from pal-e-platform, updates tag in pal-e-deployments).ArgoCD watches pal-e-deployments and auto-syncs once the kustomize image tag changes. End result: push to main → image at
harbor.tail5b443a.ts.net/westside-admin/app:<sha>→ ArgoCD applies new tag → pod rolls.Critical: Harbor project naming. Per
feedback_harbor_project_namingandpal-e-services/terraform/services.tf: service key = Harbor project = image_repo prefix. westside-app usesrepo: westsidekingsandqueens/app. westside-admin usesrepo: westside-admin/app(NOTforgejo_admin/westside-admin— owner namespace is irrelevant). Thewestside-adminHarbor project is provisioned by the pal-e-services onboarding ticket above.Scope
Create
.woodpecker.yamlmirroring the structure of~/westside-app/.woodpecker.yamlwith these specifics:alpine/gitimage, fetch fromforgejo-http.forgejo.svc.cluster.local:80with 5-attempt retrynode:22-alpine, runsnpm ci && npm run check && npm run buildwoodpeckerci/plugin-kaniko:2.3.0plugin, registryharbor.harbor.svc.cluster.local,repo: westside-admin/app,tags: ${CI_COMMIT_SHA}, uses existing global secretsharbor_username/harbor_password. Runs only on push to main + manual.alpine/git:latest, envOVERLAY=westside-adminandIMAGE_TAG=${CI_COMMIT_SHA}, wgetshttps://forgejo-http.forgejo.svc.cluster.local:80/forgejo_admin/pal-e-platform/raw/branch/main/scripts/update-kustomize-tag.shwith 5-attempt retry, then runs it. Addfailure: ignoreper Woodpecker pipeline syntax so a failed kustomize tag bump does NOT mark the pipeline as failed (the image is already pushed; tag bump is best-effort and can be re-run).YAML must parse-validate per
feedback_yaml_parse_validation: runpython -c "import yaml; yaml.safe_load(open('.woodpecker.yaml'))"before commit.After merge: enable the repo in Woodpecker (one-time operation via Woodpecker UI or
mcp__woodpecker__*tools), trigger manually to verify all 4 steps succeed.Acceptance Criteria
${CI_COMMIT_SHA}(full SHA, not short)harbor.tail5b443a.ts.net/westside-admin/app:<sha>(project =westside-admin, NOTforgejo_admin)failure: ignoreso a failure does NOT break the pipelinewestside-adminpython -c "import yaml; yaml.safe_load(open('.woodpecker.yaml'))"Test Expectations
westside-admin/app:<sha>Constraints
forgejo-http.forgejo.svc.cluster.local:80for clonewoodpeckerci/plugin-kaniko:2.3.0(match westside-app)harbor_username,harbor_password,forgejo_token— pal-e-services onboarding ticket ensures the new Harbor project accepts those credswestside-admin(NOTforgejo_admin/westside-admin)Checklist
Related
project-westside-adminarch-deployment-westside-adminfeedback_harbor_project_naming(driving rule for image path)~/westside-app/.woodpecker.yaml#6(scaffolding),#7(Dockerfile),forgejo_admin/pal-e-services#<NEW>(service onboarding)Scope Review: NEEDS_REFINEMENT
Review note:
review-1094-2026-04-25Scope mirrors
~/westside-app/.woodpecker.yamlcorrectly, but a Harbor naming claim conflicts with the documented convention and will break kaniko push if shipped as written. Backing notes (story page, arch note) also missing.Issues:
forgejo_admin"matches repo owner perfeedback_harbor_project_naming." Convention (andpal-e-services/terraform/services.tfline 7) isservice key = Harbor project = image_repo prefix— derived fromimage_repo, NOT repo owner. Reference westside-app usesrepo: westsidekingsandqueens/app, notforgejo_admin/westside-app. Pick a service key (suggestwestside-adminmatchingmcd-tracker-appprecedent), setimage_repo = "westside-admin/app", and use kanikorepo: westside-admin/app.failure: ignore. Cited commit1d54939changed when-conditions on a different step, not failure tolerance for this step. Dev must addfailure: ignore(or verify actual mechanism) — don't assume implicit.pal-e-services/terraform/k3s.tfvars+tofu apply) is required before kaniko can push (provisions Harbor project + CI robot). Not mentioned in Lineage. Document as blocker or open sibling ticket.project-westside-adminpage found in pal-e-docs. Create the user-stories section, or confirm under different slug.arch-woodpecker-cinote exists. Either create it, or relabel board item toarch:deployment-westside-admin(matches the issue body's Related section).No decomposition needed — single-pass agent task once scope corrected.
Scope Review v2: APPROVED
Review note:
review-1094-2026-04-25-v2(supersedesreview-1094-2026-04-25NEEDS_REFINEMENT)All previously flagged issues resolved in the refined body:
westside-admin/app(service-key prefix perservices.tf:7convention, NOT Forgejo owner)failure: ignoreexplicit on update-kustomize-tag steparch:ci-pipeline(perconvention-architecture-ids)story-westside-admin-admin-row-crudlisted inproject-westside-adminuser-stories)Ready to advance backlog → todo. No further refinement needed.
PR opened: #11
.woodpecker.yamlmirrors westside-app sibling pattern with admin-specific substitutions (westside-admin/appHarbor repo,westside-adminoverlay,failure: ignoreon tag bump, 5-attempt clone retry). YAML parse-validated.