[Ch 9] CI/CD — add lint, security scan, and test steps #18

New issue

Open

opened 2026-08-01 19:03:09 +00:00 by ldraney · 1 comment

ldraney commented

2026-08-01 19:03:09 +00:00

Owner

Type

Feature

Lineage

Standalone — scoped from platform-playbook chapter 9 for the full-stack mdview vision.

Repo

ldraney/mdview

User Story

As a developer
I want CI to run lint and security scans before building
So that code quality and security issues are caught before deploy

Context

The current .woodpecker.yaml only builds and pushes the Docker image. rubocop, brakeman, and bundler-audit gems are in the Gemfile but not run in CI. This ticket adds those steps and gates the build on them passing.

File Targets

.woodpecker.yaml — add lint step with rubocop, brakeman, bundler-audit before build-and-push

Files the agent should NOT touch:

Dockerfile — no changes needed
Gemfile — gems already present

Feature Flag

none

Acceptance Criteria

rubocop runs in CI and passes
brakeman runs in CI with no high-severity findings
bundler-audit runs in CI
build-and-push depends on lint step passing

Test Expectations

No unit tests — CI pipeline change
Run command: trigger Woodpecker pipeline on push to main

Constraints

Use harbor.tail5b443a.ts.net/library/rails-base:latest as the lint step image
Follow landscaping-assistant CI pattern

Checklist

PR opened
Tests pass
No unrelated changes

project-mdview — project this affects

### Type Feature ### Lineage Standalone — scoped from platform-playbook chapter 9 for the full-stack mdview vision. ### Repo `ldraney/mdview` ### User Story As a developer I want CI to run lint and security scans before building So that code quality and security issues are caught before deploy ### Context The current `.woodpecker.yaml` only builds and pushes the Docker image. rubocop, brakeman, and bundler-audit gems are in the Gemfile but not run in CI. This ticket adds those steps and gates the build on them passing. ### File Targets - `.woodpecker.yaml` — add lint step with rubocop, brakeman, bundler-audit before build-and-push Files the agent should NOT touch: - `Dockerfile` — no changes needed - `Gemfile` — gems already present ### Feature Flag none ### Acceptance Criteria - [ ] rubocop runs in CI and passes - [ ] brakeman runs in CI with no high-severity findings - [ ] bundler-audit runs in CI - [ ] build-and-push depends on lint step passing ### Test Expectations - [ ] No unit tests — CI pipeline change - Run command: trigger Woodpecker pipeline on push to main ### Constraints - Use `harbor.tail5b443a.ts.net/library/rails-base:latest` as the lint step image - Follow landscaping-assistant CI pattern ### Checklist - [ ] PR opened - [ ] Tests pass - [ ] No unrelated changes ### Related - `project-mdview` — project this affects

ldraney added the

phase:1

label

2026-08-01 20:21:18 +00:00

ldraney commented

2026-08-01 20:24:01 +00:00

Author

Owner

Scope Review: NEEDS_REFINEMENT

Review note: review-1949-2026-08-01

Template is complete and file targets verified, but three issues need resolution before this is agent-ready:

[SCOPE] Architecture note arch-mdview-app does not exist in pal-e-docs. Create it to satisfy traceability.
[BODY] Image name conflict in Constraints: specifies rails-base:latest but the landscaping-assistant pattern (also referenced) uses ruby-rails-build:latest. Clarify which image to use.
[BODY] Missing bundle-install step: the landscaping-assistant CI pattern has a separate bundle-install step that copies pre-cached gems before lint runs. Without it, rubocop/brakeman/bundler-audit won't be available. Either add the step to the spec or confirm the lint image has gems pre-installed.

## Scope Review: NEEDS_REFINEMENT Review note: `review-1949-2026-08-01` Template is complete and file targets verified, but three issues need resolution before this is agent-ready: - **[SCOPE]** Architecture note `arch-mdview-app` does not exist in pal-e-docs. Create it to satisfy traceability. - **[BODY]** Image name conflict in Constraints: specifies `rails-base:latest` but the landscaping-assistant pattern (also referenced) uses `ruby-rails-build:latest`. Clarify which image to use. - **[BODY]** Missing `bundle-install` step: the landscaping-assistant CI pattern has a separate bundle-install step that copies pre-cached gems before lint runs. Without it, rubocop/brakeman/bundler-audit won't be available. Either add the step to the spec or confirm the lint image has gems pre-installed.