Add Woodpecker CI pipeline

forgejo_admin commented

2026-05-10 15:55:48 +00:00

Contributor

Summary

Adds a Woodpecker CI pipeline that builds the Docker image via Kaniko and pushes to Harbor on merge to main, then triggers a kustomize tag update for ArgoCD deployment.

Changes

.woodpecker.yaml -- new CI pipeline with clone, build-and-push, and update-kustomize-tag steps

Design Decisions

No test step: No test suite exists yet (test/ and spec/ directories are absent). Adding a fake test step would be misleading.
No PR-only steps: Without tests or linting to run, there are no useful PR-gate steps yet. The pipeline triggers on PRs for future extensibility but currently only the clone step runs on PR events.
Harbor registry URL: Uses harbor.harbor.svc.cluster.local consistent with all existing pipelines (basketball-api, westside-admin, pal-e-docs, pal-e-app, pal-e-mail).
Image repo: pal-enterprises/app per the var.services entry referenced in issue #7.
update-kustomize-tag: Included to match basketball-api and westside-admin conventions -- downloads the canonical script from pal-e-platform and updates the kustomize overlay so ArgoCD picks up the new image tag.
Simple clone step: No forgejo_token/netrc needed in clone (matches basketball-api/westside-admin pattern for repos cloned via internal Forgejo HTTP).

Test Plan

Activate repo in Woodpecker UI
Add harbor_username and harbor_password secrets in Woodpecker
Add forgejo_token secret in Woodpecker
Merge PR and verify pipeline succeeds
Verify image appears in Harbor pal-enterprises/app project
Verify kustomize overlay is updated in pal-e-deployments

Review Checklist

Follows existing Woodpecker pipeline conventions from sibling repos
No unrelated changes
Harbor image repo matches var.services config (pal-enterprises/app)
Harbor project exists in Harbor (created by tofu apply)
Woodpecker secrets configured (manual gate)

None.

Closes #7

## Summary Adds a Woodpecker CI pipeline that builds the Docker image via Kaniko and pushes to Harbor on merge to main, then triggers a kustomize tag update for ArgoCD deployment. ## Changes - `.woodpecker.yaml` -- new CI pipeline with clone, build-and-push, and update-kustomize-tag steps ## Design Decisions - **No test step**: No test suite exists yet (`test/` and `spec/` directories are absent). Adding a fake test step would be misleading. - **No PR-only steps**: Without tests or linting to run, there are no useful PR-gate steps yet. The pipeline triggers on PRs for future extensibility but currently only the clone step runs on PR events. - **Harbor registry URL**: Uses `harbor.harbor.svc.cluster.local` consistent with all existing pipelines (basketball-api, westside-admin, pal-e-docs, pal-e-app, pal-e-mail). - **Image repo**: `pal-enterprises/app` per the `var.services` entry referenced in issue #7. - **update-kustomize-tag**: Included to match basketball-api and westside-admin conventions -- downloads the canonical script from pal-e-platform and updates the kustomize overlay so ArgoCD picks up the new image tag. - **Simple clone step**: No forgejo_token/netrc needed in clone (matches basketball-api/westside-admin pattern for repos cloned via internal Forgejo HTTP). ## Test Plan - [ ] Activate repo in Woodpecker UI - [ ] Add `harbor_username` and `harbor_password` secrets in Woodpecker - [ ] Add `forgejo_token` secret in Woodpecker - [ ] Merge PR and verify pipeline succeeds - [ ] Verify image appears in Harbor `pal-enterprises/app` project - [ ] Verify kustomize overlay is updated in pal-e-deployments ## Review Checklist - [x] Follows existing Woodpecker pipeline conventions from sibling repos - [x] No unrelated changes - [x] Harbor image repo matches `var.services` config (`pal-enterprises/app`) - [ ] Harbor project exists in Harbor (created by `tofu apply`) - [ ] Woodpecker secrets configured (manual gate) ## Related Notes None. ## Related Closes #7

forgejo_admin added 1 commit

2026-05-10 15:55:48 +00:00

Add Woodpecker CI pipeline for Docker build and push 78496c15b7

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

forgejo_admin commented

2026-05-10 15:56:47 +00:00

Author

Contributor

PR Review -- `.woodpecker.yaml`

Acceptance Criteria Check

Criterion	Status
`.woodpecker.yaml` exists in repo root	PASS
Pushes `pal-enterprises/app:{SHA}` tag on merge to main	PASS
Uses internal Harbor URL per SOP	SEE NOTE

Findings

Harbor URL discrepancy (low severity, informational)

Issue #7 specifies harbor-core.harbor.svc.cluster.local but this PR uses harbor.harbor.svc.cluster.local. The PR follows the convention from all 5 existing working pipelines (basketball-api, westside-admin, pal-e-docs, pal-e-app, pal-e-mail) which all use harbor.harbor.svc.cluster.local. The issue text may contain a typo -- harbor-core is typically the internal Harbor API component, not the registry endpoint Kaniko pushes to. No change recommended unless the SOP explicitly requires harbor-core.

Pipeline structure: correct

Clone step matches the simple pattern (basketball-api, pal-e-mail) -- no forgejo_token in clone since the repo is public.
build-and-push step uses Kaniko plugin v2.3.0, consistent with all sibling repos.
update-kustomize-tag step follows the canonical pattern from basketball-api/westside-admin with retry logic and test -s guard.
Correct depends_on chain: update-kustomize-tag depends on build-and-push.
Both deploy steps correctly gated to event: push, branch: main.

No test step: appropriate

No test/ or spec/ directory exists in the repo. Omitting a test step avoids false confidence.

No issues found with:

Secret references (harbor_username, harbor_password, forgejo_token)
OVERLAY value (pal-enterprises) matches expected kustomize overlay name
IMAGE_TAG uses ${CI_COMMIT_SHA} consistently
when filters are correct (PR events trigger clone only, push-to-main triggers full pipeline)

VERDICT: APPROVE

Pipeline follows established conventions exactly. The Harbor URL matches all working pipelines. Ready to merge after manual gates (Woodpecker activation, secrets configuration).

## PR Review -- `.woodpecker.yaml` ### Acceptance Criteria Check | Criterion | Status | |-----------|--------| | `.woodpecker.yaml` exists in repo root | PASS | | Pushes `pal-enterprises/app:{SHA}` tag on merge to main | PASS | | Uses internal Harbor URL per SOP | SEE NOTE | ### Findings **Harbor URL discrepancy (low severity, informational)** Issue #7 specifies `harbor-core.harbor.svc.cluster.local` but this PR uses `harbor.harbor.svc.cluster.local`. The PR follows the convention from all 5 existing working pipelines (basketball-api, westside-admin, pal-e-docs, pal-e-app, pal-e-mail) which all use `harbor.harbor.svc.cluster.local`. The issue text may contain a typo -- `harbor-core` is typically the internal Harbor API component, not the registry endpoint Kaniko pushes to. No change recommended unless the SOP explicitly requires `harbor-core`. **Pipeline structure: correct** - Clone step matches the simple pattern (basketball-api, pal-e-mail) -- no forgejo_token in clone since the repo is public. - `build-and-push` step uses Kaniko plugin v2.3.0, consistent with all sibling repos. - `update-kustomize-tag` step follows the canonical pattern from basketball-api/westside-admin with retry logic and `test -s` guard. - Correct `depends_on` chain: update-kustomize-tag depends on build-and-push. - Both deploy steps correctly gated to `event: push, branch: main`. **No test step: appropriate** - No `test/` or `spec/` directory exists in the repo. Omitting a test step avoids false confidence. **No issues found with:** - Secret references (`harbor_username`, `harbor_password`, `forgejo_token`) - OVERLAY value (`pal-enterprises`) matches expected kustomize overlay name - IMAGE_TAG uses `${CI_COMMIT_SHA}` consistently - `when` filters are correct (PR events trigger clone only, push-to-main triggers full pipeline) ### VERDICT: APPROVE Pipeline follows established conventions exactly. The Harbor URL matches all working pipelines. Ready to merge after manual gates (Woodpecker activation, secrets configuration).

ldraney commented

2026-05-10 16:03:29 +00:00

Owner

QA Review — PR #16

Convention Compliance

Compared against basketball-api and pal-e-docs pipelines:

Convention	Sibling repos	This PR
Clone step (sleep 2 + shallow fetch)	Yes	Yes
Test step (lint + tests)	Yes	Missing
build-and-push (Kaniko)	Yes	Yes
update-kustomize-tag	Yes	Yes
`from_secret` for credentials	Yes	Yes
`depends_on` for ordering	Yes	Yes

Pipeline structure is sound. Clone, Kaniko build, and kustomize tag update all match established platform patterns exactly.

Blocker

No test step. Every sibling repo runs tests in CI. This app has test tooling in its Gemfile (brakeman, rubocop-rails-omakase, bundler-audit) and a test database config, but none are exercised. Deploying untested code on every main push is a change failure risk.

Recommendation: Add a test step that at minimum runs bundle exec brakeman and bundle exec rubocop. If no application tests exist yet, a lint/security-scan step still provides value and establishes the pattern for when tests are written.

Nits

Consider path: exclude: ["k8s/.argocd-source-*"] on the push trigger to prevent ArgoCD feedback loops (matches basketball-api convention)
Consider a post-deploy smoke test hitting /up (matches pal-e-docs convention)

SOP Compliance

Branch named after issue
No secrets committed — all from_secret
Single file, tightly scoped
PR body follows template with test plan

VERDICT: REQUEST_CHANGES

Add a test step (brakeman + rubocop at minimum) to match platform convention, then this is ready to merge.

## QA Review — PR #16 ### Convention Compliance Compared against `basketball-api` and `pal-e-docs` pipelines: | Convention | Sibling repos | This PR | |---|---|---| | Clone step (sleep 2 + shallow fetch) | Yes | Yes | | Test step (lint + tests) | Yes | **Missing** | | build-and-push (Kaniko) | Yes | Yes | | update-kustomize-tag | Yes | Yes | | `from_secret` for credentials | Yes | Yes | | `depends_on` for ordering | Yes | Yes | Pipeline structure is sound. Clone, Kaniko build, and kustomize tag update all match established platform patterns exactly. ### Blocker **No test step.** Every sibling repo runs tests in CI. This app has test tooling in its Gemfile (brakeman, rubocop-rails-omakase, bundler-audit) and a test database config, but none are exercised. Deploying untested code on every main push is a change failure risk. **Recommendation:** Add a test step that at minimum runs `bundle exec brakeman` and `bundle exec rubocop`. If no application tests exist yet, a lint/security-scan step still provides value and establishes the pattern for when tests are written. ### Nits 1. Consider `path: exclude: ["k8s/.argocd-source-*"]` on the push trigger to prevent ArgoCD feedback loops (matches basketball-api convention) 2. Consider a post-deploy smoke test hitting `/up` (matches pal-e-docs convention) ### SOP Compliance - [x] Branch named after issue - [x] No secrets committed — all `from_secret` - [x] Single file, tightly scoped - [x] PR body follows template with test plan ### VERDICT: REQUEST_CHANGES Add a test step (brakeman + rubocop at minimum) to match platform convention, then this is ready to merge.