Infra CI/CD Pipeline

Woodpecker CI — gated push-to-main deploy chain vs. flat, ungated PR validation

Infra CI/CD Pipeline Woodpecker CI — gated push-to-main deploy chain vs. flat, ungated PR validation 01 / Push to main (phonewave) 02 / LLM host (any Pi) 03 / Operation Skuld (light tier) 04 / Pull Request (phonewave) Gated — each stage blocks the next Flat — nothing blocks, dry-run + code audit Push to main · or manual · Push to main (phonewave) Push to main or manual Syntax · lint + ansible + suites · Push to main (phonewave) › Gated — each stage blocks the next · blocking gate Syntax lint + ansible + suites blocking gate deploy-pis · converge Pis · Push to main (phonewave) › Gated — each stage blocks the next · phonewave deploy-pis converge Pis phonewave docker-host · build + converge · Push to main (phonewave) › Gated — each stage blocks the next · unit-2 / unit-3 docker-host build + converge unit-2 / unit-3 deploy-llm · converge LLM · LLM host (any Pi) · any Pi deploy-llm converge LLM any Pi op-skuld · quiet skip · Operation Skuld (light tier) · if kit's away op-skuld quiet skip if kit's away Pull Request · opened/synced · Pull Request (phonewave) Pull Request opened/synced Validate · dry-runs + fallow audit · Pull Request (phonewave) › Flat — nothing blocks, dry-run + code audit · check mode Validate dry-runs + fallow audit check mode Service CI · 6 workflows · Pull Request (phonewave) › Flat — nothing blocks, dry-run + code audit · path-filtered Service CI 6 workflows path-filtered Continuity CI · handout build · Pull Request (phonewave) › Flat — nothing blocks, dry-run + code audit · if changed Continuity CI handout build if changed Legend Agent logic Policy Cloud service External system

Convergence Refs Guard Every Deploy

  • • Each deploy diffs its own refs/deployed/* ref before touching a host
  • • Back-to-back merges can never drop a deploy
  • • operation-skuld Quiet Skips green while the kit is away instead of failing red

Gated Chain vs. Flat Validation

  • • Push to main is a strict dependency chain: syntax-check blocks deploy-pis, deploy-pis blocks the three deploys that may run on a Pi agent
  • • Pull requests run every dry-run and every service check in parallel with no gate
  • • A PR only ever reports a diff — it never touches a real host
  • • validate-pr also runs fallow audit on the TypeScript services: only dead code, duplication or complexity the PR introduces fails it, inherited debt is reported, not blocked

One Build Feeds Two Static Sites

  • • converge-check decides first, then generate-docs and generate-continuity run before the ansible converge, chained rather than parallel to avoid a pnpm install race
  • • Both generators bow out when that decision is a skip, so a Quiet Skip builds nothing
  • • Their output ships docs.phyberapex.de (zukan) and continuity.phyberapex.de (sonae)
  • • validate-pr runs the same two builds so a stale generator never merges unnoticed