Team workflow
| Tool |
Role |
URL |
| Plane |
Issues, Kanban, sprints |
https://pm.rafaelgonzalezalbes.com |
| Forgejo |
Git repos, PRs |
https://git.rafaelgonzalezalbes.com |
| Woodpecker |
CI/CD pipelines |
https://ci.rafaelgonzalezalbes.com |
| DefectDojo |
Security findings dashboard |
https://security.rafaelgonzalezalbes.com |
Issue workflow (Plane)
- Create issue in Plane — use project key prefix (e.g.
BIOS-12)
- Add to Cycle (sprint) when planning
- Move card on Kanban: Backlog → In Progress → Review → Done
- Close issue when deployed — reference in commit:
fixes BIOS-12
Issue types
- Bug — something broken in production or dev
- Story — user-facing feature
- Task — technical work (infra, refactor, docs)
Git workflow (Forgejo)
Branch naming
feature/BIOS-42-short-description
bugfix/BIOS-51-fix-scanner-crash
hotfix/BIOS-99-urgent-patch
Pull request rules
- One issue per branch when possible
- PR title:
[BIOS-42] Add barcode validation
- Require 1 approval before merge
- CI must pass (Woodpecker green) before merge
- Squash merge to
main for clean history
Commit messages
BIOS-42: validate EAN-13 checksum before lookup
fixes BIOS-42
CI/CD pipeline (Woodpecker)
On every push / PR
| Step |
What it does |
| gitleaks |
Scan for leaked secrets (blocks merge on hit) |
| trivy-fs |
Scan dependencies and configs for HIGH/CRITICAL CVEs |
| upload-defectdojo |
Send reports to security dashboard |
| install |
npm ci, build mcp-server |
| test |
Run frontend + mcp-server tests |
| build |
npm run build (Vite production bundle) |
| notify-ci-* |
Post CI status comment to linked Plane issue (BIOS-N in branch) |
On merge to main only
| Step |
Target |
Method |
| deploy-frontend |
Shared web hosting |
SFTP upload of dist/ |
| build-push-backend |
Forgejo container registry |
Docker image |
| deploy-backend |
VPS |
SSH + docker compose up -d |
Required Woodpecker secrets (per repo)
| Secret |
Used for |
ftp_host |
Web hosting hostname |
ftp_user |
FTP/SFTP username |
ftp_pass |
FTP/SFTP password |
frontend_remote_path |
Remote directory |
docker_registry_user |
Forgejo username |
docker_registry_token |
Forgejo personal access token (packages:write) |
ssh_host |
VPS IP or hostname |
ssh_user |
Deploy user on VPS |
ssh_key |
Private SSH key for deploy |
plane_api_key |
Plane CI notifications |
defectdojo_url |
DefectDojo base URL |
defectdojo_api_key |
DefectDojo API token |
defectdojo_engagement_id |
Per-repo engagement for scan uploads |
ci_webhook_url |
Discord bot /webhook/ci-failure (general pipeline failures) |
security_webhook_secret |
Bearer token for CI/security Discord webhooks |
Mark the repository as Trusted in Woodpecker to use deployment secrets.
Red CI: Discord alerts + Cursor
When a Woodpecker pipeline fails, the notify-discord-ci step posts to Discord:
| Repo |
Channel |
infra/devops |
#infra |
*/portfolio |
#portfolio |
| other (e.g. wearlab) |
#ci |
Security-gate failures skip the general alert (#security handles those).
In Cursor, .cursor/rules/ci-red-pipeline.mdc tells the agent to check Woodpecker via MCP, fix the root cause, and confirm green CI after pushes to main.
Deployment targets
- Frontend (React/Vite) → IONOS via SFTP
- Backend (mcp-server) → VPS Docker
New project checklist
- Run
bash scripts/onboard-project.sh (see Onboard project)
- Create Forgejo repo under org
- Copy Woodpecker template + notify steps
- Push
main, verify pipeline + Plane link
Roles
| Role |
Plane |
Forgejo |
Woodpecker |
| Admin |
Workspace admin |
Org owner |
Server admin |
| Developer |
Member |
Write access |
Activate own repos |
| Reviewer |
Member |
Write + approve PRs |
View pipelines |
Getting help
- Platform docs: https://docs.rafaelgonzalezalbes.com
- Backups: restic, run nightly at 03:00 by
restic-backup.timer (systemd, installed by ansible/roles/infra-backups). See Backup & restore.