Companion to the existing GHA pipeline that pushes broker-sync to
DockerHub. The Woodpecker build pushes to Forgejo as wealthfolio-sync
(image name kept to match the existing infra/stacks/wealthfolio/main.tf
CronJob reference, which has been broken since registry-private lost
the image).
Context
-------
Matches the pattern used by claude-memory-mcp (infra CLAUDE.md §CI/CD).
GHA is cheap and parallel — build+push happens there. Woodpecker runs
in-cluster and has kubectl access, so it owns the `kubectl set image`
step.
This change
-----------
- `.github/workflows/ci.yml` — push to main runs ruff + mypy strict +
pytest, then builds `viktorbarzin/broker-sync:<8-char-sha>` +
`:latest` and pushes to DockerHub, then triggers Woodpecker.
- `.woodpecker/deploy.yml` — kubectl set image on all 5 CronJobs in
the broker-sync namespace (version probe + 4 sync jobs), then
spawns a one-shot Job from the version CronJob as a smoke test
and waits for completion.
- Woodpecker repo ID is `TBD` — needs filling in once the repo is
registered with Woodpecker (see infra CLAUDE.md Repo IDs list).
The workflow skips deploy cleanly if still TBD, so this doesn't
block green builds.
Test plan
---------
## Automated
Nothing to run locally — CI is verified by pushing and watching the
run on GitHub.
## Manual Verification
1. Push this branch to GitHub, confirm `test` job runs and passes.
2. Push to `main`, confirm `build` job produces
`viktorbarzin/broker-sync:<sha>` on DockerHub.
3. Register repo with Woodpecker, note the numeric repo ID, replace
`TBD` in ci.yml, push again.
4. Confirm Woodpecker deploy pipeline runs `kubectl set image` on
all 5 CronJobs and the smoke-test job returns `broker-sync 0.1.0`.
