Publish manifests

Goal: the manifests branch matches workloads/, and Argo CD has synced it. About 3 minutes.

app/ is gitignored: manifests are never committed from a laptop. CI synthesizes them and force-pushes the result to <branch>-manifests, which manifests_branch in config.yml selects.

Procedure

just synth   # optional: confirm it synthesizes before pushing
git push

cdk8s-seal-publish.yml runs on pushes to main and v* branches that touch workloads/, and when a v* branch is created.

A push outside workloads/ publishes nothing

Commits that only touch core/, docs/ or config/ do not trigger the workflow. Run it by hand from the Actions tab (workflow_dispatch) if the manifests branch must refresh.

CI blocks rendered Secrets

The manifests branch is public. manifest-secret-guard.sh fails the run if synthesis emits a Secret payload not in the allowlist.

Check

kubectl get applications -n argocd

Every application Synced. With argocd_manual_sync: true in config.yml, sync one app at a time with just argocd-sync <app> instead.

Details: GitOps, CDK8s.