CI/CD

This project uses GitHub Actions to build container images and deploy changes via Argo CD. The two relevant workflows are: - build.yml: main build-and-deploy pipeline - sync-argocd.yml: manual Argo CD sync helper

Build pipeline (build.yml)

Triggers - Push events, releases (published), and manual runs (workflow_dispatch)

Runner selection - A preliminary job checks whether a self-hosted-linux runner is online using secrets.GH_LIST_RUNNERS_TOKEN - If available: runs the use-self-hosted job; otherwise falls back to use-github-hosted

Build metadata - Both build jobs checkout with full history and compute: - build_tag: sanitized branch (lowercase, non-alphanumerics removed). Release tags are kept as-is - sha_short and date for provenance - original_branch for downstream logic

Build action - Both jobs invoke ./.github/actions/build (composite action) which is responsible for: - building the project - producing the container image - pushing the image to GHCR with the computed build_tag

Diagram

flowchart TD A[Trigger] --> B[Select runner] B -->|Self-hosted| C[Build] B -->|GitHub-hosted| C C --> D[Push image to GHCR] D --> E[Deploy job] E --> F[Argo CD deploy] F --> G[Update image tag and sync]

Deploy job - Runs if either build job succeeds - Invokes ./.github/actions/deploy with: - argocd-server: ${{ vars.ARGOCD_SERVER || 'https://argo.swapps.live' }} - argocd-token: ${{ secrets.ARGOCD_TOKEN }} - build-tag, repository-name, commit-message, original-branch - clickup-token: ${{ secrets.CLICKUP_TOKEN }} - The deploy action applies the new image tag to the target Argo CD application and syncs it

Secrets/variables used - secrets.GH_LIST_RUNNERS_TOKEN: query org runners - secrets.GITHUB_TOKEN: used by the build action - secrets.ARGOCD_TOKEN: Argo CD API token for deploy - vars.ARGOCD_SERVER: Argo endpoint (defaults to https://argo.swapps.live) - secrets.CLICKUP_TOKEN: forwarded into the deploy action

Manual Argo CD sync (sync-argocd.yml)

Purpose - Trigger a sync against the target Argo CD app without performing a new build - Useful for re-applying the latest image or doing a dry-run

Inputs - branch (optional): branch to sync; if omitted, auto-detected - dry_run (boolean): preview changes without applying - force_recreate (boolean): restart pods post-sync

Flow 1. Determine branch and compute build_tag using the same sanitization logic as build.yml 2. Resolve the Argo CD application name from the build_tag (e.g., master → idk-dev; semantic version tags → idk-prod; or idk-<build_tag> fallback) 3. If dry_run=true, call Argo CD /applications/{app}/sync with dryRun via curl and show HTTP status/body 4. Otherwise use ./.github/actions/deploy with the computed build_tag and branch 5. If force_recreate=true, run kubectl rollout restart for all deployments in the derived namespace and wait for rollouts to complete

Diagram

flowchart TD A[Inputs] --> B[Compute build tag] B --> C[Resolve application] C --> D{Dry run?} D -->|Yes| E[Argo dry-run sync] D -->|No| F[Deploy action] F --> G[Application synced] G --> H{Force recreate?} H -->|Yes| I[Rollout restart] H -->|No| J[Done] I --> J

Requirements - Runner: self-hosted-linux - Secrets: secrets.ARGOCD_TOKEN; Vars: vars.ARGOCD_SERVER

TL;DR

  • CI builds/pushes an image tagged by sanitized branch name (or release tag), then deploys via Argo CD
  • You can re-sync or preview deployments without rebuilding using the manual sync-argocd.yml workflow