From aea0ccbbf71ff6bbe791490331c226cebade011e Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Fri, 21 Aug 2026 21:57:23 -0700
Subject: [PATCH] feat(argocd): register poimen-workflows Application, tighten
 sourceRepos

Adds the Application for the poimen-workflows Temporal worker under the
poimen AppProject, and narrows sourceRepos from the rock/* wildcard to
an explicit allowlist (only repos with a registered Application belong
here).
---
 k8s/argocd/poimen-workflows.yaml | 29 +++++++++++++++++++++++++++++
 k8s/argocd/root.yaml             |  5 ++++-
 2 files changed, 33 insertions(+), 1 deletion(-)
 create mode 100644 k8s/argocd/poimen-workflows.yaml

diff --git a/k8s/argocd/poimen-workflows.yaml b/k8s/argocd/poimen-workflows.yaml
new file mode 100644
index 0000000..a86bfcb
--- /dev/null
+++ b/k8s/argocd/poimen-workflows.yaml
@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: poimen-workflows
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: poimen-workflows
+    app.kubernetes.io/component: orchestrator
+spec:
+  project: poimen
+  source:
+    repoURL: https://forgejo.riotpiao.com/rock/poimen-workflows.git
+    targetRevision: main
+    path: k8s
+    plugin:
+      name: kustomize
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: poimen
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    retry:
+      limit: 5
+      backoff:
+        duration: 5s
+        factor: 2
+        maxDuration: 3m
diff --git a/k8s/argocd/root.yaml b/k8s/argocd/root.yaml
index 21c7595..3b6ee07 100644
--- a/k8s/argocd/root.yaml
+++ b/k8s/argocd/root.yaml
@@ -4,8 +4,11 @@ metadata:
   name: poimen
   namespace: argocd
 spec:
+  # Explicit allowlist, not the 'rock/*' wildcard -- only repos with an actual
+  # Application under this project belong here. Add a line here when (and only
+  # when) a new Application is registered.
   sourceRepos:
-  - 'https://forgejo.riotpiao.com/rock/*'
+  - 'https://forgejo.riotpiao.com/rock/poimen-workflows.git'
   destinations:
   - namespace: 'poimen'
     server: https://kubernetes.default.svc