Add an explicit ArgoCD sync and health-poll script

.github/workflows/helm-chart.yml

@@ -27,12 +27,21 @@ jobs:
         run: |
           helm template default infra/helm/medical-chatbot > /tmp/default.yaml
 
+          # values-production.yaml turns authService/apiGateway on, and their
+          # jwt-secret Secret key is `required` with no default -- real values
+          # only ever exist inline on the live Application, never in Git (see
+          # the comment on secret.jwtSecret in values-production.yaml). This
+          # placeholder exists purely so these renders reach the assertion
+          # they're actually testing (the image-tag guard) instead of failing
+          # on an unrelated missing secret; it is never applied to a cluster.
+          CI_JWT_SECRET=ci-render-only-not-a-real-secret
+
           # The live releases carry no image tag in Git -- it is supplied per
           # deploy as a commit SHA through the ArgoCD Application. Rendering
           # with an empty tag must FAIL rather than fall back to the chart's
           # `local` development tag, so assert the failure directly; otherwise
           # the guard could rot into a silent default unnoticed.
-          if helm template production infra/helm/medical-chatbot                --values infra/helm/medical-chatbot/values-production.yaml                --set aiService.image.tag=""                --set web.image.tag=""                > /tmp/untagged.yaml 2>/tmp/untagged.err; then
+          if helm template production infra/helm/medical-chatbot                --values infra/helm/medical-chatbot/values-production.yaml                --set secret.jwtSecret="$CI_JWT_SECRET"                --set aiService.image.tag=""                --set web.image.tag=""                > /tmp/untagged.yaml 2>/tmp/untagged.err; then
             echo "::error::render succeeded with no image tag; the immutable-tag guard is gone"
             exit 1
           fi
@@ -40,7 +49,7 @@ jobs:
 
           # ...and with a tag it must resolve the GHCR package, not the local
           # development image name.
-          helm template production infra/helm/medical-chatbot             --values infra/helm/medical-chatbot/values-production.yaml             --set aiService.image.repository=ghcr.io/baovu2k4/vsf-duocthu-ai-service             --set web.image.repository=ghcr.io/baovu2k4/vsf-duocthu-web             --set aiService.image.tag="$GITHUB_SHA"             --set web.image.tag="$GITHUB_SHA"             > /tmp/tagged.yaml
+          helm template production infra/helm/medical-chatbot             --values infra/helm/medical-chatbot/values-production.yaml             --set secret.jwtSecret="$CI_JWT_SECRET"             --set aiService.image.repository=ghcr.io/baovu2k4/vsf-duocthu-ai-service             --set web.image.repository=ghcr.io/baovu2k4/vsf-duocthu-web             --set aiService.image.tag="$GITHUB_SHA"             --set web.image.tag="$GITHUB_SHA"             > /tmp/tagged.yaml
           grep -q "image: \"ghcr.io/baovu2k4/vsf-duocthu-ai-service:$GITHUB_SHA\"" /tmp/tagged.yaml
           grep -q "image: \"ghcr.io/baovu2k4/vsf-duocthu-web:$GITHUB_SHA\"" /tmp/tagged.yaml
 
@@ -48,8 +57,11 @@ jobs:
       # contract is asserted here rather than trusted by review.
       - name: Render the live production manifests
         run: |
+          # See the same placeholder note in the previous step -- real secret
+          # material never enters Git and this is a render-only dry run.
           helm template medical-chatbot-app infra/helm/medical-chatbot \
             --values infra/helm/medical-chatbot/values-production.yaml \
+            --set secret.jwtSecret=ci-render-only-not-a-real-secret \
             > /tmp/prod-app.yaml
           helm template medical-chatbot-data infra/helm/medical-chatbot \
             --values infra/helm/medical-chatbot/values-production-data.yaml \

.github/workflows/inspect-argocd-app.yml

@@ -0,0 +1,22 @@
+name: Inspect ArgoCD Application (read-only)
+
+# One-off diagnostic to see the live medical-chatbot-app Application's inline
+# helm values before writing a script that edits them (adding secret.jwtSecret
+# alongside the existing secret.grafanaAdminPassword). Read-only: only calls
+# GET on the ArgoCD API, never PUT or sync.
+
+on:
+  workflow_dispatch: {}
+
+jobs:
+  inspect:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - name: Inspect live Application
+        env:
+          ARGOCD_PRACTICE_URL: ${{ secrets.ARGOCD_PRACTICE_URL }}
+          ARGOCD_PRACTICE_PASSWORD: ${{ secrets.ARGOCD_PRACTICE_PASSWORD }}
+        run: python3 .github/scripts/inspect_argocd_app.py

.github/workflows/sync-argocd-app.yml

@@ -0,0 +1,25 @@
+name: Sync ArgoCD Application and report health
+
+# Yesterday's session left the live medical-chatbot-app Application with
+# secret.jwtSecret + authService/apiGateway enabled set inline (via manual
+# ArgoCD UI edits) but no explicit sync afterward -- health is Synced/
+# Degraded with a stuck ai-service/web rollout using the chart's default
+# (nonexistent) image. This forces one explicit sync (same action as the
+# UI's SYNC button) and polls health afterward so we see the real result
+# instead of guessing.
+
+on:
+  workflow_dispatch: {}
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - name: Sync and report
+        env:
+          ARGOCD_PRACTICE_URL: ${{ secrets.ARGOCD_PRACTICE_URL }}
+          ARGOCD_PRACTICE_PASSWORD: ${{ secrets.ARGOCD_PRACTICE_PASSWORD }}
+        run: python3 .github/scripts/sync_and_report_argocd_app.py