Add an explicit ArgoCD sync and health-poll script

.github/workflows/helm-chart.yml

@@ -27,12 +27,21 @@ jobs:
         run: |
           helm template default infra/helm/medical-chatbot > /tmp/default.yaml
 
+          # values-production.yaml turns authService/apiGateway on, and their
+          # jwt-secret Secret key is `required` with no default -- real values
+          # only ever exist inline on the live Application, never in Git (see
+          # the comment on secret.jwtSecret in values-production.yaml). This
+          # placeholder exists purely so these renders reach the assertion
+          # they're actually testing (the image-tag guard) instead of failing
+          # on an unrelated missing secret; it is never applied to a cluster.
+          CI_JWT_SECRET=ci-render-only-not-a-real-secret
+
           # The live releases carry no image tag in Git -- it is supplied per
           # deploy as a commit SHA through the ArgoCD Application. Rendering
           # with an empty tag must FAIL rather than fall back to the chart's
           # `local` development tag, so assert the failure directly; otherwise
           # the guard could rot into a silent default unnoticed.
-          if helm template production infra/helm/medical-chatbot                --values infra/helm/medical-chatbot/values-production.yaml                --set aiService.image.tag=""                --set web.image.tag=""                > /tmp/untagged.yaml 2>/tmp/untagged.err; then
+          if helm template production infra/helm/medical-chatbot                --values infra/helm/medical-chatbot/values-production.yaml                --set secret.jwtSecret="$CI_JWT_SECRET"                --set aiService.image.tag=""                --set web.image.tag=""                > /tmp/untagged.yaml 2>/tmp/untagged.err; then
             echo "::error::render succeeded with no image tag; the immutable-tag guard is gone"
             exit 1
           fi
@@ -40,7 +49,7 @@ jobs:
 
           # ...and with a tag it must resolve the GHCR package, not the local
           # development image name.
-          helm template production infra/helm/medical-chatbot             --values infra/helm/medical-chatbot/values-production.yaml             --set aiService.image.repository=ghcr.io/baovu2k4/vsf-duocthu-ai-service             --set web.image.repository=ghcr.io/baovu2k4/vsf-duocthu-web             --set aiService.image.tag="$GITHUB_SHA"             --set web.image.tag="$GITHUB_SHA"             > /tmp/tagged.yaml
+          helm template production infra/helm/medical-chatbot             --values infra/helm/medical-chatbot/values-production.yaml             --set secret.jwtSecret="$CI_JWT_SECRET"             --set aiService.image.repository=ghcr.io/baovu2k4/vsf-duocthu-ai-service             --set web.image.repository=ghcr.io/baovu2k4/vsf-duocthu-web             --set aiService.image.tag="$GITHUB_SHA"             --set web.image.tag="$GITHUB_SHA"             > /tmp/tagged.yaml
           grep -q "image: \"ghcr.io/baovu2k4/vsf-duocthu-ai-service:$GITHUB_SHA\"" /tmp/tagged.yaml
           grep -q "image: \"ghcr.io/baovu2k4/vsf-duocthu-web:$GITHUB_SHA\"" /tmp/tagged.yaml
 
@@ -48,8 +57,11 @@ jobs:
       # contract is asserted here rather than trusted by review.
       - name: Render the live production manifests
         run: |
+          # See the same placeholder note in the previous step -- real secret
+          # material never enters Git and this is a render-only dry run.
           helm template medical-chatbot-app infra/helm/medical-chatbot \
             --values infra/helm/medical-chatbot/values-production.yaml \
+            --set secret.jwtSecret=ci-render-only-not-a-real-secret \
             > /tmp/prod-app.yaml
           helm template medical-chatbot-data infra/helm/medical-chatbot \
             --values infra/helm/medical-chatbot/values-production-data.yaml \