fix: 28 ApplicationSets pinned main while app-of-apps tracked the revision

.github/workflows/ci.yml

@@ -145,6 +145,21 @@ jobs:
       - name: Every platform CR the catalog declares would be admitted
         run: ./scripts/check-platform-crs.py --list
 
+  catalog-revision:
+    name: a catalog source reads its revision, never pins one
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - name: Install pyyaml
+        run: pip install pyyaml
+      # cluster-bootstrap stamps gitops/repo-branch beside gitops/repo-url. Only
+      # app-of-apps ever read it, so a cluster bootstrapped against any other
+      # revision ran app-of-apps there and every child Application on main — two
+      # revisions of the catalog at once, both reporting Synced and Healthy.
+      - name: Catalog sources read gitops/repo-branch
+        run: ./scripts/check-catalog-revision.py --list
+
   kyverno:
     name: Kyverno policy tests
     runs-on: ubuntu-latest
@@ -610,6 +625,7 @@ jobs:
         dashboards,
         serviceaccount-bindings,
         platform-crs,
+        catalog-revision,
         kyverno,
         fork-safety,
         helm-render,

applicationsets/addons-agent-operator.yaml

@@ -45,7 +45,7 @@ spec:
       project: platform
       sources:
         # A published chart at a version, not a branch. Rendering from
-        # `targetRevision: main` meant there was no release boundary at all
+        # `targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'` meant there was no release boundary at all
         # between a merge upstream and every cluster this ApplicationSet syncs —
         # a chart change reached production the moment it landed, and a chart
         # could ship a CRD field the operator image it names does not
@@ -90,7 +90,7 @@ spec:
               - $values/addons/ai-platform/operator/values.yaml
               - $values/addons/ai-platform/operator/values-{{ index .metadata.labels "environment" }}.yaml
         - repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-          targetRevision: main
+          targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
           ref: values
       destination:
         server: https://kubernetes.default.svc

applicationsets/addons-ai-platform-kustomize.yaml

@@ -46,7 +46,7 @@ spec:
       project: platform
       source:
         repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-        targetRevision: main
+        targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
         path: '{{ .path }}/overlays/{{ index .metadata.labels "environment" }}'
       destination:
         server: https://kubernetes.default.svc

applicationsets/addons-ai-platform.yaml

@@ -76,7 +76,7 @@ spec:
               - $values/{{ .path }}/values.yaml
               - $values/{{ .path }}/values-{{ index .metadata.labels "environment" }}.yaml
         - repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-          targetRevision: main
+          targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
           ref: values
       destination:
         server: https://kubernetes.default.svc

applicationsets/addons-argo-platform.yaml

@@ -64,7 +64,7 @@ spec:
               - $values/{{ .path }}/values.yaml
               - $values/{{ .path }}/values-{{ index .metadata.labels "environment" }}.yaml
         - repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-          targetRevision: main
+          targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
           ref: values
       destination:
         server: https://kubernetes.default.svc

applicationsets/addons-argo-workflows.yaml

@@ -86,7 +86,7 @@ spec:
               - $values/addons/argo-platform/argo-workflows/values.yaml
               - $values/addons/argo-platform/argo-workflows/values-{{ index .metadata.labels "environment" }}.yaml
         - repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-          targetRevision: main
+          targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
           ref: values
       destination:
         server: https://kubernetes.default.svc

applicationsets/addons-bootstrap-kustomize.yaml

@@ -44,7 +44,7 @@ spec:
       project: platform
       source:
         repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-        targetRevision: main
+        targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
         path: '{{ .path }}/overlays/{{ index .metadata.labels "environment" }}'
       destination:
         server: https://kubernetes.default.svc

applicationsets/addons-bootstrap.yaml

@@ -75,7 +75,7 @@ spec:
               - $values/{{ .path }}/values.yaml
               - $values/{{ .path }}/values-{{ index .metadata.labels "environment" }}.yaml
         - repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-          targetRevision: main
+          targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
           ref: values
       destination:
         server: https://kubernetes.default.svc

applicationsets/addons-external-dns.yaml

@@ -63,7 +63,7 @@ spec:
               - $values/addons/networking/external-dns/values.yaml
               - $values/addons/networking/external-dns/values-{{ index .metadata.labels "environment" }}.yaml
         - repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-          targetRevision: main
+          targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
           ref: values
       destination:
         server: https://kubernetes.default.svc

applicationsets/addons-karpenter.yaml

@@ -71,7 +71,7 @@ spec:
               - $values/addons/operations/karpenter/values.yaml
               - $values/addons/operations/karpenter/values-{{ index .metadata.labels "environment" }}.yaml
         - repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-          targetRevision: main
+          targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
           ref: values
       destination:
         server: https://kubernetes.default.svc

applicationsets/addons-loki.yaml

@@ -86,7 +86,7 @@ spec:
               - $values/addons/observability/loki/values.yaml
               - $values/addons/observability/loki/values-{{ index .metadata.labels "environment" }}.yaml
         - repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-          targetRevision: main
+          targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
           ref: values
       destination:
         server: https://kubernetes.default.svc

applicationsets/addons-networking.yaml

@@ -65,7 +65,7 @@ spec:
               - $values/{{ .path }}/values.yaml
               - $values/{{ .path }}/values-{{ index .metadata.labels "environment" }}.yaml
         - repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-          targetRevision: main
+          targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
           ref: values
       destination:
         server: https://kubernetes.default.svc

applicationsets/addons-observability.yaml

@@ -73,7 +73,7 @@ spec:
               - $values/{{ .path }}/values.yaml
               - $values/{{ .path }}/values-{{ index .metadata.labels "environment" }}.yaml
         - repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-          targetRevision: main
+          targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
           ref: values
       destination:
         server: https://kubernetes.default.svc

applicationsets/addons-opencost.yaml

@@ -63,7 +63,7 @@ spec:
                 region: "{{ index .metadata.labels \"region\" }}"
                 host: "aps-workspaces.{{ index .metadata.labels \"region\" }}.amazonaws.com"
         - repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-          targetRevision: main
+          targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
           ref: values
       destination:
         server: https://kubernetes.default.svc

applicationsets/addons-operations-helm.yaml

@@ -82,7 +82,7 @@ spec:
               - $values/{{ .path }}/values.yaml
               - $values/{{ .path }}/values-{{ index .metadata.labels "environment" }}.yaml
         - repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-          targetRevision: main
+          targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
           ref: values
       destination:
         server: https://kubernetes.default.svc

applicationsets/addons-operations-kustomize.yaml

@@ -42,7 +42,7 @@ spec:
       project: platform
       source:
         repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-        targetRevision: main
+        targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
         path: '{{ .path }}/overlays/{{ index .metadata.labels "environment" }}'
         # The overlay renders this environment's primary-cluster identity; patch
         # the EC2NodeClass per cluster from the cluster_name label so co-located

applicationsets/addons-otel-agent.yaml

@@ -47,7 +47,7 @@ spec:
               - $values/addons/observability/otel-agent/values.yaml
               - $values/addons/observability/otel-agent/values-{{ index .metadata.labels "environment" }}.yaml
         - repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-          targetRevision: main
+          targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
           ref: values
       destination:
         server: https://kubernetes.default.svc

applicationsets/addons-otel-gateway-floor.yaml

@@ -59,7 +59,7 @@ spec:
               - $values/addons/observability/otel-gateway-floor/values.yaml
               - $values/addons/observability/otel-gateway-floor/values-{{ index .metadata.labels "environment" }}.yaml
         - repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-          targetRevision: main
+          targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
           ref: values
       destination:
         server: https://kubernetes.default.svc

applicationsets/addons-otel-gateway.yaml

@@ -63,7 +63,7 @@ spec:
               - $values/addons/observability/otel-gateway/values.yaml
               - $values/addons/observability/otel-gateway/values-{{ index .metadata.labels "environment" }}.yaml
         - repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-          targetRevision: main
+          targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
           ref: values
       destination:
         server: https://kubernetes.default.svc

applicationsets/addons-security.yaml

@@ -70,7 +70,7 @@ spec:
               - $values/{{ .path }}/values.yaml
               - $values/{{ .path }}/values-{{ index .metadata.labels "environment" }}.yaml
         - repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-          targetRevision: main
+          targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
           ref: values
       destination:
         server: https://kubernetes.default.svc

applicationsets/addons-tempo.yaml

@@ -65,7 +65,7 @@ spec:
               - $values/addons/observability/tempo/values.yaml
               - $values/addons/observability/tempo/values-{{ index .metadata.labels "environment" }}.yaml
         - repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-          targetRevision: main
+          targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
           ref: values
       destination:
         server: https://kubernetes.default.svc

applicationsets/addons-velero.yaml

@@ -75,7 +75,7 @@ spec:
               - $values/addons/operations/velero/values.yaml
               - $values/addons/operations/velero/values-{{ index .metadata.labels "environment" }}.yaml
         - repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-          targetRevision: main
+          targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
           ref: values
       destination:
         server: https://kubernetes.default.svc

applicationsets/agent-platform.yaml

@@ -55,7 +55,7 @@ spec:
       project: platform
       source:
         repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-        targetRevision: main
+        targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
         path: '{{ .path }}/overlays/{{ index .metadata.labels "environment" }}'
       destination:
         server: https://kubernetes.default.svc

applicationsets/dashboards.yaml

@@ -45,7 +45,7 @@ spec:
       project: platform
       source:
         repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-        targetRevision: main
+        targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
         path: '{{ .path }}/base'
         # The Grafana CR's workspace URL is per-cluster and can't be templated
         # from a Secret, so inject it here from the monitoring/grafana-url

applicationsets/kyverno-policies.yaml

@@ -55,7 +55,7 @@ spec:
       project: platform
       source:
         repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-        targetRevision: main
+        targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
         path: '{{ .path }}/overlays/{{ index .metadata.labels "environment" }}'
       destination:
         server: https://kubernetes.default.svc

applicationsets/opt-in/apps-tenants.yaml

@@ -55,7 +55,7 @@ spec:
       project: '{{ .app }}'
       sources:
         - repoURL: '{{ .repoURL }}'
-          targetRevision: main
+          targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
           path: '{{ .path }}'
           helm:
             # Tenant charts default grafanaDashboard.enabled true, which renders a
@@ -81,7 +81,7 @@ spec:
               - $values/{{ .path }}/values.yaml
               - $values/{{ .path }}/values-{{ index .metadata.labels "environment" }}.yaml
         - repoURL: '{{ .repoURL }}'
-          targetRevision: main
+          targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
           ref: values
       destination:
         server: https://kubernetes.default.svc

applicationsets/opt-in/clusters-appset.yaml

@@ -70,7 +70,7 @@ spec:
       project: platform
       source:
         repoURL: git@github.com:nanohype/clusters.git
-        targetRevision: main
+        targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
         path: '{{ .path.path }}'
         directory:
           include: '{{ .path.filename }}'

applicationsets/portal-tenants.yaml

@@ -68,7 +68,7 @@ spec:
       project: platform
       source:
         repoURL: '{{ index .metadata.annotations "gitops/tenants-repo-url" }}'
-        targetRevision: main
+        targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
         path: '{{ .path.path }}'
         directory:
           recurse: true

applicationsets/rendertest/testdata/argo-workflows-cluster-no-bucket.yaml

@@ -16,4 +16,5 @@ metadata:
     region: us-west-2
   annotations:
     gitops/repo-url: https://github.com/example/gitops
+    gitops/repo-branch: main
 type: Opaque

applicationsets/rendertest/testdata/argo-workflows-cluster-with-bucket.yaml

@@ -15,5 +15,6 @@ metadata:
     region: us-west-2
   annotations:
     gitops/repo-url: https://github.com/example/gitops
+    gitops/repo-branch: main
     argo-workflows/artifact-bucket: alpha-111111111111-us-west-2-argo-workflows
 type: Opaque

applicationsets/rendertest/testdata/cluster-adopt.yaml

@@ -14,6 +14,7 @@ metadata:
     network_mode: adopt
   annotations:
     gitops/repo-url: https://github.com/example/gitops
+    gitops/repo-branch: main
     network/private-subnet-ids: subnet-priv-a,subnet-priv-b,subnet-priv-c
     network/public-subnet-ids: subnet-pub-a,subnet-pub-b,subnet-pub-c
 type: Opaque

applicationsets/rendertest/testdata/cluster-create.yaml

@@ -13,4 +13,5 @@ metadata:
     network_mode: create
   annotations:
     gitops/repo-url: https://github.com/example/gitops
+    gitops/repo-branch: main
 type: Opaque

applicationsets/rendertest/testdata/cluster-nolabel.yaml

@@ -13,4 +13,5 @@ metadata:
     cluster_name: charlie
   annotations:
     gitops/repo-url: https://github.com/example/gitops
+    gitops/repo-branch: main
 type: Opaque

applicationsets/rendertest/testdata/observability-cluster-no-buckets.yaml

@@ -14,4 +14,5 @@ metadata:
     region: us-west-2
   annotations:
     gitops/repo-url: https://github.com/example/gitops
+    gitops/repo-branch: main
 type: Opaque

applicationsets/rendertest/testdata/observability-cluster-with-buckets.yaml

@@ -15,6 +15,7 @@ metadata:
     region: us-west-2
   annotations:
     gitops/repo-url: https://github.com/example/gitops
+    gitops/repo-branch: main
     observability/loki-bucket: alpha-111111111111-us-west-2-loki
     observability/tempo-bucket: alpha-111111111111-us-west-2-tempo
 type: Opaque

applicationsets/secret-stores.yaml

@@ -61,7 +61,7 @@ spec:
       project: platform
       source:
         repoURL: '{{ index .metadata.annotations "gitops/repo-url" }}'
-        targetRevision: main
+        targetRevision: '{{ index .metadata.annotations "gitops/repo-branch" }}'
         path: '{{ .path }}'
         # The AMP endpoints Secrets Manager secret is cluster-scoped so co-located
         # sibling clusters don't collide; patch remoteRef.key per cluster. The