Ops follow-ups from the rebuild cutover (CI, gitops, Argo CD, host isolation)

Infrastructure loose ends from 2026-10-18.

CI

• Drop rebuild from the triggers in .github/workflows/design.yml, and delete the rebuild branch once nothing needs it.
• All taskl.ie workflows now run on the self-hosted tasklie ARC pool (gitops#86): one runner capped at 2 CPU / 4Gi (#88), with a default 2 CPU limit on dind. Builds queue one at a time, so a backend plus UI deploy takes about 40 minutes. Consider 2 runners, or moving runner pods off srv3.
• Decide about GitHub-hosted Actions: they stopped starting jobs, probably because the spending limit was reached.

gitops

• Fix the stale comment in apps/tasklie-ui/base/resources.yaml that says the UI "reads the tasklie Postgres". It doesn't any more, and its DB_* keys were removed from both secrets.

Argo CD

• The argocd Helm release (rev 1, May) has drifted from bootstrap/argocd-values.yaml.
• argocd-cm holds hand-applied oidc.config and url, so any helm upgrade (even --reuse-values) would wipe Argo's Keycloak SSO.
• The taskl.ie notifications were patched directly into argocd-notifications-cm and argocd-notifications-secret (~/tasklie-argo-notifications.sh). The values file has notifications.secret.create: false.
• Reconcile the values with the live release deliberately before anyone upgrades.

Host isolation

• srv3 is both the agent host and a production node. Agent builds and CI starved production pods twice on 2026-10-18.
• Mitigations in place:
  • agents pinned to 4 cores with taskset;
  • CI CPU caps (#88);
  • production CPU requests and probes (#87).
• Decide on a durable fix: systemctl set-property paseo.service CPUQuota=400% (needs sudo), and/or keep production pods off the agent host.

Secrets

• Rotate the local Infisical CLI vault passphrase (~/.infisical). It was printed into a session log by mistake.