Merge pull request #16 from datum-cloud/fix/github-app-polling-only

refactor: infra-owned GitHub App secrets, polling-only discovery

Author: scotwells

app-config.yaml

@@ -65,14 +65,16 @@ integrations:
       token: ${GITHUB_TOKEN}
       # Deployed environments authenticate as a GitHub App instead of a PAT
       # (org-wide install, higher rate limits, no personal token to rotate).
-      # The credentials are already projected into the pod by the
-      # external-secrets component (backstage-github-app -> GITHUB_APP_*).
+      # The environment's infra overlay projects the credentials into the pod
+      # (an ExternalSecret + envFrom -> GITHUB_APP_*); this repo does not own
+      # that env-specific secret wiring. Catalog discovery polls GitHub
+      # outbound on a schedule, so no inbound webhook (and no webhookSecret) is
+      # required — see catalog.providers below.
       # Enable per-environment by supplying this block from the deploy overlay:
       # apps:
       #   - appId: ${GITHUB_APP_ID}
       #     clientId: ${GITHUB_CLIENT_ID}
       #     clientSecret: ${GITHUB_CLIENT_SECRET}
-      #     webhookSecret: ${GITHUB_WEBHOOK_SECRET}
       #     privateKey: ${GITHUB_PRIVATE_KEY}
 
 proxy:

config/README.md

@@ -10,7 +10,6 @@ config/
     database-cnpg/          # CloudNativePG Cluster + POSTGRES_* env wiring
     app-config/             # mounts a `backstage-app-config` ConfigMap as --config
     networking/             # HTTPRoute onto the shared internal-auth-gateway
-    external-secrets/       # GitHub App + backend secret from gcp-secret-store
   overlays/
     e2e/                    # base + database-cnpg + app-config, image backstage:e2e
 ```
@@ -31,10 +30,14 @@ Each component factors out one concern so any overlay can opt in via
 | `database-cnpg` | A `postgresql.cnpg.io` `Cluster` (`backstage-postgres`) and a Deployment patch sourcing `POSTGRES_*` from the generated `backstage-postgres-app` secret. Used by the kind e2e environment. |
 | `app-config` | Deployment patch that layers `app-config.yaml` with a `backstage-app-config` ConfigMap mounted at `/etc/backstage`. The overlay supplies the ConfigMap contents. |
 | `networking` | An `HTTPRoute` attaching to the shared `internal-auth-gateway` (OIDC is enforced at the gateway). |
-| `external-secrets` | An `ExternalSecret` projecting the GitHub App credentials and backend secret from the `gcp-secret-store` ClusterSecretStore into the pod. |
 
 ## overlays
 
 `e2e` composes `base` with `database-cnpg` and `app-config` and is what the
 `E2E` workflow deploys into a kind cluster. Production overlays are composed
 on the deploy side (infra repo) from `base` plus the relevant components.
+
+Secret injection (the GitHub App credentials, backend secret, etc.) is
+environment-specific — the secret store, GCP project, and secret names differ
+per stack — so it is defined in the infra overlay as an `ExternalSecret` plus
+an `envFrom` Deployment patch, not shipped as a component here.