[noels]

The public catalogues (gitops-addons, gitops-workloads) no longer have hand-made SOPS repo Secrets (control-plane#24: the SSH entries were unused, and the addons one showed "Failed"). They still work, since apps fetch them anonymously over HTTPS, but they no longer appear in Argo CD's Settings → Repositories.

This registers them through the Argo CD chart's configs.repositories, as inline Helm values on the addons-argocd appset, templated from each cluster's own annotations (addons_repo_url, workloads_repo_url):

• The URLs always match exactly what the apps use, on any cluster, including a fork with different catalogue URLs.
• HTTPS with no credentials, so the chart-rendered Secrets (argocd-repo-gitops-addons, argocd-repo-gitops-workloads) hold nothing sensitive and live in Git. Private repos keep their SOPS Secrets.

Checked: rendered with ivylen's full value stack (catalogue default + ivylen's private argo-cd values + this) on chart 7.7.12 (current) and 10.9.2 (target). Both produce the two argocd-repo-* repository Secrets, with the URLs decoding to https://github.com/SilexConsulting/gitops-addons and …/gitops-workloads.

After merge, the repo list should show gitops-addons, gitops-workloads and gitops-private, all Successful.

🤖 Generated with Claude Code

[noels]

Closing: the public catalogues stay unregistered (they work anonymously over HTTPS), and workloads-repo config doesn't belong in the addons repo.