docs: document CI/CD bootstrap, seed images, and troubleshooting

Add bootstrap checklist (seed-ci-images, Sealed Secrets, two-repo GitOps),
Kaniko BASE_IMAGE/insecure-pull details, platform secret requirements, and
updated gitops install order. Link RUNBOOK-CICD from README.

Co-authored-by: Cursor <cursoragent@cursor.com>

gitops/README.md

@@ -46,34 +46,38 @@ helm upgrade --install argocd argo/argo-cd -n argocd --create-namespace \
 helm upgrade --install gitea gitea-charts/gitea -n gitea --create-namespace \
   -f gitops/gitea/values.yaml --timeout 15m --wait
 
-# 4. TLS + registry secrets در namespaceهای argocd/gitea/cloudhost-builds
+# 4. TLS + registry + egress secrets در namespaceهای argocd/gitea/cloudhost-builds
 for ns in argocd gitea cloudhost-builds; do
   kubectl -n cloudhost get secret abrban-wildcard-tls -o yaml | sed "s/namespace: cloudhost/namespace: ${ns}/" | kubectl apply -f -
   kubectl -n cloudhost get secret registry-pull-secret -o yaml | sed "s/namespace: cloudhost/namespace: ${ns}/" | kubectl apply -f -
 done
-
-# پروکسی egress برای act-runner (دانلود kubectl) و Kaniko (pull ایمیج پایه از docker.io)
 for ns in gitea cloudhost-builds; do
   kubectl -n cloudhost get secret registry-egress-proxy -o yaml | sed "s/namespace: cloudhost/namespace: ${ns}/" | kubectl apply -f -
 done
 
-# 5. git push سورس به Gitea (نه docker push)
+# 5. Seed ایمیج‌های CI در Harbor abrban/ (یک‌بار — الزامی قبل از Pipeline)
+kubectl apply -f gitops/jobs/seed-ci-images.yaml
+kubectl -n cloudhost wait --for=condition=complete job/seed-ci-images --timeout=15m
+
+# 6. Sealed Secrets controller
+helm repo add sealed-secrets https://bitnami.github.io/sealed-secrets
+helm upgrade --install sealed-secrets sealed-secrets/sealed-secrets \
+  -n kube-system -f gitops/sealed-secrets/values.yaml --timeout 10m --wait
+
+# 7. git push سورس به Gitea
 #    git remote add gitea https://git.abrban.com/abrban/cloud-host.git
 #    git push gitea main
-
-# 6. اولین build در کلاستر (Kaniko → abrban/)
-./scripts/trigger-platform-build.sh
-
-# 7. Deploy
-./scripts/gitops-deploy.sh
+#    ریپوی GitOps: https://git.abrban.com/abrban/cloud-host-gitops (SealedSecretها + values)
 
 # 8. Gitea Actions runner
-#    توکن ثبت: SealedSecret در ریپوی cloud-host-gitops (sealed-secrets/gitea-act-runner-token.yaml)
-#    یا دستی: kubectl -n gitea create secret generic gitea-act-runner-token --from-literal=token='<TOKEN>'
+#    توکن ثبت: SealedSecret در cloud-host-gitops/sealed-secrets/gitea-act-runner-token.yaml
 kubectl apply -f gitops/gitea/act-runner.yaml
 
-# 9. Argo CD Application
+# 9. Argo CD Application (multi-source: chart از cloud-host، values از cloud-host-gitops)
 kubectl apply -f gitops/argocd/application-platform.yaml
+
+# 10. اولین deploy: push به main → Gitea Actions → Argo CD sync (جریان عادی)
+#     برای bootstrap دستی: TAG=... ./scripts/gitops-deploy.sh
 ```
 
 ## CI/CD

gitops/jobs/seed-ci-images.yaml

@@ -1,4 +1,13 @@
-# Bootstrap: copy act_runner + kaniko into abrban/ (kubelet cannot use proxy-cache reliably)
+# Bootstrap: seed CI/build images into Harbor project abrban/
+#
+# kubelet and Kaniko cannot reliably use Harbor proxy-cache for all images.
+# Run once after Harbor is up and registry-egress-proxy exists in cloudhost:
+#
+#   kubectl apply -f gitops/jobs/seed-ci-images.yaml
+#   kubectl -n cloudhost wait --for=condition=complete job/seed-ci-images --timeout=15m
+#
+# Images copied (see RUNBOOK-CICD.fa.md):
+#   abrban/act-runner, abrban/alpine-git, abrban/node, abrban/kaniko-executor
 apiVersion: batch/v1
 kind: Job
 metadata:
@@ -25,6 +34,7 @@ spec:
             - |
               set -eux
               DEST="docker://harbor-registry.cloudhost.svc.cluster.local:5000/abrban"
+              # Must match harbor-core → REGISTRY_CREDENTIAL_PASSWORD (default: harbor_registry_password)
               CREDS="harbor_registry_user:harbor_registry_password"
               skopeo copy --dest-tls-verify=false --dest-creds="${CREDS}" \
                 docker://docker.io/gitea/act_runner:0.2.11 \