infra(ci): self-apply Argo templates on infra/k8s/argo/ changes

Pipeline now auto-applies WorkflowTemplates, EventSources, Sensors,
and RBAC when infra/k8s/argo/ files change — no more manual kubectl.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infra/k8s/argo/ci-deploy-rbac.yaml

@@ -1,4 +1,4 @@
-# RBAC for CI pipeline deploy step — allows argo-workflow SA to restart deployments
+# RBAC for CI pipeline — deploy step + self-apply Argo templates
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -10,6 +10,9 @@ rules:
   - apiGroups: ["apps"]
     resources: [deployments]
     verbs: [get, list, patch]
+  - apiGroups: ["argoproj.io"]
+    resources: [workflowtemplates, eventsources, sensors]
+    verbs: [get, list, create, update, patch]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding

infra/k8s/argo/ci-pipeline-template.yaml

@@ -172,6 +172,15 @@ spec:
                   value: foxhunt-training-runtime
             when: "{{tasks.detect-changes.outputs.parameters.docker-images}} == true"
 
+          - name: apply-argo-templates
+            dependencies: [detect-changes]
+            template: apply-argo-templates
+            arguments:
+              parameters:
+                - name: commit-sha
+                  value: "{{workflow.parameters.commit-sha}}"
+            when: "{{tasks.detect-changes.outputs.parameters.needs-argo-templates}} == true"
+
           - name: terragrunt-apply
             dependencies: [detect-changes]
             template: terragrunt-apply
@@ -272,6 +281,7 @@ spec:
             NEEDS_DASHBOARD=$(check_paths "web-dashboard/")
             INFRA_CI=$(check_paths "infra/k8s/argo/ci-pipeline infra/k8s/services/")
             NEEDS_INFRA=$(check_paths "infra/live/ infra/modules/")
+            NEEDS_ARGO_TEMPLATES=$(check_paths "infra/k8s/argo/")
 
             # ========================================
             # Build SERVICE package list
@@ -418,6 +428,7 @@ spec:
             echo "needs-code:        $NEEDS_CODE"
             echo "needs-dashboard:   $NEEDS_DASHBOARD"
             echo "needs-infra:       $NEEDS_INFRA"
+            echo "needs-argo:        $NEEDS_ARGO_TEMPLATES"
             echo "docker-images:     $DOCKER_IMAGES"
             echo "service-packages:  $SERVICE_PKGS"
             echo "training-examples: $TRAINING_EXAMPLES"
@@ -431,6 +442,7 @@ spec:
             echo -n "$DOCKER_IMAGES"     > /tmp/outputs/docker-images
             echo -n "$NEEDS_CODE"        > /tmp/outputs/needs-code
             echo -n "$NEEDS_INFRA"       > /tmp/outputs/needs-infra
+            echo -n "$NEEDS_ARGO_TEMPLATES" > /tmp/outputs/needs-argo-templates
             echo -n "$SERVICE_PKGS"      > /tmp/outputs/service-packages
             echo -n "$TRAINING_EXAMPLES" > /tmp/outputs/training-examples
             echo -n "$DEPLOY_LIST"       > /tmp/outputs/deploy-list
@@ -466,6 +478,9 @@ spec:
           - name: needs-infra
             valueFrom:
               path: /tmp/outputs/needs-infra
+          - name: needs-argo-templates
+            valueFrom:
+              path: /tmp/outputs/needs-argo-templates
 
     # ── create-tag: CalVer auto-tag on code changes ──
     - name: create-tag
@@ -1167,3 +1182,64 @@ spec:
             done
 
             echo "=== Terragrunt apply complete ==="
+
+    # ── apply-argo-templates: self-apply WorkflowTemplates, EventSources, Sensors ──
+    - name: apply-argo-templates
+      inputs:
+        parameters:
+          - name: commit-sha
+      nodeSelector:
+        k8s.scaleway.com/pool-name: platform
+      serviceAccountName: argo-workflow
+      container:
+        image: gitlab-registry.foxhunt.svc.cluster.local:5000/root/foxhunt/foxhunt-runtime:latest
+        command: ["/bin/sh", "-c"]
+        resources:
+          requests:
+            cpu: 100m
+            memory: 128Mi
+          limits:
+            cpu: 500m
+            memory: 256Mi
+        volumeMounts:
+          - name: git-ssh-key
+            mountPath: /etc/git-ssh
+            readOnly: true
+        args:
+          - |
+            set -e
+
+            # Clone repo at commit
+            mkdir -p /root/.ssh
+            cp /etc/git-ssh/ssh-privatekey /root/.ssh/id_ed25519
+            chmod 600 /root/.ssh/id_ed25519
+            printf 'Host *\n  StrictHostKeyChecking no\n  UserKnownHostsFile /dev/null\n' > /root/.ssh/config
+            chmod 600 /root/.ssh/config
+
+            SHA="{{inputs.parameters.commit-sha}}"
+            REPO="ssh://git@gitlab-gitlab-shell.foxhunt.svc.cluster.local:2222/root/foxhunt.git"
+            git clone --no-checkout --filter=blob:none "$REPO" /workspace/src
+            cd /workspace/src
+            git checkout "$SHA"
+            echo "Checked out $(git rev-parse --short HEAD)"
+
+            # Apply all Argo WorkflowTemplates
+            for f in infra/k8s/argo/*-template.yaml; do
+              if [ -f "$f" ]; then
+                echo "=== Applying $(basename $f) ==="
+                kubectl -n foxhunt apply -f "$f"
+              fi
+            done
+
+            # Apply EventSources and Sensors
+            for f in infra/k8s/argo/events/*.yaml; do
+              if [ -f "$f" ]; then
+                echo "=== Applying $(basename $f) ==="
+                kubectl -n foxhunt apply -f "$f"
+              fi
+            done
+
+            # Apply RBAC
+            kubectl -n foxhunt apply -f infra/k8s/argo/ci-deploy-rbac.yaml
+
+            echo "=== Argo templates applied ==="