Why ArgoCD makes your GitHub Actions setup dramatically more secure

You're already using GitHub Actions. It works. So why bother adding another tool? This guide answers that question concretely — with your security concern (Jenkins-style blast radius) at the center — and walks you step-by-step through a realistic workflow. No marketing fluff.

What's actually wrong with "just use GitHub Actions"?

GitHub Actions is great for building, testing, and publishing. But when people use it as the deployment tool, they recreate the same architectural problem that made Jenkins dangerous — just with a nicer UI.

Today's typical GitHub Actions deploy flow

The hidden cost of this pattern

# .github/workflows/deploy.yml — a typical setup
name: Deploy to production
on: { push: { branches: [main] } }

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up kubectl
        run: echo "${{ secrets.KUBE_CONFIG }}" | base64 -d > ~/.kube/config  # 🚩 long-lived cluster admin creds
      - name: Build and push image
        run: docker build -t myapp:${{ github.sha }} . && docker push ...
      - name: Deploy
        run: kubectl set image deploy/myapp myapp=myapp:${{ github.sha }}

What "GitOps" actually means (without the buzzword soup)

GitOps is not a product. It's a pattern with four rules. If you follow all four, you are doing GitOps. ArgoCD is simply a tool that makes following those four rules easy on Kubernetes.

Push vs Pull — visualized

How ArgoCD actually works under the hood

ArgoCD is a Kubernetes controller. That's it. Once you understand what a controller is, ArgoCD becomes obvious.

The reconciliation loop

Every ArgoCD action is a variation of this same loop, which runs forever:

In plain English

Every ~3 minutes (configurable), ArgoCD:

1. Fetches the latest commit from your Git repo.
2. Renders the manifests (plain YAML, or Helm charts, or Kustomize overlays).
3. Compares the rendered output to what's actually running in the cluster. Any difference = "drift".
4. Syncs by applying the diff — creating, updating, or deleting K8s resources as needed.

The same loop also runs instantly when you push a commit (via webhook) or click "Sync" in the UI.

The two things ArgoCD gives you that kubectl alone can't

The Application CRD — ArgoCD's main concept

An Application is a Kubernetes resource ArgoCD gives you. It's a declarative pointer that says "sync this Git path into this namespace".

Application.yamlapiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: snip-link
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/vattanac/infra.git    # where to find manifests
    path: apps/snip-link/production                # which folder
    targetRevision: main                          # which branch
  destination:
    server: https://kubernetes.default.svc         # which cluster
    namespace: snip-link-prod                         # which namespace
  syncPolicy:
    automated:
      prune: true      # delete resources removed from Git
      selfHeal: true   # revert manual changes to the cluster

Architecture — the five components

ArgoCD runs as a handful of pods inside your cluster. Understanding which pod does what makes debugging vastly easier.

Where the security actually lives

The only credential ArgoCD itself needs is a read-only Git deploy key (or GitHub App with read access). Even if someone steals that key, they can only read your infra Git repo — they cannot write to your cluster.

GitHub Actions + ArgoCD — who does what?

This is the part people get confused about. You don't throw away GitHub Actions. You give it a clearer, smaller job.

Division of labor

The recommended Git structure

You need two repositories (or two folders in a monorepo). This separation is the key to making GitOps clean.

The full flow, end to end

The new GitHub Actions workflow — no more kubeconfig

.github/workflows/build.ymlname: Build and update manifest
on: { push: { branches: [main] } }

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write                 # push to GHCR only — no cluster access!
    steps:
      - uses: actions/checkout@v4

      - name: Log in to registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push
        run: |
          docker build -t ghcr.io/vattanac/snip-link:${{ github.sha }} .
          docker push ghcr.io/vattanac/snip-link:${{ github.sha }}

      - name: Bump image tag in infra repo
        run: |
          git clone https://x-access-token:${{ secrets.INFRA_REPO_TOKEN }}@github.com/vattanac/infra.git
          cd infra/apps/snip-link/production
          sed -i "s/newTag:.*/newTag: ${{ github.sha }}/" kustomization.yaml
          git config user.email "ci@bot" && git config user.name "ci"
          git commit -am "deploy snip-link ${{ github.sha }}"
          git push

Install ArgoCD in 5 minutes

You need a Kubernetes cluster (k3s, kind, EKS, DigitalOcean Kubernetes — anything works) and kubectl. That's it.

Step 1 — Install ArgoCD

# Create the namespace and apply the official install manifest
kubectl create namespace argocd
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml

# Wait until pods are ready
kubectl -n argocd wait --for=condition=ready pod -l app.kubernetes.io/name=argocd-server --timeout=300s

Step 2 — Access the UI

# Port-forward the server pod to your laptop
kubectl port-forward -n argocd svc/argocd-server 8080:443

# Get the initial admin password
kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d

# Open https://localhost:8080 → login as admin

Step 3 — Install the CLI (optional but nice)

brew install argocd
# or
curl -sSL -o argocd https://github.com/argoproj/argo-cd/releases/latest/download/argocd-linux-amd64
chmod +x argocd && sudo mv argocd /usr/local/bin/

argocd login localhost:8080 --username admin --password <password>

Step 4 — Point ArgoCD at your infra repo

# Register the repo (once per cluster)
argocd repo add https://github.com/vattanac/infra.git \
  --username vattanac --password <github-pat-with-read>

# Create your first Application
argocd app create snip-link \
  --repo https://github.com/vattanac/infra.git \
  --path apps/snip-link/production \
  --dest-server https://kubernetes.default.svc \
  --dest-namespace snip-link-prod \
  --sync-policy automated \
  --self-heal \
  --auto-prune

Live demo — deploying "Snip.link" end-to-end

Click through the 8 steps below. This is the exact workflow you'll use every day. No placeholder content — every step shows real files, real commands, real UI.

# In your app repo (snip-link)
vim src/server.js                      # add /api/v2/shorten endpoint
git add .
git commit -m "add v2 shorten endpoint"
git push origin main

# Verify the image is there
docker pull ghcr.io/vattanac/snip-link:a3f29b1
✓ a3f29b1: Pulling from vattanac/snip-link
✓ Digest: sha256:9f7ac2ed61...

infra/apps/snip-link/production/kustomization.yamlapiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - ../base

images:
  - name: ghcr.io/vattanac/snip-link
    newTag: a3f29b1          # 👈 this line got updated

namespace: snip-link-prod
replicas:
  - name: snip-link
    count: 3

kubectl -n snip-link-prod get pods -w

NAME                          READY   STATUS              RESTARTS   AGE
snip-link-5d8c6f7b9c-a1b2c    1/1     Running             0          12m
snip-link-5d8c6f7b9c-d3e4f    1/1     Running             0          12m
snip-link-5d8c6f7b9c-g5h6i    1/1     Running             0          12m
snip-link-7f9a3c2d1e-x7y8z    0/1     ContainerCreating   0          2s   ← new
snip-link-7f9a3c2d1e-x7y8z    1/1     Running             0          8s
snip-link-5d8c6f7b9c-a1b2c    1/1     Terminating         0          12m  ← old
...

kubectl -n snip-link-prod scale deploy snip-link --replicas=10  # 🚩 not in Git!

# In the INFRA repo (not the app repo)
cd infra
git revert <bump-commit-sha>
git push
# Done. ArgoCD sees the new commit, rolls forward (back to the old image)

The five benefits you'll actually feel

Forget marketing pages. These are the five things that make real engineers go "oh, that's nice" in the first month of using ArgoCD properly.

Common mistakes that kill ArgoCD adoption

Most "ArgoCD isn't giving me much" feelings come from one of these five misconfigurations. Avoid them and the value becomes obvious.

When is ArgoCD worth it?

The 60-second recommendation for your situation