feat: add GitHub token to ArgoCD repo credentials to avoid API rate limiting on fresh deployments

[allamand]

Problem

On fresh workshop event deployments, ArgoCD fetches the aws-samples/appmod-blueprints public repo using unauthenticated GitHub API calls (60 req/hr limit). When multiple events are created simultaneously, the rate limit is hit quickly, causing ArgoCD's root ApplicationSet to fail generating child apps. This manifests as:

1 apps so far, waiting...  (repeated for 5+ minutes)

ArgoCD eventually recovers once the rate limit window resets, but adds 5-10 minutes to the install time.

Proposed Solution

Use a GitHub App at the org level (preferred) or a fine-grained PAT from a service/bot account, stored in AWS Secrets Manager, and applied as an ArgoCD repository credential in hub:seed.

Implementation

1. Create a GitHub App in aws-samples org with read-only access to appmod-blueprints repo
2. Store app credentials (app ID + private key) in CDK-managed Secrets Manager secret
3. In hub:seed, create an ArgoCD repository type secret with the GitHub App credentials:

apiVersion: v1
kind: Secret
metadata:
  name: appmod-blueprints-repo
  namespace: argocd
  labels:
    argocd.argoproj.io/secret-type: repository
stringData:
  type: git
  url: https://github.com/aws-samples/appmod-blueprints
  githubAppID: "<app-id>"
  githubAppInstallationID: "<installation-id>"
  githubAppPrivateKey: "<private-key>"

This increases the rate limit from 60/hr (unauthenticated) to 5000/hr (GitHub App).

Alternative (simpler)

Use a fine-grained PAT from a aws-samples service/bot account with read-only access to public repos. Store in Secrets Manager, apply as ArgoCD repo credential with username/password auth.

Impact

• Affects: fresh crossplane/kro-ack workshop deployments
• Severity: low (self-heals after ~5-10min)
• Frequency: only when multiple events created simultaneously