josip-op · Sep 21, 2026 · Oct 2, 2026 · Oct 2, 2026 · Oct 2, 2026
@@ -26,7 +26,7 @@ dependencies:
     condition: argo-workflows.enabled
   - name: sealed-secrets
     repository: https://bitnami.github.io/sealed-secrets
-    version: 2.18.0
+    version: 2.18.6
     condition: sealed-secrets.enabled
   - name: codefresh-tunnel-client
     repository: oci://quay.io/codefresh/charts

@@ -813,7 +813,7 @@ global:
 | redis.readinessProbe | object | `{"enabled":true,"failureThreshold":5,"initialDelaySeconds":30,"periodSeconds":15,"successThreshold":1,"timeoutSeconds":15}` | Probes configuration |
 | redis.service | object | `{"annotations":{},"labels":{},"ports":{"metrics":{"port":9121,"targetPort":9121},"redis":{"port":6379,"targetPort":6379}},"type":"ClusterIP"}` | Service configuration |
 | redis.serviceAccount | object | `{"annotations":{},"create":true,"name":""}` | Create ServiceAccount for redis |
-| sealed-secrets | object | `{"fullnameOverride":"sealed-secrets-controller","image":{"registry":"quay.io","repository":"codefresh/sealed-secrets-controller","tag":"0.36.0"},"keyrenewperiod":"720h","resources":{"limits":{"cpu":"500m","memory":"1Gi"},"requests":{"cpu":"200m","memory":"512Mi"}}}` | --------------------------------------------------------------------------------------------------------------------- |
+| sealed-secrets | object | `{"fullnameOverride":"sealed-secrets-controller","image":{"registry":"docker.io","repository":"octopusdeploy/dhi-sealed-secrets-controller","tag":"0.40.0"},"keyrenewperiod":"720h","resources":{"limits":{"cpu":"500m","memory":"1Gi"},"requests":{"cpu":"200m","memory":"512Mi"}}}` | --------------------------------------------------------------------------------------------------------------------- |
 | tunnel-client | object | `{"affinity":{},"enabled":true,"libraryMode":true,"nodeSelector":{},"tolerations":[],"tunnelServer":{"host":"register-tunnels.cf-cd.com","subdomainHost":"tunnels.cf-cd.com"}}` | Tunnel based runtime. Not supported for on-prem platform. In on-prem use ingress based runtimes. |
 | tunnel-client.enabled | bool | `true` | Will only be used if global.runtime.ingress.enabled = false |
 | tunnel-client.libraryMode | bool | `true` | Do not change this value! Breaks chart logic |
@@ -265,9 +265,10 @@ sealed-secrets:
   fullnameOverride: sealed-secrets-controller
   keyrenewperiod: "720h"
   image:
-    registry: 'quay.io'
-    repository: 'codefresh/sealed-secrets-controller'
-    tag: '0.36.0'
+    registry: 'docker.io'
+    repository: 'octopusdeploy/dhi-sealed-secrets-controller'
+    # NB: this overrides version 0.37.0 from bitnami chart version 2.18.6
+    tag: '0.40.0'
   resources:
     limits:
       cpu: 500m

@@ -2,14 +2,6 @@
 
 This guide explains how to perform releases for the GitOps Runtime Helm chart.
 
-> **Tip**: There's a CLI that automates most of these steps:
-> ```bash
-> npx @codefresh-io/gitops-release --help
-> ```
-> See the [CLI repository](https://github.com/codefresh-io/gitops-release) for details.
-
-The instructions below explain how to do everything manually if you prefer that approach, don't have an Anthropic API key for AI release notes, or need to troubleshoot.
-
 ---
 
 ## Table of Contents
@@ -30,25 +22,20 @@ The instructions below explain how to do everything manually if you prefer that
 
 ## Overview
 
-The GitOps Runtime release process uses **Argo Events and Workflows** to automate most of the work. Your job as release manager is to:
+The GitOps Runtime release process uses **Codefresh CI** to automate most of the work.
+The developers:
 
-1. **Trigger pipelines** by creating branches or merging PRs
-2. **Review and approve** the automatically created prepare-release PRs
+1. **Trigger pipelines** by creating branches
+2. **Review and approve** the PRs
 3. **Write/edit release notes** (the AI can help, but human review is essential)
-4. **Publish releases** by merging the prepare-release PR
+4. **Publish releases** by merging the PR
 
 ### How It Works
 
 ```
-You create stable/X.Y branch
-        ↓
-[Argo Workflow: prepare-release] runs automatically
-        ↓
-Creates prep/vX.Y.0 branch + PR + draft GitHub release
-        ↓
-You review, edit release notes, then merge the PR
+You complete work on a PR for main, edit release notes, then merge the PR
         ↓
-[Argo Workflow: promote] runs automatically
+[CF CI: promote] runs automatically
         ↓
 Chart published to quay.io + GitHub release published
 ```
@@ -81,56 +68,18 @@ gh auth login
 
 ## Release Types
 
-| Type | When | Branch Created | Example |
-|------|------|----------------|---------|
-| **Minor Release** | New features, starting a release line | `stable/0.27` | 0.27.0 |
-| **Patch Release** | Bug fixes to existing release | Already exists | 0.26.6 |
+| Type | When | Example |
+|------|------|---------|
+| **Minor Release** | New features, starting a release line | 0.27.0 |
+| **Patch Release** | Bug fixes to existing release | 0.26.6 |
 
 ---
 
-## Creating a New Minor Release
+## Basic release sanity checks
 
-Use this when starting a new release line (e.g., 0.27.x).
-
-### Step 1: Create the Stable Branch
-
-**Option A: GitHub UI (easiest)**
-1. Go to https://github.com/codefresh-io/gitops-runtime-helm
-2. Click the branch dropdown
-3. Type `stable/0.27` (replace with your version)
-4. Click "Create branch: stable/0.27 from main"
-
-**Option B: Git command line**
-```bash
-git fetch origin
-git checkout main
-git pull
-git checkout -b stable/0.27
-git push -u origin stable/0.27
-```
-
-**From a specific commit:**
-```bash
-git checkout -b stable/0.27 abc1234
-git push -u origin stable/0.27
-```
-
-### Step 2: Wait for the Pipeline
-
-The **prepare-release** pipeline will automatically:
-- Create `prep/v0.27.0` branch
-- Bump version in `Chart.yaml`
-- Open a PR with the `prepare-release` label
-- Create a draft GitHub release
-
-This usually takes 2-5 minutes.
-
-### Step 3: Verify
-
-Check that everything was created:
 ```bash
 # Check for the PR
-gh pr list --repo codefresh-io/gitops-runtime-helm --head prep/v0.27.0
+gh pr list --repo codefresh-io/gitops-runtime-helm --head your-branch-name
 
 # Check for draft release
 gh release list --repo codefresh-io/gitops-runtime-helm | head -5
@@ -144,7 +93,7 @@ Or visit:
 
 ## Release Validation
 
-After the prepare-release PR is automatically created and before publishing the release, the release should be validated to ensure stability.
+After the PR is reviewed and approved, the release should be validated to ensure stability.
 
 ### Current Approach
 
@@ -157,7 +106,7 @@ The CI pipeline runs e2e tests on every PR. If these tests pass, the release is
 Before publishing, ensure:
 
 - [ ] All CI checks pass (unit tests, linting, e2e tests)
-- [ ] The prepare-release PR has been reviewed
+- [ ] The PR has been reviewed by the right reviewers
 - [ ] Release notes accurately reflect the changes
 - [ ] No known critical issues exist in the changes being released
 
@@ -174,11 +123,6 @@ Before publishing, verify:
    gh pr checks <PR-NUMBER> --repo codefresh-io/gitops-runtime-helm
    ```
 
-2. **PR has the `prepare-release` label** (CRITICAL - this triggers the promote pipeline)
-   ```bash
-   gh pr view <PR-NUMBER> --repo codefresh-io/gitops-runtime-helm --json labels
-   ```
-
 3. **Release notes are complete** (see [Writing Release Notes](#writing-release-notes))
 
 ### Step 2: Review the PR
@@ -190,7 +134,6 @@ Before publishing, verify:
 ### Step 3: Merge the PR
 
 ```bash
-# Merge the prepare-release PR
 gh pr merge <PR-NUMBER> --repo codefresh-io/gitops-runtime-helm --squash
 ```
 
@@ -218,63 +161,6 @@ No manual action required. If notifications don't appear, see [Troubleshooting:
 
 ---
 
-## Creating a Patch Release
-
-Patch releases (e.g., 0.26.6) happen when fixes are merged to an existing stable branch.
-
-### Step 1: Merge Fixes to Stable Branch
-
-Either:
-- Merge PRs directly to `stable/0.26`
-- Cherry-pick commits (see [Cherry-Picking Fixes](#cherry-picking-fixes))
-
-### Step 2: Pipeline Creates New Prep PR
-
-When commits are merged to `stable/X.Y`, the prepare-release pipeline automatically:
-- Creates `prep/v0.26.6` (incremented patch version)
-- Opens a new prepare-release PR
-- Creates a new draft release
-
-### Step 3: Publish
-
-Follow the same [Publishing a Release](#publishing-a-release) steps.
-
----
-
-## Cherry-Picking Fixes
-
-To backport a fix from `main` to a stable branch:
-
-```bash
-# Make sure you have the latest
-git fetch origin
-
-# Checkout stable branch
-git checkout stable/0.26
-git pull
-
-# Create backport branch
-git checkout -b backport/fix-memory-leak
-
-# Cherry-pick the commit(s) from main
-git cherry-pick abc1234
-
-# If there are conflicts, resolve them, then:
-git add .
-git cherry-pick --continue
-
-# Push and create PR
-git push -u origin backport/fix-memory-leak
-gh pr create --base stable/0.26 --title "Backport: Fix memory leak" --body "Cherry-picked from main"
-```
-
-**Multiple commits:**
-```bash
-git cherry-pick abc1234 def5678 ghi9012
-```
-
----
-
 ## Writing Release Notes
 
 > **Important**: AI-generated release notes are only as good as the commit messages. If commits are not descriptive or miss important context (like breaking changes), you MUST manually edit the notes.
@@ -357,27 +243,6 @@ Valid `kind` values: `added`, `changed`, `deprecated`, `removed`, `fixed`, `secu
 
 ## Troubleshooting
 
-### Pipeline Didn't Run
-
-**Symptom**: Created stable branch but no prep PR appeared
-
-**Check**:
-1. Verify the branch was created correctly:
-   ```bash
-   gh api repos/codefresh-io/gitops-runtime-helm/branches/stable/0.27
-   ```
-2. Check Argo Events sensor logs (requires cluster access)
-3. Try creating a small commit to the branch to re-trigger
-
-### PR Doesn't Have `prepare-release` Label
-
-**Symptom**: PR exists but missing the label
-
-**Fix**:
-```bash
-gh pr edit <PR-NUMBER> --repo codefresh-io/gitops-runtime-helm --add-label prepare-release
-```
-
 ### CI Checks Failing
 
 **Symptom**: PR checks are red
@@ -387,37 +252,6 @@ gh pr edit <PR-NUMBER> --repo codefresh-io/gitops-runtime-helm --add-label prepa
 2. Fix issues on the `prep/vX.Y.Z` branch
 3. Push fixes - checks will re-run
 
-### Merge Conflicts
-
-**Symptom**: PR shows merge conflicts
-
-**Fix**:
-```bash
-# Checkout the prep branch
-git fetch origin
-git checkout prep/v0.27.0
-
-# Rebase or merge from stable
-git rebase origin/stable/0.27
-# OR
-git merge origin/stable/0.27
-
-# Resolve conflicts, then force push
-git push --force-with-lease
-```
-
-### Release Not Publishing After Merge
-
-**Symptom**: Merged the PR but release is still draft
-
-**Check**:
-1. Verify the PR had the `prepare-release` label when merged
-2. Check promote pipeline logs (requires cluster access)
-3. Manual fallback - publish the release:
-   ```bash
-   gh release edit 0.27.0 --repo codefresh-io/gitops-runtime-helm --draft=false
-   ```
-
 ### Slack Notifications Not Sent
 
 **Symptom**: Release published but no Slack notifications appeared
@@ -454,15 +288,8 @@ git push --force-with-lease
 
 | Pattern | Purpose | Example |
 |---------|---------|---------|
-| `main` | Development branch | - |
-| `stable/X.Y` | Release branch | `stable/0.27` |
-| `prep/vX.Y.Z` | Prepare-release branch | `prep/v0.27.0` |
-
-### Important Labels
-
-| Label | Purpose |
-|-------|---------|
-| `prepare-release` | **CRITICAL**: Triggers promote pipeline when PR is merged |
+| `main` | Release branch | - |
+| `(feat|fix|...)/XX-YYYY-desc` | Development branches | `feat/CF-1234-fancy-stuff` |
 
 ### Version Formats
 
@@ -590,23 +417,18 @@ Updates alpine base image to 3.19.1 which patches CVE-2024-12345
 # List recent releases
 gh release list --repo codefresh-io/gitops-runtime-helm
 
-# View open prepare-release PRs
-gh pr list --repo codefresh-io/gitops-runtime-helm --label prepare-release
+# View open PRs
+gh pr list --repo codefresh-io/gitops-runtime-helm
 
 # Check PR status
 gh pr view <PR-NUMBER> --repo codefresh-io/gitops-runtime-helm
 
 # Check PR CI status
 gh pr checks <PR-NUMBER> --repo codefresh-io/gitops-runtime-helm
 
-# Merge prepare-release PR
+# Merge a PR
 gh pr merge <PR-NUMBER> --repo codefresh-io/gitops-runtime-helm --squash
 
 # View a release
 gh release view <VERSION> --repo codefresh-io/gitops-runtime-helm
-
-# Create stable branch from main
-git fetch origin && git checkout main && git pull
-git checkout -b stable/0.27
-git push -u origin stable/0.27
 ```