From c782450beea7744f4b772b6617b48499698b8e1a Mon Sep 17 00:00:00 2001
From: Jehoszafat Zimnowoda <17126497+j-zimnowoda@users.noreply.github.com>
Date: Thu, 9 Jul 2026 14:27:45 +0200
Subject: [PATCH 1/3] ci: add BYO_GIT checkbox to the Deploy APL action

---
 .github/workflows/integration.yml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 6ff950ef78..15ff598b8e 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -109,6 +109,10 @@ on:
         description: 'Check the box to enable Wiz integration'
         type: boolean
         default: true
+      BYO_GIT:
+        description: 'Check the box to use a custom git repository (requires BYO_GIT_PAT and BYO_GIT_URL secrets)'
+        type: boolean
+        default: false
 
 env:
   CACHE_REGISTRY: ghcr.io
@@ -139,6 +143,18 @@ jobs:
           echo 'certificate: ${{ inputs.certificate }}'
           echo 'is_pre_installed: ${{ inputs.is_pre_installed }}'
           echo 'disableORCS: ${{ inputs.disableORCS }}'
+          echo 'BYO_GIT: ${{ inputs.BYO_GIT }}'
+
+      - name: Validate BYO_GIT secrets
+        if: ${{ inputs.BYO_GIT }}
+        env:
+          BYO_GIT_PAT: ${{ secrets.BYO_GIT_PAT }}
+          BYO_GIT_URL: ${{ secrets.BYO_GIT_URL }}
+        run: |
+          if [[ -z "$BYO_GIT_PAT" ]] || [[ -z "$BYO_GIT_URL" ]]; then
+            echo "BYO_GIT is enabled but BYO_GIT_PAT or BYO_GIT_URL secrets are not set."
+            exit 1
+          fi
 
   preprocess-linode-input:
     needs: preprocess-input
@@ -308,6 +324,8 @@ jobs:
           EDGEDNS_HOST: ${{ secrets.EDGEDNS_HOST }}
           LKE_CP_ACL_IPV4: ${{ secrets.LKE_CP_ACL_IPV4 }}
           LKE_APL_FIREWALL_INBOUND_RULES: ${{ secrets.LKE_APL_FIREWALL_INBOUND_RULES }}
+          BYO_GIT_PAT: ${{ secrets.BYO_GIT_PAT }}
+          BYO_GIT_URL: ${{ secrets.BYO_GIT_URL }}
         run: |
           touch values.yaml
           adminPassword="$(head /dev/urandom | tr -dc 'A-Za-z0-9' | head -c 24)"
@@ -348,6 +366,12 @@ jobs:
             fi
           fi
 
+          if [[ '${{ inputs.BYO_GIT }}' == 'true' ]]; then
+            install_args+=(--set otomi.git.repoUrl="$BYO_GIT_URL")
+            install_args+=(--set otomi.git.password="$BYO_GIT_PAT")
+            install_args+=(--set otomi.git.branch="$DOMAIN")
+          fi
+
           if [[ -n '${{ env.LKE_APL_FIREWALL_INBOUND_RULES }}' ]]; then
             install_args+=(--set-json apps.linode-cfw._rawValues.firewall.inbound='${{ env.LKE_APL_FIREWALL_INBOUND_RULES }}')
           fi

From a1bc7899dd81676647af66cef6ab59fd448b2cea Mon Sep 17 00:00:00 2001
From: Jehoszafat Zimnowoda <17126497+j-zimnowoda@users.noreply.github.com>
Date: Thu, 9 Jul 2026 14:30:52 +0200
Subject: [PATCH 2/3] ci: add BYO_GIT checkbox to the Deploy APL action

---
 .github/workflows/integration.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 15ff598b8e..09d9bfddf7 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -110,7 +110,7 @@ on:
         type: boolean
         default: true
       BYO_GIT:
-        description: 'Check the box to use a custom git repository (requires BYO_GIT_PAT and BYO_GIT_URL secrets)'
+        description: 'Use external values repo instead of the default'
         type: boolean
         default: false
 

From 89b749cc670b4c1a5ae18d18481e23384d4cbc38 Mon Sep 17 00:00:00 2001
From: Jehoszafat Zimnowoda <17126497+j-zimnowoda@users.noreply.github.com>
Date: Thu, 9 Jul 2026 15:09:31 +0200
Subject: [PATCH 3/3] ci: add BYO_GIT checkbox to the Deploy APL action

---
 .github/workflows/integration.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 09d9bfddf7..21e25c8e63 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -110,7 +110,7 @@ on:
         type: boolean
         default: true
       BYO_GIT:
-        description: 'Use external values repo instead of the default'
+        description: 'BYO git. Use predefined external values repo with branch named after the cluster.domainSuffix'
         type: boolean
         default: false