How-To2026-09-0511 min read

How to Set Up a GitOps Workflow in GitHub

GitOps treats your Git repository as the single source of truth for infrastructure and application state. Instead of making ad-hoc changes through CLIs, consoles, or scripts, every change goes through a pull request, gets reviewed, and is automatically applied when merged. This gives you an audit trail, rollback capability, and the same review process for infrastructure that you already have for application code.

The core GitOps principle is declarative configuration versioned in Git with automated reconciliation. GitHub provides the platform — repositories for state, pull requests for review, Actions for automation — and tools like Flux or ArgoCD provide the reconciliation. This guide focuses on setting up the GitHub side of the GitOps workflow so your team can manage deployments through PRs.

Step-by-step guide

01

Create a dedicated configuration repository

Create a new GitHub repository for your deployment configurations (e.g., infrastructure-config or gitops-deployments). Structure it with directories for each environment: base/ for shared configurations, staging/ for staging overrides, and production/ for production overrides. This repository contains only declarative configuration (Kubernetes manifests, Terraform files, Helm values) — no application source code. Separating config from code gives each its own review and merge cadence.

  • Create the repository with a clear README explaining the directory structure
  • Add base/, staging/, and production/ directories
  • Set branch protection requiring reviews and status checks on main
02

Define the directory structure for environment promotion

Use a Kustomize or Helm-based overlay pattern where base/ contains the default configuration and environment directories contain only the overrides. For example, base/ has the Kubernetes deployment with 1 replica and production/ has an overlay that sets replicas to 3. This pattern minimizes duplication and makes it clear what differs between environments. Changes flow from staging to production through separate PRs, creating explicit promotion gates.

03

Set up GitHub Actions for validation on pull requests

Create a workflow at .github/workflows/validate.yml that runs on pull_request events. The workflow should lint configuration files (yamllint, kubeval, terraform validate), run a dry-run or plan to show what would change, and post the diff as a PR comment. This gives reviewers visibility into the actual impact of a configuration change before they approve. No change should merge without passing validation.

  • Add a linting step for YAML/JSON syntax validation
  • Add a dry-run step that shows the planned changes
  • Post the plan output as a PR comment using the github-script action
04

Configure automated deployment on merge to main

Create a workflow at .github/workflows/deploy.yml that triggers on push to main. The workflow determines which environment was affected (by checking which directory was modified), runs the appropriate deployment command (kubectl apply, terraform apply, helm upgrade), and reports the result. For Kubernetes, the preferred approach is to install Flux or ArgoCD in the cluster and point it at this repository so the cluster continuously reconciles to the declared state.

05

Implement environment promotion with branch protection

Configure branch protection on main to require at least two approvals for production changes (detected by modifications to the production/ directory). Add CODEOWNERS rules mapping staging/ to the engineering team and production/ to the platform or SRE team. This ensures that production changes get appropriate review while staging changes can move faster. The PR-based workflow creates a natural audit trail of who approved what change and when.

06

Set up drift detection and automated reconciliation

Configure your GitOps controller (Flux or ArgoCD) to periodically compare the desired state in Git with the actual state in the cluster and alert on drift. Enable auto-reconciliation so that manual changes made outside of Git are automatically reverted to the declared state. Add a GitHub Actions workflow that runs on a cron schedule to check for drift and open an issue if the actual state does not match Git. This ensures Git remains the true source of truth.

Common mistakes

Storing secrets in the GitOps repository

Configuration files in Git should not contain passwords, API keys, or certificates. Use a secrets management solution like Sealed Secrets, SOPS, or an external secrets operator that references secrets from a vault. The GitOps repo contains encrypted references, not plaintext secrets.

Mixing application code and infrastructure config

When application code and deployment configuration live in the same repository, every application commit triggers a deployment pipeline even if nothing about the deployment changed. Separate repositories let each artifact move at its own pace and be reviewed by the appropriate team.

Not validating changes before merge

Without PR validation, a syntactically invalid YAML file can merge and break the deployment pipeline. Always run linting, schema validation, and a dry-run/plan in the PR workflow. The cost of validation is minutes; the cost of a broken deployment is hours.

Allowing manual changes outside of Git

If team members can make changes directly in the console or via CLI, the Git repository no longer represents the actual state. Enable drift detection and auto-reconciliation to enforce that Git is the only change pathway. Manual changes should be automatically reverted.

Tips

Use GitHub's environment protection rules to add manual approval gates for production deployments — the deploy workflow waits for an authorized approver before applying production changes.

Add a Makefile or Taskfile to the config repository with common operations (validate, diff, apply) so developers use consistent commands instead of memorizing CLI flags.

Use Git commit signing (GPG or SSH) for the config repository to ensure that deployment changes are verifiably authored by team members.

Create a #gitops-deploys Slack channel and configure GitHub Actions to post deployment notifications there so the team has real-time visibility into what is being deployed.

How Vantage helps

Vantage generates implementation tickets with deployment context, including infrastructure requirements and rollout considerations. When a PRD involves infrastructure changes, Vantage-generated tickets can specify the configuration changes needed in the GitOps repository, bridging product requirements to infrastructure execution.

Frequently asked questions

Spend less time on setup, more on decisions

Vantage connects your tools and generates specs grounded in real data. Free to start.

Free to start. No credit card required.

Related reading