feat(argocd): add argocd-wait-sync-multi action for concurrent rollout verification

[JesperTerkelsen]

What

New composite action argocd-wait-sync-multi — waits concurrently for many ArgoCD apps to sync and become healthy at an expected git revision, fails fast, and emits one aggregated per-app timing JSON.

It's the multi-app sibling of argocd-wait-sync (which is left untouched — it's pinned @main by many deploy pipelines, so zero risk to them). This action reuses the same proven per-app state machine (refresh → detect our revision → wait Synced+Healthy), the same fail-fast conditions, and the same supersede-via-git-ancestry check, generalized to N apps in one job.

Why

For repos where one workflow run deploys several apps (e.g. a monorepo that bumps many services in a single manifests commit), we want one job that verifies every app rolled out healthy and hands the per-app start/end timing to a downstream step (e.g. a release changelog). A single-app-in-a-matrix approach can't aggregate outputs; this can.

Key addition: multi-source support

Multi-source ArgoCD apps (spec.sources[], e.g. a chart source + a separate manifests/image-values source) leave .status.sync.revision empty and report one revision per source in .status.sync.revisions[]. The new source-repo input selects which source's revision to verify against (by repoURL substring). Single-source apps omit it and use the singular field — identical to argocd-wait-sync.

Outputs

deployments: [{ name, app, revision, start, end, status, url }] (ISO 8601 UTC).

Fail-fast

Exits non-zero the moment any app is Degraded / Missing / operation Failed/Error / manifests diverged, or on overall timeout with any app not yet healthy. Transient Unknown (≤30s) and ComparisonError (≤60s, with hard refresh) are tolerated.

Tests

• Offline fixture suite (test/run-tests.sh) — multi-source extraction, two-phase progress→healthy, fail-fast on Degraded, single-source backward compat, input validation. Passes on bash 3.2 and 5.x; shellcheck clean.
• Live harness (test-local.sh) for validation against argocd.monta.app.

Not in this PR

The caller wiring (monorepo-typescript wait-rollout job) lands separately, after a live run + observe-only soak against real deploys.

Notes for reviewers

• No existing workflow/action is modified except a CLAUDE.md changelog entry.
• argocd-wait-sync behavior is unchanged (not touched). A future follow-up can refactor it to share this core.

🤖 Generated with Claude Code