diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 0461156..792a1a6 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -28,14 +28,21 @@ jobs:
           docker login docker.pkg.github.com -u wahyd4 -p ${{ secrets.GITHUB_TOKEN }}
           docker push docker.pkg.github.com/wahyd4/scraper/app:v0.1.$GITHUB_RUN_NUMBER
 
-      - name: deploy cronjob to cluster
+      - name: update manifest
         uses: wahyd4/kubectl-helm-action@master
-        env:
-          KUBE_CONFIG_DATA: ${{ secrets.KUBE_CONFIG_DATA }}
         with:
           args: |
             IMAGE_VERSION=v0.1.$GITHUB_RUN_NUMBER
-            rm -rf tmp && mkdir tmp
-            cat manifest.yaml | sed "s/{{IMAGE_VERSION}}/${IMAGE_VERSION}/g" >  tmp/manifest.yaml
+            cat manifest-template.yaml | sed "s/{{IMAGE_VERSION}}/${IMAGE_VERSION}/g" >  manifest.yaml
             kubectl apply -f tmp/manifest.yaml -n apps
             rm -rf tmp
+
+      - name: Commit changes
+        uses: EndBug/add-and-commit@v7
+        with:
+          author_name: junv-repo-bot
+          author_email: me@toozhao.com
+          message: 'Update manifest'
+          add: 'manifest.yaml'
+          push: true
+          branch: master
diff --git a/manifest-template.yaml b/manifest-template.yaml
new file mode 100644
index 0000000..4c52b74
--- /dev/null
+++ b/manifest-template.yaml
@@ -0,0 +1,33 @@
+apiVersion: batch/v1beta1
+kind: CronJob
+metadata:
+  name: house-data-scraper
+spec:
+  # every Sunday 10:05 am
+  schedule: "5 0 * * 0"
+  jobTemplate:
+    spec:
+      backoffLimit: 0
+      template:
+        spec:
+          containers:
+            - name: data-scraper
+              image: "docker.pkg.github.com/wahyd4/scraper/app:{{IMAGE_VERSION}}"
+              imagePullPolicy: IfNotPresent
+              env:
+                - name: DB_USERNAME
+                  value: postgres
+                - name: DB_PASSWORD
+                  valueFrom: {secretKeyRef: {name: database-credentials, key: password}}
+                - name: PORT
+                  value: "5432"
+              resources:
+                requests:
+                  cpu: 50m
+                  memory: 126Mi
+                limits:
+                  cpu: 100m
+                  memory: 256Mi
+          restartPolicy: Never
+          imagePullSecrets:
+            - name: regcred