Docs

ArgoCD

Description

The argocd crawler looks recursively for every .yaml and .yml file from a root directory, and proposes an update for each Helm chart it finds declared in an ArgoCD application.

A source is picked up when repoURL, chart, and targetRevision are all set. It is read from any of:

  • spec.source and spec.sources[] - ArgoCD Application

  • spec.template.spec.source and spec.template.spec.sources[] - ArgoCD ApplicationSet

Multi-document YAML files are supported; each document is addressed by index in the generated manifest.

This crawler is enabled by default, so it can be used either automatically by running updatecli diff from a directory containing the files to update, or by providing a manifest. The automatic discovery behavior can be tuned by providing a YAML manifest with an argocd crawler in top-level directive autodiscovery as explained in the "Autodiscovery" page.

Important
Matching is structural, not by resource kind. apiVersion and kind are not checked, so any YAML document exposing spec.source.repoURL, .chart, and .targetRevision is treated as an ArgoCD application. Use only or ignore to narrow the scan when that is too broad.

Generated manifests

Each discovered chart produces a helmchart source, two yaml conditions, and one yaml target:

  • Source - the latest chart version from the repository declared by repoURL.

  • Conditions - assert that .chart and .repoURL still hold the expected values, so the target is skipped if the application has been edited in the meantime.

  • Target - writes the new version to .targetRevision.

A repoURL with no URL scheme is treated as an OCI registry and rewritten to oci://<repoURL>, matching ArgoCD’s own behaviour.

Authentication

Use auths to reach private chart repositories. Entries are keyed by registry host, domain[:port] without a scheme, and accept either a token or a username/password pair. Credentials are propagated into every generated source spec.

Warning
Only the host part of the URL is used for the credential lookup, so one entry applies to every chart served by that host.

Version filtering

If unspecified, the version filter defaults to kind semver with pattern *, since Helm charts are expected to follow semantic versioning.

More details on the "Version Filtering" page.

Limitations

  • Only Helm chart sources are handled. Git, Kustomize, and directory sources have no chart field and are ignored.

  • Sources missing any of repoURL, chart, or targetRevision are skipped.

Manifest

Parameters

NameTypeDescriptionRequired
authsobject

Auths holds a map of registry credentials where the key is the registry host (domain[:port]) without scheme.

Please be aware that only the host part of the URL is used to lookup for authentication credentials.

Example:

auths:
  "my-helm-repo.com":
    token: "my-secret-token"
  "my-second-helm-repo.com":
    username: "username"
    password: "my-secret-password"
    tokenstring
ignorearrayignore allows to specify rule to ignore autodiscovery a specific Argocd manifest based on a rule
    chartsobjectCharts specifies the list of Helm Chart repository to check
    pathstringPath specifies a Argocd file path pattern, the pattern requires to match all of name, not just a subpart of the path.
    repositoriesarrayRepositories specifies the list of Helm Chart repository to check
onlyarrayonly allows to specify rule to only autodiscover manifest for a specific ArgoCD manifest based on a rule
    chartsobjectCharts specifies the list of Helm Chart repository to check
    pathstringPath specifies a Argocd file path pattern, the pattern requires to match all of name, not just a subpart of the path.
    repositoriesarrayRepositories specifies the list of Helm Chart repository to check
rootdirstringrootDir defines the root directory used to recursively search for ArgoCD manifest
versionfilterobject
    kindstringspecifies the version kind such as semver, regex, or latest
    patternstringspecifies the version pattern according the version kind for semver, it is a semver constraint for regex, it is a regex pattern for time, it is a date format
    regexstringspecifies the regex pattern, used for regex/semver and regex/time. Output of the first capture group will be used.
    replaceallobjectreplaceAll applies a regex replacement to version strings before filtering. This is useful for transforming versions (e.g., curl-8_15_0 to curl-8.15.0) before regex extraction.
        patternstringPattern specifies the regex pattern to match for replacement
        replacementstringReplacement specifies the replacement string (supports $1, $2, etc. for captured groups)
    strictbooleanstrict enforce strict versioning rule. Only used for semantic versioning at this time
⚠ This table is generated from the Updatecli codebase and may contain inaccurate data. Feel free to report them on github.com/updatecli/updatecli
Note
only and ignore rules accept path (a file path pattern that must match the whole path), charts (a map of chart name to version), and repositories (a list of chart repository URLs). Conditions within a rule are combined, and rules are evaluated independently.

Example

# updatecli.d/default.yaml
name: Argocd Autodiscovery Example

autodiscovery:
  # scmid is applied to all crawlers
  scmid: default
  # actionid is applied to all crawlers
  actionid: default
  crawlers:
    argocd:
      # To ignore specific path
      ignore:
        # Ignore manifest match path "dev/*.yaml"
        - path: dev/*.yaml
        # Ignore any Helm chart named "kubewarden-crds"
        - charts:
            "kubewarden-crds": ""
        # Ignore any helm chart repository named "https://charts.jetstack.io"
        - repositories:
            - "https://charts.jetstack.io"

        # Ignore any Helm chart named "kubewarden-crds" in manifest path "dev/*.yaml"
        - path: dev/*.yaml
          charts:
            "kubewarden-crds": ""
      # Only accepts the same rule than ignore
      #only:
      #  - path: helmfile.d/*
      #  - charts:
      #      "kubewarden-crds": ""
      #  - repositories:
      #      - "https://charts.jetstack.io"
      #
scms:
  default:
    kind: github
    spec:
      owner: updatecli
      repository: updatecli
      token: '{{ requiredEnv "GITHUB_TOKEN" }}'
      branch: "main"
    
actions:
    default:
        kind: "github/pullrequest"
        spec:
            labels:
                - "dependencies"
            mergemethod: "squash"
        scmid: "default"
Last updated on July 30, 2026
Prev
GitHub Action
Next
Bazel