ArgoCD Diff GitHub Action

This action generates a diff between the PR and the state of the cluster for any Applications that are sourced from the repo that the action is running in.

Note: This includes any changes between the head branch (i.e., the feature branch) and the base branch (i.e., the trunk, e.g., main), as well as ways in which the cluster is out-of-sync. Essentially, any diff from an Application that is sourced from the repo.

This is forked from quizlet/argocd-diff-action which has not had a change since 2021-12-14.

Usage

Example GH action:

# .github/workflows/checks.yml
name: Checks

on:
  pull_request:
    branches: [main]

jobs:
  argocd-diff:
    name: Generate ArgoCD Diff
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: argocd-diff-action/argocd-diff-action@v0
        with:
          argocd-exclude-paths: 'path/to/exclude,'
          argocd-extra-cli-args: '--grpc-web'
          argocd-headers: 'Authorization: ${{ secrets.ARGO_CD_AUTHORIZATION_TOKEN }},SomeOtherHeader: some-value'
          argocd-server-fqdn: 'argocd.example.com'
          argocd-token: '${{ secrets.ARGOCD_TOKEN }}'
          github-token: '${{ secrets.GITHUB_TOKEN }}'
          timezone: 'America/Toronto'

Inputs

Name	Required	Default	Description
argocd-exclude-paths	false		ArgoCD app paths to exclude in comma separated list
argocd-extra-cli-args	false	--grpc-web	Extra arguments to pass to the argocd CLI
argocd-headers	false		A list of headers to pass to argocd
argocd-server-fqdn	true		ArgoCD server FQDN (i.e., without the protocol)
argocd-server-tls	false	true	Use TLS to communicate with ArgoCD
argocd-token	true		ArgoCD token for a local or project-scoped user https://argoproj.github.io/argo-cd/operator-manual/user-management/#local-usersaccounts-v15
argocd-version	false		argocd command version to install. Defaults to the server version.
github-token	true		Github Token
target-revisions	false	master,main,HEAD	A comma-separated list of branches to consider "HEAD"
timezone	false	America/Toronto	Timezone string used for dates in the github comment.

Outputs

Name	Description

Compatibility

• Requires argocd-version >= v2.1.0 to support use of the --exit-code=false option on app diff.

How it works

1. Downloads the ArgoCD binary, makes it executable and authenticates the Server.
2. Fetches all the Applications from the ArgoCD API using the argocd-token.
3. Filters the Applications to the ones that are sourced from the current repo (using the context of the action), targeting the trunk of the repo, and are not in an excluded path.
4. Runs argocd app diff --local <path> for each Application.
5. If in the Application diff there is an Application with a change to its targetRevision, get the diff for it using --revision.
   • Note that this won't include any other changes to the App of App (e.g., Helm value changes).
6. Posts the diff output as a comment on the PR (updating the same comment if it already exists).

Releases & Publishing

Releases are automated using semantic-release via the release.yml workflow and the .releaserc config file.

Each release will create a semver tag (e.g., 0.2.0) and update the floating major version tag (e.g., v0) associated with it.

The action is in early development (v0), which means there may be breaking changes introduced at any time. It's suggested to pin to the semver release tag until the release of v1.

Contributing

All commits must conform to the Angular commit convention and be done through a PR. Given this, the use of Rebase and merge is preferred to capture each semantic commit in a PR in the changelog.

Check commit-analyzer plugin configuration to see which types cause what releases.

Local Development

1. Install nvm
2. Activate the correct node version nvm install && nvm use
3. Install dependencies pnpm i --frozen-lockfile
4. Run tests pnpm run test

Note these are unit tests that, currently, cover a small portion of the code base. This will also run on every PR.