ArgoCD Diff GitHub Action

This action generates a diff between the PR and the state of the cluster for any Applications that are sourced from the repo that the action is running in.

Note: This includes any changes between the head branch (i.e., the feature branch) and the base branch (i.e., the trunk, e.g., main), as well as ways in which the cluster is out-of-sync. Essentially, any diff from an Application that is sourced from the repo.

This is forked from quizlet/argocd-diff-action which has not had a change since 2021-12-14.

Example GH action:

# .github/workflows/checks.yml
name: Checks

on:
  pull_request:
    branches: [main]

jobs:
  argocd-diff:
    name: Generate ArgoCD Diff
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: argocd-diff-action/argocd-diff-action@v0
        with:
          argocd-exclude-paths: 'path/to/exclude,'
          argocd-extra-cli-args: '--grpc-web'
          argocd-headers: 'Authorization: ${{ secrets.ARGO_CD_AUTHORIZATION_TOKEN }},SomeOtherHeader: some-value'
          argocd-server-fqdn: 'argocd.example.com'
          argocd-token: '${{ secrets.ARGOCD_TOKEN }}'
          github-token: '${{ secrets.GITHUB_TOKEN }}'
          timezone: 'America/Toronto'

By default the action renders each app locally in the runner (argocd app diff --local). That fails for apps generated by a Config Management Plugin, because the plugin runs as a sidecar on the ArgoCD repo-server and its socket does not exist in the runner — you'll see an error like pluginname.sock: connect: connection refused.

Set argocd-server-side-generate: true to upload the checked-out repo and render manifests on the ArgoCD server instead. This also resolves apps whose manifests reference files outside their own source.path via relative paths, since the whole checkout is uploaded rather than just the app's directory.

# .github/workflows/argocd-diff.yml
name: ArgoCD Diff

on:
  pull_request:
    branches: [main]

jobs:
  argocd-diff:
    name: Generate ArgoCD Diff
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      # Install any tools your plugin needs locally here (e.g. kustomize, helm).
      - uses: argocd-diff-action/argocd-diff-action@v0
        with:
          argocd-server-fqdn: 'argocd.example.com'
          argocd-token: '${{ secrets.ARGOCD_TOKEN }}'
          github-token: '${{ secrets.GITHUB_TOKEN }}'
          argocd-server-side-generate: 'true'

Server-side generation streams the manifests over gRPC. If your ArgoCD ingress doesn't terminate gRPC-Web, drop --grpc-web from argocd-extra-cli-args (the default) and connect over plaintext gRPC instead — for example when targeting the in-cluster service directly:

        with:
          argocd-server-fqdn: 'argocd-server.argocd.svc.cluster.local'
          argocd-server-tls: 'false'
          argocd-extra-cli-args: ''
          argocd-server-side-generate: 'true'
          argocd-token: '${{ secrets.ARGOCD_TOKEN }}'
          github-token: '${{ secrets.GITHUB_TOKEN }}'

• Requires argocd-version >= v2.1.0 to support use of the --exit-code=false option on app diff.

1. Downloads the ArgoCD binary, makes it executable and authenticates the Server.
2. Fetches all the Applications from the ArgoCD API using the argocd-token.
3. Filters the Applications to the ones that are sourced from the current repo (using the context of the action), targeting the trunk of the repo, and are not in an excluded path.
4. Runs argocd app diff --local <path> for each Application (or --server-side-generate against the whole checkout when argocd-server-side-generate is enabled — required for Config Management Plugins).
5. If in the Application diff there is an Application with a change to its targetRevision, get the diff for it using --revision.
   • Note that this won't include any other changes to the App of App (e.g., Helm value changes).
6. Posts the diff output as a comment on the PR (updating the same comment if it already exists).

Releases are automated using semantic-release via the release.yml workflow and the .releaserc config file.

Each release will create a semver tag (e.g., 0.2.0) and update the floating major version tag (e.g., v0) associated with it.

The action is in early development (v0), which means there may be breaking changes introduced at any time. It's suggested to pin to the semver release tag until the release of v1.

All commits must conform to the Angular commit convention and be done through a PR. Given this, the use of Rebase and merge is preferred to capture each semantic commit in a PR in the changelog.

Check commit-analyzer plugin configuration to see which types cause what releases.

1. Install nvm
2. Activate the correct node version nvm install && nvm use
3. Install dependencies pnpm i --frozen-lockfile
4. Run tests pnpm run test

Note these are unit tests that, currently, cover a small portion of the code base. This will also run on every PR.