Argo CD webhook support for GHCR

Introduced 2026-08-04 · score 0.97

HOW TO USE IT

When GHCR artifacts are published, configure a GitHub repository webhook to POST package events to `https://<argocd-server>/api/webhook` with content type `application/json` and Packages enabled. Set the same webhook secret in GitHub and `argocd-secret` as `webhook.github.secret`; only published container package events trigger refreshes for matching Applications.

GitHub repository → Settings → Webhooks → Add webhook; Payload URL: `https://<argocd-server>/api/webhook`; Content type: `application/json`; Secret: `<your-webhook-secret>`; Events: select individual events and enable Packages.

apiVersion: v1
kind: Secret
metadata:
  name: argocd-secret
  namespace: argocd
type: Opaque
stringData:
  webhook.github.secret: <your-webhook-secret>

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: <app-name>
spec:
  source:
    repoURL: oci://ghcr.io/<owner>/<image>
    targetRevision: <tag-or-semver-constraint>
  destination:
    server: https://kubernetes.default.svc
    namespace: <namespace>

WHY THIS HELPS

Use a GHCR image update event to trigger an Argo CD webhook workflow.

REQUIREMENTS AND LIMITATIONS

Version: v3.5.0
Payload URL (required): GitHub webhook endpoint: `https://<argocd-server>/api/webhook`.
Content type (required): Set to `application/json`.
Packages event (required): Enable Packages under individual webhook events; only `published` events for `container` packages trigger refresh.
webhook.github.secret: Shared GitHub webhook secret in `argocd-secret`; use the same value configured on the webhook. Secret configuration is optional; recommended if Argo CD is publicly accessible.
spec.source.repoURL (required): OCI repository URL that matches the GHCR image, for example `oci://ghcr.io/<owner>/<image>`.
spec.source.targetRevision (required): Exact tag or supported semver constraint used to match pushed artifacts.
Prerequisite: GHCR image repository must be linked to an associated GitHub repository; webhook events are registered on that GitHub repository, not directly on GHCR.
Prerequisite: Artifacts with unknown media types do not produce GitHub package webhook events; only `published` container package events are handled.

FIRST-PARTY EVIDENCE

Check the installed version and the source before using it. Entry JSON

Report a problem with this card

Tools change faster than your agent’s training data.

Changes

Argo CD webhook support for GHCR