{
  "slug": "application-toggle-auto-sync-resource-action-036002c5012a",
  "title": "Application toggle-auto-sync resource action",
  "tools": [
    "argocd"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-08-04T08:35:57.000Z",
  "announced_at": "2026-08-04T08:35:57.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When a role needs to toggle an Application's auto-sync without broad update access, grant the dedicated action permission and run `toggle-auto-sync` on the Application. Disabling saves the documented auto-sync settings, while enabling restores saved settings when present.",
    "examples": [
      "p, role:dev, applications, action/argoproj.io/Application/toggle-auto-sync, */*, allow",
      "argocd app actions run <APPNAME> toggle-auto-sync --kind Application --group argoproj.io"
    ],
    "gotchas": [
      "Version: v3.5.0",
      "applications (required): RBAC resource on which the action permission applies.",
      "action/argoproj.io/Application/toggle-auto-sync (required): Action path; format is `action/<group>/<kind>/<action-name>`.",
      "<APPNAME> (required): Application name.",
      "toggle-auto-sync (required): Action name to run.",
      "--kind Application (required): Selects the resource kind; `--kind` is the required filter.",
      "--group argoproj.io: Selects the resource API group.",
      "--resource-name <RESOURCE>: Filters by resource name.",
      "--namespace <NAMESPACE>: Filters by resource namespace.",
      "--all: Runs the action on all matching resources when more than one matches.",
      "Prerequisite: Resource actions are controlled with the RBAC `action` action; the permission path uses `action/<group>/<kind>/<action-name>`.",
      "Prerequisite: The CLI command requires `--kind`; other resource filters are optional. Actions run only on resources represented in Git and cannot run on child resources."
    ]
  },
  "why_it_matters": "Grant a role permission to toggle autosync on an Application without granting broad application update permission.",
  "before": "Toggling auto-sync required the broad `application update` permission.",
  "sources": [
    "https://github.com/argoproj/argo-cd/releases/tag/v3.5.0",
    "https://github.com/argoproj/argo-cd/pull/26477",
    "https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/rbac.md",
    "https://argo-cd.readthedocs.io/en/release-3.4/user-guide/commands/argocd_app_actions_run/"
  ],
  "rank": 0.97038,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1b-20261016",
    "verdict_id": "wave1b-20261016:wave1b-20261016-3e6f19ea3fbe0298-7:gate",
    "evidence_hash": "59e3de6b8157068242cc7e1fc3500773d71abd7a18e450e1c7bab99d2b03c82d"
  },
  "review": {
    "draft_hash": "a0e47f7c1a382cd62fdadde524390f547ee2392cf2e0e39fddd1e00d47c69360",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave1b-20261016:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.97 >= 0.9; 2 needed) and Jev gave 0.77 (>= 0.6 needed)."
  }
}