{
  "slug": "argo-cd-webhook-support-for-ghcr-ef462a2053c7",
  "title": "Argo CD webhook support for GHCR",
  "tools": [
    "argocd"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-08-04T08:35:57.000Z",
  "announced_at": "2026-08-04T08:35:57.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When GHCR artifacts are published, configure a GitHub repository webhook to POST package events to `https://<argocd-server>/api/webhook` with content type `application/json` and Packages enabled. Set the same webhook secret in GitHub and `argocd-secret` as `webhook.github.secret`; only published container package events trigger refreshes for matching Applications.",
    "examples": [
      "GitHub repository → Settings → Webhooks → Add webhook; Payload URL: `https://<argocd-server>/api/webhook`; Content type: `application/json`; Secret: `<your-webhook-secret>`; Events: select individual events and enable Packages.",
      "apiVersion: v1\nkind: Secret\nmetadata:\n  name: argocd-secret\n  namespace: argocd\ntype: Opaque\nstringData:\n  webhook.github.secret: <your-webhook-secret>",
      "apiVersion: argoproj.io/v1alpha1\nkind: Application\nmetadata:\n  name: <app-name>\nspec:\n  source:\n    repoURL: oci://ghcr.io/<owner>/<image>\n    targetRevision: <tag-or-semver-constraint>\n  destination:\n    server: https://kubernetes.default.svc\n    namespace: <namespace>"
    ],
    "gotchas": [
      "Version: v3.5.0",
      "Payload URL (required): GitHub webhook endpoint: `https://<argocd-server>/api/webhook`.",
      "Content type (required): Set to `application/json`.",
      "Packages event (required): Enable Packages under individual webhook events; only `published` events for `container` packages trigger refresh.",
      "webhook.github.secret: Shared GitHub webhook secret in `argocd-secret`; use the same value configured on the webhook. Secret configuration is optional; recommended if Argo CD is publicly accessible.",
      "spec.source.repoURL (required): OCI repository URL that matches the GHCR image, for example `oci://ghcr.io/<owner>/<image>`.",
      "spec.source.targetRevision (required): Exact tag or supported semver constraint used to match pushed artifacts.",
      "Prerequisite: GHCR image repository must be linked to an associated GitHub repository; webhook events are registered on that GitHub repository, not directly on GHCR.",
      "Prerequisite: Artifacts with unknown media types do not produce GitHub package webhook events; only `published` container package events are handled."
    ]
  },
  "why_it_matters": "Use a GHCR image update event to trigger an Argo CD webhook workflow.",
  "sources": [
    "https://github.com/argoproj/argo-cd/releases/tag/v3.5.0",
    "https://github.com/argoproj/argo-cd/blob/v3.5.0/docs/operator-manual/webhook.md"
  ],
  "rank": 0.97035,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3-rejudge+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1b-20261016",
    "verdict_id": "wave1b-20261016:wave1b-20261016-656f1cd605543c63-33:rescue",
    "evidence_hash": "07be7454f1632122a2ab9cf03b6223f667e5b8c46a3233bb371b89fc1a018727"
  },
  "review": {
    "draft_hash": "c6b4b53ba1b0964c3590faaea42cf054b7a82fa9468c644a48f4ed4dc6984dfe",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave1b-20261016:rescue",
    "reason": "Rescue path: first rejected only because the extracted card lacked usage; judged again on the enriched card, 3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.97 >= 0.9; 2 needed) and Jev gave 0.69 (>= 0.6 needed)."
  }
}