Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrHMACVerificationFailed = errors.New("HMAC verification failed")
ErrHMACVerificationFailed is returned when a registry webhook signature check fails.
Functions ¶
func GetAPIURLRegex ¶
GetAPIURLRegex compiles a regex that will match any targetRevision referring to the same repo as the given apiURL.
func GetWebURLRegex ¶
GetWebURLRegex compiles a regex that will match any targetRevision referring to the same repo as the given webURL. webURL is expected to be a URL from an SCM webhook payload pointing to the web page for the repo.
func ParseRevision ¶
Types ¶
type ArgoCDWebhookHandler ¶
type ArgoCDWebhookHandler struct {
sync.WaitGroup // for testing
// contains filtered or unexported fields
}
func NewHandler ¶
func NewHandler(namespace string, applicationNamespaces []string, webhookParallelism int, webhookRefreshWorkers int, appClientset appclientset.Interface, appsLister alpha1.ApplicationLister, set *settings.ArgoCDSettings, settingsSrc settingsSource, repoCache *cache.Cache, serverCache *servercache.Cache, argoDB db.ArgoDB, maxWebhookPayloadSizeB int64, webhookRefreshJitter time.Duration, webhookRefreshJitterThreshold int) *ArgoCDWebhookHandler
func (*ArgoCDWebhookHandler) HandleEvent ¶
func (a *ArgoCDWebhookHandler) HandleEvent(payload any)
HandleEvent handles webhook events for repo push events
func (*ArgoCDWebhookHandler) HandleRegistryEvent ¶
func (a *ArgoCDWebhookHandler) HandleRegistryEvent(event *RegistryEvent)
HandleRegistryEvent processes a normalized registry event and refreshes matching Argo CD Applications.
It constructs the full OCI repository URL from the event, finds Applications whose sources reference that repository and revision, and triggers a refresh for each matching Application. Namespace filters are applied according to the handler configuration.
func (*ArgoCDWebhookHandler) Handler ¶
func (a *ArgoCDWebhookHandler) Handler(w http.ResponseWriter, r *http.Request)
func (*ArgoCDWebhookHandler) Shutdown ¶
func (a *ArgoCDWebhookHandler) Shutdown()
Shutdown gracefully shuts down the webhook handler by closing queues and waiting for workers
type Extractor ¶
Extractor dispatches a webhook request to the matching provider.
CanHandle inspects request headers to decide whether this parser owns the request. Parse extracts the provider-specific payload. On verification failures it either emits a security-audit log line directly or returns a known sentinel error (e.g. ErrHMACVerificationFailed) that the caller logs centrally. A (nil, nil) return signals a request that was claimed but intentionally skipped (e.g. an unsupported sub-event).
type GHCRPayload ¶
type GHCRPayload struct {
Action string `json:"action"`
Package struct {
Name string `json:"name"`
PackageType string `json:"package_type"`
Owner struct {
Login string `json:"login"`
} `json:"owner"`
PackageVersion struct {
ContainerMetadata struct {
Tag struct {
Name string `json:"name"`
} `json:"tag"`
} `json:"container_metadata"`
} `json:"package_version"`
} `json:"package"`
}
GHCRPayload represents the webhook payload sent by GitHub for package events.
type RegistryEvent ¶
type RegistryEvent struct {
// RegistryURL is the hostname of the registry, without protocol or trailing slash.
// e.g. "ghcr.io", "docker.io", "123456789.dkr.ecr.us-east-1.amazonaws.com"
// Together with Repository, it forms the OCI repo URL: oci://RegistryURL/Repository.
// Parsers must ensure this value is consistent with how users configure repoURL
// in their Argo CD Applications (e.g. oci://ghcr.io/owner/repo).
RegistryURL string `json:"registryUrl,omitempty"`
// Repository is the full repository path within the registry, without a leading slash.
// e.g. "owner/repo" for ghcr.io, "library/nginx" for docker.io.
// Together with RegistryURL, it forms the OCI repo URL: oci://RegistryURL/Repository.
Repository string `json:"repository,omitempty"`
// Tag is the image tag
// eg. 0.3.0
Tag string `json:"tag,omitempty"`
}
RegistryEvent represents a normalized container registry webhook event.
It captures the essential information needed to identify an OCI artifact update, including the registry host, repository name, tag, and optional content digest. This structure is produced by registry-specific parsers and consumed by the registry webhook handler to trigger application refreshes.
func (*RegistryEvent) OCIRepoURL ¶
func (e *RegistryEvent) OCIRepoURL() string
OCIRepoURL returns the full OCI repository URL for use in Argo CD Application source matching, e.g. "oci://ghcr.io/owner/repo".
Source Files