Documentation
¶
Index ¶
- Variables
- func CompareRevisions(revision string, targetRevision string) bool
- func GetAPIURLRegex(apiURL string) (*regexp.Regexp, error)
- func GetWebURLRegex(webURL string) (*regexp.Regexp, error)
- func NormalizeOCI(url string) string
- func ParseRevision(ref string) string
- type ArgoCDWebhookHandler
- type Extractor
- type GHCRParser
- type GHCRPayload
- type HarborEventData
- type HarborPayload
- type HarborRepository
- type HarborResource
- type RegistryEvent
Constants ¶
This section is empty.
Variables ¶
var ErrHMACVerificationFailed = errors.New("HMAC verification failed")
ErrHMACVerificationFailed is returned when a registry webhook signature check fails.
var ErrSecretVerificationFailed = errors.New("secret verification failed")
ErrSecretVerificationFailed is returned when a registry webhook's pre-shared secret check fails. Unlike ErrHMACVerificationFailed it does not imply a signed payload: it covers registries such as Docker Hub that cannot sign their payloads and can only be authenticated with a secret supplied alongside the request.
Functions ¶
func CompareRevisions ¶
func GetAPIURLRegex ¶
GetAPIURLRegex compiles a regex that will match any targetRevision referring to the same repo as the given apiURL.
func GetWebURLRegex ¶
GetWebURLRegex compiles a regex that will match any targetRevision referring to the same repo as the given webURL. webURL is expected to be a URL from an SCM webhook payload pointing to the web page for the repo.
func NormalizeOCI ¶
NormalizeOCI normalizes an OCI repository URL for comparison.
It removes the oci:// prefix, converts to lowercase, and removes any trailing slash to ensure consistent matching between webhook events and Application source URLs.
func ParseRevision ¶
Types ¶
type ArgoCDWebhookHandler ¶
type ArgoCDWebhookHandler struct {
sync.WaitGroup // for testing
// contains filtered or unexported fields
}
func NewHandler ¶
func NewHandler(namespace string, applicationNamespaces []string, webhookParallelism int, webhookRefreshWorkers int, appClientset appclientset.Interface, appsLister alpha1.ApplicationLister, set *settings.ArgoCDSettings, settingsSrc settingsSource, repoCache *cache.Cache, serverCache *servercache.Cache, argoDB db.ArgoDB, maxWebhookPayloadSizeB int64, webhookRefreshJitter time.Duration, webhookRefreshJitterThreshold int, appProjectsLister alpha1.AppProjectNamespaceLister) *ArgoCDWebhookHandler
func (*ArgoCDWebhookHandler) HandleEvent ¶
func (a *ArgoCDWebhookHandler) HandleEvent(payload any)
HandleEvent handles webhook events for repo push events
func (*ArgoCDWebhookHandler) HandleRegistryEvent ¶ added in v3.5.0
func (a *ArgoCDWebhookHandler) HandleRegistryEvent(event *RegistryEvent)
HandleRegistryEvent processes a normalized registry event and refreshes matching Argo CD Applications.
It constructs the full OCI repository URL from the event, finds Applications whose sources reference that repository and revision, and triggers a refresh for each matching Application. Namespace filters are applied according to the handler configuration.
func (*ArgoCDWebhookHandler) Handler ¶
func (a *ArgoCDWebhookHandler) Handler(w http.ResponseWriter, r *http.Request)
func (*ArgoCDWebhookHandler) Shutdown ¶ added in v3.5.0
func (a *ArgoCDWebhookHandler) Shutdown()
Shutdown gracefully shuts down the webhook handler by closing queues and waiting for workers
type Extractor ¶ added in v3.5.0
Extractor dispatches a webhook request to the matching provider.
CanHandle inspects request headers to decide whether this parser owns the request. Parse extracts the provider-specific payload. On verification failures it either emits a security-audit log line directly or returns a known sentinel error (e.g. ErrHMACVerificationFailed) that the caller logs centrally. A (nil, nil) return signals a request that was claimed but intentionally skipped (e.g. an unsupported sub-event).
type GHCRParser ¶
type GHCRParser struct {
// contains filtered or unexported fields
}
GHCRParser parses webhook payloads sent by GitHub Container Registry (GHCR).
It extracts container image publication events from GitHub package webhooks and converts them into a normalized RegistryEvent structure.
func NewGHCRParser ¶
func NewGHCRParser(secret string) *GHCRParser
NewGHCRParser creates a new ghcrParser instance.
The parser supports GitHub package webhook events for container images published to GitHub Container Registry (ghcr.io).
func (*GHCRParser) CanHandle ¶
func (p *GHCRParser) CanHandle(r *http.Request) bool
CanHandle reports whether the HTTP request corresponds to a GHCR webhook.
It checks the GitHub event header and returns true for package-related events that may contain container registry updates.
func (*GHCRParser) Parse ¶
func (p *GHCRParser) Parse(r *http.Request) (any, error)
Parse validates the request signature and extracts container publication details from a GHCR webhook payload.
The method expects a GitHub package event with action "published" for a container package. It returns a normalized RegistryEvent containing the registry host, repository, and tag. Returns nil, nil for events that are intentionally skipped (unsupported actions, non-container packages, or missing tags). Only returns an error for genuinely malformed payloads or signature verification failures.
type GHCRPayload ¶ added in v3.5.0
type GHCRPayload struct {
Action string `json:"action"`
Package struct {
Name string `json:"name"`
PackageType string `json:"package_type"`
Owner struct {
Login string `json:"login"`
} `json:"owner"`
PackageVersion struct {
ContainerMetadata struct {
Tag struct {
Name string `json:"name"`
} `json:"tag"`
} `json:"container_metadata"`
} `json:"package_version"`
} `json:"package"`
}
GHCRPayload represents the webhook payload sent by GitHub for package events.
type HarborEventData ¶
type HarborEventData struct {
Resources []HarborResource `json:"resources"`
Repository HarborRepository `json:"repository"`
}
HarborEventData holds the resources and repository information from a Harbor webhook event.
type HarborPayload ¶
type HarborPayload struct {
// Type is the event type, e.g. "PUSH_ARTIFACT", "PULL_ARTIFACT", "DELETE_ARTIFACT".
Type string `json:"type"`
OccurAt int64 `json:"occur_at"`
Operator string `json:"operator"`
EventData HarborEventData `json:"event_data"`
}
HarborPayload represents the Default format payload sent by Harbor webhooks (Harbor 2.x). See https://goharbor.io/docs/2.12.0/working-with-projects/project-configuration/configure-webhooks/
type HarborRepository ¶
type HarborRepository struct {
Name string `json:"name"`
Namespace string `json:"namespace"`
RepoFullName string `json:"repo_full_name"`
RepoType string `json:"repo_type"`
DateCreated int64 `json:"date_created"`
}
HarborRepository describes the repository associated with a Harbor webhook event.
type HarborResource ¶
type HarborResource struct {
Digest string `json:"digest"`
Tag string `json:"tag"`
ResourceURL string `json:"resource_url"`
}
HarborResource describes a single artifact resource within a Harbor webhook event.
type RegistryEvent ¶ added in v3.5.0
type RegistryEvent struct {
// RegistryURL is the hostname of the registry, without protocol or trailing slash.
// e.g. "ghcr.io", "docker.io", "123456789.dkr.ecr.us-east-1.amazonaws.com"
// Together with Repository, it forms the OCI repo URL: oci://RegistryURL/Repository.
// Parsers must ensure this value is consistent with how users configure repoURL
// in their Argo CD Applications (e.g. oci://ghcr.io/owner/repo).
RegistryURL string `json:"registryUrl,omitempty"`
// Repository is the full repository path within the registry, without a leading slash.
// e.g. "owner/repo" for ghcr.io, "library/nginx" for docker.io.
// Together with RegistryURL, it forms the OCI repo URL: oci://RegistryURL/Repository.
Repository string `json:"repository,omitempty"`
// Tag is the image tag
// eg. 0.3.0
Tag string `json:"tag,omitempty"`
}
RegistryEvent represents a normalized container registry webhook event.
It captures the essential information needed to identify an OCI artifact update, including the registry host, repository name, tag, and optional content digest. This structure is produced by registry-specific parsers and consumed by the registry webhook handler to trigger application refreshes.
func (*RegistryEvent) OCIRepoURL ¶ added in v3.5.0
func (e *RegistryEvent) OCIRepoURL() string
OCIRepoURL returns the full OCI repository URL for use in Argo CD Application source matching, e.g. "oci://ghcr.io/owner/repo".
Source Files