eldhugr/ArgoCD App

Drive the ArgoCD API (app set / diff / wait) natively in JavaScript - no argocd CLI required.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jun 25, 2026
License: Apache 2.0

Pinned Snippet

workflow.ymlSHA-pinned

uses: eldhugr/argocd-action@187621d14b880ae23e4eb61fd79fec608d01fab2 # v1.1.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
command	Sub-command to run: set \| diff \| sync \| wait \| deploy \| get \| rollback \| history \| terminate-op	yes	—
application	Application name (e.g. app.stage.comments). Required for all commands except `deploy` when `applications` is provided.	no	—
server	ArgoCD server host, with or without scheme (defaults to $ARGOCD_SERVER)	no	—
auth-method	Authentication method: token \| password \| oidc. When unset, it is inferred (token, then username/password, then OIDC if an ID token is available).	no	—
auth-token	Bearer auth token (defaults to $ARGOCD_AUTH_TOKEN)	no	—
username	Username for password login (defaults to $ARGOCD_USERNAME). Used only when no auth-token is provided.	no	—
password	Password for password login (defaults to $ARGOCD_PASSWORD).	no	—
oidc-audience	Audience for the requested GitHub OIDC ID token. Leave empty to use the default audience.	no	—
oidc-client-id	Dex/OIDC client id used for the token exchange (auth-method: oidc)	no	argo-cd-cli
oidc-connector-id	Dex connector id configured for GitHub Actions on the ArgoCD server (auth-method: oidc)	no	github-actions
insecure	Skip TLS certificate verification (defaults to $ARGOCD_INSECURE, else false)	no	—
app-namespace	Namespace of the Application CR (appNamespace query param), for apps in any namespace	no	—
parameters	Newline-separated Helm parameters to set, each as name=value (command: set)	no	—
unset-parameters	Newline/comma-separated Helm parameter names to remove from the application. May be combined with `parameters` to set and unset in one call (command: set)	no	—
kustomize-images	Newline/comma-separated Kustomize image overrides to set on the application, each in `argocd app set --kustomize-image` form (e.g. nginx=nginx:1.21, web:v2, app@sha256:...). An override replaces an existing one for the same image (command: set)	no	—
source-name	For multi-source apps: the source name to apply parameters to (command: set)	no	—
source-position	For multi-source apps: 1-based source index to apply parameters to (command: set)	no	—
prune	Prune resources that are no longer defined in Git (command: sync, deploy, rollback)	no	false
force	Force apply (kubectl apply --force) during sync (command: sync, deploy)	no	false
replace	Use kubectl replace/create instead of apply (sync option Replace=true) (command: sync, deploy)	no	false
server-side	Use server-side apply (sync option ServerSideApply=true) (command: sync, deploy)	no	false
apply-out-of-sync-only	Only apply resources that are out of sync (sync option ApplyOutOfSyncOnly=true) (command: sync, deploy)	no	false
sync-options	Additional sync options, one per line or comma-separated, each as Name=value (e.g. CreateNamespace=true) (command: sync, deploy)	no	—
strategy	Sync strategy: "apply" (default) or "hook" (command: sync, deploy)	no	—
dry-run	Perform a dry run without applying changes (command: sync, rollback)	no	false
revision	Target Git revision to sync to (command: sync), or the history revision to roll back to (command: rollback)	no	—
resources	Limit the sync to specific resources, one per line or comma-separated, each as [group:]kind:name (e.g. apps:Deployment:web or :Service:web). Mirrors `argocd app sync --resource` (command: sync, deploy)	no	—
refresh	Refresh the app before diff/wait: "false" \| "normal" \| "hard" (command: diff, wait)	no	normal
fail-on-diff	If true, the diff command fails the step when differences are found (command: diff)	no	false
unified-diff	Render a unified (+/-) field-level diff with old/new values. For `diff`: in the step summary (beneath the resource table) and the job log. For `deploy`: in the per-application job log. Values of Secret resources are masked. (command: diff, deploy)	no	false
timeout	Seconds to wait for the app to become Synced/Healthy (command: wait)	no	600
wait-for-sync	Wait for sync status to be Synced (command: wait)	no	true
wait-for-health	Wait for health status to be Healthy (command: wait)	no	true
wait-for-operation	Wait for any in-flight sync operation to finish (command: wait, deploy)	no	true
fail-on-rollout-failure	Fail fast when a rollout cannot recover, instead of waiting out the timeout. Requires wait-for-health (a sync-only wait does not check rollout health) and only fires once the sync operation has settled. Aborts on an app whose health is Degraded (debounced over a couple of polls, so a stale post-sync snapshot or a momentary blip does not trip it), and on a managed Pod stuck in an unrecoverable state (ImagePullBackOff, ErrImagePull, InvalidImageName, CreateContainerConfigError, CrashLoopBackOff, ...) - the latter catches the failure before the app itself goes Degraded. Image/config faults abort after a couple of polls; crash-loops are debounced longer to ride out a slow start. Best-effort: a resource-tree read error just skips the pod check for that poll (command: wait, deploy, sync, rollback)	no	true
applications	List of application names to deploy with the same settings - a JSON array of names (e.g. ["app.stage.comments","app.dev.comments"]) or a newline/comma-separated list. Takes precedence over `application` (command: deploy)	no	—
restart	When there is no rendered diff, restart these workloads instead of doing nothing. `false` (default, off) or an explicit kind / comma-separated kinds, e.g. `Deployment`, `StatefulSet`, or `Deployment,StatefulSet` (command: deploy)	no	false
parallel	Deploy multiple applications concurrently instead of sequentially. Set to false to deploy one at a time (command: deploy)	no	true
fail-fast	Stop after the first failing application in sequential mode (command: deploy). Ignored when allow-failure is true.	no	true
allow-failure	Do not fail the job when some applications fail to deploy - still deploy the rest and report status. Implies fail-fast=false (command: deploy)	no	false
ignore-missing	Do not fail the job for applications that do not exist - reported as `missing` (404) or, since ArgoCD v2.7, a masked `forbidden` (403, "missing or no access"). Both are still reported in `summary` and the step summary; only the job-failure is suppressed. Other failures (sync errors, timeouts) still fail the job (command: deploy)	no	false
rollback-id	Deployment history id to roll back to. When omitted, `revision` is used to find the entry, else the previous deployment is used (command: rollback)	no	—

Outputs

name	description
diff	"true" when the diff command found differences, otherwise "false"
sync-status	Last observed sync status (e.g. Synced, OutOfSync)
health-status	Last observed health status (e.g. Healthy, Progressing, Degraded)
revision	Synced revision of the application
images	JSON array of container images currently deployed (command: get)
history	JSON array of deployment history entries: {id, revision, deployedAt, ...} (command: get, history)
results	JSON array of per-application deploy results: {app, status, diff, action, syncStatus, healthStatus, revision, images} or {app, status, error}. `status` is one of updated \| restarted \| unchanged \| missing \| forbidden \| failed (command: deploy)
outcome	`success` (all deployed), `partial` (some failed), or `failure` (all failed) (command: deploy)
summary	JSON object grouping application names by status: {updated, restarted, unchanged, missing, forbidden, failed}. `missing` is a definitive 404; `forbidden` is a 403, which ArgoCD returns both for a non-existent app and a real RBAC denial (command: deploy)