argoproj-labs · jgwest · Oct 15, 2025
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
@@ -1,4 +1,4 @@
-name: Code scans
+name: "Validation, verifications, and lints"
 on:
   pull_request:
     paths-ignore:
@@ -24,3 +24,16 @@ jobs:
       - name: Ensure there is no diff in code
         run: |
           git diff --ignore-matching-lines='.*createdAt:.*' --exit-code -- .
+
+  verify_argo_cd_has_updated_dependencies:
+    name: Verify Argo CD has updated dependencies, for the given target version
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+      - name: "Call update dependencies Makefile target"
+        run: |
+          make update-dependencies
+      - name: Ensure there is no unexpected diff in repository artifacts
+        run: |
+          git diff --ignore-matching-lines='.*createdAt:.*' --exit-code -- .
diff --git a/Makefile b/Makefile
@@ -5,6 +5,13 @@
 # - use environment variables to overwrite this value (e.g export VERSION=0.0.2)
 VERSION ?= 0.17.0
 
+# ARGO_CD_TARGET_VERSION is the target version that argocd-operator will install. 
+# Update this when you upgrade the Argo CD dependencies of the project.
+# After updating, call 'make update-dependencies'.
+# Notes:
+# - String should NOT begin with 'v' prefix, e.g. 'v3.1.1'
+ARGO_CD_TARGET_VERSION ?= 3.1.8
+
 # Try to detect Docker or Podman
 CONTAINER_RUNTIME := $(shell command -v docker 2> /dev/null || command -v podman 2> /dev/null)
 
@@ -361,3 +368,8 @@ if [ $$(printf '%s\n' $$requiredver $$currentver | sort -V | head -n1) = $$requi
 rm -rf $$TMP_DIR ;\
 }
 endef
+
+# Updates upstream dependencies throughout the repository
+.PHONY: update-dependencies
+update-dependencies:
+	"hack/update-dependencies-script/run.sh"
diff --git a/build/util/Dockerfile b/build/util/Dockerfile
@@ -1,5 +1,5 @@
-# Argo CD v3.1.1
-FROM quay.io/argoproj/argocd@sha256:a36ab0c0860c77159c16e04c7e786e7a282f04889ba9318052f0b8897d6d2040 AS argocd
+# Argo CD v3.1.8
+FROM quay.io/argoproj/argocd@sha256:19ba7f44cba487c4a0c98ac336327c4df04383dff84f87ea1a578972eb62dd17 as argocd
 
 # Final Image
 FROM docker.io/library/ubuntu:24.04

diff --git a/common/defaults.go b/common/defaults.go
@@ -70,7 +70,7 @@ const (
 	ArgoCDDefaultArgoImage = "quay.io/argoproj/argocd"
 
 	// ArgoCDDefaultArgoVersion is the Argo CD container image digest to use when version not specified.
-	ArgoCDDefaultArgoVersion = "sha256:a36ab0c0860c77159c16e04c7e786e7a282f04889ba9318052f0b8897d6d2040" // v3.1.1
+	ArgoCDDefaultArgoVersion = "sha256:19ba7f44cba487c4a0c98ac336327c4df04383dff84f87ea1a578972eb62dd17" // v3.1.8
 
 	// ArgoCDDefaultBackupKeyLength is the length of the generated default backup key.
 	ArgoCDDefaultBackupKeyLength = 32

diff --git a/config/crd/bases/argoproj.io_applications.yaml b/config/crd/bases/argoproj.io_applications.yaml
@@ -5887,4 +5887,4 @@ spec:
         type: object
     served: true
     storage: true
-    subresources: {}
+    subresources: {}
diff --git a/config/crd/bases/argoproj.io_applicationsets.yaml b/config/crd/bases/argoproj.io_applicationsets.yaml
@@ -17721,4 +17721,4 @@ spec:
     served: true
     storage: true
     subresources:
-      status: {}
+      status: {}
diff --git a/config/crd/bases/argoproj.io_appprojects.yaml b/config/crd/bases/argoproj.io_appprojects.yaml
@@ -363,4 +363,4 @@ spec:
         - spec
         type: object
     served: true
-    storage: true
+    storage: true
diff --git a/controllers/argocd/applicationset_test.go b/controllers/argocd/applicationset_test.go
@@ -1481,7 +1481,7 @@ func TestGetApplicationSetContainerImage(t *testing.T) {
 	cr.Spec.Image = ""
 	cr.Spec.Version = ""
 	out = getApplicationSetContainerImage(&cr)
-	assert.Equal(t, "quay.io/argoproj/argocd@sha256:a36ab0c0860c77159c16e04c7e786e7a282f04889ba9318052f0b8897d6d2040", out)
+	assert.Equal(t, "quay.io/argoproj/argocd@"+common.ArgoCDDefaultArgoVersion, out)
 
 	// when env var is not set and spec image and version fields are set, spec fields should be returned
 	cr.Spec.Image = "customimage"
@@ -1502,5 +1502,5 @@ func TestGetApplicationSetContainerImage(t *testing.T) {
 	cr.Spec.Version = ""
 	os.Setenv(common.ArgoCDImageEnvName, "")
 	out = getApplicationSetContainerImage(&cr)
-	assert.Equal(t, "customimage@sha256:a36ab0c0860c77159c16e04c7e786e7a282f04889ba9318052f0b8897d6d2040", out)
+	assert.Equal(t, "customimage@"+common.ArgoCDDefaultArgoVersion, out)
 }
diff --git a/controllers/argocd/dex_test.go b/controllers/argocd/dex_test.go
@@ -581,7 +581,7 @@ func TestReconcileArgoCD_reconcileDexDeployment_withUpdate(t *testing.T) {
 				Containers: []corev1.Container{
 					{
 						Name:  "dex",
-						Image: "ghcr.io/dexidp/dex@sha256:b08a58c9731c693b8db02154d7afda798e1888dc76db30d34c4a0d0b8a26d913",
+						Image: "ghcr.io/dexidp/dex@sha256:b08a58c9731c693b8db02154d7afda798e1888dc76db30d34c4a0d0b8a26d913", // (v2.43.0) NOTE: this value is modified by dependency update script
 						Command: []string{
 							"/shared/argocd-dex",
 							"rundex",

diff --git a/go.mod b/go.mod
@@ -175,6 +175,7 @@ require (
 )
 
 replace (
+	// This replace block is from Argo CD v3.1.8 go.mod
 	github.com/golang/protobuf => github.com/golang/protobuf v1.5.4
 	github.com/grpc-ecosystem/grpc-gateway => github.com/grpc-ecosystem/grpc-gateway v1.16.0
 

diff --git a/hack/update-dependencies-script/README.md b/hack/update-dependencies-script/README.md
@@ -0,0 +1,19 @@
+# update-dependencies-script
+
+This is a simple go-based script that will upgrade the upstream dependencies in argocd-operator.
+
+## To run this script:
+
+In `(root)/Makefile`, modify `ARGO_CD_TARGET_VERSION` to target Argo CD version.
+
+Example:
+```
+ARGO_CD_TARGET_VERSION ?= 3.1.8
+```
+
+Then run the script:
+```
+make update-dependencies
+```
+
+See `hack/update-dependencies-script/main.go` for list dependencies that are updated.
diff --git a/hack/update-dependencies-script/go.mod b/hack/update-dependencies-script/go.mod
@@ -0,0 +1,9 @@
+module github.com/argoproj-labs/argocd-operator/dependency-upgrade
+
+go 1.20
+
+require (
+	github.com/google/go-github/v58 v58.0.0
+	github.com/google/go-querystring v1.1.0 // indirect
+	gopkg.in/yaml.v2 v2.4.0
+)
diff --git a/hack/update-dependencies-script/go.sum b/hack/update-dependencies-script/go.sum
@@ -0,0 +1,10 @@
+github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-github/v58 v58.0.0 h1:Una7GGERlF/37XfkPwpzYJe0Vp4dt2k1kCjlxwjIvzw=
+github.com/google/go-github/v58 v58.0.0/go.mod h1:k4hxDKEfoWpSqFlc8LTpGd9fu2KrV1YAa6Hi6FmDNY4=
+github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
+github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=