Argo CD Application Target Revision Drift Auto-Patch Gate

id: argocd-application-target-revision-drift-auto-patch-gate
namespace: company.team

description: |
  Read an Argo CD application's live spec and check whether its targetRevision still matches the
  branch, tag, or commit your GitOps policy approves, classify any drift, auto-patch it back to
  the approved revision only when explicitly authorized, alert Slack otherwise, and log a
  governance audit trail either way.

inputs:
  - id: argocd_application
    type: STRING
    displayName: Argo CD application name
    description: Name of the Argo CD Application to check.
    defaults: "my-argocd-app"

  - id: expected_target_revision
    type: STRING
    displayName: Expected target revision
    description: The branch, tag, or commit this application's
      spec.source.targetRevision should be pinned to per your GitOps policy.
    defaults: "main"

  - id: confirm_patch
    type: BOOL
    displayName: Confirm automatic patch
    description: When true, this flow is authorized to patch the application's
      targetRevision back to expected_target_revision itself. When false, a
      drifted revision only alerts Slack so a human corrects it.
    defaults: false

tasks:
  - id: check_app_spec
    type: io.kestra.plugin.argocd.apps.Status
    description: Read-only probe. `argocd app get --output json` returns the full
      Application object; Status only parses sync/health state into typed
      outputs, so the live spec.source.targetRevision has to be read back out of
      rawOutput. Does not sync, patch, or roll back anything on the cluster.
    allowFailure: true
    server: "{{ secret('ARGOCD_SERVER') }}"
    token: "{{ secret('ARGOCD_TOKEN') }}"
    application: "{{ inputs.argocd_application }}"
    refresh: false

  - id: evaluate
    type: io.kestra.plugin.core.output.OutputValues
    description: Extracts the live targetRevision from the raw Application JSON and
      classifies it as aligned or drifted, folding confirm_patch into the
      drifted classification so the Switch branch needs no further nesting.
    values:
      live_target_revision: >-
        {{ outputs.check_app_spec is not defined ? '' : (({'rawOutput':
        outputs.check_app_spec.rawOutput} | jq('(.rawOutput |
        fromjson).spec.source.targetRevision // "UNKNOWN"')) | first) }}
      severity: >-
        {{ outputs.check_app_spec is not defined ? 'UNREACHABLE' :
        (((({'rawOutput': outputs.check_app_spec.rawOutput} | jq('(.rawOutput |
        fromjson).spec.source.targetRevision // "UNKNOWN"')) | first) ==
        inputs.expected_target_revision) ? 'ALIGNED' : (inputs.confirm_patch ?
        'DRIFT_AUTO_PATCH' : 'DRIFT_NEEDS_HUMAN')) }}

  - id: route
    type: io.kestra.plugin.core.flow.Switch
    description: ALIGNED just logs. DRIFT_AUTO_PATCH performs the safe remediation
      (restoring the GitOps-approved revision) only when confirm_patch
      authorizes it. DRIFT_NEEDS_HUMAN and UNREACHABLE both alert Slack instead
      of acting.
    value: "{{ outputs.evaluate.values.severity }}"
    cases:
      "ALIGNED":
        - id: log_aligned
          type: io.kestra.plugin.core.log.Log
          message: "Argo CD application {{ inputs.argocd_application }} is pinned to the
            approved targetRevision '{{ inputs.expected_target_revision }}'."
      "DRIFT_AUTO_PATCH":
        - id: patch_target_revision
          type: io.kestra.plugin.argocd.apps.Patch
          description: Restores spec.source.targetRevision to the GitOps-approved value
            now that confirm_patch explicitly authorizes this flow to act.
          server: "{{ secret('ARGOCD_SERVER') }}"
          token: "{{ secret('ARGOCD_TOKEN') }}"
          application: "{{ inputs.argocd_application }}"
          patchType: MERGE
          patch: |
            {"spec": {"source": {"targetRevision": "{{ inputs.expected_target_revision }}"}}}
        - id: alert_auto_patched
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {{ {'text': 'DRIFT_AUTO_PATCH: Argo CD application ' ~ inputs.argocd_application ~ ' had targetRevision ' ~ '"' ~ outputs.evaluate.values.live_target_revision ~ '"' ~ ' instead of the approved ' ~ '"' ~ inputs.expected_target_revision ~ '"' ~ '. This flow patched it back automatically because confirm_patch is true.'} | toJson }}
      "DRIFT_NEEDS_HUMAN":
        - id: alert_drift
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {{ {'text': 'DRIFT_NEEDS_HUMAN: Argo CD application ' ~ inputs.argocd_application ~ ' has targetRevision ' ~ '"' ~ outputs.evaluate.values.live_target_revision ~ '"' ~ ' instead of the approved ' ~ '"' ~ inputs.expected_target_revision ~ '"' ~ '. Someone may have bypassed GitOps. Set confirm_patch to true to let this flow correct it, or patch it manually now.'} | toJson }}
      "UNREACHABLE":
        - id: alert_unreachable
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {{ {'text': 'UNREACHABLE: could not read Argo CD application ' ~ inputs.argocd_application ~ '. Check the server URL, token, and that the application name is correct.'} | toJson }}

  - id: summary
    type: io.kestra.plugin.core.log.Log
    message: "Argo CD application target revision drift auto-patch gate complete for
      {{ inputs.argocd_application }}: severity {{
      outputs.evaluate.values.severity }}."

errors:
  - id: alert_flow_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {{ {'text': 'Argo CD application target revision drift auto-patch gate failed (execution ' ~ execution.id ~ '). Check the logs.'} | toJson }}

triggers:
  - id: hourly
    type: io.kestra.plugin.core.trigger.Schedule
    description: Shipped disabled. Enable once ARGOCD_SERVER, ARGOCD_TOKEN, and
      SLACK_WEBHOOK_URL are set and the inputs point at a real application and
      its approved revision; confirm_patch stays false by default so drift
      alerts a human rather than being auto-corrected until you deliberately opt
      in.
    cron: "0 * * * *"
    disabled: true
    inputs:
      argocd_application: "my-argocd-app"
      expected_target_revision: "main"
      confirm_patch: false