# Helm pilot — argo/argo-cd 10.10.5 is the latest published chart (appVersion v3.5.5).
# Image pin is quay.io/argoproj/argocd:v3.5.6 (official argo-cd 10.10.6 / appVersion v3.5.6
# is still open as argoproj/argo-helm#4156 and is not in the helm index yet).
# Source archive: https://github.com/argoproj/argo-cd/archive/refs/tags/v3.5.6.tar.gz
#   sha256:6a0af11b2bce7f72719b8669617d5ef1f2ae9389f95f7c13bb8720d336a9f513
#   SOURCE_COMMIT=c2b1e3017e2cec86b122172e861dcd026453ae44
# Ladder (b): Argo CD v3.5.6 rebuilt from public source following upstream's v3.5.6 Dockerfile, with:
#   - Go 1.27.3 toolchain (CVE-2026-111943 fixed) (upstream: 1.26.10; prebuilt kustomize go1.24.0, git-lfs go1.25.3, helm go1.26.4)
#   - helm v4.2.1 / kustomize v5.8.1 / git-lfs v3.7.1 (= hack/tool-versions.sh @ v3.5.6, unchanged from v3.5.5) rebuilt from source
#   - minimal "at least" module bumps (scripts/go-bumps.py from both scanners; never downgrade, never cross a major)
#   - same ubuntu:26.04 base; /usr/bin/pebble (shipped in the ubuntu:26.04 rootfs, not a dpkg package,
#     unused by Argo CD) removed
# tpio.2: x/net >=0.60.0 fixes the three real HIGHs; Slack >=0.23.1 and
# OpenTelemetry >=1.45.0 fix the source MEDIUM/LOWs. Runtime dist-upgrade below
# keeps gnu-coreutils at the vendor-fixed version.
# v3.5.6 (watch bump): same recipe, toolchain and module floors on the v3.5.6 source.
# No Argo CD source changes. This job's bar is 0C/0H with no suppressions/VEX.
ARG GO_IMAGE=docker.io/library/golang:1.27.3@sha256:f24164268fc1e741bbdc0066dbadcf1c8426c5a8489f0729c02c3905a53032fd
ARG NODE_IMAGE=docker.io/library/node:24.14.1@sha256:80fc934952c8f1b2b4d39907af7211f8a9fff1a4c2cf673fb49099292c251cec
ARG BASE_IMAGE=docker.io/library/ubuntu:26.04@sha256:f144425ff09be612d6d9ad965196e9cdc23dae1f42110a8a11a3e9a8198759f7
ARG ARGOCD_REF=v3.5.6

FROM ${GO_IMAGE} AS src
ARG ARGOCD_REF
RUN git clone --depth 1 --branch ${ARGOCD_REF} https://github.com/argoproj/argo-cd.git /src && git -C /src rev-parse HEAD > /src/.upstream-commit

FROM ${GO_IMAGE} AS tools
ENV GOTOOLCHAIN=local CGO_ENABLED=0 GOWORK=off
COPY go-min-bump.sh /usr/local/bin/
ARG HELM_REF=v4.2.1
ARG HELM_BUMPS="golang.org/x/crypto@v0.56.0 golang.org/x/net@v0.60.0 golang.org/x/text@v0.39.0 oras.land/oras-go/v2@v2.6.2"
RUN git clone --depth 1 --branch ${HELM_REF} https://github.com/helm/helm.git /helm && cd /helm \
 && go-min-bump.sh ${HELM_BUMPS} > /helm.bumps \
 && make build && ./bin/helm version && install -m0755 bin/helm /usr/local/bin/helm
ARG KUSTOMIZE_REF=kustomize/v5.8.1
ARG KUSTOMIZE_BUMPS="golang.org/x/text@v0.39.0 golang.org/x/net@v0.60.0"
RUN git clone --depth 1 --branch ${KUSTOMIZE_REF} https://github.com/kubernetes-sigs/kustomize.git /kz && cd /kz/kustomize \
 && go-min-bump.sh ${KUSTOMIZE_BUMPS} > /kustomize.bumps \
 && go build -trimpath -ldflags "-s -w -X sigs.k8s.io/kustomize/api/provenance.version=${KUSTOMIZE_REF} -X sigs.k8s.io/kustomize/api/provenance.gitCommit=$(git rev-parse HEAD)" -o /usr/local/bin/kustomize . \
 && /usr/local/bin/kustomize version
ARG GITLFS_REF=v3.7.1
ARG GITLFS_BUMPS="golang.org/x/crypto@v0.56.0 golang.org/x/net@v0.60.0 golang.org/x/text@v0.39.0"
RUN git clone --depth 1 --branch ${GITLFS_REF} https://github.com/git-lfs/git-lfs.git /lfs && cd /lfs \
 && go-min-bump.sh ${GITLFS_BUMPS} > /gitlfs.bumps \
 && go build -trimpath -ldflags "-s -w -X github.com/git-lfs/git-lfs/v3/config.GitCommit=$(git rev-parse --short HEAD)" -o /usr/local/bin/git-lfs . \
 && /usr/local/bin/git-lfs version

FROM ${NODE_IMAGE} AS argocd-ui
WORKDIR /src
COPY --from=src /src/ui/package.json /src/ui/pnpm-lock.yaml ./
RUN npm install -g corepack@0.34.6 && corepack enable && pnpm install --frozen-lockfile
COPY --from=src /src/ui/ .
ARG ARGOCD_REF
ENV ARGO_VERSION=${ARGOCD_REF}
RUN NODE_ENV='production' NODE_ONLINE_ENV='online' NODE_OPTIONS=--max_old_space_size=8192 pnpm build

FROM ${GO_IMAGE} AS argocd-build
ENV GOTOOLCHAIN=local
COPY go-min-bump.sh /usr/local/bin/
COPY --from=src /src /go/src/github.com/argoproj/argo-cd
WORKDIR /go/src/github.com/argoproj/argo-cd
ARG ARGOCD_BUMPS="github.com/go-git/go-git/v5@v5.19.2 github.com/klauspost/compress@v1.18.7 golang.org/x/crypto@v0.56.0 golang.org/x/net@v0.60.0 golang.org/x/text@v0.39.0 google.golang.org/grpc@v1.83.2 oras.land/oras-go/v2@v2.6.2 github.com/slack-go/slack@v0.23.1 go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.45.0 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.45.0 go.opentelemetry.io/otel/sdk@v1.45.0"
RUN go-min-bump.sh ${ARGOCD_BUMPS} > /argocd.bumps && git diff --stat go.mod
COPY --from=argocd-ui /src/dist/app ui/dist/app
ARG ARGOCD_REF
RUN GIT_TAG=${ARGOCD_REF} GIT_TREE_STATE=dirty GIT_COMMIT=$(cat .upstream-commit) make argocd-all && ls -la dist/

FROM ${BASE_IMAGE}
ARG ARGOCD_REF
LABEL org.opencontainers.image.source="https://github.com/argoproj/argo-cd" \
      org.opencontainers.image.version="v3.5.6" \
      io.thepeoples.hardened.upstream="quay.io/argoproj/argocd:v3.5.6@sha256:8e5cc5bb008df8a09dba439462e58c94c55b7735888d3ebde0c25fc05e4e5335" \
      io.thepeoples.hardened.replaces="quay.io/argoproj/argocd:v3.5.6@sha256:8e5cc5bb008df8a09dba439462e58c94c55b7735888d3ebde0c25fc05e4e5335" \
      io.thepeoples.hardened.ladder="b" \
      io.thepeoples.hardened.claim="package-fixable CRITICAL/HIGH cleared vs upstream digest; not FIPS/FedRAMP"
USER root
ENV ARGOCD_USER_ID=999 DEBIAN_FRONTEND=noninteractive
RUN groupadd -g $ARGOCD_USER_ID argocd && useradd -r -u $ARGOCD_USER_ID -g argocd argocd \
 && mkdir -p /home/argocd && chown argocd:0 /home/argocd && chmod g=u /home/argocd \
 && apt-get update && apt-get dist-upgrade -y \
 && apt-get install --no-install-recommends -y git tini ca-certificates gpg gpg-agent tzdata connect-proxy openssh-client \
 && apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/* /usr/share/doc/* \
 && rm -rf /usr/bin/pebble /var/lib/pebble
COPY --from=src /src/hack/gpg-wrapper.sh /src/hack/git-verify-wrapper.sh /src/entrypoint.sh /usr/local/bin/
COPY --from=tools /usr/local/bin/helm /usr/local/bin/kustomize /usr/local/bin/git-lfs /usr/local/bin/
RUN git lfs install --system
COPY --from=tools /helm.bumps /kustomize.bumps /gitlfs.bumps /usr/share/tp-hardened/
COPY --from=argocd-build /argocd.bumps /go/src/github.com/argoproj/argo-cd/.upstream-commit /usr/share/tp-hardened/
RUN ln -s /usr/local/bin/entrypoint.sh /usr/local/bin/uid_entrypoint.sh
WORKDIR /app/config/ssh
RUN touch ssh_known_hosts && ln -s /app/config/ssh/ssh_known_hosts /etc/ssh/ssh_known_hosts
WORKDIR /app/config
RUN mkdir -p tls gpg/source gpg/keys && chown argocd gpg/keys && chmod 0700 gpg/keys
ENV USER=argocd GRPC_ENABLE_TXT_SERVICE_CONFIG=false
COPY --from=argocd-build /go/src/github.com/argoproj/argo-cd/dist/argocd* /usr/local/bin/
RUN for c in server repo-server cmp-server application-controller dex notifications applicationset-controller k8s-auth commit-server; do \
      ln -s /usr/local/bin/argocd /usr/local/bin/argocd-$c; done
USER $ARGOCD_USER_ID
WORKDIR /home/argocd
ENTRYPOINT ["/usr/bin/tini", "--"]