From 8983720d3afb8dae7526957a8dd428c0ce3a1e93 Mon Sep 17 00:00:00 2001
From: rock <locartrock@gmail.com>
Date: Mon, 7 Sep 2026 18:19:46 -0700
Subject: [PATCH] feat: switch image-updater to digest-based :latest tracking
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All image-updater annotations now use update-strategy: digest with
allow-tags: ^latest$ and write-back-method: argocd. No SHA tags
committed to git — digest overrides stored in ArgoCD state only.

- poimen: git write-back → argocd, removed git-branch
- portfolio: newest-build SHA → digest latest
- api-gateway: newest-build SHA → digest latest
---
 k8s/argocd/apps/55-api-gateway.yaml  |  4 ++--
 k8s/argocd/apps/60-applications.yaml |  4 ++--
 k8s/argocd/apps/70-poimen.yaml       | 15 +++++++--------
 3 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/k8s/argocd/apps/55-api-gateway.yaml b/k8s/argocd/apps/55-api-gateway.yaml
index 1f5dbb9..7b8b508 100644
--- a/k8s/argocd/apps/55-api-gateway.yaml
+++ b/k8s/argocd/apps/55-api-gateway.yaml
@@ -38,8 +38,8 @@ metadata:
     argocd.argoproj.io/sync-wave: "7"
     # ArgoCD Image Updater - auto-update on new image push
     argocd-image-updater.argoproj.io/image-list: gw=forgejo.riotpiao.com/rock/api-gateway
-    argocd-image-updater.argoproj.io/gw.update-strategy: newest-build
-    argocd-image-updater.argoproj.io/gw.allow-tags: regexp:^[0-9a-f]{7}$
+    argocd-image-updater.argoproj.io/gw.update-strategy: digest
+    argocd-image-updater.argoproj.io/gw.allow-tags: regexp:^latest$
     argocd-image-updater.argoproj.io/write-back-method: argocd
 spec:
   project: homelab
diff --git a/k8s/argocd/apps/60-applications.yaml b/k8s/argocd/apps/60-applications.yaml
index a346d0f..ebe7606 100644
--- a/k8s/argocd/apps/60-applications.yaml
+++ b/k8s/argocd/apps/60-applications.yaml
@@ -248,8 +248,8 @@ metadata:
     argocd.argoproj.io/sync-wave: "8"
     # ArgoCD Image Updater - auto-update on new image push
     argocd-image-updater.argoproj.io/image-list: app=forgejo.riotpiao.com/rock/portfolio
-    argocd-image-updater.argoproj.io/app.update-strategy: newest-build
-    argocd-image-updater.argoproj.io/app.allow-tags: regexp:^[0-9a-f]{7}$
+    argocd-image-updater.argoproj.io/app.update-strategy: digest
+    argocd-image-updater.argoproj.io/app.allow-tags: regexp:^latest$
     argocd-image-updater.argoproj.io/write-back-method: argocd
 spec:
   project: homelab
diff --git a/k8s/argocd/apps/70-poimen.yaml b/k8s/argocd/apps/70-poimen.yaml
index 1d2f4e3..09d809e 100644
--- a/k8s/argocd/apps/70-poimen.yaml
+++ b/k8s/argocd/apps/70-poimen.yaml
@@ -10,14 +10,13 @@ metadata:
       memory=forgejo.riotpiao.com/rock/poimen-memory
       workflows=forgejo.riotpiao.com/rock/poimen-workflows
       frontend=forgejo.riotpiao.com/rock/poimen-frontend
-    argocd-image-updater.argoproj.io/memory.update-strategy: newest-build
-    argocd-image-updater.argoproj.io/memory.allow-tags: regexp:^[0-9a-f]{7}$
-    argocd-image-updater.argoproj.io/workflows.update-strategy: newest-build
-    argocd-image-updater.argoproj.io/workflows.allow-tags: regexp:^[0-9a-f]{7}$
-    argocd-image-updater.argoproj.io/frontend.update-strategy: newest-build
-    argocd-image-updater.argoproj.io/frontend.allow-tags: regexp:^[0-9a-f]{7}$
-    argocd-image-updater.argoproj.io/write-back-method: git
-    argocd-image-updater.argoproj.io/git-branch: main
+    argocd-image-updater.argoproj.io/memory.update-strategy: digest
+    argocd-image-updater.argoproj.io/memory.allow-tags: regexp:^latest$
+    argocd-image-updater.argoproj.io/workflows.update-strategy: digest
+    argocd-image-updater.argoproj.io/workflows.allow-tags: regexp:^latest$
+    argocd-image-updater.argoproj.io/frontend.update-strategy: digest
+    argocd-image-updater.argoproj.io/frontend.allow-tags: regexp:^latest$
+    argocd-image-updater.argoproj.io/write-back-method: argocd
 spec:
   project: homelab
   sources: