apiVersion: "helm-expt.confighub.com/v1alpha1"
kind: "ProductionImagePolicyDecision"
metadata:
  name: "argo-cd-argo-cd-public-oci-image-policy-decision"
spec:
  chart: "argo-cd/argo-cd"
  version: "9.5.15"
  targetScope:
    clusterClass: "cub-lk-kind-vanilla"
    namespace: "argocd"
    deliveryPath: "confighub-oci"
    gitopsController: "argo"
  supportedBaseCandidate: "default"
  variantsCovered:
    - "default"
    - "no-crds"
  decision: "mutable-image-exception-accepted-for-target-scope"
  decidedAt: "2026-06-09"
  claim: "The rendered Argo CD bases still contain mutable image tags, but each rendered image reference has digest-resolution evidence. For this public GitOps-controller support scope, the mutable tag is accepted as a target-scoped exception while stricter environments remain free to require digest-pinned bases or image overrides."
  renderedImageSummary:
    renderedSubjects: 2
    subjectsNeedingResolution: 2
    imageRefs: 18
    mutableTagRefs: 18
    floatingLatestOrUntaggedRefs: 0
    resolutionReceipts: 2
  variantReceipts:
    default:
      renderedObjectSetSHA256: "e52ddef5e56e347a8959dd1e8591e116479bf8aa8682c83e3753fe7355a38cc0"
      sourceImageReviewRows: 9
      uniqueImages: 3
      receiptPath: "data/image-digest-workdown/receipts/argo-cd-argo-cd/default/image-digest-resolution.yaml"
    no-crds:
      renderedObjectSetSHA256: "23a51fb8ea2215b08a853bbb26698d80f58a5514b68d4f49cdcd870a8371fc71"
      sourceImageReviewRows: 9
      uniqueImages: 3
      receiptPath: "data/image-digest-workdown/receipts/argo-cd-argo-cd/no-crds/image-digest-resolution.yaml"
  acceptedException:
    reason: "The public proof target uses upstream Argo CD, Dex, and Redis image tags. The receipt set records the registry digest each tag resolved to at decision time, so reviewers can rerun the decision when upstream tags move."
    operatorAction: "For stricter production environments, create a digest-pinned base or image override policy before support expansion."
  limits:
    - "This does not mean the rendered manifests are digest-pinned."
    - "This is not a blanket approval for all clusters, private overlays, regulated environments, or future chart versions."
    - "This does not make Argo CD production-supported by itself."
    - "If an upstream image tag is retargeted, rerun digest resolution and re-review this decision before promotion."
  evidence:
    -
      path: "data/image-digest-workdown/chart-summary.csv"
      claim: "Summarizes Argo CD rendered image references."
    -
      path: "data/attack-plan-workdown/image-digest-review.csv"
      claim: "Lists every rendered image reference found in the Argo CD object sets."
    -
      path: "data/image-digest-workdown/receipts/argo-cd-argo-cd/default/image-digest-resolution.yaml"
      claim: "Records registry digest resolution for the default rendered object set."
    -
      path: "data/image-digest-workdown/receipts/argo-cd-argo-cd/no-crds/image-digest-resolution.yaml"
      claim: "Records registry digest resolution for the no-crds rendered object set."
  remainingSupportBlockers:
    - "Record security/resource-policy acceptance and fresh target-scoped ConfigHub OCI/GitOps evidence."