fix(git): guard batched writer for non-git/missing creds; test: strengthen batching test; docs: v100.0.5a changelog

Author: Eidmantas Ivanauskas

CHANGELOG.md

@@ -30,6 +30,22 @@ handling on your side.
 * refactor: make argocd-image-updater-config volume mapping optional (#145)
 
 
+## 2025-09-18 - Release v100.0.5a
+
+### Fixes
+
+- fix(git): Prevent panic in batched writer when `GetCreds` is nil or write-back method is not Git
+  - Only enqueue batched writes when `wbc.Method == git`
+  - Guard in `repoWriter.commitBatch` for missing `GetCreds` (skip with log)
+
+### Tests
+
+- test(git): Strengthen batched writer test to set `Method: WriteBackGit` and provide `GetCreds` stub, so missing-GetCreds would fail tests
+
+### Notes
+
+- No flags or defaults changed; safe upgrade from v100.0.4a
+
 ## 2025-09-18 - Release v100.0.4a
 
 ### Changes

pkg/argocd/git.go

@@ -229,6 +229,16 @@ func (rw *repoWriter) commitBatch(branch string, intents []writeIntent) {
     first := intents[0]
     logCtx := log.WithContext().AddField("repository", rw.repoURL)
 
+    // Only Git write-back is supported by the batched writer
+    if first.wbc == nil || first.wbc.Method != WriteBackGit {
+        logCtx.Warnf("skipping batched commit: non-git write-back method")
+        return
+    }
+
+    if first.wbc.GetCreds == nil {
+        logCtx.Errorf("batched commit: missing GetCreds resolver; skipping")
+        return
+    }
     creds, err := first.wbc.GetCreds(first.app)
     if err != nil { logCtx.Errorf("could not get creds: %v", err); return }
 

pkg/argocd/git_test.go

@@ -64,8 +64,8 @@ func Test_repoWriter_BatchesPerBranch(t *testing.T) {
 
     appMain := &v1alpha1.Application{}
     appDev := &v1alpha1.Application{ObjectMeta: appMain.ObjectMeta}
-    wbcMain := &WriteBackConfig{GitRepo: "https://example/repo.git", GitWriteBranch: "main", GetCreds: func(a *v1alpha1.Application) (extgit.Creds, error) { return nil, nil }}
-    wbcDev := &WriteBackConfig{GitRepo: "https://example/repo.git", GitWriteBranch: "dev", GetCreds: func(a *v1alpha1.Application) (extgit.Creds, error) { return nil, nil }}
+    wbcMain := &WriteBackConfig{GitRepo: "https://example/repo.git", GitWriteBranch: "main", Method: WriteBackGit, GetCreds: func(a *v1alpha1.Application) (extgit.Creds, error) { return extgit.NopCreds{}, nil }}
+    wbcDev := &WriteBackConfig{GitRepo: "https://example/repo.git", GitWriteBranch: "dev", Method: WriteBackGit, GetCreds: func(a *v1alpha1.Application) (extgit.Creds, error) { return extgit.NopCreds{}, nil }}
 
     rw := &repoWriter{repoURL: wbcMain.GitRepo, intentsCh: make(chan writeIntent, 10), flushEvery: 0, maxBatch: 100, stopCh: make(chan struct{})}
     // Directly call flushBatch to avoid goroutine timing

pkg/argocd/update.go

@@ -410,15 +410,15 @@ func UpdateApplication(updateConf *UpdateConfiguration, state *SyncIterationStat
     if needUpdate {
 		logCtx := log.WithContext().AddField("application", app)
         log.Debugf("Using commit message: %s", wbc.GitCommitMessage)
-		if !updateConf.DryRun {
-            logCtx.Infof("Queuing %d parameter update(s) for application %s (git write pending)", result.NumImagesUpdated, app)
-            // Enqueue batched write intent unless tests explicitly disable batching
+        if !updateConf.DryRun {
+            // If write-back is Git, we can batch; otherwise commit directly via Argo CD API
             var err error
-            if env.GetBoolVal("GIT_BATCH_DISABLE", false) {
+            if wbc.Method != WriteBackGit || env.GetBoolVal("GIT_BATCH_DISABLE", false) {
                 err = commitChangesLocked(&updateConf.UpdateApp.Application, wbc, state, changeList)
             } else {
+                logCtx.Infof("Queuing %d parameter update(s) for application %s (git write pending)", result.NumImagesUpdated, app)
                 // Ensure Git credentials resolver is set for batched writer
-                if wbc.Method == WriteBackGit && wbc.GetCreds == nil {
+                if wbc.GetCreds == nil {
                     if perr := parseGitConfig(&updateConf.UpdateApp.Application, updateConf.KubeClient, wbc, "repocreds"); perr != nil {
                         logCtx.Warnf("could not prepare git credentials for batched write: %v", perr)
                     }