Source Hydrator: periodic reconciliation (timeout.reconciliation) does not detect new drySource commits and trigger hydration

[yogeek]

Checklist

• I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq
• I've included steps to reproduce the bug.
• I've pasted the output of argocd version.

Describe the bug

When using Source Hydrator without webhooks configured, the periodic reconciliation triggered by timeout.reconciliation (default: 180 seconds) does not detect new commits on the drySource branch and does not trigger hydration automatically.

Hydration only occurs when:

• A manual refresh is triggered (argocd app get <app> --refresh or via UI)
• A webhook is received from the Git provider (after PR fix(hydrator): use refresh paths from drySource when source hydration is enabled #25516 fix)

This means users relying solely on periodic polling (without webhooks) never get automatic hydration when new commits are pushed to their drySource branch.

Related Issues

• Source Hydrator not auto-refreshing after upgrade from v3.1.9 to v3.2.0 #25347 - Source Hydrator not auto-refreshing after upgrade from v3.1.9 to v3.2.0
• SourceHydrator: Auto Refreshes not Triggering Hydration with New Commit on drySource #26054 - SourceHydrator: Auto Refreshes not Triggering Hydration with New Commit on drySource
• fix(hydrator): use refresh paths from drySource when source hydration is enabled #25516 - fix(hydrator): use refresh paths from drySource when source hydration is enabled (webhook fix only)

Per discussion with maintainer @crenshaw-dev in Slack, the fix in PR #25516 only addressed webhook-triggered refreshes. This issue tracks the periodic reconciliation path which appears to be broken for Source Hydrator.

To Reproduce

1. Deploy ArgoCD v3.3.0 (or v3.2.x) with Source Hydrator enabled:

2. Do NOT configure webhooks from your Git provider to ArgoCD

3. Create an Application with sourceHydrator configured:

4. Wait for initial hydration to complete successfully

5. Push a new commit to the drySource branch (e.g., main)

6. Wait for more than 3 minutes (default timeout.reconciliation: 180s)

7. Observe: The application does NOT refresh, and hydration is NOT triggered

8. Manually refresh the application:

   argocd app get test-hydrator-app --refresh

9. Observe: Hydration IS triggered and completes successfully

Expected behavior

After timeout.reconciliation (default 180 seconds) elapses, the application controller should:

1. Check the latest commit SHA on drySource.targetRevision (e.g., HEAD of main branch)
2. Compare it to app.Status.SourceHydrator.CurrentOperation.DrySHA
3. If they differ, trigger hydration automatically

This is how it worked in earlier versions.

Actual behavior

The periodic reconciliation:

• Does NOT fetch/compare the latest drySource commit
• Does NOT trigger hydration even when drySource has new commits
• Only a manual refresh or webhook triggers hydration

Version

argocd: v3.3.0

Issue also confirmed on:

• v3.2.3, v3.2.6
• v3.3.0

Workaround

Configure webhooks from your Git provider (GitHub/GitLab/Bitbucket) to ArgoCD's /api/webhook endpoint. The webhook path correctly triggers hydration after PR #25516.

Analysis

The issue appears to be in how appNeedsHydration() in controller/hydrator/hydrator.go determines whether hydration is needed during periodic reconciliation.

Current conditions checked in appNeedsHydration():

• Operation is already running
• SourceHydrator spec changed
• DrySHA differs from status
• Status timeout exceeded

The problem is that during periodic reconciliation, the controller may not be actively fetching the current HEAD commit from the drySource repository to compare against CurrentOperation.DrySHA. It appears to only compare against cached/stored values rather than polling Git for new commits.

In contrast, the webhook handler (after PR #25516) receives the new commit SHA directly from the Git provider's webhook payload and can correctly trigger hydration.

Suggested Fix

During the periodic reconciliation cycle for applications with sourceHydrator configured, the controller should:

1. Fetch the latest commit SHA from drySource.repoURL at drySource.targetRevision
2. Compare it to app.Status.SourceHydrator.CurrentOperation.DrySHA
3. If different, queue the application for hydration

This is similar to how regular (non-hydrator) applications detect new commits during reconciliation.

Environment

• Kubernetes version: 1.32
• ArgoCD installation method: Helm / manifests
• Git provider: GitLab (self-hosted)
• Webhooks: NOT configured (relying on polling)

[adityaraj178]

Hii, i would like to work on this.