Git Update Manifest

Bump an image tag in a GitOps manifest and commit back to the manifests repo.

Reference: loha/git-update-manifest@v1

Category: deploy

Runtime: alpine/git:2.43.0 (non-root, digest-pinned)

License: Apache-2.0

When to use

Use this step in your deploy stage when ArgoCD (or another GitOps controller) watches a separate manifests repo. After building a new image, this step rewrites the :tag reference in your Kustomize / Helm values / plain manifest and pushes the change so the GitOps controller reconciles.

Parameters

Parameter	Type	Default	Required	Description
GIT_REPOSITORY	string	—	Yes	GitOps repository URL
GIT_BRANCH	string	main	No	Branch to update
IMAGE_NAME	string	—	Yes	Full image name (without tag)
IMAGE_TAG	string	—	Yes	New image tag to set
MANIFEST_PATH	string	k8s/kustomization.yaml	No	Path to manifest file within repository
MANIFEST_TYPE	string	kustomize	No	Type of manifest (kustomize, helm, kubernetes)

Workspaces

• source (required): bound from pipeline workspace source
• ssh-directory (optional): bound from pipeline workspace ssh-credentials
• basic-auth (optional): bound from pipeline workspace git-credentials

Results

Result	Description
COMMIT	Commit SHA of the manifest update
UPDATED_FILE	Path to the updated manifest file

How it works

Clones GIT_REPOSITORY, finds MANIFEST_PATH, and rewrites the line referencing IMAGE_NAME to use the new IMAGE_TAG. The rewrite logic differs by MANIFEST_TYPE: kustomize updates images: blocks, helm patches values files via key paths, and kubernetes does an in-place sed on image: lines. Commits + pushes with the SSH key from the ssh-directory workspace.

Examples

Bump tag in a Kustomize repo after a successful build

steps:
  - name: bump-manifest
    uses: loha/git-update-manifest@v1
    with:
      GIT_REPOSITORY: 'git@gitlab.example.com:my-org/my-app-manifests.git'
      GIT_BRANCH: 'main'
      IMAGE_NAME: 'registry.example.com/my-org/my-app'
      IMAGE_TAG: '${COMMIT_SHA}'
      MANIFEST_PATH: 'k8s/overlays/production/kustomization.yaml'
      MANIFEST_TYPE: 'kustomize'

Troubleshooting

Problem: Push rejected: protected branch.

Solution: Either use a deploy key with bypass rights, or target a non-protected branch and have a downstream automation merge.

---

Problem: Image tag not picked up by ArgoCD.

Solution: Confirm MANIFEST_TYPE matches the file shape: Kustomize images: blocks need explicit name/newTag keys, and Helm values files need the right key path. Inspect the resulting commit's diff before assuming the step is broken.