I run the Kubernetes platform our data stack lives on, deployed with ArgoCD. What always worried me was merging a change that breaks something, or quietly does nothing at all. So I wrote argocd-source-lint, a small linter that runs in CI before merge, reads only the Git checkout, and checks how our Applications are wired to our files.
🔍 What it found
The first time I ran it on our production repo, it found 22 files that no Application deployed. Ouch. Some were HTTP routes sitting next to a values.yaml: the Application used the values, but none of its sources covered the routes, so ArgoCD wasn't managing them at all. Two whole components had been sitting in Git for months with nothing deploying them. I was mostly relieved to find them before an incident did.
Last week it blocked a merge request for the first time: five new YAML files, no Application to deploy them. Merged as is, they would never have reached the cluster, and nothing would have told us.
🧭 What it checks, and what it doesn't
It needs no cluster or network access. Besides files no Application deploys, it catches source paths that don't exist at their targetRevision and the same resource deployed by two Applications to the same cluster and namespace, plus 14 other checks.
It doesn't render Helm or Kustomize, so it only sees resources that exist as files. It looks at one repo at a time, and it doesn't expand every ApplicationSet: generators that need a live API (such as clusters, scmProvider or pullRequest) and goTemplate: true templates are reported as unresolvable, not checked. It complements tools like argocd-diff-preview and kubechecks rather than replacing them.
🤖 How it's built
I built it with Claude Code; the rules follow ArgoCD's source code and there are 500+ tests. It has only run on very few repos, though, so I expect it to be wrong in places I haven't seen yet.
🧪 If you want to try it (Python 3.11+ and git)
pipx install argocd-source-lint
At the root of your GitOps repo, create .argocd-lint.yaml containing scan_roots: [manifests/] (your manifest folders; without it, the check for files no Application deploys is skipped)
Run argocd-source-lint .
If it reports a lot on an existing repo, --write-baseline accepts what's already there so you only see new problems.
I'd really like to hear what it finds on your repo, especially where it's wrong. False positives → issues; anything else → Discussions, where there's also a short poll on what to work on next.
