Writing image updates to helm values file doesn't work with multiple images

[ljupchokotev]

Describe the bug
ArgoCD Image Updater does not update the image tags correctly when multiple images are in a single helm values file.

We can see the commit message has:

updates image workflows-docker-virtual/workflows/workflows-api tag 'staging-3590699-20240327111632' to 'staging-fe2e578-20240717134349'
updates image workflows-docker-virtual/workflows/resource-controller tag 'staging-3590699-20240327111636' to 'staging-fe2e578-20240717134350'

The commit has the following changes to the file:

 resourceController:
   image:
     name: registry/image
-    tag: staging-801acf3-20240716201426
+    tag: staging-fe2e578-20240717134350

There should be an additional change to set another Helm value for the workflows-api image tag.

The application is configured with the following annotations:

    argocd-image-updater.argoproj.io/write-back-method: git:secret:argocd/xxx
    argocd-image-updater.argoproj.io/write-back-target: helmvalues:/apps/workflows/staging/values.yaml
    argocd-image-updater.argoproj.io/git-repository: [email protected]:org/repo
    argocd-image-updater.argoproj.io/image-list: api=registry.com/workflows-docker-virtual/workflows/workflows-api, rc=registry.com/workflows-docker-virtual/workflows/resource-controller
    argocd-image-updater.argoproj.io/api.helm.image-name: api.image.name
    argocd-image-updater.argoproj.io/api.helm.image-tag: api.image.tag
    argocd-image-updater.argoproj.io/api.platforms: linux/amd64
    argocd-image-updater.argoproj.io/api.update-strategy: latest
    argocd-image-updater.argoproj.io/api.allow-tags: regexp:^staging-.*
    argocd-image-updater.argoproj.io/rc.helm.image-name: resourceController.image.name
    argocd-image-updater.argoproj.io/rc.helm.image-tag: resourceController.image.tag
    argocd-image-updater.argoproj.io/rc.platforms: linux/amd64
    argocd-image-updater.argoproj.io/rc.update-strategy: latest
    argocd-image-updater.argoproj.io/rc.allow-tags: regexp:^staging-.*
    argocd-image-updater.argoproj.io/pull-secret: pullsecret:argocd/image-pull-secret
    argocd-image-updater.argoproj.io/force-update: "true"
    argocd-image-updater.argoproj.io/git-branch: main

Based on the commit message, it seems like the configuration is correct as it was able to find updates to both images. But it only updates the rc image. The next time the updater runs, it will say that the file contents are as expected and will skip doing any changes. We see the following log line:

time="2024-07-17T12:51:23Z" level=debug msg="target parameter file and marshaled data are the same, skipping commit." application=workflows-staging

If I remove the rc image, then it will successfully update the api image.

To Reproduce
Steps to reproduce the behavior:

1. Configure an application with multiple sources and the above annotations.
2. Push new tags for the images at almost the same time.
3. See ArgoCD Image Updater only updating a single image in the values.yaml file.

Expected behavior
Both image tags should be updated.

Additional context
The values.yaml file has:

api:
  image:
    name: xxx
    tag: xxx
resourceController:
  image:
    name: xxx
    tag: xxx

The application uses multiple sources:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: workflows-staging
  namespace: argocd
  annotations:
    # same as above
spec:
  project: workflows
  sources:
    - repoURL: https://helm-repo-url
      chart: workflows-staging
      targetRevision: 0.*.*
      helm:
        releaseName: workflows
        valueFiles:
          - $values/apps/workflows/staging/values.yaml
    - repoURL: [email protected]:org/repo
      targetRevision: main
      ref: values
  destination:
    namespace: my-namespace
    name: workflows-stage

Version
v0.14.0

Logs

time="2024-07-17T12:51:23Z" level=debug msg="target parameter file and marshaled data are the same, skipping commit." application=workflows-staging

[ljupchokotev]

After trying to debug locally and going through the code, I noticed that it was picking up the same images multiple times. Turns out that was due to the force-update annotation. Once I removed that annotation, it updates the api image, but not the rc image. The commit description still shows that both images need to be updated.