Bump version to 3.0.23 on release-3.0 branch (#26118 )

Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: crenshaw-dev <350466+crenshaw-dev@users.noreply.github.com>
fix: cherry pick #25516 to release-3.0 (#26107 )
2026-02-21 10:08:47 +01:00 · 2026-01-22 14:33:36 -05:00 · 2026-01-22 12:09:14 -05:00 · 2026-01-20 18:51:40 +02:00 · 2026-01-15 16:26:10 -05:00 · 2026-01-13 20:38:15 +02:00
999 changed files with 43512 additions and 62088 deletions
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -10,7 +10,7 @@ updates:
    groups:
      otel:
        patterns:
-          - "go.opentelemetry.io/*"
+          - "^go.opentelemetry.io/.*"

  - package-ecosystem: "github-actions"
    directory: "/"
@@ -22,11 +22,10 @@ updates:
    schedule:
      interval: "daily"

-# Disabled since this code is rarely used.
-#  - package-ecosystem: "npm"
-#    directory: "/ui-test/"
-#    schedule:
-#      interval: "daily"
+  - package-ecosystem: "npm"
+    directory: "/ui-test/"
+    schedule:
+      interval: "daily"

  - package-ecosystem: "docker"
    directory: "/"
@@ -53,8 +52,7 @@ updates:
    schedule:
      interval: "daily"

-# Disabled since this code is rarely used.
-#  - package-ecosystem: "docker"
-#    directory: "/ui-test/"
-#    schedule:
-#      interval: "daily"
+  - package-ecosystem: "docker"
+    directory: "/ui-test/"
+    schedule:
+      interval: "daily"
--- a/.github/workflows/README.md
+++ b/.github/workflows/README.md
@@ -16,7 +16,7 @@

 ## image-reuse.yaml

- The reusable workflow can be used to publish or build images with multiple container registries(Quay,GHCR, dockerhub), and then sign them with cosign when an image is published.
+- The resuable workflow can be used to publish or build images with multiple container registries(Quay,GHCR, dockerhub), and then sign them with cosign when an image is published.
 - A GO version `must` be specified e.g. 1.21
 - The image name for each registry *must* contain the tag. Note: multiple tags are allowed for each registry using a CSV type.
 - Multiple platforms can be specified e.g. linux/amd64,linux/arm64
--- a/.github/workflows/bump-major-version.yaml
+++ b/.github/workflows/bump-major-version.yaml
@@ -37,7 +37,7 @@ jobs:
        working-directory: /home/runner/go/src/github.com/argoproj/argo-cd

      - name: Setup Golang
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: ${{ env.GOLANG_VERSION }}
      - name: Add ~/go/bin to PATH
@@ -74,7 +74,7 @@ jobs:
          rsync -a --exclude=.git /home/runner/go/src/github.com/argoproj/argo-cd/ ../argo-cd

      - name: Create pull request
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e  # v7.0.8
+        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f  # v7.0.5
        with:
          commit-message: "Bump major version to ${{ steps.get-target-version.outputs.TARGET_VERSION }}"
          title: "Bump major version to ${{ steps.get-target-version.outputs.TARGET_VERSION }}"
--- a/.github/workflows/ci-build.yaml
+++ b/.github/workflows/ci-build.yaml
@@ -14,11 +14,11 @@ on:
 env:
  # Golang version to use across CI steps
  # renovate: datasource=golang-version packageName=golang
-  GOLANG_VERSION: '1.24.4'
+  GOLANG_VERSION: '1.24.6'

 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
+  cancel-in-progress: true

 permissions:
  contents: read
@@ -32,7 +32,7 @@ jobs:
      docs: ${{ steps.filter.outputs.docs_any_changed }}
    steps:
      - uses: actions/checkout@8410ad0602e1e429cee44a835ae9f77f654a6694 # v4.0.0
-      - uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46.0.5
+      - uses: tj-actions/changed-files@bab30c2299617f6615ec02a68b9a40d10bd21366 # v45.0.5
        id: filter
        with:
          # Any file which is not under docs/, ui/ or is not a markdown file is counted as a backend file
@@ -57,7 +57,7 @@ jobs:
      - name: Checkout code
        uses: actions/checkout@8410ad0602e1e429cee44a835ae9f77f654a6694 # v4.0.0
      - name: Setup Golang
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: ${{ env.GOLANG_VERSION }}
      - name: Download all Go modules
@@ -78,11 +78,11 @@ jobs:
      - name: Checkout code
        uses: actions/checkout@8410ad0602e1e429cee44a835ae9f77f654a6694 # v4.0.0
      - name: Setup Golang
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: ${{ env.GOLANG_VERSION }}
      - name: Restore go build cache
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: ~/.cache/go-build
          key: ${{ runner.os }}-go-build-v1-${{ github.run_id }}
@@ -105,14 +105,14 @@ jobs:
      - name: Checkout code
        uses: actions/checkout@8410ad0602e1e429cee44a835ae9f77f654a6694 # v4.0.0
      - name: Setup Golang
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: ${{ env.GOLANG_VERSION }}
      - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
+        uses: golangci/golangci-lint-action@971e284b6050e8a5849b72094c50ab08da042db8 # v6.1.1
        with:
          # renovate: datasource=go packageName=github.com/golangci/golangci-lint versioning=regex:^v(?<major>\d+)\.(?<minor>\d+)\.(?<patch>\d+)?$
-          version: v2.1.6
+          version: v1.64.7
          args: --verbose

  test-go:
@@ -133,7 +133,7 @@ jobs:
      - name: Create symlink in GOPATH
        run: ln -s $(pwd) ~/go/src/github.com/argoproj/argo-cd
      - name: Setup Golang
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: ${{ env.GOLANG_VERSION }}
      - name: Install required packages
@@ -153,7 +153,7 @@ jobs:
        run: |
          echo "/usr/local/bin" >> $GITHUB_PATH
      - name: Restore go build cache
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: ~/.cache/go-build
          key: ${{ runner.os }}-go-build-v1-${{ github.run_id }}
@@ -174,7 +174,7 @@ jobs:
      - name: Run all unit tests
        run: make test-local
      - name: Generate test results artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: test-results
          path: test-results
@@ -197,7 +197,7 @@ jobs:
      - name: Create symlink in GOPATH
        run: ln -s $(pwd) ~/go/src/github.com/argoproj/argo-cd
      - name: Setup Golang
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: ${{ env.GOLANG_VERSION }}
      - name: Install required packages
@@ -217,7 +217,7 @@ jobs:
        run: |
          echo "/usr/local/bin" >> $GITHUB_PATH
      - name: Restore go build cache
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: ~/.cache/go-build
          key: ${{ runner.os }}-go-build-v1-${{ github.run_id }}
@@ -238,7 +238,7 @@ jobs:
      - name: Run all unit tests
        run: make test-race-local
      - name: Generate test results artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: race-results
          path: test-results/
@@ -253,7 +253,7 @@ jobs:
      - name: Checkout code
        uses: actions/checkout@8410ad0602e1e429cee44a835ae9f77f654a6694 # v4.0.0
      - name: Setup Golang
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: ${{ env.GOLANG_VERSION }}
      - name: Create symlink in GOPATH
@@ -305,13 +305,13 @@ jobs:
      - name: Checkout code
        uses: actions/checkout@8410ad0602e1e429cee44a835ae9f77f654a6694 # v4.0.0
      - name: Setup NodeJS
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
        with:
          # renovate: datasource=node-version packageName=node versioning=node
          node-version: '22.9.0'
      - name: Restore node dependency cache
        id: cache-dependencies
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: ui/node_modules
          key: ${{ runner.os }}-node-dep-v2-${{ hashFiles('**/yarn.lock') }}
@@ -333,15 +333,6 @@ jobs:
        run: yarn lint
        working-directory: ui/

-  shellcheck:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@8410ad0602e1e429cee44a835ae9f77f654a6694 # v4.0.0
-      - run: |
-          sudo apt-get install shellcheck
-          shellcheck -e SC2086 -e SC2046 -e SC2068 -e SC2206 -e SC2048 -e SC2059 -e SC2154 -e SC2034 -e SC2016 -e SC2128 -e SC1091 -e SC2207  $(find . -type f -name '*.sh') | tee sc.log
-          test ! -s sc.log
-
  analyze:
    name: Process & analyze test artifacts
    if: ${{ needs.changes.outputs.backend == 'true' || needs.changes.outputs.frontend == 'true' }}
@@ -360,7 +351,7 @@ jobs:
          fetch-depth: 0
      - name: Restore node dependency cache
        id: cache-dependencies
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: ui/node_modules
          key: ${{ runner.os }}-node-dep-v2-${{ hashFiles('**/yarn.lock') }}
@@ -368,12 +359,12 @@ jobs:
        run: |
          rm -rf ui/node_modules/argo-ui/node_modules
      - name: Get e2e code coverage
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: e2e-code-coverage
          path: e2e-code-coverage
      - name: Get unit test code coverage
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
        with:
          name: test-results
          path: test-results
@@ -385,15 +376,15 @@ jobs:
        run: |
          go tool covdata percent -i=test-results,e2e-code-coverage/applicationset-controller,e2e-code-coverage/repo-server,e2e-code-coverage/app-controller,e2e-code-coverage/commit-server -o test-results/full-coverage.out
      - name: Upload code coverage information to codecov.io
-        uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24 # v5.4.3
+        uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
        with:
-          files: test-results/full-coverage.out
+          file: test-results/full-coverage.out
          fail_ci_if_error: true
        env:
          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
      - name: Upload test results to Codecov
        if: github.ref == 'refs/heads/master' && github.event_name == 'push' && github.repository == 'argoproj/argo-cd'
-        uses: codecov/test-results-action@47f89e9acb64b76debcd5ea40642d25a4adced9f # v1.1.1
+        uses: codecov/test-results-action@9739113ad922ea0a9abb4b2c0f8bf6a4aa8ef820 # v1.0.1
        with:
          file: test-results/junit.xml
          fail_ci_if_error: true
@@ -402,7 +393,7 @@ jobs:
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-        uses: SonarSource/sonarqube-scan-action@2500896589ef8f7247069a56136f8dc177c27ccf # v5.2.0
+        uses: SonarSource/sonarqube-scan-action@bfd4e558cda28cda6b5defafb9232d191be8c203 # v4.2.1
        if: env.sonar_secret != ''
  test-e2e:
    name: Run end-to-end tests
@@ -414,14 +405,14 @@ jobs:
        # latest: true means that this version mush upload the coverage report to codecov.io
        # We designate the latest version because we only collect code coverage for that version.
        k3s:
-          - version: v1.33.1
-            latest: true
          - version: v1.32.1
-            latest: false
+            latest: true
          - version: v1.31.0
            latest: false
          - version: v1.30.4
            latest: false
+          - version: v1.29.8
+            latest: false
    needs:
      - build-go
      - changes
@@ -449,7 +440,7 @@ jobs:
      - name: Checkout code
        uses: actions/checkout@8410ad0602e1e429cee44a835ae9f77f654a6694 # v4.0.0
      - name: Setup Golang
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: ${{ env.GOLANG_VERSION }}
      - name: GH actions workaround - Kill XSP4 process
@@ -468,7 +459,7 @@ jobs:
          sudo chmod go-r $HOME/.kube/config
          kubectl version
      - name: Restore go build cache
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3
+        uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
        with:
          path: ~/.cache/go-build
          key: ${{ runner.os }}-go-build-v1-${{ github.run_id }}
@@ -494,9 +485,9 @@ jobs:
          git config --global user.email "john.doe@example.com"
      - name: Pull Docker image required for tests
        run: |
-          docker pull ghcr.io/dexidp/dex:v2.43.0
+          docker pull ghcr.io/dexidp/dex:v2.41.1
          docker pull argoproj/argo-cd-ci-builder:v1.0.0
-          docker pull redis:7.2.7-alpine
+          docker pull redis:7.2.11-alpine
      - name: Create target directory for binaries in the build-process
        run: |
          mkdir -p dist
@@ -526,13 +517,13 @@ jobs:
          goreman run stop-all || echo "goreman trouble"
          sleep 30
      - name: Upload e2e coverage report
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: e2e-code-coverage
          path: /tmp/coverage
        if: ${{ matrix.k3s.latest }}
      - name: Upload e2e-server logs
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: e2e-server-k8s${{ matrix.k3s.version }}.log
          path: /tmp/e2e-server.log
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -33,7 +33,7 @@ jobs:

    # Use correct go version. https://github.com/github/codeql-action/issues/1842#issuecomment-1704398087
    - name: Setup Golang
-      uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+      uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
      with:
        go-version-file: go.mod
      
--- a/.github/workflows/image-reuse.yaml
+++ b/.github/workflows/image-reuse.yaml
@@ -67,16 +67,15 @@ jobs:
        if: ${{ github.ref_type != 'tag'}}

      - name: Setup Golang
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: ${{ inputs.go-version }}
-          cache: false

      - name: Install cosign
-        uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
+        uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0

-      - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
-      - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+      - uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
+      - uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0

      - name: Setup tags for container image as a CSV type
        run: |
@@ -103,7 +102,7 @@ jobs:
            echo 'EOF' >> $GITHUB_ENV

      - name: Login to Quay.io
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: quay.io
          username: ${{ secrets.quay_username }}
@@ -111,7 +110,7 @@ jobs:
        if: ${{ inputs.quay_image_name && inputs.push }}

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          registry: ghcr.io
          username: ${{ secrets.ghcr_username }}
@@ -119,7 +118,7 @@ jobs:
        if: ${{ inputs.ghcr_image_name && inputs.push }}

      - name: Login to dockerhub Container Registry
-        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
        with:
          username: ${{ secrets.docker_username }}
          password: ${{ secrets.docker_password }}
@@ -142,7 +141,7 @@ jobs:

      - name: Build and push container image
        id: image
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 #v6.18.0
+        uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 #v6.10.0
        with:
          context: .
          platforms: ${{ inputs.platforms }}
--- a/.github/workflows/image.yaml
+++ b/.github/workflows/image.yaml
@@ -53,7 +53,7 @@ jobs:
    with:
      # Note: cannot use env variables to set go-version (https://docs.github.com/en/actions/using-workflows/reusing-workflows#limitations)
      # renovate: datasource=golang-version packageName=golang
-      go-version: 1.24.4
+      go-version: 1.24.6
      platforms: ${{ needs.set-vars.outputs.platforms }}
      push: false

@@ -70,7 +70,7 @@ jobs:
      ghcr_image_name: ghcr.io/argoproj/argo-cd/argocd:${{ needs.set-vars.outputs.image-tag }}
      # Note: cannot use env variables to set go-version (https://docs.github.com/en/actions/using-workflows/reusing-workflows#limitations)
      # renovate: datasource=golang-version packageName=golang
-      go-version: 1.24.4
+      go-version: 1.24.6
      platforms: ${{ needs.set-vars.outputs.platforms }}
      push: true
    secrets:
@@ -88,7 +88,7 @@ jobs:
      packages: write # for uploading attestations. (https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#known-issues)
    if: ${{ github.repository == 'argoproj/argo-cd' && github.event_name == 'push' }}
    # Must be refernced by a tag. https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#referencing-the-slsa-generator
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.0.0
    with:
      image: ghcr.io/argoproj/argo-cd/argocd
      digest: ${{ needs.build-and-publish.outputs.image-digest }}
--- a/.github/workflows/init-release.yaml
+++ b/.github/workflows/init-release.yaml
@@ -64,7 +64,7 @@ jobs:
          git stash pop

      - name: Create pull request
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e  # v7.0.8
+        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f  # v7.0.5
        with:
          commit-message: "Bump version to ${{ inputs.TARGET_VERSION }}"
          title: "Bump version to ${{ inputs.TARGET_VERSION }} on ${{ inputs.TARGET_BRANCH }} branch"
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -11,7 +11,7 @@ permissions: {}

 env:
  # renovate: datasource=golang-version packageName=golang
-  GOLANG_VERSION: '1.24.4' # Note: go-version must also be set in job argocd-image.with.go-version
+  GOLANG_VERSION: '1.24.6' # Note: go-version must also be set in job argocd-image.with.go-version

 jobs:
  argocd-image:
@@ -25,13 +25,49 @@ jobs:
      quay_image_name: quay.io/argoproj/argocd:${{ github.ref_name }}
      # Note: cannot use env variables to set go-version (https://docs.github.com/en/actions/using-workflows/reusing-workflows#limitations)
      # renovate: datasource=golang-version packageName=golang
-      go-version: 1.24.4
+      go-version: 1.24.6
      platforms: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
      push: true
    secrets:
      quay_username: ${{ secrets.RELEASE_QUAY_USERNAME }}
      quay_password: ${{ secrets.RELEASE_QUAY_TOKEN }}

+  setup-variables:
+    name: Setup Release Variables
+    if: github.repository == 'argoproj/argo-cd'
+    runs-on: ubuntu-22.04
+    outputs:
+      is_pre_release: ${{ steps.var.outputs.is_pre_release }}
+      is_latest_release: ${{ steps.var.outputs.is_latest_release }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@8410ad0602e1e429cee44a835ae9f77f654a6694 # v4.0.0
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Setup variables
+        id: var
+        run: |
+          set -xue
+          # Fetch all tag information
+          git fetch --prune --tags --force
+
+          LATEST_RELEASE_TAG=$(git -c 'versionsort.suffix=-rc' tag --list --sort=version:refname | grep -v '-' | tail -n1)
+
+          PRE_RELEASE=false
+          # Check if latest tag is a pre-release
+          if echo ${{ github.ref_name }} | grep -E -- '-rc[0-9]+$';then
+            PRE_RELEASE=true
+          fi
+
+          IS_LATEST=false
+          # Ensure latest release tag matches github.ref_name
+          if [[ $LATEST_RELEASE_TAG == ${{ github.ref_name }} ]];then
+            IS_LATEST=true
+          fi
+          echo "is_pre_release=$PRE_RELEASE" >> $GITHUB_OUTPUT
+          echo "is_latest_release=$IS_LATEST" >> $GITHUB_OUTPUT
+
  argocd-image-provenance:
    needs: [argocd-image]
    permissions:
@@ -40,7 +76,7 @@ jobs:
      packages: write # for uploading attestations. (https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#known-issues)
    # Must be refernced by a tag. https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#referencing-the-slsa-generator
    if: github.repository == 'argoproj/argo-cd'
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.0.0
    with:
      image: quay.io/argoproj/argocd
      digest: ${{ needs.argocd-image.outputs.image-digest }}
@@ -50,15 +86,17 @@ jobs:

  goreleaser:
    needs:
+      - setup-variables
      - argocd-image
      - argocd-image-provenance
    permissions:
      contents: write # used for uploading assets
    if: github.repository == 'argoproj/argo-cd'
    runs-on: ubuntu-22.04
+    env:
+      GORELEASER_MAKE_LATEST: ${{ needs.setup-variables.outputs.is_latest_release }}
    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}
-
    steps:
      - name: Checkout code
        uses: actions/checkout@8410ad0602e1e429cee44a835ae9f77f654a6694 # v4.0.0
@@ -70,10 +108,9 @@ jobs:
        run: git fetch --force --tags

      - name: Setup Golang
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: ${{ env.GOLANG_VERSION }}
-          cache: false

      - name: Set GORELEASER_PREVIOUS_TAG # Workaround, GoReleaser uses 'git-describe' to determine a previous tag. Our tags are created in release branches.
        run: |
@@ -96,7 +133,7 @@ jobs:
          tool-cache: false

      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
+        uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
        id: run-goreleaser
        with:
          version: latest
@@ -128,7 +165,7 @@ jobs:
      contents: write #  Needed for release uploads
    if: github.repository == 'argoproj/argo-cd'
    # Must be refernced by a tag. https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#referencing-the-slsa-generator
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
    with:
      base64-subjects: '${{ needs.goreleaser.outputs.hashes }}'
      provenance-name: 'argocd-cli.intoto.jsonl'
@@ -142,7 +179,7 @@ jobs:
    permissions:
      contents: write # Needed for release uploads
    outputs:
-      hashes: ${{ steps.sbom-hash.outputs.hashes}}
+      hashes: ${{ steps.sbom-hash.outputs.hashes }}
    if: github.repository == 'argoproj/argo-cd'
    runs-on: ubuntu-22.04
    steps:
@@ -153,10 +190,9 @@ jobs:
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Setup Golang
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
        with:
          go-version: ${{ env.GOLANG_VERSION }}
-          cache: false

      - name: Generate SBOM (spdx)
        id: spdx-builder
@@ -198,7 +234,7 @@ jobs:
          echo "hashes=$(sha256sum /tmp/sbom.tar.gz | base64 -w0)" >> "$GITHUB_OUTPUT"

      - name: Upload SBOM
-        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
+        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
@@ -213,7 +249,7 @@ jobs:
      contents: write #  Needed for release uploads
    if: github.repository == 'argoproj/argo-cd'
    # Must be referenced by a tag. https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#referencing-the-slsa-generator
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
    with:
      base64-subjects: '${{ needs.generate-sbom.outputs.hashes }}'
      provenance-name: 'argocd-sbom.intoto.jsonl'
@@ -221,6 +257,7 @@ jobs:

  post-release:
    needs:
+      - setup-variables
      - argocd-image
      - goreleaser
      - generate-sbom
@@ -229,6 +266,8 @@ jobs:
      pull-requests: write # Needed to create PR for VERSION update.
    if: github.repository == 'argoproj/argo-cd'
    runs-on: ubuntu-22.04
+    env:
+      TAG_STABLE: ${{ needs.setup-variables.outputs.is_latest_release }}
    steps:
      - name: Checkout code
        uses: actions/checkout@8410ad0602e1e429cee44a835ae9f77f654a6694 # v4.0.0
@@ -242,27 +281,6 @@ jobs:
          git config --global user.email 'ci@argoproj.com'
          git config --global user.name 'CI'

-      - name: Check if tag is the latest version and not a pre-release
-        run: |
-          set -xue
-          # Fetch all tag information
-          git fetch --prune --tags --force
-
-          LATEST_TAG=$(git -c 'versionsort.suffix=-rc' tag --list --sort=version:refname | tail -n1)
-
-          PRE_RELEASE=false
-          # Check if latest tag is a pre-release
-          if echo $LATEST_TAG | grep -E -- '-rc[0-9]+$';then
-            PRE_RELEASE=true
-          fi
-
-          # Ensure latest tag matches github.ref_name & not a pre-release
-          if [[ $LATEST_TAG == ${{ github.ref_name }} ]] && [[ $PRE_RELEASE != 'true' ]];then
-            echo "TAG_STABLE=true" >> $GITHUB_ENV
-          else
-            echo "TAG_STABLE=false" >> $GITHUB_ENV
-          fi
-
      - name: Update stable tag to latest version
        run: |
          git tag -f stable ${{ github.ref_name }}
@@ -296,7 +314,7 @@ jobs:
        if: ${{ env.UPDATE_VERSION == 'true' }}

      - name: Create PR to update VERSION on master branch
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
        with:
          commit-message: Bump version in master
          title: 'chore: Bump version in master'
--- a/.github/workflows/scorecard.yaml
+++ b/.github/workflows/scorecard.yaml
@@ -35,7 +35,7 @@ jobs:
          persist-credentials: false

      - name: "Run analysis"
-        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
        with:
          results_file: results.sarif
          results_format: sarif
@@ -54,7 +54,7 @@ jobs:
      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
      # format to the repository Actions tab.
      - name: "Upload artifact"
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
        with:
          name: SARIF file
          path: results.sarif
--- a/.gitignore
+++ b/.gitignore
@@ -8,7 +8,6 @@ ui/dist/app/*
 !ui/dist/app/gitkeep
 site/
 *.iml
-.tilt-bin/
 # delve debug binaries
 cmd/**/debug
 debug.test
@@ -28,6 +27,3 @@ cmd/argocd/argocd
 cmd/argocd-application-controller/argocd-application-controller
 cmd/argocd-repo-server/argocd-repo-server
 cmd/argocd-server/argocd-server
-
-# ignore generated `.argocd-helm-dep-up` marker file; this should not be committed to git
-reposerver/repository/testdata/**/.argocd-helm-dep-up
--- a/.gitpod.Dockerfile
+++ b/.gitpod.Dockerfile
@@ -0,0 +1,21 @@
+FROM gitpod/workspace-full@sha256:a47a68ee7f9da10cd889ccce4661bc73f2c0d5a98d3d087e8bdfc0230b27964c
+
+USER root
+
+RUN curl -o /usr/local/bin/kubectl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" && \
+    chmod +x /usr/local/bin/kubectl
+
+RUN curl -L https://github.com/kubernetes-sigs/kubebuilder/releases/download/v2.3.1/kubebuilder_2.3.1_$(go env GOOS)_$(go env GOARCH).tar.gz | \
+    tar -xz -C /tmp/ && mv /tmp/kubebuilder_2.3.1_$(go env GOOS)_$(go env GOARCH) /usr/local/kubebuilder
+
+ENV GOCACHE=/go-build-cache
+
+RUN apt-get install redis-server -y
+RUN go install github.com/mattn/goreman@latest
+
+RUN chown -R gitpod:gitpod /go-build-cache
+
+USER gitpod
+
+ENV ARGOCD_REDIS_LOCAL=true
+ENV KUBECONFIG=/tmp/kubeconfig
--- a/.gitpod.yml
+++ b/.gitpod.yml
@@ -0,0 +1,6 @@
+image:
+  file: .gitpod.Dockerfile
+
+tasks:
+  - init: make mod-download-local dep-ui-local && GO111MODULE=off go install github.com/mattn/goreman@latest
+    command: make start-test-k8s
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -1,253 +1,156 @@
-formatters:
-  enable:
-    - gofumpt
-    - goimports
-
-  settings:
-    goimports:
-      local-prefixes:
-        - github.com/argoproj/argo-cd/v3
-
 issues:
+  exclude:
+    - SA5011
  max-issues-per-linter: 0
-
  max-same-issues: 0
-
+  exclude-rules:
+    - path: '(.+)_test\.go'
+      linters:
+        - unparam
 linters:
  enable:
+    - errcheck
    - errorlint
-    - exptostd
    - gocritic
+    - gofumpt
+    - goimports
    - gomodguard
+    - gosimple
    - govet
    - importas
+    - ineffassign
    - misspell
+    # Disabled because of https://github.com/argoproj/argo-cd/issues/21705
+    # - nolintlint
    - perfsprint
    - revive
    - staticcheck
    - testifylint
    - thelper
-    - tparallel
    - unparam
+    - unused
    - usestdlibvars
    - usetesting
    - whitespace
-
-  exclusions:
+linters-settings:
+  gocritic:
+    disabled-checks:
+      - appendAssign
+      - assignOp # Keep it disabled for readability
+      - exitAfterDefer
+      - mapKey
+      - typeSwitchVar
+  goimports:
+    local-prefixes: github.com/argoproj/argo-cd/v3
+  gomodguard:
+    blocked:
+      modules:
+        - github.com/golang-jwt/jwt/v4:
+            recommendations:
+              - github.com/golang-jwt/jwt/v5
+        - github.com/imdario/mergo:
+            recommendations:
+              - dario.cat/mergo
+            reason: '`github.com/imdario/mergo` has been renamed.'
+        - github.com/pkg/errors:
+            recommendations:
+              - errors
+  importas:
+    alias:
+      - alias: jwtgo
+        pkg: github.com/golang-jwt/jwt/v5
+      - alias: appsv1
+        pkg: k8s.io/api/apps/v1
+      - alias: corev1
+        pkg: k8s.io/api/core/v1
+      - alias: rbacv1
+        pkg: k8s.io/api/rbac/v1
+      - alias: apierrors
+        pkg: k8s.io/apimachinery/pkg/api/errors
+      - alias: apiextensionsv1
+        pkg: k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1
+      - alias: metav1
+        pkg: k8s.io/apimachinery/pkg/apis/meta/v1
+      - alias: informersv1
+        pkg: k8s.io/client-go/informers/core/v1
+      - alias: stderrors
+        pkg: errors
+  nolintlint:
+    require-specific: true
+  perfsprint:
+    # Optimizes even if it requires an int or uint type cast.
+    int-conversion: true
+    # Optimizes into `err.Error()` even if it is only equivalent for non-nil errors.
+    err-error: true
+    # Optimizes `fmt.Errorf`.
+    errorf: true
+    # Optimizes `fmt.Sprintf` with only one argument.
+    sprintf1: true
+    # Optimizes into strings concatenation.
+    strconcat: true
+  revive:
+    # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md
    rules:
-      - linters:
-          - unparam
-        path: (.+)_test\.go
-
-    presets:
-      - comments
-      - common-false-positives
-      - legacy
-      - std-error-handling
-
-    warn-unused: true
-
-  settings:
-    gocritic:
-      enable-all: true
-      # Most of these should probably be enabled one-by-one.
-      disabled-checks:
-        - appendAssign
-        - appendCombine # Leave disabled, multi-line assigns can be more readable.
-        - assignOp # Leave disabled, assign operations can be more confusing than helpful.
-        - commentedOutCode
-        - deferInLoop
-        - exitAfterDefer
-        - exposedSyncMutex
-        - hugeParam
-        - importShadow
-        - paramTypeCombine # Leave disabled, there are too many failures to be worth fixing.
-        - rangeValCopy
-        - tooManyResultsChecker
-        - unnamedResult
-        - whyNoLint
-
-    gomodguard:
-      blocked:
-        modules:
-          - github.com/golang-jwt/jwt/v4:
-              recommendations:
-                - github.com/golang-jwt/jwt/v5
-
-          - github.com/imdario/mergo:
-              recommendations:
-                - dario.cat/mergo
-              reason: '`github.com/imdario/mergo` has been renamed.'
-
-          - github.com/pkg/errors:
-              recommendations:
-                - errors
-
-    govet:
-      disable:
-        - fieldalignment
-        - shadow
-      enable-all: true
-
-    importas:
-      alias:
-        - pkg: github.com/golang-jwt/jwt/v5
-          alias: jwtgo
-
-        - pkg: k8s.io/api/apps/v1
-          alias: appsv1
-
-        - pkg: k8s.io/api/core/v1
-          alias: corev1
-
-        - pkg: k8s.io/api/rbac/v1
-          alias: rbacv1
-
-        - pkg: k8s.io/apimachinery/pkg/api/errors
-          alias: apierrors
-
-        - pkg: k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1
-          alias: apiextensionsv1
-
-        - pkg: k8s.io/apimachinery/pkg/apis/meta/v1
-          alias: metav1
-
-        - pkg: k8s.io/client-go/informers/core/v1
-          alias: informersv1
-
-        - pkg: errors
-          alias: stderrors
-
-        - pkg: github.com/argoproj/argo-cd/v3/util/io
-          alias: utilio
-
-    nolintlint:
-      require-specific: true
-
-    perfsprint:
-      # Optimizes even if it requires an int or uint type cast.
-      int-conversion: true
-      # Optimizes into `err.Error()` even if it is only equivalent for non-nil errors.
-      err-error: true
-      # Optimizes `fmt.Errorf`.
-      errorf: true
-      # Optimizes `fmt.Sprintf` with only one argument.
-      sprintf1: true
-      # Optimizes into strings concatenation.
-      strconcat: true
-
-    revive:
-      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md
-      rules:
-        - name: bool-literal-in-expr
-
-        - name: blank-imports
-          disabled: true
-
-        - name: context-as-argument
-          arguments:
-            - allowTypesBefore: '*testing.T,testing.TB'
-
-        - name: context-keys-type
-          disabled: true
-
-        - name: dot-imports
-          disabled: true
-
-        - name: duplicated-imports
-
-        - name: early-return
-          arguments:
-            - preserveScope
-
-        - name: empty-block
-          disabled: true
-
-        - name: error-naming
-          disabled: true
-
-        - name: error-return
-
-        - name: error-strings
-          disabled: true
-
-        - name: errorf
-
-        - name: identical-branches
-
-        - name: if-return
-
-        - name: increment-decrement
-
-        - name: indent-error-flow
-          arguments:
-            - preserveScope
-
-        - name: modifies-parameter
-
-        - name: optimize-operands-order
-
-        - name: range
-
-        - name: receiver-naming
-
-        - name: redefines-builtin-id
-          disabled: true
-
-        - name: redundant-import-alias
-
-        - name: superfluous-else
-          arguments:
-            - preserveScope
-
-        - name: time-equal
-
-        - name: time-naming
-          disabled: true
-
-        - name: unexported-return
-          disabled: true
-
-        - name: unnecessary-stmt
-
-        - name: unreachable-code
-
-        - name: unused-parameter
-
-        - name: use-any
-
-        - name: useless-break
-
-        - name: var-declaration
-
-        - name: var-naming
-          arguments:
-            - - ID
-            - - VM
-            - - skipPackageNameChecks: true
-                upperCaseConst: true
-
-    staticcheck:
-      checks:
-        - all
-        - -SA5011
-        - -ST1003
-        - -ST1016
-
-    testifylint:
-      enable-all: true
-
-      disable:
-        - go-require
-
-    unused:
-      field-writes-are-uses: false
-      exported-fields-are-used: false
-
-    usetesting:
-      os-mkdir-temp: false
-
-output:
-  show-stats: false
-
-version: "2"
+      - name: bool-literal-in-expr
+      - name: blank-imports
+        disabled: true
+      - name: context-as-argument
+        arguments:
+          - allowTypesBefore: '*testing.T,testing.TB'
+      - name: context-keys-type
+        disabled: true
+      - name: dot-imports
+        disabled: true
+      - name: duplicated-imports
+      - name: early-return
+        arguments:
+          - 'preserveScope'
+      - name: empty-block
+        disabled: true
+      - name: error-naming
+        disabled: true
+      - name: error-return
+      - name: error-strings
+        disabled: true
+      - name: errorf
+      - name: identical-branches
+      - name: if-return
+      - name: increment-decrement
+      - name: indent-error-flow
+        arguments:
+          - 'preserveScope'
+      - name: modifies-parameter
+      - name: optimize-operands-order
+      - name: range
+      - name: receiver-naming
+      - name: redefines-builtin-id
+        disabled: true
+      - name: redundant-import-alias
+      - name: superfluous-else
+        arguments:
+          - 'preserveScope'
+      - name: time-equal
+      - name: time-naming
+        disabled: true
+      - name: unexported-return
+        disabled: true
+      - name: unnecessary-stmt
+      - name: unreachable-code
+      - name: unused-parameter
+      - name: use-any
+      - name: useless-break
+      - name: var-declaration
+      - name: var-naming
+        arguments:
+          - ["ID"]
+          - ["VM"]
+          - - skipPackageNameChecks: true
+              upperCaseConst: true
+  testifylint:
+    enable-all: true
+    disable:
+      - go-require
+  usetesting:
+    os-mkdir-temp: false
+run:
+  timeout: 50m
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -21,7 +21,7 @@ builds:
      - -X github.com/argoproj/argo-cd/v3/common.gitCommit={{ .FullCommit }}
      - -X github.com/argoproj/argo-cd/v3/common.gitTreeState={{ .Env.GIT_TREE_STATE }}
      - -X github.com/argoproj/argo-cd/v3/common.kubectlVersion={{ .Env.KUBECTL_VERSION }}
-      - '{{ if or (eq .Runtime.Goos "linux") (eq .Runtime.Goos "windows") }}-extldflags="-static"{{ end }}'
+      - -extldflags="-static"
    goos:
      - linux
      - windows
@@ -42,29 +42,21 @@ builds:
        goarch: ppc64le
      - goos: windows
        goarch: arm64
-    overrides:
-      - goos: darwin
-        goarch: amd64
-        env:
-          - CGO_ENABLED=1
-      - goos: darwin
-        goarch: arm64
-        env:
-          - CGO_ENABLED=1

 archives:
  - id: argocd-archive
-    ids:
+    builds:
      - argocd-cli
    name_template: |-
      {{ .ProjectName }}-{{ .Os }}-{{ .Arch }}
-    formats: [ binary ]
+    formats: [binary]

 checksum:
  name_template: 'cli_checksums.txt'
  algorithm: sha256

 release:
+  make_latest: '{{ .Env.GORELEASER_MAKE_LATEST }}'
  prerelease: auto
  draft: false
  header: |
@@ -89,7 +81,7 @@ release:
    All Argo CD container images are signed by cosign.  A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the [documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/signed-release-assets) on how to verify.

    ## Release Notes Blog Post
-    For a detailed breakdown of the key changes and improvements in this release, check out the [official blog post](https://blog.argoproj.io/argo-cd-v3-0-release-candidate-a0b933f4e58f)
+    For a detailed breakdown of the key changes and improvements in this release, check out the [official blog post](https://blog.argoproj.io/argo-cd-v2-14-release-candidate-57a664791e2a)

    ## Upgrading

@@ -100,16 +92,13 @@ release:
    <a href="https://argoproj.github.io/cd/"><img src="https://raw.githubusercontent.com/argoproj/argo-site/master/content/pages/cd/gitops-cd.png" width="25%" ></a>

 snapshot: #### To be removed for PR
-  version_template: '2.6.0'
+  name_template: '2.6.0'

 changelog:
  use: github
  sort: asc
  abbrev: 0
  groups: # Regex use RE2 syntax as defined here: https://github.com/google/re2/wiki/Syntax.
-    - title: 'Breaking Changes'
-      regexp: '^.*?(\([[:word:]]+\))??!:.+$'
-      order: 0
    - title: 'Features'
      regexp: '^.*?feat(\([[:word:]]+\))??!?:.+$'
      order: 100
--- a/.mockery.yaml
+++ b/.mockery.yaml
@@ -1,82 +1,82 @@
-dir: '{{.InterfaceDir}}/mocks'
-structname: '{{.InterfaceName}}'
-filename: '{{.InterfaceName}}.go'
-pkgname: mocks
-
-template-data:
-  unroll-variadic: true
-
+# global config
+filename: "{{.InterfaceName}}.go"
+dir: "{{.InterfaceDir}}/mocks"
+outpkg: "mocks"
+mockname: "{{.InterfaceName}}"
+with-expecter: false
+# individual interface config
 packages:
  github.com/argoproj/argo-cd/v3/applicationset/generators:
    interfaces:
-      Generator: {}
+      Generator:
  github.com/argoproj/argo-cd/v3/applicationset/services:
    interfaces:
-      Repos: {}
+      Repos:
  github.com/argoproj/argo-cd/v3/applicationset/services/scm_provider:
    config:
-      dir: applicationset/services/scm_provider/aws_codecommit/mocks
+      dir: "applicationset/services/scm_provider/aws_codecommit/mocks"
    interfaces:
-      AWSCodeCommitClient: {}
-      AWSTaggingClient: {}
+      AWSCodeCommitClient:
+      AWSTaggingClient:
+  github.com/microsoft/azure-devops-go-api/azuredevops/git:
+    config:
+      dir: "applicationset/services/scm_provider/azure_devops/git/mocks"
+    interfaces:
+      Client:
  github.com/argoproj/argo-cd/v3/applicationset/utils:
    interfaces:
-      Renderer: {}
-  github.com/argoproj/argo-cd/v3/commitserver/apiclient:
-    interfaces:
-      Clientset: {}
-      CommitServiceClient: {}
+      Renderer:
  github.com/argoproj/argo-cd/v3/commitserver/commit:
    interfaces:
-      RepoClientFactory: {}
+      RepoClientFactory:
+  github.com/argoproj/argo-cd/v3/commitserver/apiclient:
+    interfaces:
+      CommitServiceClient:
+      Clientset:
  github.com/argoproj/argo-cd/v3/controller/cache:
    interfaces:
-      LiveStateCache: {}
-  github.com/argoproj/argo-cd/v3/pkg/apiclient/cluster:
-    interfaces:
-      ClusterServiceServer: {}
-  github.com/argoproj/argo-cd/v3/pkg/apiclient/session:
-    interfaces:
-      SessionServiceClient: {}
-      SessionServiceServer: {}
-  github.com/argoproj/argo-cd/v3/pkg/client/clientset/versioned/typed/application/v1alpha1:
-    interfaces:
-      AppProjectInterface: {}
+      LiveStateCache:
  github.com/argoproj/argo-cd/v3/reposerver/apiclient:
    interfaces:
-      RepoServerService_GenerateManifestWithFilesClient: {}
-      RepoServerServiceClient: {}
+      RepoServerServiceClient:
+      RepoServerService_GenerateManifestWithFilesClient:
  github.com/argoproj/argo-cd/v3/server/application:
    interfaces:
-      Broadcaster: {}
+      Broadcaster:
  github.com/argoproj/argo-cd/v3/server/extension:
    interfaces:
-      ApplicationGetter: {}
-      ExtensionMetricsRegistry: {}
-      ProjectGetter: {}
-      RbacEnforcer: {}
-      SettingsGetter: {}
-      UserGetter: {}
+      ApplicationGetter:
+      ExtensionMetricsRegistry:
+      ProjectGetter:
+      RbacEnforcer:
+      SettingsGetter:
+      UserGetter:
  github.com/argoproj/argo-cd/v3/util/db:
    interfaces:
-      ArgoDB: {}
+      ArgoDB:
  github.com/argoproj/argo-cd/v3/util/git:
    interfaces:
-      Client: {}
+      Client:
  github.com/argoproj/argo-cd/v3/util/helm:
    interfaces:
-      Client: {}
+      Client:
  github.com/argoproj/argo-cd/v3/util/io:
    interfaces:
-      TempPaths: {}
+      TempPaths:
  github.com/argoproj/argo-cd/v3/util/notification/argocd:
    interfaces:
-      Service: {}
+      Service:
  github.com/argoproj/argo-cd/v3/util/workloadidentity:
    interfaces:
-      TokenProvider: {}
-  github.com/microsoft/azure-devops-go-api/azuredevops/v7/git:
-    config:
-      dir: applicationset/services/scm_provider/azure_devops/git/mocks
+      TokenProvider:
+  # These mocks are not currently used, but they are part of the public API of this package.      
+  github.com/argoproj/argo-cd/v3/pkg/apiclient/session:
    interfaces:
-      Client: {}
+      SessionServiceServer:
+      SessionServiceClient:
+  github.com/argoproj/argo-cd/v3/pkg/apiclient/cluster:
+    interfaces:
+      ClusterServiceServer:
+  github.com/argoproj/argo-cd/v3/pkg/client/clientset/versioned/typed/application/v1alpha1:
+    interfaces:
+      AppProjectInterface:
--- a/4
+++ b/4
@@ -4,7 +4,7 @@ ARG BASE_IMAGE=docker.io/library/ubuntu:24.04@sha256:80dd3c3b9c6cecb9f1667e9290b
 # Initial stage which pulls prepares build dependencies and CLI tooling we need for our final image
 # Also used as the image in CI jobs so needs all dependencies
 ####################################################################################################
-FROM docker.io/library/golang:1.24.4@sha256:db5d0afbfb4ab648af2393b92e87eaae9ad5e01132803d80caef91b5752d289c AS builder
+FROM docker.io/library/golang:1.24.6@sha256:2c89c41fb9efc3807029b59af69645867cfe978d2b877d475be0d72f6c6ce6f6 AS builder

 WORKDIR /tmp

@@ -103,7 +103,7 @@ RUN HOST_ARCH=$TARGETARCH NODE_ENV='production' NODE_ONLINE_ENV='online' NODE_OP
 ####################################################################################################
 # Argo CD Build stage which performs the actual build of Argo CD binaries
 ####################################################################################################
-FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.24.4@sha256:db5d0afbfb4ab648af2393b92e87eaae9ad5e01132803d80caef91b5752d289c AS argocd-build
+FROM --platform=$BUILDPLATFORM docker.io/library/golang:1.24.6@sha256:2c89c41fb9efc3807029b59af69645867cfe978d2b877d475be0d72f6c6ce6f6 AS argocd-build

 WORKDIR /go/src/github.com/argoproj/argo-cd

--- a/Dockerfile.tilt
+++ b/Dockerfile.tilt
@@ -1,62 +0,0 @@
-FROM docker.io/library/golang:1.24.1@sha256:c5adecdb7b3f8c5ca3c88648a861882849cc8b02fed68ece31e25de88ad13418 
-
-ENV DEBIAN_FRONTEND=noninteractive
-
-RUN echo 'deb http://archive.debian.org/debian buster-backports main' >> /etc/apt/sources.list
-
-RUN apt-get update && apt-get install --no-install-recommends -y \
-    curl \
-    openssh-server \
-    nginx \
-    unzip \
-    fcgiwrap \
-    git \
-    git-lfs \
-    make \
-    wget \
-    gcc \
-    sudo \
-    zip \
-    tini \
-    gpg \
-    tzdata \
-    connect-proxy
-
-RUN go install github.com/go-delve/delve/cmd/dlv@latest
-
-COPY hack/install.sh hack/tool-versions.sh ./
-COPY hack/installers installers
-
-RUN ./install.sh helm && \
-    INSTALL_PATH=/usr/local/bin ./install.sh kustomize
-
-COPY hack/gpg-wrapper.sh \
-    hack/git-verify-wrapper.sh \
-    entrypoint.sh \
-    /usr/local/bin/
-
-# support for mounting configuration from a configmap
-WORKDIR /app/config/ssh
-RUN touch ssh_known_hosts && \
-    ln -s /app/config/ssh/ssh_known_hosts /etc/ssh/ssh_known_hosts
-
-WORKDIR /app/config
-RUN mkdir -p tls && \
-    mkdir -p gpg/source && \
-    mkdir -p gpg/keys 
-
-COPY .tilt-bin/argocd_linux /usr/local/bin/argocd
-
-RUN ln -s /usr/local/bin/argocd /usr/local/bin/argocd-server && \
-    ln -s /usr/local/bin/argocd /usr/local/bin/argocd-repo-server && \
-    ln -s /usr/local/bin/argocd /usr/local/bin/argocd-application-controller && \
-    ln -s /usr/local/bin/argocd /usr/local/bin/argocd-dex && \
-    ln -s /usr/local/bin/argocd /usr/local/bin/argocd-notifications && \
-    ln -s /usr/local/bin/argocd /usr/local/bin/argocd-applicationset-controller && \
-    ln -s /usr/local/bin/argocd /usr/local/bin/argocd-commit-server
-
-# directory for Tilt restart file
-RUN mkdir -p /tilt
-
-# overridden by Tiltfile
-ENTRYPOINT ["/usr/bin/tini", "-s", "--", "dlv", "exec", "--continue", "--accept-multiclient", "--headless", "--listen=:2345", "--api-version=2"]
--- a/Dockerfile.ui.tilt
+++ b/Dockerfile.ui.tilt
@@ -1,9 +0,0 @@
-FROM node:24
-
-WORKDIR /app/ui
-
-COPY ui /app/ui
-
-RUN yarn install
-
-ENTRYPOINT ["yarn", "start"]
--- a/18
+++ b/18
@@ -3,16 +3,7 @@ CURRENT_DIR=$(shell pwd)
 DIST_DIR=${CURRENT_DIR}/dist
 CLI_NAME=argocd
 BIN_NAME=argocd
-
-UNAME_S:=$(shell uname)
-IS_DARWIN:=$(if $(filter Darwin, $(UNAME_S)),true,false)
-
-# When using OSX/Darwin, you might need to enable CGO for local builds
-DEFAULT_CGO_FLAG:=0
-ifeq ($(IS_DARWIN),true)
-    DEFAULT_CGO_FLAG:=1
-endif
-CGO_FLAG?=${DEFAULT_CGO_FLAG}
+CGO_FLAG=0

 GEN_RESOURCES_CLI_NAME=argocd-resources-gen

@@ -156,11 +147,7 @@ PATH:=$(PATH):$(PWD)/hack
 DOCKER_PUSH?=false
 IMAGE_NAMESPACE?=
 # perform static compilation
-DEFAULT_STATIC_BUILD:=true
-ifeq ($(IS_DARWIN),true)
-    DEFAULT_STATIC_BUILD:=false
-endif
-STATIC_BUILD?=${DEFAULT_STATIC_BUILD}
+STATIC_BUILD?=true
 # build development images
 DEV_IMAGE?=false
 ARGOCD_GPG_ENABLED?=true
@@ -598,7 +585,6 @@ install-test-tools-local:
 	./hack/install.sh kustomize
 	./hack/install.sh helm
 	./hack/install.sh gotestsum
-	./hack/install.sh oras

 # Installs all tools required for running codegen (Linux packages)
 .PHONY: install-codegen-tools-local
--- a/1
+++ b/1
@@ -8,7 +8,6 @@ commit-server: [ "$BIN_MODE" = 'true' ] && COMMAND=./dist/argocd || COMMAND='go
 ui: sh -c 'cd ui && ${ARGOCD_E2E_YARN_CMD:-yarn} start'
 git-server: test/fixture/testrepos/start-git.sh
 helm-registry: test/fixture/testrepos/start-helm-registry.sh
-oci-registry: test/fixture/testrepos/start-authenticated-helm-registry.sh
 dev-mounter: [[ "$ARGOCD_E2E_TEST" != "true" ]] && go run hack/dev-mounter/main.go --configmap argocd-ssh-known-hosts-cm=${ARGOCD_SSH_DATA_PATH:-/tmp/argocd-local/ssh} --configmap argocd-tls-certs-cm=${ARGOCD_TLS_DATA_PATH:-/tmp/argocd-local/tls} --configmap argocd-gpg-keys-cm=${ARGOCD_GPG_DATA_PATH:-/tmp/argocd-local/gpg/source}
 applicationset-controller: [ "$BIN_MODE" = 'true' ] && COMMAND=./dist/argocd || COMMAND='go run ./cmd/main.go' && sh -c "GOCOVERDIR=${ARGOCD_COVERAGE_DIR:-/tmp/coverage/applicationset-controller} FORCE_LOG_COLORS=4 ARGOCD_FAKE_IN_CLUSTER=true ARGOCD_TLS_DATA_PATH=${ARGOCD_TLS_DATA_PATH:-/tmp/argocd-local/tls} ARGOCD_SSH_DATA_PATH=${ARGOCD_SSH_DATA_PATH:-/tmp/argocd-local/ssh} ARGOCD_BINARY_NAME=argocd-applicationset-controller $COMMAND --loglevel debug --metrics-addr localhost:12345 --probe-addr localhost:12346 --argocd-repo-server localhost:${ARGOCD_E2E_REPOSERVER_PORT:-8081}"
 notification: [ "$BIN_MODE" = 'true' ] && COMMAND=./dist/argocd || COMMAND='go run ./cmd/main.go' && sh -c "GOCOVERDIR=${ARGOCD_COVERAGE_DIR:-/tmp/coverage/notification} FORCE_LOG_COLORS=4 ARGOCD_FAKE_IN_CLUSTER=true ARGOCD_TLS_DATA_PATH=${ARGOCD_TLS_DATA_PATH:-/tmp/argocd-local/tls} ARGOCD_BINARY_NAME=argocd-notifications $COMMAND --loglevel debug --application-namespaces=${ARGOCD_APPLICATION_NAMESPACES:-''} --self-service-notification-enabled=${ARGOCD_NOTIFICATION_CONTROLLER_SELF_SERVICE_NOTIFICATION_ENABLED:-'false'}"
--- a/SECURITY-INSIGHTS.yml
+++ b/SECURITY-INSIGHTS.yml
@@ -3,9 +3,9 @@ header:
  expiration-date: '2024-10-31T00:00:00.000Z' # One year from initial release.
  last-updated: '2023-10-27'
  last-reviewed: '2023-10-27'
-  commit-hash: 226a670fe6b3c6769ff6d18e6839298a58e4577d
+  commit-hash: 74a367d10e7110209610ba3ec225539ebe5f7522
  project-url: https://github.com/argoproj/argo-cd
-  project-release: v3.1.0
+  project-release: v2.14.0
  changelog: https://github.com/argoproj/argo-cd/releases
  license: https://github.com/argoproj/argo-cd/blob/master/LICENSE
 project-lifecycle:
--- a/282
+++ b/282
@@ -1,282 +0,0 @@
-load('ext://restart_process', 'docker_build_with_restart')
-load('ext://uibutton', 'cmd_button', 'location')
-
-# add ui button in web ui to run make codegen-local (top nav)
-cmd_button(
-    'make codegen-local',
-    argv=['sh', '-c', 'make codegen-local'],
-    location=location.NAV,
-    icon_name='terminal',
-    text='make codegen-local',
-)
-
-# add ui button in web ui to run make codegen-local (top nav)
-cmd_button(
-    'make cli-local',
-    argv=['sh', '-c', 'make cli-local'],
-    location=location.NAV,
-    icon_name='terminal',
-    text='make cli-local',
-)
-
-# detect cluster architecture for build
-cluster_version = decode_yaml(local('kubectl version -o yaml'))
-platform = cluster_version['serverVersion']['platform']
-arch = platform.split('/')[1]
-
-# build the argocd binary on code changes
-code_deps = [
-    'applicationset',
-    'cmd',
-    'cmpserver',
-    'commitserver',
-    'common',
-    'controller',
-    'notification-controller',
-    'pkg',
-    'reposerver',
-    'server',
-    'util',
-    'go.mod',
-    'go.sum',
-]
-local_resource(
-    'build',
-    'CGO_ENABLED=0 GOOS=linux GOARCH=' + arch + ' go build -gcflags="all=-N -l" -mod=readonly -o .tilt-bin/argocd_linux cmd/main.go',
-    deps = code_deps,
-    allow_parallel=True,
-)
-
-# deploy the argocd manifests
-k8s_yaml(kustomize('manifests/dev-tilt'))
-
-# build dev image
-docker_build_with_restart(
-    'argocd', 
-    context='.',
-    dockerfile='Dockerfile.tilt',
-    entrypoint=[
-        "/usr/bin/tini",
-        "-s",
-        "--",
-        "dlv",
-        "exec",
-        "--continue",
-        "--accept-multiclient",
-        "--headless",
-        "--listen=:2345",
-        "--api-version=2"
-    ],
-    platform=platform,
-    live_update=[
-        sync('.tilt-bin/argocd_linux_amd64', '/usr/local/bin/argocd'),
-    ],
-    only=[
-        '.tilt-bin',
-        'hack',
-        'entrypoint.sh',
-    ],
-    restart_file='/tilt/.restart-proc'
-)
-
-# build image for argocd-cli jobs
-docker_build(
-    'argocd-job', 
-    context='.',
-    dockerfile='Dockerfile.tilt',
-    platform=platform,
-    only=[
-        '.tilt-bin',
-        'hack',
-        'entrypoint.sh',
-    ]
-)
-
-# track argocd-server resources and port forward
-k8s_resource(
-    workload='argocd-server',
-    objects=[
-        'argocd-server:serviceaccount',
-        'argocd-server:role',
-        'argocd-server:rolebinding',
-        'argocd-cm:configmap',
-        'argocd-cmd-params-cm:configmap',
-        'argocd-gpg-keys-cm:configmap',
-        'argocd-rbac-cm:configmap',
-        'argocd-ssh-known-hosts-cm:configmap',
-        'argocd-tls-certs-cm:configmap',
-        'argocd-secret:secret',
-        'argocd-server-network-policy:networkpolicy',
-        'argocd-server:clusterrolebinding',
-        'argocd-server:clusterrole',
-    ],
-    port_forwards=[
-        '8080:8080',
-        '9345:2345',
-        '8083:8083'
-    ],
-)
-
-# track crds
-k8s_resource(
-    new_name='cluster-resources',
-    objects=[
-        'applications.argoproj.io:customresourcedefinition',
-        'applicationsets.argoproj.io:customresourcedefinition',
-        'appprojects.argoproj.io:customresourcedefinition',
-        'argocd:namespace'
-    ]
-)
-
-# track argocd-repo-server resources and port forward
-k8s_resource(
-    workload='argocd-repo-server',
-    objects=[
-        'argocd-repo-server:serviceaccount',
-        'argocd-repo-server-network-policy:networkpolicy',
-    ],
-    port_forwards=[
-        '8081:8081',
-        '9346:2345',
-        '8084:8084'
-    ],
-)
-
-# track argocd-redis resources and port forward
-k8s_resource(
-    workload='argocd-redis',
-    objects=[
-        'argocd-redis:serviceaccount',
-        'argocd-redis:role',
-        'argocd-redis:rolebinding',
-        'argocd-redis-network-policy:networkpolicy',
-    ],
-    port_forwards=[
-        '6379:6379',
-    ],
-)
-
-# track argocd-applicationset-controller resources
-k8s_resource(
-    workload='argocd-applicationset-controller',
-    objects=[
-        'argocd-applicationset-controller:serviceaccount',
-        'argocd-applicationset-controller-network-policy:networkpolicy',
-        'argocd-applicationset-controller:role',
-        'argocd-applicationset-controller:rolebinding',
-        'argocd-applicationset-controller:clusterrolebinding',
-        'argocd-applicationset-controller:clusterrole',
-    ],
-    port_forwards=[
-        '9347:2345',
-        '8085:8080',
-        '7000:7000'
-    ],
-)
-
-# track argocd-application-controller resources
-k8s_resource(
-    workload='argocd-application-controller',
-    objects=[
-        'argocd-application-controller:serviceaccount',
-        'argocd-application-controller-network-policy:networkpolicy',
-        'argocd-application-controller:role',
-        'argocd-application-controller:rolebinding',
-        'argocd-application-controller:clusterrolebinding',
-        'argocd-application-controller:clusterrole',
-    ],
-    port_forwards=[
-        '9348:2345',
-        '8086:8082',
-    ],
-)
-
-# track argocd-notifications-controller resources
-k8s_resource(
-    workload='argocd-notifications-controller',
-    objects=[
-        'argocd-notifications-controller:serviceaccount',
-        'argocd-notifications-controller-network-policy:networkpolicy',
-        'argocd-notifications-controller:role',
-        'argocd-notifications-controller:rolebinding',
-        'argocd-notifications-cm:configmap',
-        'argocd-notifications-secret:secret',
-    ],
-    port_forwards=[
-        '9349:2345',
-        '8087:9001',
-    ],
-)
-
-# track argocd-dex-server resources
-k8s_resource(
-    workload='argocd-dex-server',
-    objects=[
-        'argocd-dex-server:serviceaccount',
-        'argocd-dex-server-network-policy:networkpolicy',
-        'argocd-dex-server:role',
-        'argocd-dex-server:rolebinding',
-    ],
-)
-
-# track argocd-commit-server resources
-k8s_resource(
-    workload='argocd-commit-server',
-    objects=[
-        'argocd-commit-server:serviceaccount',
-        'argocd-commit-server-network-policy:networkpolicy',
-    ],
-    port_forwards=[
-        '9350:2345',
-        '8088:8087',
-        '8089:8086',
-    ],
-)
-
-# docker for ui
-docker_build(
-    'argocd-ui',
-    context='.',
-    dockerfile='Dockerfile.ui.tilt',
-    entrypoint=['sh', '-c', 'cd /app/ui && yarn start'], 
-    only=['ui'],
-    live_update=[
-        sync('ui', '/app/ui'),
-        run('sh -c "cd /app/ui && yarn install"', trigger=['/app/ui/package.json', '/app/ui/yarn.lock']),
-    ],
-)
-
-# track argocd-ui resources and port forward
-k8s_resource(
-    workload='argocd-ui',
-    port_forwards=[
-        '4000:4000',
-    ],
-)
-
-# linting
-local_resource(
-    'lint',
-    'make lint-local',
-    deps = code_deps,
-    allow_parallel=True,
-)
-
-local_resource(
-    'lint-ui',
-    'make lint-ui-local',
-    deps = [
-        'ui',
-    ],
-    allow_parallel=True,
-)
-
-local_resource(
-    'vendor',
-    'go mod vendor',
-    deps = [
-        'go.mod',
-        'go.sum',
-    ],
-)
-
--- a/USERS.md
+++ b/USERS.md
@@ -30,7 +30,6 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [Ant Group](https://www.antgroup.com/)
 1. [AppDirect](https://www.appdirect.com)
 1. [Arctiq Inc.](https://www.arctiq.ca)
-1. [Artemis Health by Nomi Health](https://www.artemishealth.com/)
 1. [Arturia](https://www.arturia.com)
 1. [ARZ Allgemeines Rechenzentrum GmbH](https://www.arz.at/)
 1. [Augury](https://www.augury.com/)
@@ -46,7 +45,6 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [Bedag Informatik AG](https://www.bedag.ch/)
 1. [Beleza Na Web](https://www.belezanaweb.com.br/)
 1. [Believable Bots](https://believablebots.io)
-1. [Bayer AG](https://bayer.com)
 1. [BigPanda](https://bigpanda.io)
 1. [BioBox Analytics](https://biobox.io)
 1. [BMW Group](https://www.bmwgroup.com/)
@@ -69,7 +67,6 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [Chainnodes](https://chainnodes.org)
 1. [Chargetrip](https://chargetrip.com)
 1. [Chime](https://www.chime.com)
-1. [Chronicle Labs](https://chroniclelabs.org)
 1. [Cisco ET&I](https://eti.cisco.com/)
 1. [Cloud Posse](https://www.cloudposse.com/)
 1. [Cloud Scale](https://cloudscaleinc.com/)
@@ -95,15 +92,12 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [Daydream](https://daydream.ing)
 1. [Deloitte](https://www.deloitte.com/)
 1. [Deutsche Telekom AG](https://telekom.com)
-1. [Deutsche Bank AG](https://www.deutsche-bank.de/)
 1. [Devopsi - Poland Software/DevOps Consulting](https://devopsi.pl/)
 1. [Devtron Labs](https://github.com/devtron-labs/devtron)
-1. [DigitalEd](https://www.digitaled.com)
 1. [DigitalOcean](https://www.digitalocean.com)
 1. [Divar](https://divar.ir)
 1. [Divistant](https://divistant.com)
 1. [Dott](https://ridedott.com)
-1. [Doubble](https://www.doubble.app)
 1. [Doximity](https://www.doximity.com/)
 1. [EDF Renewables](https://www.edf-re.com/)
 1. [edX](https://edx.org)
@@ -115,7 +109,6 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [Energisme](https://energisme.com/)
 1. [enigmo](https://enigmo.co.jp/)
 1. [Envoy](https://envoy.com/)
-1. [eSave](https://esave.es/)
 1. [Factorial](https://factorialhr.com/)
 1. [Farfetch](https://www.farfetch.com)
 1. [Faro](https://www.faro.com/)
@@ -163,7 +156,6 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [IABAI](https://www.iab.ai)
 1. [IBM](https://www.ibm.com/)
 1. [Ibotta](https://home.ibotta.com)
-1. [Icelandair](https://www.icelandair.com)
 1. [IFS](https://www.ifs.com)
 1. [IITS-Consulting](https://iits-consulting.de)
 1. [IllumiDesk](https://www.illumidesk.com)
@@ -267,7 +259,6 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [Patreon](https://www.patreon.com/)
 1. [PayIt](https://payitgov.com/)
 1. [PayPay](https://paypay.ne.jp/)
-1. [Paystack](https://paystack.com/)
 1. [Peloton Interactive](https://www.onepeloton.com/)
 1. [Percona](https://percona.com/)
 1. [PGS](https://www.pgs.com)
@@ -314,7 +305,6 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [Saloodo! GmbH](https://www.saloodo.com)
 1. [Sap Labs](http://sap.com)
 1. [Sauce Labs](https://saucelabs.com/)
-1. [Schneider Electric](https://www.se.com)
 1. [Schwarz IT](https://jobs.schwarz/it-mission)
 1. [SCRM Lidl International Hub](https://scrm.lidl)
 1. [SEEK](https://seek.com.au)
@@ -324,7 +314,7 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [SI Analytics](https://si-analytics.ai)
 1. [Sidewalk Entertainment](https://sidewalkplay.com/)
 1. [Skit](https://skit.ai/)
-1. [Skribble](https://skribble.com)
+1. [Skribble](https://skribble.com) 
 1. [Skyscanner](https://www.skyscanner.net/)
 1. [Smart Pension](https://www.smartpension.co.uk/)
 1. [Smilee.io](https://smilee.io)
@@ -345,13 +335,11 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [Sumo Logic](https://sumologic.com/)
 1. [Sutpc](http://www.sutpc.com/)
 1. [Swiss Post](https://github.com/swisspost)
-1. [Swissblock Technologies](https://swissblock.net/)
 1. [Swisscom](https://www.swisscom.ch)
 1. [Swissquote](https://github.com/swissquote)
 1. [Syncier](https://syncier.com/)
 1. [Synergy](https://synergy.net.au)
 1. [Syself](https://syself.com)
-1. [T-ROC Global](https://trocglobal.com/)
 1. [TableCheck](https://tablecheck.com/)
 1. [Tailor Brands](https://www.tailorbrands.com)
 1. [Tamkeen Technologies](https://tamkeentech.sa/)
@@ -393,7 +381,6 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [Volvo Cars](https://www.volvocars.com/)
 1. [Voyager Digital](https://www.investvoyager.com/)
 1. [VSHN - The DevOps Company](https://vshn.ch/)
-1. [Wakacje.pl](https://www.wakacje.pl/)
 1. [Walkbase](https://www.walkbase.com/)
 1. [Webstores](https://www.webstores.nl)
 1. [Wehkamp](https://www.wehkamp.nl/)
@@ -409,8 +396,8 @@ Currently, the following organizations are **officially** using Argo CD:
 1. [Yieldlab](https://www.yieldlab.de/)
 1. [Youverify](https://youverify.co/)
 1. [Yubo](https://www.yubo.live/)
-1. [Yuno](https://y.uno/)
 1. [ZDF](https://www.zdf.de/)
 1. [Zimpler](https://www.zimpler.com/)
-1. [ZipRecruiter](https://www.ziprecruiter.com/)
+1. [ZipRecuiter](https://www.ziprecruiter.com/)
 1. [ZOZO](https://corp.zozo.com/)
+
--- a/2
+++ b/2
@@ -1 +1 @@
-3.1.0
+3.0.23
--- a/applicationset/controllers/applicationset_controller.go
+++ b/applicationset/controllers/applicationset_controller.go
@@ -51,7 +51,6 @@ import (
 	"github.com/argoproj/argo-cd/v3/applicationset/status"
 	"github.com/argoproj/argo-cd/v3/applicationset/utils"
 	"github.com/argoproj/argo-cd/v3/common"
-	applog "github.com/argoproj/argo-cd/v3/util/app/log"
 	"github.com/argoproj/argo-cd/v3/util/db"

 	argov1alpha1 "github.com/argoproj/argo-cd/v3/pkg/apis/application/v1alpha1"
@@ -72,6 +71,7 @@ const (
 var defaultPreservedAnnotations = []string{
 	NotifiedAnnotationKey,
 	argov1alpha1.AnnotationKeyRefresh,
+	argov1alpha1.AnnotationKeyHydrate,
 }

 // ApplicationSetReconciler reconciles a ApplicationSet object
@@ -92,6 +92,7 @@ type ApplicationSetReconciler struct {
 	GlobalPreservedAnnotations []string
 	GlobalPreservedLabels      []string
 	Metrics                    *metrics.ApplicationsetMetrics
+	MaxResourcesStatusCount    int
 }

 // +kubebuilder:rbac:groups=argoproj.io,resources=applicationsets,verbs=get;list;watch;create;update;patch;delete
@@ -128,8 +129,8 @@ func (r *ApplicationSetReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 	}()

 	// Do not attempt to further reconcile the ApplicationSet if it is being deleted.
-	if applicationSetInfo.DeletionTimestamp != nil {
-		appsetName := applicationSetInfo.Name
+	if applicationSetInfo.ObjectMeta.DeletionTimestamp != nil {
+		appsetName := applicationSetInfo.ObjectMeta.Name
 		logCtx.Debugf("DeletionTimestamp is set on %s", appsetName)
 		deleteAllowed := utils.DefaultPolicy(applicationSetInfo.Spec.SyncPolicy, r.Policy, r.EnablePolicyOverride).AllowDelete()
 		if !deleteAllowed {
@@ -211,16 +212,16 @@ func (r *ApplicationSetReconciler) Reconcile(ctx context.Context, req ctrl.Reque
 	appSyncMap := map[string]bool{}

 	if r.EnableProgressiveSyncs {
-		if !isRollingSyncStrategy(&applicationSetInfo) && len(applicationSetInfo.Status.ApplicationStatus) > 0 {
-			// If an appset was previously syncing with a `RollingSync` strategy but it has switched to the default strategy, clean up the progressive sync application statuses
+		if applicationSetInfo.Spec.Strategy == nil && len(applicationSetInfo.Status.ApplicationStatus) > 0 {
+			// If appset used progressive sync but stopped, clean up the progressive sync application statuses
 			logCtx.Infof("Removing %v unnecessary AppStatus entries from ApplicationSet %v", len(applicationSetInfo.Status.ApplicationStatus), applicationSetInfo.Name)

 			err := r.setAppSetApplicationStatus(ctx, logCtx, &applicationSetInfo, []argov1alpha1.ApplicationSetApplicationStatus{})
 			if err != nil {
 				return ctrl.Result{}, fmt.Errorf("failed to clear previous AppSet application statuses for %v: %w", applicationSetInfo.Name, err)
 			}
-		} else if isRollingSyncStrategy(&applicationSetInfo) {
-			// The appset uses progressive sync with `RollingSync` strategy
+		} else if applicationSetInfo.Spec.Strategy != nil {
+			// appset uses progressive sync
 			for _, app := range currentApplications {
 				appMap[app.Name] = app
 			}
@@ -315,7 +316,7 @@ func (r *ApplicationSetReconciler) Reconcile(ctx context.Context, req ctrl.Reque

 	if applicationSetInfo.RefreshRequired() {
 		delete(applicationSetInfo.Annotations, common.AnnotationApplicationSetRefresh)
-		err := r.Update(ctx, &applicationSetInfo)
+		err := r.Client.Update(ctx, &applicationSetInfo)
 		if err != nil {
 			logCtx.Warnf("error occurred while updating ApplicationSet: %v", err)
 			_ = r.setApplicationSetStatusCondition(ctx,
@@ -489,7 +490,7 @@ func (r *ApplicationSetReconciler) validateGeneratedApplications(ctx context.Con
 		namesSet[app.Name] = true

 		appProject := &argov1alpha1.AppProject{}
-		err := r.Get(ctx, types.NamespacedName{Name: app.Spec.Project, Namespace: r.ArgoCDNamespace}, appProject)
+		err := r.Client.Get(ctx, types.NamespacedName{Name: app.Spec.Project, Namespace: r.ArgoCDNamespace}, appProject)
 		if err != nil {
 			if apierrors.IsNotFound(err) {
 				errorsByIndex[i] = fmt.Errorf("application references project %s which does not exist", app.Spec.Project)
@@ -578,7 +579,7 @@ func (r *ApplicationSetReconciler) createOrUpdateInCluster(ctx context.Context,
 	var firstError error
 	// Creates or updates the application in appList
 	for _, generatedApp := range desiredApplications {
-		appLog := logCtx.WithFields(applog.GetAppLogFields(&generatedApp))
+		appLog := logCtx.WithFields(log.Fields{"app": generatedApp.QualifiedName()})

 		// Normalize to avoid fighting with the application controller.
 		generatedApp.Spec = *argoutil.NormalizeApplicationSpec(&generatedApp.Spec)
@@ -625,7 +626,7 @@ func (r *ApplicationSetReconciler) createOrUpdateInCluster(ctx context.Context,
 			preservedAnnotations = append(preservedAnnotations, defaultPreservedAnnotations...)

 			for _, key := range preservedAnnotations {
-				if state, exists := found.Annotations[key]; exists {
+				if state, exists := found.ObjectMeta.Annotations[key]; exists {
 					if generatedApp.Annotations == nil {
 						generatedApp.Annotations = map[string]string{}
 					}
@@ -634,7 +635,7 @@ func (r *ApplicationSetReconciler) createOrUpdateInCluster(ctx context.Context,
 			}

 			for _, key := range preservedLabels {
-				if state, exists := found.Labels[key]; exists {
+				if state, exists := found.ObjectMeta.Labels[key]; exists {
 					if generatedApp.Labels == nil {
 						generatedApp.Labels = map[string]string{}
 					}
@@ -644,7 +645,7 @@ func (r *ApplicationSetReconciler) createOrUpdateInCluster(ctx context.Context,

 			// Preserve post-delete finalizers:
 			//   https://github.com/argoproj/argo-cd/issues/17181
-			for _, finalizer := range found.Finalizers {
+			for _, finalizer := range found.ObjectMeta.Finalizers {
 				if strings.HasPrefix(finalizer, argov1alpha1.PostDeleteFinalizerName) {
 					if generatedApp.Finalizers == nil {
 						generatedApp.Finalizers = []string{}
@@ -653,10 +654,10 @@ func (r *ApplicationSetReconciler) createOrUpdateInCluster(ctx context.Context,
 				}
 			}

-			found.Annotations = generatedApp.Annotations
+			found.ObjectMeta.Annotations = generatedApp.Annotations

-			found.Finalizers = generatedApp.Finalizers
-			found.Labels = generatedApp.Labels
+			found.ObjectMeta.Finalizers = generatedApp.Finalizers
+			found.ObjectMeta.Labels = generatedApp.Labels

 			return controllerutil.SetControllerReference(&applicationSet, found, r.Scheme)
 		})
@@ -710,7 +711,7 @@ func (r *ApplicationSetReconciler) createInCluster(ctx context.Context, logCtx *

 func (r *ApplicationSetReconciler) getCurrentApplications(ctx context.Context, applicationSet argov1alpha1.ApplicationSet) ([]argov1alpha1.Application, error) {
 	var current argov1alpha1.ApplicationList
-	err := r.List(ctx, &current, client.MatchingFields{".metadata.controller": applicationSet.Name}, client.InNamespace(applicationSet.Namespace))
+	err := r.Client.List(ctx, &current, client.MatchingFields{".metadata.controller": applicationSet.Name}, client.InNamespace(applicationSet.Namespace))
 	if err != nil {
 		return nil, fmt.Errorf("error retrieving applications: %w", err)
 	}
@@ -741,7 +742,7 @@ func (r *ApplicationSetReconciler) deleteInCluster(ctx context.Context, logCtx *
 	// Delete apps that are not in m[string]bool
 	var firstError error
 	for _, app := range current {
-		logCtx = logCtx.WithFields(applog.GetAppLogFields(&app))
+		logCtx = logCtx.WithField("app", app.QualifiedName())
 		_, exists := m[app.Name]

 		if !exists {
@@ -755,7 +756,7 @@ func (r *ApplicationSetReconciler) deleteInCluster(ctx context.Context, logCtx *
 				continue
 			}

-			err = r.Delete(ctx, &app)
+			err = r.Client.Delete(ctx, &app)
 			if err != nil {
 				logCtx.WithError(err).Error("failed to delete Application")
 				if firstError != nil {
@@ -824,7 +825,7 @@ func (r *ApplicationSetReconciler) removeFinalizerOnInvalidDestination(ctx conte
 			if log.IsLevelEnabled(log.DebugLevel) {
 				utils.LogPatch(appLog, patch, updated)
 			}
-			if err := r.Patch(ctx, updated, patch); err != nil {
+			if err := r.Client.Patch(ctx, updated, patch); err != nil {
 				return fmt.Errorf("error updating finalizers: %w", err)
 			}
 			// Application must have updated list of finalizers
@@ -846,7 +847,7 @@ func (r *ApplicationSetReconciler) removeOwnerReferencesOnDeleteAppSet(ctx conte

 	for _, app := range applications {
 		app.SetOwnerReferences([]metav1.OwnerReference{})
-		err := r.Update(ctx, &app)
+		err := r.Client.Update(ctx, &app)
 		if err != nil {
 			return fmt.Errorf("error updating application: %w", err)
 		}
@@ -1001,14 +1002,8 @@ func appSyncEnabledForNextStep(appset *argov1alpha1.ApplicationSet, app argov1al
 	return true
 }

-func isRollingSyncStrategy(appset *argov1alpha1.ApplicationSet) bool {
-	// It's only RollingSync if the type specifically sets it
-	return appset.Spec.Strategy != nil && appset.Spec.Strategy.Type == "RollingSync" && appset.Spec.Strategy.RollingSync != nil
-}
-
 func progressiveSyncsRollingSyncStrategyEnabled(appset *argov1alpha1.ApplicationSet) bool {
-	// ProgressiveSync is enabled if the strategy is set to `RollingSync` + steps slice is not empty
-	return isRollingSyncStrategy(appset) && len(appset.Spec.Strategy.RollingSync.Steps) > 0
+	return appset.Spec.Strategy != nil && appset.Spec.Strategy.RollingSync != nil && appset.Spec.Strategy.Type == "RollingSync" && len(appset.Spec.Strategy.RollingSync.Steps) > 0
 }

 func isApplicationHealthy(app argov1alpha1.Application) bool {
@@ -1310,6 +1305,11 @@ func (r *ApplicationSetReconciler) updateResourcesStatus(ctx context.Context, lo
 	sort.Slice(statuses, func(i, j int) bool {
 		return statuses[i].Name < statuses[j].Name
 	})
+
+	if r.MaxResourcesStatusCount > 0 && len(statuses) > r.MaxResourcesStatusCount {
+		logCtx.Warnf("Truncating ApplicationSet %s resource status from %d to max allowed %d entries", appset.Name, len(statuses), r.MaxResourcesStatusCount)
+		statuses = statuses[:r.MaxResourcesStatusCount]
+	}
 	appset.Status.Resources = statuses
 	// DefaultRetry will retry 5 times with a backoff factor of 1, jitter of 0.1 and a duration of 10ms
 	err := retry.RetryOnConflict(retry.DefaultRetry, func() error {
@@ -1405,7 +1405,7 @@ func (r *ApplicationSetReconciler) syncValidApplications(logCtx *log.Entry, appl
 		pruneEnabled := false

 		// ensure that Applications generated with RollingSync do not have an automated sync policy, since the AppSet controller will handle triggering the sync operation instead
-		if validApps[i].Spec.SyncPolicy != nil && validApps[i].Spec.SyncPolicy.IsAutomatedSyncEnabled() {
+		if validApps[i].Spec.SyncPolicy != nil && validApps[i].Spec.SyncPolicy.Automated != nil {
 			pruneEnabled = validApps[i].Spec.SyncPolicy.Automated.Prune
 			validApps[i].Spec.SyncPolicy.Automated = nil
 		}
@@ -1441,10 +1441,6 @@ func syncApplication(application argov1alpha1.Application, prune bool) argov1alp
 			},
 		},
 		Sync: &argov1alpha1.SyncOperation{},
-		// Set a retry limit of 5, aligning with the default in Argo CD's appcontroller auto-sync behavior.
-		// This provides consistency for retry behavior across controllers.
-		// See: https://github.com/argoproj/argo-cd/blob/af9ebac0bb35dc16eb034c1cefaf7c92d1029927/controller/appcontroller.go#L2126
-		Retry: argov1alpha1.RetryStrategy{Limit: 5},
 	}

 	if application.Spec.SyncPolicy != nil {
@@ -1467,23 +1463,23 @@ func getApplicationOwnsHandler(enableProgressiveSyncs bool) predicate.Funcs {
 			// if we are the owner and there is a create event, we most likely created it and do not need to
 			// re-reconcile
 			if log.IsLevelEnabled(log.DebugLevel) {
-				logFields := log.Fields{"app": ""}
+				var appName string
 				app, isApp := e.Object.(*argov1alpha1.Application)
 				if isApp {
-					logFields = applog.GetAppLogFields(app)
+					appName = app.QualifiedName()
 				}
-				log.WithFields(logFields).Debugln("received create event from owning an application")
+				log.WithField("app", appName).Debugln("received create event from owning an application")
 			}
 			return false
 		},
 		DeleteFunc: func(e event.DeleteEvent) bool {
 			if log.IsLevelEnabled(log.DebugLevel) {
-				logFields := log.Fields{"app": ""}
+				var appName string
 				app, isApp := e.Object.(*argov1alpha1.Application)
 				if isApp {
-					logFields = applog.GetAppLogFields(app)
+					appName = app.QualifiedName()
 				}
-				log.WithFields(logFields).Debugln("received delete event from owning an application")
+				log.WithField("app", appName).Debugln("received delete event from owning an application")
 			}
 			return true
 		},
@@ -1492,7 +1488,7 @@ func getApplicationOwnsHandler(enableProgressiveSyncs bool) predicate.Funcs {
 			if !isApp {
 				return false
 			}
-			logCtx := log.WithFields(applog.GetAppLogFields(appOld))
+			logCtx := log.WithField("app", appOld.QualifiedName())
 			logCtx.Debugln("received update event from owning an application")
 			appNew, isApp := e.ObjectNew.(*argov1alpha1.Application)
 			if !isApp {
@@ -1504,12 +1500,12 @@ func getApplicationOwnsHandler(enableProgressiveSyncs bool) predicate.Funcs {
 		},
 		GenericFunc: func(e event.GenericEvent) bool {
 			if log.IsLevelEnabled(log.DebugLevel) {
-				logFields := log.Fields{}
+				var appName string
 				app, isApp := e.Object.(*argov1alpha1.Application)
 				if isApp {
-					logFields = applog.GetAppLogFields(app)
+					appName = app.QualifiedName()
 				}
-				log.WithFields(logFields).Debugln("received generic event from owning an application")
+				log.WithField("app", appName).Debugln("received generic event from owning an application")
 			}
 			return true
 		},
@@ -1532,9 +1528,9 @@ func shouldRequeueForApplication(appOld *argov1alpha1.Application, appNew *argov
 	// https://pkg.go.dev/reflect#DeepEqual
 	// ApplicationDestination has an unexported field so we can just use the == for comparison
 	if !cmp.Equal(appOld.Spec, appNew.Spec, cmpopts.EquateEmpty(), cmpopts.EquateComparable(argov1alpha1.ApplicationDestination{})) ||
-		!cmp.Equal(appOld.GetAnnotations(), appNew.GetAnnotations(), cmpopts.EquateEmpty()) ||
-		!cmp.Equal(appOld.GetLabels(), appNew.GetLabels(), cmpopts.EquateEmpty()) ||
-		!cmp.Equal(appOld.GetFinalizers(), appNew.GetFinalizers(), cmpopts.EquateEmpty()) {
+		!cmp.Equal(appOld.ObjectMeta.GetAnnotations(), appNew.ObjectMeta.GetAnnotations(), cmpopts.EquateEmpty()) ||
+		!cmp.Equal(appOld.ObjectMeta.GetLabels(), appNew.ObjectMeta.GetLabels(), cmpopts.EquateEmpty()) ||
+		!cmp.Equal(appOld.ObjectMeta.GetFinalizers(), appNew.ObjectMeta.GetFinalizers(), cmpopts.EquateEmpty()) {
 		return true
 	}

@@ -1614,20 +1610,21 @@ func shouldRequeueForApplicationSet(appSetOld, appSetNew *argov1alpha1.Applicati
 		}
 	}

-	// only compare the applicationset spec, annotations, labels and finalizers, specifically avoiding
+	// only compare the applicationset spec, annotations, labels and finalizers, deletionTimestamp, specifically avoiding
 	// the status field. status is owned by the applicationset controller,
 	// and we do not need to requeue when it does bookkeeping
 	// NB: the ApplicationDestination comes from the ApplicationSpec being embedded
 	// in the ApplicationSetTemplate from the generators
 	if !cmp.Equal(appSetOld.Spec, appSetNew.Spec, cmpopts.EquateEmpty(), cmpopts.EquateComparable(argov1alpha1.ApplicationDestination{})) ||
 		!cmp.Equal(appSetOld.GetLabels(), appSetNew.GetLabels(), cmpopts.EquateEmpty()) ||
-		!cmp.Equal(appSetOld.GetFinalizers(), appSetNew.GetFinalizers(), cmpopts.EquateEmpty()) {
+		!cmp.Equal(appSetOld.GetFinalizers(), appSetNew.GetFinalizers(), cmpopts.EquateEmpty()) ||
+		!cmp.Equal(appSetOld.DeletionTimestamp, appSetNew.DeletionTimestamp, cmpopts.EquateEmpty()) {
 		return true
 	}

 	// Requeue only when the refresh annotation is newly added to the ApplicationSet.
 	// Changes to other annotations made simultaneously might be missed, but such cases are rare.
-	if !cmp.Equal(appSetOld.GetAnnotations(), appSetNew.GetAnnotations(), cmpopts.EquateEmpty()) {
+	if !cmp.Equal(appSetOld.ObjectMeta.GetAnnotations(), appSetNew.ObjectMeta.GetAnnotations(), cmpopts.EquateEmpty()) {
 		_, oldHasRefreshAnnotation := appSetOld.Annotations[common.AnnotationApplicationSetRefresh]
 		_, newHasRefreshAnnotation := appSetNew.Annotations[common.AnnotationApplicationSetRefresh]

--- a/applicationset/controllers/applicationset_controller_test.go
+++ b/applicationset/controllers/applicationset_controller_test.go
@@ -36,7 +36,6 @@ import (
 	argocommon "github.com/argoproj/argo-cd/v3/common"
 	"github.com/argoproj/argo-cd/v3/pkg/apis/application"
 	"github.com/argoproj/argo-cd/v3/pkg/apis/application/v1alpha1"
-	applog "github.com/argoproj/argo-cd/v3/util/app/log"
 	"github.com/argoproj/argo-cd/v3/util/db"
 	"github.com/argoproj/argo-cd/v3/util/settings"
 )
@@ -589,6 +588,72 @@ func TestCreateOrUpdateInCluster(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "Ensure that hydrate annotation is preserved from an existing app",
+			appSet: v1alpha1.ApplicationSet{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "name",
+					Namespace: "namespace",
+				},
+				Spec: v1alpha1.ApplicationSetSpec{
+					Template: v1alpha1.ApplicationSetTemplate{
+						Spec: v1alpha1.ApplicationSpec{
+							Project: "project",
+						},
+					},
+				},
+			},
+			existingApps: []v1alpha1.Application{
+				{
+					TypeMeta: metav1.TypeMeta{
+						Kind:       application.ApplicationKind,
+						APIVersion: "argoproj.io/v1alpha1",
+					},
+					ObjectMeta: metav1.ObjectMeta{
+						Name:            "app1",
+						Namespace:       "namespace",
+						ResourceVersion: "2",
+						Annotations: map[string]string{
+							"annot-key":                   "annot-value",
+							v1alpha1.AnnotationKeyHydrate: string(v1alpha1.RefreshTypeNormal),
+						},
+					},
+					Spec: v1alpha1.ApplicationSpec{
+						Project: "project",
+					},
+				},
+			},
+			desiredApps: []v1alpha1.Application{
+				{
+					ObjectMeta: metav1.ObjectMeta{
+						Name:      "app1",
+						Namespace: "namespace",
+					},
+					Spec: v1alpha1.ApplicationSpec{
+						Project: "project",
+					},
+				},
+			},
+			expected: []v1alpha1.Application{
+				{
+					TypeMeta: metav1.TypeMeta{
+						Kind:       application.ApplicationKind,
+						APIVersion: "argoproj.io/v1alpha1",
+					},
+					ObjectMeta: metav1.ObjectMeta{
+						Name:            "app1",
+						Namespace:       "namespace",
+						ResourceVersion: "3",
+						Annotations: map[string]string{
+							v1alpha1.AnnotationKeyHydrate: string(v1alpha1.RefreshTypeNormal),
+						},
+					},
+					Spec: v1alpha1.ApplicationSpec{
+						Project: "project",
+					},
+				},
+			},
+		},
 		{
 			name: "Ensure that configured preserved annotations are preserved from an existing app",
 			appSet: v1alpha1.ApplicationSet{
@@ -1211,7 +1276,7 @@ func TestRemoveFinalizerOnInvalidDestination_FinalizerTypes(t *testing.T) {
 			clusterList, err := utils.ListClusters(t.Context(), kubeclientset, "namespace")
 			require.NoError(t, err)

-			appLog := log.WithFields(applog.GetAppLogFields(&app)).WithField("appSet", "")
+			appLog := log.WithFields(log.Fields{"app": app.Name, "appSet": ""})

 			appInputParam := app.DeepCopy()

@@ -1367,7 +1432,7 @@ func TestRemoveFinalizerOnInvalidDestination_DestinationTypes(t *testing.T) {
 			clusterList, err := utils.ListClusters(t.Context(), kubeclientset, "argocd")
 			require.NoError(t, err)

-			appLog := log.WithFields(applog.GetAppLogFields(&app)).WithField("appSet", "")
+			appLog := log.WithFields(log.Fields{"app": app.Name, "appSet": ""})

 			appInputParam := app.DeepCopy()

@@ -2185,12 +2250,12 @@ func TestReconcilerValidationProjectErrorBehaviour(t *testing.T) {
 	var app v1alpha1.Application

 	// make sure good app got created
-	err = r.Get(t.Context(), crtclient.ObjectKey{Namespace: "argocd", Name: "good-project"}, &app)
+	err = r.Client.Get(t.Context(), crtclient.ObjectKey{Namespace: "argocd", Name: "good-project"}, &app)
 	require.NoError(t, err)
 	assert.Equal(t, "good-project", app.Name)

 	// make sure bad app was not created
-	err = r.Get(t.Context(), crtclient.ObjectKey{Namespace: "argocd", Name: "bad-project"}, &app)
+	err = r.Client.Get(t.Context(), crtclient.ObjectKey{Namespace: "argocd", Name: "bad-project"}, &app)
 	require.Error(t, err)
 }

@@ -2473,13 +2538,13 @@ func applicationsUpdateSyncPolicyTest(t *testing.T, applicationsSyncPolicy v1alp
 	var app v1alpha1.Application

 	// make sure good app got created
-	err = r.Get(t.Context(), crtclient.ObjectKey{Namespace: "argocd", Name: "good-cluster"}, &app)
+	err = r.Client.Get(t.Context(), crtclient.ObjectKey{Namespace: "argocd", Name: "good-cluster"}, &app)
 	require.NoError(t, err)
 	assert.Equal(t, "good-cluster", app.Name)

 	// Update resource
 	var retrievedApplicationSet v1alpha1.ApplicationSet
-	err = r.Get(t.Context(), crtclient.ObjectKey{Namespace: "argocd", Name: "name"}, &retrievedApplicationSet)
+	err = r.Client.Get(t.Context(), crtclient.ObjectKey{Namespace: "argocd", Name: "name"}, &retrievedApplicationSet)
 	require.NoError(t, err)

 	retrievedApplicationSet.Spec.Template.Annotations = map[string]string{"annotation-key": "annotation-value"}
@@ -2489,13 +2554,13 @@ func applicationsUpdateSyncPolicyTest(t *testing.T, applicationsSyncPolicy v1alp
 		Values: "global.test: test",
 	}

-	err = r.Update(t.Context(), &retrievedApplicationSet)
+	err = r.Client.Update(t.Context(), &retrievedApplicationSet)
 	require.NoError(t, err)

 	resUpdate, err := r.Reconcile(t.Context(), req)
 	require.NoError(t, err)

-	err = r.Get(t.Context(), crtclient.ObjectKey{Namespace: "argocd", Name: "good-cluster"}, &app)
+	err = r.Client.Get(t.Context(), crtclient.ObjectKey{Namespace: "argocd", Name: "good-cluster"}, &app)
 	require.NoError(t, err)
 	assert.Equal(t, time.Duration(0), resUpdate.RequeueAfter)
 	assert.Equal(t, "good-cluster", app.Name)
@@ -2509,7 +2574,7 @@ func TestUpdateNotPerformedWithSyncPolicyCreateOnly(t *testing.T) {
 	app := applicationsUpdateSyncPolicyTest(t, applicationsSyncPolicy, 1, true)

 	assert.Nil(t, app.Spec.Source.Helm)
-	assert.Nil(t, app.Annotations)
+	assert.Nil(t, app.ObjectMeta.Annotations)
 }

 func TestUpdateNotPerformedWithSyncPolicyCreateDelete(t *testing.T) {
@@ -2518,7 +2583,7 @@ func TestUpdateNotPerformedWithSyncPolicyCreateDelete(t *testing.T) {
 	app := applicationsUpdateSyncPolicyTest(t, applicationsSyncPolicy, 1, true)

 	assert.Nil(t, app.Spec.Source.Helm)
-	assert.Nil(t, app.Annotations)
+	assert.Nil(t, app.ObjectMeta.Annotations)
 }

 func TestUpdatePerformedWithSyncPolicyCreateUpdate(t *testing.T) {
@@ -2527,8 +2592,8 @@ func TestUpdatePerformedWithSyncPolicyCreateUpdate(t *testing.T) {
 	app := applicationsUpdateSyncPolicyTest(t, applicationsSyncPolicy, 2, true)

 	assert.Equal(t, "global.test: test", app.Spec.Source.Helm.Values)
-	assert.Equal(t, map[string]string{"annotation-key": "annotation-value"}, app.Annotations)
-	assert.Equal(t, map[string]string{"label-key": "label-value"}, app.Labels)
+	assert.Equal(t, map[string]string{"annotation-key": "annotation-value"}, app.ObjectMeta.Annotations)
+	assert.Equal(t, map[string]string{"label-key": "label-value"}, app.ObjectMeta.Labels)
 }

 func TestUpdatePerformedWithSyncPolicySync(t *testing.T) {
@@ -2537,8 +2602,8 @@ func TestUpdatePerformedWithSyncPolicySync(t *testing.T) {
 	app := applicationsUpdateSyncPolicyTest(t, applicationsSyncPolicy, 2, true)

 	assert.Equal(t, "global.test: test", app.Spec.Source.Helm.Values)
-	assert.Equal(t, map[string]string{"annotation-key": "annotation-value"}, app.Annotations)
-	assert.Equal(t, map[string]string{"label-key": "label-value"}, app.Labels)
+	assert.Equal(t, map[string]string{"annotation-key": "annotation-value"}, app.ObjectMeta.Annotations)
+	assert.Equal(t, map[string]string{"label-key": "label-value"}, app.ObjectMeta.Labels)
 }

 func TestUpdatePerformedWithSyncPolicyCreateOnlyAndAllowPolicyOverrideFalse(t *testing.T) {
@@ -2547,8 +2612,8 @@ func TestUpdatePerformedWithSyncPolicyCreateOnlyAndAllowPolicyOverrideFalse(t *t
 	app := applicationsUpdateSyncPolicyTest(t, applicationsSyncPolicy, 2, false)

 	assert.Equal(t, "global.test: test", app.Spec.Source.Helm.Values)
-	assert.Equal(t, map[string]string{"annotation-key": "annotation-value"}, app.Annotations)
-	assert.Equal(t, map[string]string{"label-key": "label-value"}, app.Labels)
+	assert.Equal(t, map[string]string{"annotation-key": "annotation-value"}, app.ObjectMeta.Annotations)
+	assert.Equal(t, map[string]string{"label-key": "label-value"}, app.ObjectMeta.Labels)
 }

 func applicationsDeleteSyncPolicyTest(t *testing.T, applicationsSyncPolicy v1alpha1.ApplicationsSyncPolicy, recordBuffer int, allowPolicyOverride bool) v1alpha1.ApplicationList {
@@ -2648,13 +2713,13 @@ func applicationsDeleteSyncPolicyTest(t *testing.T, applicationsSyncPolicy v1alp
 	var app v1alpha1.Application

 	// make sure good app got created
-	err = r.Get(t.Context(), crtclient.ObjectKey{Namespace: "argocd", Name: "good-cluster"}, &app)
+	err = r.Client.Get(t.Context(), crtclient.ObjectKey{Namespace: "argocd", Name: "good-cluster"}, &app)
 	require.NoError(t, err)
 	assert.Equal(t, "good-cluster", app.Name)

 	// Update resource
 	var retrievedApplicationSet v1alpha1.ApplicationSet
-	err = r.Get(t.Context(), crtclient.ObjectKey{Namespace: "argocd", Name: "name"}, &retrievedApplicationSet)
+	err = r.Client.Get(t.Context(), crtclient.ObjectKey{Namespace: "argocd", Name: "name"}, &retrievedApplicationSet)
 	require.NoError(t, err)
 	retrievedApplicationSet.Spec.Generators = []v1alpha1.ApplicationSetGenerator{
 		{
@@ -2664,7 +2729,7 @@ func applicationsDeleteSyncPolicyTest(t *testing.T, applicationsSyncPolicy v1alp
 		},
 	}

-	err = r.Update(t.Context(), &retrievedApplicationSet)
+	err = r.Client.Update(t.Context(), &retrievedApplicationSet)
 	require.NoError(t, err)

 	resUpdate, err := r.Reconcile(t.Context(), req)
@@ -2672,7 +2737,7 @@ func applicationsDeleteSyncPolicyTest(t *testing.T, applicationsSyncPolicy v1alp

 	var apps v1alpha1.ApplicationList

-	err = r.List(t.Context(), &apps)
+	err = r.Client.List(t.Context(), &apps)
 	require.NoError(t, err)
 	assert.Equal(t, time.Duration(0), resUpdate.RequeueAfter)

@@ -2834,20 +2899,20 @@ func TestPolicies(t *testing.T) {
 			assert.Equal(t, time.Duration(0), res.RequeueAfter)

 			var app v1alpha1.Application
-			err = r.Get(t.Context(), crtclient.ObjectKey{Namespace: "argocd", Name: "my-app"}, &app)
+			err = r.Client.Get(t.Context(), crtclient.ObjectKey{Namespace: "argocd", Name: "my-app"}, &app)
 			require.NoError(t, err)
 			assert.Equal(t, "value", app.Annotations["key"])

 			// Check if Application is updated
 			app.Annotations["key"] = "edited"
-			err = r.Update(t.Context(), &app)
+			err = r.Client.Update(t.Context(), &app)
 			require.NoError(t, err)

 			res, err = r.Reconcile(t.Context(), req)
 			require.NoError(t, err)
 			assert.Equal(t, time.Duration(0), res.RequeueAfter)

-			err = r.Get(t.Context(), crtclient.ObjectKey{Namespace: "argocd", Name: "my-app"}, &app)
+			err = r.Client.Get(t.Context(), crtclient.ObjectKey{Namespace: "argocd", Name: "my-app"}, &app)
 			require.NoError(t, err)

 			if c.allowedUpdate {
@@ -2857,21 +2922,21 @@ func TestPolicies(t *testing.T) {
 			}

 			// Check if Application is deleted
-			err = r.Get(t.Context(), crtclient.ObjectKey{Namespace: "argocd", Name: "name"}, &appSet)
+			err = r.Client.Get(t.Context(), crtclient.ObjectKey{Namespace: "argocd", Name: "name"}, &appSet)
 			require.NoError(t, err)
 			appSet.Spec.Generators[0] = v1alpha1.ApplicationSetGenerator{
 				List: &v1alpha1.ListGenerator{
 					Elements: []apiextensionsv1.JSON{},
 				},
 			}
-			err = r.Update(t.Context(), &appSet)
+			err = r.Client.Update(t.Context(), &appSet)
 			require.NoError(t, err)

 			res, err = r.Reconcile(t.Context(), req)
 			require.NoError(t, err)
 			assert.Equal(t, time.Duration(0), res.RequeueAfter)

-			err = r.Get(t.Context(), crtclient.ObjectKey{Namespace: "argocd", Name: "my-app"}, &app)
+			err = r.Client.Get(t.Context(), crtclient.ObjectKey{Namespace: "argocd", Name: "my-app"}, &app)
 			require.NoError(t, err)
 			if c.allowedDelete {
 				assert.NotNil(t, app.DeletionTimestamp)
@@ -3888,7 +3953,7 @@ func TestBuildAppSyncMap(t *testing.T) {
 						Name: "app1",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusHealthy,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -3904,7 +3969,7 @@ func TestBuildAppSyncMap(t *testing.T) {
 						Name: "app2",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusHealthy,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -3966,7 +4031,7 @@ func TestBuildAppSyncMap(t *testing.T) {
 						Name: "app1",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusHealthy,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -3982,7 +4047,7 @@ func TestBuildAppSyncMap(t *testing.T) {
 						Name: "app2",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusHealthy,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -4044,7 +4109,7 @@ func TestBuildAppSyncMap(t *testing.T) {
 						Name: "app1",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusHealthy,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -4060,7 +4125,7 @@ func TestBuildAppSyncMap(t *testing.T) {
 						Name: "app2",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusHealthy,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -4122,7 +4187,7 @@ func TestBuildAppSyncMap(t *testing.T) {
 						Name: "app1",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusDegraded,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -4138,7 +4203,7 @@ func TestBuildAppSyncMap(t *testing.T) {
 						Name: "app2",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusDegraded,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -4204,7 +4269,7 @@ func TestBuildAppSyncMap(t *testing.T) {
 						Name: "app1",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusHealthy,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -4220,7 +4285,7 @@ func TestBuildAppSyncMap(t *testing.T) {
 						Name: "app2",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusHealthy,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -4294,7 +4359,7 @@ func TestBuildAppSyncMap(t *testing.T) {
 						Name: "app1",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusHealthy,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -4310,7 +4375,7 @@ func TestBuildAppSyncMap(t *testing.T) {
 						Name: "app2",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusHealthy,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -4326,7 +4391,7 @@ func TestBuildAppSyncMap(t *testing.T) {
 						Name: "app3",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusHealthy,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -4342,7 +4407,7 @@ func TestBuildAppSyncMap(t *testing.T) {
 						Name: "app5",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusHealthy,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -4358,7 +4423,7 @@ func TestBuildAppSyncMap(t *testing.T) {
 						Name: "app6",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusDegraded,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -4476,7 +4541,7 @@ func TestUpdateApplicationSetApplicationStatus(t *testing.T) {
 						Name: "app1",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusHealthy,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -4531,7 +4596,7 @@ func TestUpdateApplicationSetApplicationStatus(t *testing.T) {
 						Name: "app1",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusHealthy,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -4595,7 +4660,7 @@ func TestUpdateApplicationSetApplicationStatus(t *testing.T) {
 						Name: "app1",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusHealthy,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -4746,7 +4811,7 @@ func TestUpdateApplicationSetApplicationStatus(t *testing.T) {
 						Name: "app1",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusProgressing,
 						},
 						Sync: v1alpha1.SyncStatus{
@@ -4808,7 +4873,7 @@ func TestUpdateApplicationSetApplicationStatus(t *testing.T) {
 						Name: "app1",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusHealthy,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -4874,7 +4939,7 @@ func TestUpdateApplicationSetApplicationStatus(t *testing.T) {
 						Name: "app1",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusHealthy,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -4940,7 +5005,7 @@ func TestUpdateApplicationSetApplicationStatus(t *testing.T) {
 						Name: "app1",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusHealthy,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -4995,7 +5060,7 @@ func TestUpdateApplicationSetApplicationStatus(t *testing.T) {
 						Name: "app1",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusHealthy,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -5068,7 +5133,7 @@ func TestUpdateApplicationSetApplicationStatus(t *testing.T) {
 						Name: "app1",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusDegraded,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -5149,7 +5214,7 @@ func TestUpdateApplicationSetApplicationStatus(t *testing.T) {
 						Name: "app1",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusDegraded,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -5234,7 +5299,7 @@ func TestUpdateApplicationSetApplicationStatus(t *testing.T) {
 						Name: "app1",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusHealthy,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -5300,7 +5365,7 @@ func TestUpdateApplicationSetApplicationStatus(t *testing.T) {
 						Name: "app1",
 					},
 					Status: v1alpha1.ApplicationStatus{
-						Health: v1alpha1.AppHealthStatus{
+						Health: v1alpha1.HealthStatus{
 							Status: health.HealthStatusHealthy,
 						},
 						OperationState: &v1alpha1.OperationState{
@@ -6117,10 +6182,11 @@ func TestUpdateResourceStatus(t *testing.T) {
 	require.NoError(t, err)

 	for _, cc := range []struct {
-		name              string
-		appSet            v1alpha1.ApplicationSet
-		apps              []v1alpha1.Application
-		expectedResources []v1alpha1.ResourceStatus
+		name                    string
+		appSet                  v1alpha1.ApplicationSet
+		apps                    []v1alpha1.Application
+		expectedResources       []v1alpha1.ResourceStatus
+		maxResourcesStatusCount int
 	}{
 		{
 			name: "handles an empty application list",
@@ -6156,8 +6222,9 @@ func TestUpdateResourceStatus(t *testing.T) {
 						Sync: v1alpha1.SyncStatus{
 							Status: v1alpha1.SyncStatusCodeSynced,
 						},
-						Health: v1alpha1.AppHealthStatus{
-							Status: health.HealthStatusHealthy,
+						Health: v1alpha1.HealthStatus{
+							Status:  health.HealthStatusHealthy,
+							Message: "OK",
 						},
 					},
 				},
@@ -6167,7 +6234,8 @@ func TestUpdateResourceStatus(t *testing.T) {
 					Name:   "app1",
 					Status: v1alpha1.SyncStatusCodeSynced,
 					Health: &v1alpha1.HealthStatus{
-						Status: health.HealthStatusHealthy,
+						Status:  health.HealthStatusHealthy,
+						Message: "OK",
 					},
 				},
 			},
@@ -6185,7 +6253,8 @@ func TestUpdateResourceStatus(t *testing.T) {
 							Name:   "app1",
 							Status: v1alpha1.SyncStatusCodeSynced,
 							Health: &v1alpha1.HealthStatus{
-								Status: health.HealthStatusHealthy,
+								Status:  health.HealthStatusHealthy,
+								Message: "OK",
 							},
 						},
 					},
@@ -6200,8 +6269,9 @@ func TestUpdateResourceStatus(t *testing.T) {
 						Sync: v1alpha1.SyncStatus{
 							Status: v1alpha1.SyncStatusCodeSynced,
 						},
-						Health: v1alpha1.AppHealthStatus{
-							Status: health.HealthStatusHealthy,
+						Health: v1alpha1.HealthStatus{
+							Status:  health.HealthStatusHealthy,
+							Message: "OK",
 						},
 					},
 				},
@@ -6211,7 +6281,8 @@ func TestUpdateResourceStatus(t *testing.T) {
 					Name:   "app1",
 					Status: v1alpha1.SyncStatusCodeSynced,
 					Health: &v1alpha1.HealthStatus{
-						Status: health.HealthStatusHealthy,
+						Status:  health.HealthStatusHealthy,
+						Message: "OK",
 					},
 				},
 			},
@@ -6245,8 +6316,9 @@ func TestUpdateResourceStatus(t *testing.T) {
 						Sync: v1alpha1.SyncStatus{
 							Status: v1alpha1.SyncStatusCodeSynced,
 						},
-						Health: v1alpha1.AppHealthStatus{
-							Status: health.HealthStatusHealthy,
+						Health: v1alpha1.HealthStatus{
+							Status:  health.HealthStatusHealthy,
+							Message: "OK",
 						},
 					},
 				},
@@ -6256,7 +6328,8 @@ func TestUpdateResourceStatus(t *testing.T) {
 					Name:   "app1",
 					Status: v1alpha1.SyncStatusCodeSynced,
 					Health: &v1alpha1.HealthStatus{
-						Status: health.HealthStatusHealthy,
+						Status:  health.HealthStatusHealthy,
+						Message: "OK",
 					},
 				},
 			},
@@ -6284,6 +6357,73 @@ func TestUpdateResourceStatus(t *testing.T) {
 			apps:              []v1alpha1.Application{},
 			expectedResources: nil,
 		},
+		{
+			name: "truncates resources status list to",
+			appSet: v1alpha1.ApplicationSet{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "name",
+					Namespace: "argocd",
+				},
+				Status: v1alpha1.ApplicationSetStatus{
+					Resources: []v1alpha1.ResourceStatus{
+						{
+							Name:   "app1",
+							Status: v1alpha1.SyncStatusCodeOutOfSync,
+							Health: &v1alpha1.HealthStatus{
+								Status:  health.HealthStatusProgressing,
+								Message: "this is progressing",
+							},
+						},
+						{
+							Name:   "app2",
+							Status: v1alpha1.SyncStatusCodeOutOfSync,
+							Health: &v1alpha1.HealthStatus{
+								Status:  health.HealthStatusProgressing,
+								Message: "this is progressing",
+							},
+						},
+					},
+				},
+			},
+			apps: []v1alpha1.Application{
+				{
+					ObjectMeta: metav1.ObjectMeta{
+						Name: "app1",
+					},
+					Status: v1alpha1.ApplicationStatus{
+						Sync: v1alpha1.SyncStatus{
+							Status: v1alpha1.SyncStatusCodeSynced,
+						},
+						Health: v1alpha1.HealthStatus{
+							Status: health.HealthStatusHealthy,
+						},
+					},
+				},
+				{
+					ObjectMeta: metav1.ObjectMeta{
+						Name: "app2",
+					},
+					Status: v1alpha1.ApplicationStatus{
+						Sync: v1alpha1.SyncStatus{
+							Status: v1alpha1.SyncStatusCodeSynced,
+						},
+						Health: v1alpha1.HealthStatus{
+							Status: health.HealthStatusHealthy,
+						},
+					},
+				},
+			},
+			expectedResources: []v1alpha1.ResourceStatus{
+				{
+					Name:   "app1",
+					Status: v1alpha1.SyncStatusCodeSynced,
+					Health: &v1alpha1.HealthStatus{
+						Status: health.HealthStatusHealthy,
+					},
+				},
+			},
+			maxResourcesStatusCount: 1,
+		},
 	} {
 		t.Run(cc.name, func(t *testing.T) {
 			kubeclientset := kubefake.NewSimpleClientset([]runtime.Object{}...)
@@ -6294,13 +6434,14 @@ func TestUpdateResourceStatus(t *testing.T) {
 			argodb := db.NewDB("argocd", settings.NewSettingsManager(t.Context(), kubeclientset, "argocd"), kubeclientset)

 			r := ApplicationSetReconciler{
-				Client:        client,
-				Scheme:        scheme,
-				Recorder:      record.NewFakeRecorder(1),
-				Generators:    map[string]generators.Generator{},
-				ArgoDB:        argodb,
-				KubeClientset: kubeclientset,
-				Metrics:       metrics,
+				Client:                  client,
+				Scheme:                  scheme,
+				Recorder:                record.NewFakeRecorder(1),
+				Generators:              map[string]generators.Generator{},
+				ArgoDB:                  argodb,
+				KubeClientset:           kubeclientset,
+				Metrics:                 metrics,
+				MaxResourcesStatusCount: cc.maxResourcesStatusCount,
 			}

 			err := r.updateResourcesStatus(t.Context(), log.NewEntry(log.StandardLogger()), &cc.appSet, cc.apps)
@@ -6318,7 +6459,8 @@ func generateNAppResourceStatuses(n int) []v1alpha1.ResourceStatus {
 			Name:   "app" + strconv.Itoa(i),
 			Status: v1alpha1.SyncStatusCodeSynced,
 			Health: &v1alpha1.HealthStatus{
-				Status: health.HealthStatusHealthy,
+				Status:  health.HealthStatusHealthy,
+				Message: "OK",
 			},
 		},
 		)
@@ -6337,8 +6479,9 @@ func generateNHealthyApps(n int) []v1alpha1.Application {
 				Sync: v1alpha1.SyncStatus{
 					Status: v1alpha1.SyncStatusCodeSynced,
 				},
-				Health: v1alpha1.AppHealthStatus{
-					Status: health.HealthStatusHealthy,
+				Health: v1alpha1.HealthStatus{
+					Status:  health.HealthStatusHealthy,
+					Message: "OK",
 				},
 			},
 		})
@@ -6442,12 +6585,12 @@ func TestApplicationOwnsHandler(t *testing.T) {
 		{name: "ApplicationHealthStatusDiff", args: args{
 			e: event.UpdateEvent{
 				ObjectOld: &v1alpha1.Application{Status: v1alpha1.ApplicationStatus{
-					Health: v1alpha1.AppHealthStatus{
+					Health: v1alpha1.HealthStatus{
 						Status: "Unknown",
 					},
 				}},
 				ObjectNew: &v1alpha1.Application{Status: v1alpha1.ApplicationStatus{
-					Health: v1alpha1.AppHealthStatus{
+					Health: v1alpha1.HealthStatus{
 						Status: "Healthy",
 					},
 				}},
@@ -6813,6 +6956,28 @@ func TestApplicationSetOwnsHandlerUpdate(t *testing.T) {
 			enableProgressiveSyncs: false,
 			want:                   false,
 		},
+		{
+			name:      "deletionTimestamp present when progressive sync enabled",
+			appSetOld: buildAppSet(map[string]string{}),
+			appSetNew: &v1alpha1.ApplicationSet{
+				ObjectMeta: metav1.ObjectMeta{
+					DeletionTimestamp: &metav1.Time{Time: time.Now()},
+				},
+			},
+			enableProgressiveSyncs: true,
+			want:                   true,
+		},
+		{
+			name:      "deletionTimestamp present when progressive sync disabled",
+			appSetOld: buildAppSet(map[string]string{}),
+			appSetNew: &v1alpha1.ApplicationSet{
+				ObjectMeta: metav1.ObjectMeta{
+					DeletionTimestamp: &metav1.Time{Time: time.Now()},
+				},
+			},
+			enableProgressiveSyncs: false,
+			want:                   true,
+		},
 	}

 	for _, tt := range tests {
@@ -6961,6 +7126,36 @@ func TestShouldRequeueForApplicationSet(t *testing.T) {
 			},
 			want: true,
 		},
+		{
+			name: "ApplicationSetWithDeletionTimestamp",
+			args: args{
+				appSetOld: &v1alpha1.ApplicationSet{
+					Status: v1alpha1.ApplicationSetStatus{
+						ApplicationStatus: []v1alpha1.ApplicationSetApplicationStatus{
+							{
+								Application: "app1",
+								Status:      "Healthy",
+							},
+						},
+					},
+				},
+				appSetNew: &v1alpha1.ApplicationSet{
+					ObjectMeta: metav1.ObjectMeta{
+						DeletionTimestamp: &metav1.Time{Time: time.Now()},
+					},
+					Status: v1alpha1.ApplicationSetStatus{
+						ApplicationStatus: []v1alpha1.ApplicationSetApplicationStatus{
+							{
+								Application: "app1",
+								Status:      "Waiting",
+							},
+						},
+					},
+				},
+				enableProgressiveSyncs: false,
+			},
+			want: true,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -7051,150 +7246,3 @@ func TestIgnoreNotAllowedNamespaces(t *testing.T) {
 		})
 	}
 }
-
-func TestIsRollingSyncStrategy(t *testing.T) {
-	tests := []struct {
-		name     string
-		appset   *v1alpha1.ApplicationSet
-		expected bool
-	}{
-		{
-			name: "RollingSync strategy is explicitly set",
-			appset: &v1alpha1.ApplicationSet{
-				Spec: v1alpha1.ApplicationSetSpec{
-					Strategy: &v1alpha1.ApplicationSetStrategy{
-						Type: "RollingSync",
-						RollingSync: &v1alpha1.ApplicationSetRolloutStrategy{
-							Steps: []v1alpha1.ApplicationSetRolloutStep{},
-						},
-					},
-				},
-			},
-			expected: true,
-		},
-		{
-			name: "AllAtOnce strategy is explicitly set",
-			appset: &v1alpha1.ApplicationSet{
-				Spec: v1alpha1.ApplicationSetSpec{
-					Strategy: &v1alpha1.ApplicationSetStrategy{
-						Type: "AllAtOnce",
-					},
-				},
-			},
-			expected: false,
-		},
-		{
-			name: "Strategy is empty",
-			appset: &v1alpha1.ApplicationSet{
-				Spec: v1alpha1.ApplicationSetSpec{
-					Strategy: &v1alpha1.ApplicationSetStrategy{},
-				},
-			},
-			expected: false,
-		},
-		{
-			name: "Strategy is nil",
-			appset: &v1alpha1.ApplicationSet{
-				Spec: v1alpha1.ApplicationSetSpec{
-					Strategy: nil,
-				},
-			},
-			expected: false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := isRollingSyncStrategy(tt.appset)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
-
-func TestSyncApplication(t *testing.T) {
-	tests := []struct {
-		name     string
-		input    v1alpha1.Application
-		prune    bool
-		expected v1alpha1.Application
-	}{
-		{
-			name: "Default retry limit with no SyncPolicy",
-			input: v1alpha1.Application{
-				Spec: v1alpha1.ApplicationSpec{},
-			},
-			prune: false,
-			expected: v1alpha1.Application{
-				Spec: v1alpha1.ApplicationSpec{},
-				Operation: &v1alpha1.Operation{
-					InitiatedBy: v1alpha1.OperationInitiator{
-						Username:  "applicationset-controller",
-						Automated: true,
-					},
-					Info: []*v1alpha1.Info{
-						{
-							Name:  "Reason",
-							Value: "ApplicationSet RollingSync triggered a sync of this Application resource.",
-						},
-					},
-					Sync: &v1alpha1.SyncOperation{
-						Prune: false,
-					},
-					Retry: v1alpha1.RetryStrategy{
-						Limit: 5,
-					},
-				},
-			},
-		},
-		{
-			name: "Retry and SyncOptions from SyncPolicy are applied",
-			input: v1alpha1.Application{
-				Spec: v1alpha1.ApplicationSpec{
-					SyncPolicy: &v1alpha1.SyncPolicy{
-						Retry: &v1alpha1.RetryStrategy{
-							Limit: 10,
-						},
-						SyncOptions: []string{"CreateNamespace=true"},
-					},
-				},
-			},
-			prune: true,
-			expected: v1alpha1.Application{
-				Spec: v1alpha1.ApplicationSpec{
-					SyncPolicy: &v1alpha1.SyncPolicy{
-						Retry: &v1alpha1.RetryStrategy{
-							Limit: 10,
-						},
-						SyncOptions: []string{"CreateNamespace=true"},
-					},
-				},
-				Operation: &v1alpha1.Operation{
-					InitiatedBy: v1alpha1.OperationInitiator{
-						Username:  "applicationset-controller",
-						Automated: true,
-					},
-					Info: []*v1alpha1.Info{
-						{
-							Name:  "Reason",
-							Value: "ApplicationSet RollingSync triggered a sync of this Application resource.",
-						},
-					},
-					Sync: &v1alpha1.SyncOperation{
-						SyncOptions: []string{"CreateNamespace=true"},
-						Prune:       true,
-					},
-					Retry: v1alpha1.RetryStrategy{
-						Limit: 10,
-					},
-				},
-			},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := syncApplication(tt.input, tt.prune)
-			assert.Equal(t, tt.expected, result)
-		})
-	}
-}
--- a/applicationset/controllers/clustereventhandler_test.go
+++ b/applicationset/controllers/clustereventhandler_test.go
@@ -20,15 +20,6 @@ import (
 	argov1alpha1 "github.com/argoproj/argo-cd/v3/pkg/apis/application/v1alpha1"
 )

-type mockAddRateLimitingInterface struct {
-	addedItems []reconcile.Request
-}
-
-// Add checks the type, and adds it to the internal list of received additions
-func (obj *mockAddRateLimitingInterface) Add(item reconcile.Request) {
-	obj.addedItems = append(obj.addedItems, item)
-}
-
 func TestClusterEventHandler(t *testing.T) {
 	scheme := runtime.NewScheme()
 	err := argov1alpha1.AddToScheme(scheme)
@@ -565,6 +556,15 @@ func TestClusterEventHandler(t *testing.T) {
 	}
 }

+// Add checks the type, and adds it to the internal list of received additions
+func (obj *mockAddRateLimitingInterface) Add(item reconcile.Request) {
+	obj.addedItems = append(obj.addedItems, item)
+}
+
+type mockAddRateLimitingInterface struct {
+	addedItems []reconcile.Request
+}
+
 func TestNestedGeneratorHasClusterGenerator_NestedClusterGenerator(t *testing.T) {
 	nested := argov1alpha1.ApplicationSetNestedGenerator{
 		Clusters: &argov1alpha1.ClusterGenerator{},
--- a/applicationset/controllers/requeue_after_test.go
+++ b/applicationset/controllers/requeue_after_test.go
@@ -56,7 +56,7 @@ func TestRequeueAfter(t *testing.T) {
 		},
 	}
 	fakeDynClient := dynfake.NewSimpleDynamicClientWithCustomListKinds(runtime.NewScheme(), gvrToListKind, duckType)
-	scmConfig := generators.NewSCMConfig("", []string{""}, true, true, nil, true)
+	scmConfig := generators.NewSCMConfig("", []string{""}, true, nil, true)
 	terminalGenerators := map[string]generators.Generator{
 		"List":                    generators.NewListGenerator(),
 		"Clusters":                generators.NewClusterGenerator(ctx, k8sClient, appClientset, "argocd"),
@@ -129,7 +129,7 @@ func TestRequeueAfter(t *testing.T) {
 					}},
 				},
 			},
-		}, ""}, want: generators.DefaultRequeueAfter, wantErr: assert.NoError},
+		}, ""}, want: generators.DefaultRequeueAfterSeconds, wantErr: assert.NoError},
 		{name: "ClusterMatrixNested", args: args{&argov1alpha1.ApplicationSet{
 			Spec: argov1alpha1.ApplicationSetSpec{
 				Generators: []argov1alpha1.ApplicationSetGenerator{
@@ -144,7 +144,7 @@ func TestRequeueAfter(t *testing.T) {
 					}},
 				},
 			},
-		}, ""}, want: generators.DefaultRequeueAfter, wantErr: assert.NoError},
+		}, ""}, want: generators.DefaultRequeueAfterSeconds, wantErr: assert.NoError},
 		{name: "ListGenerator", args: args{appset: &argov1alpha1.ApplicationSet{
 			Spec: argov1alpha1.ApplicationSetSpec{
 				Generators: []argov1alpha1.ApplicationSetGenerator{{List: &argov1alpha1.ListGenerator{}}},
@@ -154,7 +154,7 @@ func TestRequeueAfter(t *testing.T) {
 			Spec: argov1alpha1.ApplicationSetSpec{
 				Generators: []argov1alpha1.ApplicationSetGenerator{{ClusterDecisionResource: &argov1alpha1.DuckTypeGenerator{}}},
 			},
-		}}, want: generators.DefaultRequeueAfter, wantErr: assert.NoError},
+		}}, want: generators.DefaultRequeueAfterSeconds, wantErr: assert.NoError},
 		{name: "OverrideRequeueDuck", args: args{
 			appset: &argov1alpha1.ApplicationSet{
 				Spec: argov1alpha1.ApplicationSetSpec{
--- a/applicationset/controllers/template/patch_test.go
+++ b/applicationset/controllers/template/patch_test.go
@@ -27,7 +27,7 @@ func Test_ApplyTemplatePatch(t *testing.T) {
 				ObjectMeta: metav1.ObjectMeta{
 					Name:       "my-cluster-guestbook",
 					Namespace:  "namespace",
-					Finalizers: []string{appv1.ResourcesFinalizerName},
+					Finalizers: []string{"resources-finalizer.argocd.argoproj.io"},
 				},
 				Spec: appv1.ApplicationSpec{
 					Project: "default",
@@ -72,7 +72,7 @@ func Test_ApplyTemplatePatch(t *testing.T) {
 				ObjectMeta: metav1.ObjectMeta{
 					Name:       "my-cluster-guestbook",
 					Namespace:  "namespace",
-					Finalizers: []string{appv1.ResourcesFinalizerName},
+					Finalizers: []string{"resources-finalizer.argocd.argoproj.io"},
 					Annotations: map[string]string{
 						"annotation-some-key": "annotation-some-value",
 					},
@@ -112,7 +112,7 @@ func Test_ApplyTemplatePatch(t *testing.T) {
 				ObjectMeta: metav1.ObjectMeta{
 					Name:       "my-cluster-guestbook",
 					Namespace:  "namespace",
-					Finalizers: []string{appv1.ResourcesFinalizerName},
+					Finalizers: []string{"resources-finalizer.argocd.argoproj.io"},
 				},
 				Spec: appv1.ApplicationSpec{
 					Project: "default",
@@ -148,7 +148,7 @@ spec:
 				ObjectMeta: metav1.ObjectMeta{
 					Name:       "my-cluster-guestbook",
 					Namespace:  "namespace",
-					Finalizers: []string{appv1.ResourcesFinalizerName},
+					Finalizers: []string{"resources-finalizer.argocd.argoproj.io"},
 					Annotations: map[string]string{
 						"annotation-some-key": "annotation-some-value",
 					},
--- a/applicationset/controllers/template/template_test.go
+++ b/applicationset/controllers/template/template_test.go
@@ -341,10 +341,10 @@ func TestGenerateAppsUsingPullRequestGenerator(t *testing.T) {
 				renderer,
 				nil,
 			)
-			assert.Equal(t, cases.expectedApp[0].Name, gotApp[0].Name)
-			assert.Equal(t, cases.expectedApp[0].Spec.Source.TargetRevision, gotApp[0].Spec.Source.TargetRevision)
-			assert.Equal(t, cases.expectedApp[0].Spec.Destination.Namespace, gotApp[0].Spec.Destination.Namespace)
-			assert.True(t, maps.Equal(cases.expectedApp[0].Labels, gotApp[0].Labels))
+			assert.EqualValues(t, cases.expectedApp[0].ObjectMeta.Name, gotApp[0].ObjectMeta.Name)
+			assert.EqualValues(t, cases.expectedApp[0].Spec.Source.TargetRevision, gotApp[0].Spec.Source.TargetRevision)
+			assert.EqualValues(t, cases.expectedApp[0].Spec.Destination.Namespace, gotApp[0].Spec.Destination.Namespace)
+			assert.True(t, maps.Equal(cases.expectedApp[0].ObjectMeta.Labels, gotApp[0].ObjectMeta.Labels))
 		})
 	}
 }
--- a/applicationset/examples/git-generator-files-discovery/excludes/git-files-exclude-example-fasttemplate.yaml
+++ b/applicationset/examples/git-generator-files-discovery/excludes/git-files-exclude-example-fasttemplate.yaml
@@ -1,26 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: ApplicationSet
-metadata:
-  name: guestbook
-spec:
-  generators:
-    - git:
-        repoURL: https://github.com/argoproj/argo-cd.git
-        revision: HEAD
-        files:
-          - path: "applicationset/examples/git-generator-files-discovery/cluster-config/**/config.json"
-          - path: "applicationset/examples/git-generator-files-discovery/cluster-config/*/dev/config.json"
-            exclude: true
-  template:
-    metadata:
-      name: '{{cluster.name}}-guestbook'
-    spec:
-      project: default
-      source:
-        repoURL: https://github.com/argoproj/argo-cd.git
-        targetRevision: HEAD
-        path: "applicationset/examples/git-generator-files-discovery/apps/guestbook"
-      destination:
-        server: https://kubernetes.default.svc
-        #server: '{{cluster.address}}'
-        namespace: guestbook
--- a/applicationset/examples/git-generator-files-discovery/excludes/git-files-exclude-example.yaml
+++ b/applicationset/examples/git-generator-files-discovery/excludes/git-files-exclude-example.yaml
@@ -1,27 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: ApplicationSet
-metadata:
-  name: guestbook
-spec:
-  goTemplate: true
-  goTemplateOptions: ["missingkey=error"]
-  generators:
-    - git:
-        repoURL: https://github.com/argoproj/argo-cd.git
-        revision: HEAD
-        files:
-          - path: "applicationset/examples/git-generator-files-discovery/cluster-config/**/config.json"
-          - path: "applicationset/examples/git-generator-files-discovery/cluster-config/*/dev/config.json"
-            exclude: true
-  template:
-    metadata:
-      name: '{{.cluster.name}}-guestbook'
-    spec:
-      project: default
-      source:
-        repoURL: https://github.com/argoproj/argo-cd.git
-        targetRevision: HEAD
-        path: "applicationset/examples/git-generator-files-discovery/apps/guestbook"
-      destination:
-        server: https://kubernetes.default.svc
-        namespace: guestbook
--- a/applicationset/generators/cluster.go
+++ b/applicationset/generators/cluster.go
@@ -7,6 +7,8 @@ import (

 	log "github.com/sirupsen/logrus"

+	"github.com/argoproj/argo-cd/v3/util/settings"
+
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"
@@ -25,17 +27,21 @@ type ClusterGenerator struct {
 	ctx       context.Context
 	clientset kubernetes.Interface
 	// namespace is the Argo CD namespace
-	namespace string
+	namespace       string
+	settingsManager *settings.SettingsManager
 }

 var render = &utils.Render{}

 func NewClusterGenerator(ctx context.Context, c client.Client, clientset kubernetes.Interface, namespace string) Generator {
+	settingsManager := settings.NewSettingsManager(ctx, clientset, namespace)
+
 	g := &ClusterGenerator{
-		Client:    c,
-		ctx:       ctx,
-		clientset: clientset,
-		namespace: namespace,
+		Client:          c,
+		ctx:             ctx,
+		clientset:       clientset,
+		namespace:       namespace,
+		settingsManager: settingsManager,
 	}
 	return g
 }
@@ -53,11 +59,11 @@ func (g *ClusterGenerator) GetTemplate(appSetGenerator *argoappsetv1alpha1.Appli
 func (g *ClusterGenerator) GenerateParams(appSetGenerator *argoappsetv1alpha1.ApplicationSetGenerator, appSet *argoappsetv1alpha1.ApplicationSet, _ client.Client) ([]map[string]any, error) {
 	logCtx := log.WithField("applicationset", appSet.GetName()).WithField("namespace", appSet.GetNamespace())
 	if appSetGenerator == nil {
-		return nil, ErrEmptyAppSetGenerator
+		return nil, EmptyAppSetGeneratorError
 	}

 	if appSetGenerator.Clusters == nil {
-		return nil, ErrEmptyAppSetGenerator
+		return nil, EmptyAppSetGeneratorError
 	}

 	// Do not include the local cluster in the cluster parameters IF there is a non-empty selector
@@ -133,20 +139,20 @@ func (g *ClusterGenerator) GenerateParams(appSetGenerator *argoappsetv1alpha1.Ap
 		if appSet.Spec.GoTemplate {
 			meta := map[string]any{}

-			if len(cluster.Annotations) > 0 {
-				meta["annotations"] = cluster.Annotations
+			if len(cluster.ObjectMeta.Annotations) > 0 {
+				meta["annotations"] = cluster.ObjectMeta.Annotations
 			}
-			if len(cluster.Labels) > 0 {
-				meta["labels"] = cluster.Labels
+			if len(cluster.ObjectMeta.Labels) > 0 {
+				meta["labels"] = cluster.ObjectMeta.Labels
 			}

 			params["metadata"] = meta
 		} else {
-			for key, value := range cluster.Annotations {
+			for key, value := range cluster.ObjectMeta.Annotations {
 				params["metadata.annotations."+key] = value
 			}

-			for key, value := range cluster.Labels {
+			for key, value := range cluster.ObjectMeta.Labels {
 				params["metadata.labels."+key] = value
 			}
 		}
@@ -182,7 +188,7 @@ func (g *ClusterGenerator) getSecretsByClusterName(log *log.Entry, appSetGenerat
 		return nil, fmt.Errorf("error converting label selector: %w", err)
 	}

-	if err := g.List(context.Background(), clusterSecretList, client.MatchingLabelsSelector{Selector: secretSelector}); err != nil {
+	if err := g.Client.List(context.Background(), clusterSecretList, client.MatchingLabelsSelector{Selector: secretSelector}); err != nil {
 		return nil, err
 	}
 	log.Debugf("clusters matching labels: %d", len(clusterSecretList.Items))
--- a/applicationset/generators/duck_type.go
+++ b/applicationset/generators/duck_type.go
@@ -10,8 +10,9 @@ import (
 	log "github.com/sirupsen/logrus"
 	"sigs.k8s.io/controller-runtime/pkg/client"

+	"github.com/argoproj/argo-cd/v3/util/settings"
+
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/client-go/dynamic"
@@ -25,18 +26,22 @@ var _ Generator = (*DuckTypeGenerator)(nil)

 // DuckTypeGenerator generates Applications for some or all clusters registered with ArgoCD.
 type DuckTypeGenerator struct {
-	ctx       context.Context
-	dynClient dynamic.Interface
-	clientset kubernetes.Interface
-	namespace string // namespace is the Argo CD namespace
+	ctx             context.Context
+	dynClient       dynamic.Interface
+	clientset       kubernetes.Interface
+	namespace       string // namespace is the Argo CD namespace
+	settingsManager *settings.SettingsManager
 }

 func NewDuckTypeGenerator(ctx context.Context, dynClient dynamic.Interface, clientset kubernetes.Interface, namespace string) Generator {
+	settingsManager := settings.NewSettingsManager(ctx, clientset, namespace)
+
 	g := &DuckTypeGenerator{
-		ctx:       ctx,
-		dynClient: dynClient,
-		clientset: clientset,
-		namespace: namespace,
+		ctx:             ctx,
+		dynClient:       dynClient,
+		clientset:       clientset,
+		namespace:       namespace,
+		settingsManager: settingsManager,
 	}
 	return g
 }
@@ -57,12 +62,12 @@ func (g *DuckTypeGenerator) GetTemplate(appSetGenerator *argoprojiov1alpha1.Appl

 func (g *DuckTypeGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, appSet *argoprojiov1alpha1.ApplicationSet, _ client.Client) ([]map[string]any, error) {
 	if appSetGenerator == nil {
-		return nil, ErrEmptyAppSetGenerator
+		return nil, EmptyAppSetGeneratorError
 	}

 	// Not likely to happen
 	if appSetGenerator.ClusterDecisionResource == nil {
-		return nil, ErrEmptyAppSetGenerator
+		return nil, EmptyAppSetGeneratorError
 	}

 	// ListCluster from Argo CD's util/db package will include the local cluster in the list of clusters
@@ -92,13 +97,13 @@ func (g *DuckTypeGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.A
 	// Validate the fields
 	if kind == "" || versionIdx < 1 {
 		log.Warningf("kind=%v, resourceName=%v, versionIdx=%v", kind, resourceName, versionIdx)
-		return nil, errors.New("there is a problem with the apiVersion, kind or resourceName provided")
+		return nil, errors.New("There is a problem with the apiVersion, kind or resourceName provided")
 	}

 	if (resourceName == "" && labelSelector.MatchLabels == nil && labelSelector.MatchExpressions == nil) ||
 		(resourceName != "" && (labelSelector.MatchExpressions != nil || labelSelector.MatchLabels != nil)) {
 		log.Warningf("You must choose either resourceName=%v, labelSelector.matchLabels=%v or labelSelect.matchExpressions=%v", resourceName, labelSelector.MatchLabels, labelSelector.MatchExpressions)
-		return nil, errors.New("there is a problem with the definition of the ClusterDecisionResource generator")
+		return nil, errors.New("There is a problem with the definition of the ClusterDecisionResource generator")
 	}

 	// Split up the apiVersion
@@ -131,51 +136,18 @@ func (g *DuckTypeGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.A

 	// Override the duck type in the status of the resource
 	statusListKey := "clusters"
+
+	matchKey := cm.Data["matchKey"]
+
 	if cm.Data["statusListKey"] != "" {
 		statusListKey = cm.Data["statusListKey"]
 	}
-
-	matchKey := cm.Data["matchKey"]
 	if matchKey == "" {
 		log.WithField("matchKey", matchKey).Warning("matchKey not found in " + cm.Name)
 		return nil, nil
 	}

-	clusterDecisions := buildClusterDecisions(duckResources, statusListKey)
-	if len(clusterDecisions) == 0 {
-		log.Warningf("clusterDecisionResource status.%s missing", statusListKey)
-		return nil, nil
-	}
-
 	res := []map[string]any{}
-	for _, clusterDecision := range clusterDecisions {
-		cluster := findCluster(clustersFromArgoCD, clusterDecision, matchKey, statusListKey)
-		// if no cluster is found, move to the next cluster
-		if cluster == nil {
-			continue
-		}
-
-		// generated instance of cluster params
-		params := map[string]any{
-			"name":   cluster.Name,
-			"server": cluster.Server,
-		}
-
-		for key, value := range clusterDecision.(map[string]any) {
-			params[key] = value.(string)
-		}
-
-		for key, value := range appSetGenerator.ClusterDecisionResource.Values {
-			collectParams(appSet, params, key, value)
-		}
-
-		res = append(res, params)
-	}
-
-	return res, nil
-}
-
-func buildClusterDecisions(duckResources *unstructured.UnstructuredList, statusListKey string) []any {
 	clusterDecisions := []any{}

 	// Build the decision slice
@@ -192,38 +164,60 @@ func buildClusterDecisions(duckResources *unstructured.UnstructuredList, statusL
 		clusterDecisions = append(clusterDecisions, duckResource.Object["status"].(map[string]any)[statusListKey].([]any)...)
 	}
 	log.Infof("Number of decisions found: %v", len(clusterDecisions))
-	return clusterDecisions
-}

-func findCluster(clustersFromArgoCD []utils.ClusterSpecifier, cluster any, matchKey string, statusListKey string) *utils.ClusterSpecifier {
-	log.Infof("cluster: %v", cluster)
-	matchValue := cluster.(map[string]any)[matchKey]
-	if matchValue == nil || matchValue.(string) == "" {
-		log.Warningf("matchKey=%v not found in \"%v\" list: %v\n", matchKey, statusListKey, cluster.(map[string]any))
-		return nil // no match
+	if len(clusterDecisions) == 0 {
+		log.Warningf("clusterDecisionResource status.%s missing", statusListKey)
+		return nil, nil
 	}
+	for _, cluster := range clusterDecisions {
+		// generated instance of cluster params
+		params := map[string]any{}

-	strMatchValue := matchValue.(string)
-	log.WithField(matchKey, strMatchValue).Debug("validate against ArgoCD")
-
-	for _, argoCluster := range clustersFromArgoCD {
-		if argoCluster.Name == strMatchValue {
-			log.WithField(matchKey, argoCluster.Name).Info("matched cluster in ArgoCD")
-			return &argoCluster
+		log.Infof("cluster: %v", cluster)
+		matchValue := cluster.(map[string]any)[matchKey]
+		if matchValue == nil || matchValue.(string) == "" {
+			log.Warningf("matchKey=%v not found in \"%v\" list: %v\n", matchKey, statusListKey, cluster.(map[string]any))
+			continue
 		}
-	}

-	log.WithField(matchKey, strMatchValue).Warning("unmatched cluster in ArgoCD")
-	return nil
-}
+		strMatchValue := matchValue.(string)
+		log.WithField(matchKey, strMatchValue).Debug("validate against ArgoCD")

-func collectParams(appSet *argoprojiov1alpha1.ApplicationSet, params map[string]any, key string, value string) {
-	if appSet.Spec.GoTemplate {
-		if params["values"] == nil {
-			params["values"] = map[string]string{}
+		found := false
+
+		for _, argoCluster := range clustersFromArgoCD {
+			if argoCluster.Name == strMatchValue {
+				log.WithField(matchKey, argoCluster.Name).Info("matched cluster in ArgoCD")
+				params["name"] = argoCluster.Name
+				params["server"] = argoCluster.Server
+
+				found = true
+				break // Stop looking
+			}
 		}
-		params["values"].(map[string]string)[key] = value
-	} else {
-		params["values."+key] = value
+
+		if !found {
+			log.WithField(matchKey, strMatchValue).Warning("unmatched cluster in ArgoCD")
+			continue
+		}
+
+		for key, value := range cluster.(map[string]any) {
+			params[key] = value.(string)
+		}
+
+		for key, value := range appSetGenerator.ClusterDecisionResource.Values {
+			if appSet.Spec.GoTemplate {
+				if params["values"] == nil {
+					params["values"] = map[string]string{}
+				}
+				params["values"].(map[string]string)[key] = value
+			} else {
+				params["values."+key] = value
+			}
+		}
+
+		res = append(res, params)
 	}
+
+	return res, nil
 }
--- a/applicationset/generators/duck_type_test.go
+++ b/applicationset/generators/duck_type_test.go
@@ -159,7 +159,7 @@ func TestGenerateParamsForDuckType(t *testing.T) {
 			resource:      duckType,
 			values:        nil,
 			expected:      []map[string]any{},
-			expectedError: errors.New("there is a problem with the definition of the ClusterDecisionResource generator"),
+			expectedError: errors.New("There is a problem with the definition of the ClusterDecisionResource generator"),
 		},
 		/*** This does not work with the FAKE runtime client, fieldSelectors are broken.
 		{
@@ -270,7 +270,7 @@ func TestGenerateParamsForDuckType(t *testing.T) {
 			resource:      duckType,
 			values:        nil,
 			expected:      nil,
-			expectedError: errors.New("there is a problem with the definition of the ClusterDecisionResource generator"),
+			expectedError: errors.New("There is a problem with the definition of the ClusterDecisionResource generator"),
 		},
 	}

@@ -455,7 +455,7 @@ func TestGenerateParamsForDuckTypeGoTemplate(t *testing.T) {
 			resource:      duckType,
 			values:        nil,
 			expected:      []map[string]any{},
-			expectedError: errors.New("there is a problem with the definition of the ClusterDecisionResource generator"),
+			expectedError: errors.New("There is a problem with the definition of the ClusterDecisionResource generator"),
 		},
 		/*** This does not work with the FAKE runtime client, fieldSelectors are broken.
 		{
@@ -566,7 +566,7 @@ func TestGenerateParamsForDuckTypeGoTemplate(t *testing.T) {
 			resource:      duckType,
 			values:        nil,
 			expected:      nil,
-			expectedError: errors.New("there is a problem with the definition of the ClusterDecisionResource generator"),
+			expectedError: errors.New("There is a problem with the definition of the ClusterDecisionResource generator"),
 		},
 	}

--- a/applicationset/generators/git.go
+++ b/applicationset/generators/git.go
@@ -29,26 +29,22 @@ type GitGenerator struct {
 }

 // NewGitGenerator creates a new instance of Git Generator
-func NewGitGenerator(repos services.Repos, namespace string) Generator {
+func NewGitGenerator(repos services.Repos, controllerNamespace string) Generator {
 	g := &GitGenerator{
 		repos:     repos,
-		namespace: namespace,
+		namespace: controllerNamespace,
 	}

 	return g
 }

-// GetTemplate returns the ApplicationSetTemplate associated with the Git generator
-// from the provided ApplicationSetGenerator. This template defines how each
-// generated Argo CD Application should be rendered.
 func (g *GitGenerator) GetTemplate(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator) *argoprojiov1alpha1.ApplicationSetTemplate {
 	return &appSetGenerator.Git.Template
 }

-// GetRequeueAfter returns the duration after which the Git generator should be
-// requeued for reconciliation. If RequeueAfterSeconds is set in the generator spec,
-// it uses that value. Otherwise, it falls back to a default requeue interval (3 minutes).
 func (g *GitGenerator) GetRequeueAfter(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator) time.Duration {
+	// Return a requeue default of 3 minutes, if no default is specified.
+
 	if appSetGenerator.Git.RequeueAfterSeconds != nil {
 		return time.Duration(*appSetGenerator.Git.RequeueAfterSeconds) * time.Second
 	}
@@ -56,15 +52,13 @@ func (g *GitGenerator) GetRequeueAfter(appSetGenerator *argoprojiov1alpha1.Appli
 	return getDefaultRequeueAfter()
 }

-// GenerateParams generates a list of parameter maps for the ApplicationSet by evaluating the Git generator's configuration.
-// It supports both directory-based and file-based Git generators.
 func (g *GitGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, appSet *argoprojiov1alpha1.ApplicationSet, client client.Client) ([]map[string]any, error) {
 	if appSetGenerator == nil {
-		return nil, ErrEmptyAppSetGenerator
+		return nil, EmptyAppSetGeneratorError
 	}

 	if appSetGenerator.Git == nil {
-		return nil, ErrEmptyAppSetGenerator
+		return nil, EmptyAppSetGeneratorError
 	}

 	noRevisionCache := appSet.RefreshRequired()
@@ -74,15 +68,14 @@ func (g *GitGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.Applic
 	// When the project field is templated, the contents of the git repo are required to run the git generator and get the templated value,
 	// but git generator cannot be called without verifying the commit signature.
 	// In this case, we skip the signature verification.
-	// If the project is templated, we skip the commit verification
 	if !strings.Contains(appSet.Spec.Template.Spec.Project, "{{") {
 		project := appSet.Spec.Template.Spec.Project
 		appProject := &argoprojiov1alpha1.AppProject{}
-		namespace := g.namespace
-		if namespace == "" {
-			namespace = appSet.Namespace
+		controllerNamespace := g.namespace
+		if controllerNamespace == "" {
+			controllerNamespace = appSet.Namespace
 		}
-		if err := client.Get(context.TODO(), types.NamespacedName{Name: project, Namespace: namespace}, appProject); err != nil {
+		if err := client.Get(context.TODO(), types.NamespacedName{Name: project, Namespace: controllerNamespace}, appProject); err != nil {
 			return nil, fmt.Errorf("error getting project %s: %w", project, err)
 		}
 		// we need to verify the signature on the Git revision if GPG is enabled
@@ -101,7 +94,7 @@ func (g *GitGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.Applic
 	case len(appSetGenerator.Git.Files) != 0:
 		res, err = g.generateParamsForGitFiles(appSetGenerator, noRevisionCache, verifyCommit, appSet.Spec.GoTemplate, project, appSet.Spec.GoTemplateOptions)
 	default:
-		return nil, ErrEmptyAppSetGenerator
+		return nil, EmptyAppSetGeneratorError
 	}
 	if err != nil {
 		return nil, fmt.Errorf("error generating params from git: %w", err)
@@ -110,10 +103,8 @@ func (g *GitGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.Applic
 	return res, nil
 }

-// generateParamsForGitDirectories generates parameters for an ApplicationSet using a directory-based Git generator.
-// It fetches all directories from the given Git repository and revision, optionally using a revision cache and verifying commits.
-// It then filters the directories based on the generator's configuration and renders parameters for the resulting applications
 func (g *GitGenerator) generateParamsForGitDirectories(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, noRevisionCache, verifyCommit, useGoTemplate bool, project string, goTemplateOptions []string) ([]map[string]any, error) {
+	// Directories, not files
 	allPaths, err := g.repos.GetDirectories(context.TODO(), appSetGenerator.Git.RepoURL, appSetGenerator.Git.Revision, project, noRevisionCache, verifyCommit)
 	if err != nil {
 		return nil, fmt.Errorf("error getting directories from repo: %w", err)
@@ -137,88 +128,41 @@ func (g *GitGenerator) generateParamsForGitDirectories(appSetGenerator *argoproj
 	return res, nil
 }

-// generateParamsForGitFiles generates parameters for an ApplicationSet using a file-based Git generator.
-// It retrieves and processes specified files from the Git repository, supporting both YAML and JSON formats,
-// and returns a list of parameter maps extracted from the content.
 func (g *GitGenerator) generateParamsForGitFiles(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, noRevisionCache, verifyCommit, useGoTemplate bool, project string, goTemplateOptions []string) ([]map[string]any, error) {
-	// fileContentMap maps absolute file paths to their byte content
-	fileContentMap := make(map[string][]byte)
-	var includePatterns []string
-	var excludePatterns []string
-
-	for _, req := range appSetGenerator.Git.Files {
-		if req.Exclude {
-			excludePatterns = append(excludePatterns, req.Path)
-		} else {
-			includePatterns = append(includePatterns, req.Path)
-		}
-	}
-
-	// Fetch all files from include patterns
-	for _, includePattern := range includePatterns {
-		retrievedFiles, err := g.repos.GetFiles(
-			context.TODO(),
-			appSetGenerator.Git.RepoURL,
-			appSetGenerator.Git.Revision,
-			project,
-			includePattern,
-			noRevisionCache,
-			verifyCommit,
-		)
+	// Get all files that match the requested path string, removing duplicates
+	allFiles := make(map[string][]byte)
+	for _, requestedPath := range appSetGenerator.Git.Files {
+		files, err := g.repos.GetFiles(context.TODO(), appSetGenerator.Git.RepoURL, appSetGenerator.Git.Revision, project, requestedPath.Path, noRevisionCache, verifyCommit)
 		if err != nil {
 			return nil, err
 		}
-		for absPath, content := range retrievedFiles {
-			fileContentMap[absPath] = content
+		for filePath, content := range files {
+			allFiles[filePath] = content
 		}
 	}

-	// Now remove files matching any exclude pattern
-	for _, excludePattern := range excludePatterns {
-		matchingFiles, err := g.repos.GetFiles(
-			context.TODO(),
-			appSetGenerator.Git.RepoURL,
-			appSetGenerator.Git.Revision,
-			project,
-			excludePattern,
-			noRevisionCache,
-			verifyCommit,
-		)
-		if err != nil {
-			return nil, err
-		}
-		for absPath := range matchingFiles {
-			// if the file doesn't exist already and you try to delete it from the map
-			// the operation is a no-op. It’s safe and doesn't return an error or panic.
-			// Hence, we can simply try to delete the file from the path without checking
-			// if that file already exists in the map.
-			delete(fileContentMap, absPath)
-		}
+	// Extract the unduplicated map into a list, and sort by path to ensure a deterministic
+	// processing order in the subsequent step
+	allPaths := []string{}
+	for path := range allFiles {
+		allPaths = append(allPaths, path)
 	}
+	sort.Strings(allPaths)

-	// Get a sorted list of file paths to ensure deterministic processing order
-	var filePaths []string
-	for path := range fileContentMap {
-		filePaths = append(filePaths, path)
-	}
-	sort.Strings(filePaths)
-
-	var allParams []map[string]any
-	for _, filePath := range filePaths {
+	// Generate params from each path, and return
+	res := []map[string]any{}
+	for _, path := range allPaths {
 		// A JSON / YAML file path can contain multiple sets of parameters (ie it is an array)
-		paramsFromFileArray, err := g.generateParamsFromGitFile(filePath, fileContentMap[filePath], appSetGenerator.Git.Values, useGoTemplate, goTemplateOptions, appSetGenerator.Git.PathParamPrefix)
+		paramsArray, err := g.generateParamsFromGitFile(path, allFiles[path], appSetGenerator.Git.Values, useGoTemplate, goTemplateOptions, appSetGenerator.Git.PathParamPrefix)
 		if err != nil {
-			return nil, fmt.Errorf("unable to process file '%s': %w", filePath, err)
+			return nil, fmt.Errorf("unable to process file '%s': %w", path, err)
 		}
-		allParams = append(allParams, paramsFromFileArray...)
-	}

-	return allParams, nil
+		res = append(res, paramsArray...)
+	}
+	return res, nil
 }

-// generateParamsFromGitFile parses the content of a Git-tracked file and generates a slice of parameter maps.
-// The file can contain a single YAML/JSON object or an array of such objects. Depending on the useGoTemplate flag,
-// it either preserves structure for Go templating or flattens the objects for use as plain key-value parameters.
 func (g *GitGenerator) generateParamsFromGitFile(filePath string, fileContent []byte, values map[string]string, useGoTemplate bool, goTemplateOptions []string, pathParamPrefix string) ([]map[string]any, error) {
 	objectsFound := []map[string]any{}

@@ -278,7 +222,7 @@ func (g *GitGenerator) generateParamsFromGitFile(filePath string, fileContent []
 			params[pathParamName+".basenameNormalized"] = utils.SanitizeName(path.Base(params[pathParamName].(string)))
 			params[pathParamName+".filenameNormalized"] = utils.SanitizeName(path.Base(params[pathParamName+".filename"].(string)))
 			for k, v := range strings.Split(params[pathParamName].(string), "/") {
-				if v != "" {
+				if len(v) > 0 {
 					params[pathParamName+"["+strconv.Itoa(k)+"]"] = v
 				}
 			}
@@ -295,10 +239,8 @@ func (g *GitGenerator) generateParamsFromGitFile(filePath string, fileContent []
 	return res, nil
 }

-// filterApps filters the list of all application paths based on inclusion and exclusion rules
-// defined in GitDirectoryGeneratorItems. Each item can either include or exclude matching paths.
 func (g *GitGenerator) filterApps(directories []argoprojiov1alpha1.GitDirectoryGeneratorItem, allPaths []string) []string {
-	var res []string
+	res := []string{}
 	for _, appPath := range allPaths {
 		appInclude := false
 		appExclude := false
@@ -325,9 +267,6 @@ func (g *GitGenerator) filterApps(directories []argoprojiov1alpha1.GitDirectoryG
 	return res
 }

-// generateParamsFromApps generates a list of parameter maps based on the given app paths.
-// Each app path is converted into a parameter object with path metadata (basename, segments, etc.).
-// It supports both Go templates and flat key-value parameters.
 func (g *GitGenerator) generateParamsFromApps(requestedApps []string, appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, useGoTemplate bool, goTemplateOptions []string) ([]map[string]any, error) {
 	res := make([]map[string]any, len(requestedApps))
 	for i, a := range requestedApps {
@@ -353,7 +292,7 @@ func (g *GitGenerator) generateParamsFromApps(requestedApps []string, appSetGene
 			params[pathParamName+".basename"] = path.Base(a)
 			params[pathParamName+".basenameNormalized"] = utils.SanitizeName(path.Base(a))
 			for k, v := range strings.Split(params[pathParamName].(string), "/") {
-				if v != "" {
+				if len(v) > 0 {
 					params[pathParamName+"["+strconv.Itoa(k)+"]"] = v
 				}
 			}
@@ -370,7 +309,6 @@ func (g *GitGenerator) generateParamsFromApps(requestedApps []string, appSetGene
 	return res, nil
 }

-// resolveProjectName resolves a project name whether templated or not
 func resolveProjectName(project string) string {
 	if strings.Contains(project, "{{") {
 		return ""
--- a/applicationset/generators/git_test.go
+++ b/applicationset/generators/git_test.go
@@ -2,6 +2,7 @@ package generators

 import (
 	"errors"
+	"fmt"
 	"testing"

 	"github.com/stretchr/testify/assert"
@@ -180,8 +181,6 @@ foo:
 }

 func TestGitGenerateParamsFromDirectories(t *testing.T) {
-	t.Parallel()
-
 	cases := []struct {
 		name            string
 		directories     []v1alpha1.GitDirectoryGeneratorItem
@@ -364,8 +363,6 @@ func TestGitGenerateParamsFromDirectories(t *testing.T) {
 }

 func TestGitGenerateParamsFromDirectoriesGoTemplate(t *testing.T) {
-	t.Parallel()
-
 	cases := []struct {
 		name            string
 		directories     []v1alpha1.GitDirectoryGeneratorItem
@@ -667,8 +664,6 @@ func TestGitGenerateParamsFromDirectoriesGoTemplate(t *testing.T) {
 }

 func TestGitGenerateParamsFromFiles(t *testing.T) {
-	t.Parallel()
-
 	cases := []struct {
 		name string
 		// files is the list of paths/globs to match
@@ -1019,928 +1014,7 @@ cluster:
 			client := fake.NewClientBuilder().WithScheme(scheme).WithObjects(&appProject).Build()

 			got, err := gitGenerator.GenerateParams(&applicationSetInfo.Spec.Generators[0], &applicationSetInfo, client)
-
-			if testCaseCopy.expectedError != nil {
-				require.EqualError(t, err, testCaseCopy.expectedError.Error())
-			} else {
-				require.NoError(t, err)
-				assert.ElementsMatch(t, testCaseCopy.expected, got)
-			}
-
-			argoCDServiceMock.AssertExpectations(t)
-		})
-	}
-}
-
-// TestGitGeneratorParamsFromFilesWithExcludeOptionWithNewGlobbing tests the params values generated by git file generator
-// when exclude option is set to true. It gives the result files based on new globbing pattern - doublestar package
-func TestGitGeneratorParamsFromFilesWithExcludeOptionWithNewGlobbing(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name string
-		// files is the list of paths/globs to match
-		files []v1alpha1.GitFileGeneratorItem
-		// includePattern contains a list of file patterns that needs to be included
-		includePattern []string
-		// excludePattern contains a list of file patterns that needs to be excluded
-		excludePattern []string
-		// includeFiles is a map with key as absolute path to file and value as the content in bytes that satisfies the includePattern
-		includeFiles map[string][]byte
-		// excludeFiles is a map with key as absolute path to file and value as the content in bytes that satisfies the excludePattern
-		// This means all the files should be excluded
-		excludeFiles map[string][]byte
-		// noMatchFiles contains all the files that neither match include pattern nor exclude pattern
-		// Instead of keeping those files in the excludeFiles map, it is better to keep those files separately
-		// in a separate field like 'noMatchFiles' to avoid confusion.
-		noMatchFiles map[string][]byte
-		// if repoPathsError is non-nil, the call to GetPaths(...) will return this error value
-		repoPathsError error
-		values         map[string]string
-		expected       []map[string]any
-		expectedError  error
-	}{
-		{
-			name: "filter files according to file-path with exclude",
-			files: []v1alpha1.GitFileGeneratorItem{
-				{
-					Path: "**/config.json",
-				},
-				{
-					Path:    "p1/**/config.json",
-					Exclude: true,
-				},
-			},
-			includePattern: []string{"**/config.json"},
-			excludePattern: []string{"p1/**/config.json"},
-			includeFiles: map[string][]byte{
-				"cluster-config/production/config.json": []byte(`{
-				   "cluster": {
-				       "owner": "john.doe@example.com",
-				       "name": "production",
-				       "address": "https://kubernetes.default.svc"
-				   },
-				   "key1": "val1",
-				   "key2": {
-				       "key2_1": "val2_1",
-				       "key2_2": {
-				           "key2_2_1": "val2_2_1"
-				       }
-				   },
-				   "key3": 123
-				}
-`),
-				"p1/config.json": []byte(`{
-				  "database": {
-				    "admin": "db.admin@example.com",
-				    "name": "user-data",
-				    "host": "db.internal.local",
-				    "settings": {
-				      "replicas": 3,
-				      "backup": "daily"
-				    }
-				  }
-				}
-`),
-				"p1/p2/config.json": []byte(``),
-			},
-			excludeFiles: map[string][]byte{
-				"p1/config.json": []byte(`{
-				  "database": {
-				    "admin": "db.admin@example.com",
-				    "name": "user-data",
-				    "host": "db.internal.local",
-				    "settings": {
-				      "replicas": 3,
-				      "backup": "daily"
-				    }
-				  }
-				}
-`),
-				"p1/p2/config.json": []byte(``),
-			},
-			repoPathsError: nil,
-			expected: []map[string]any{
-				{
-					"cluster.owner":           "john.doe@example.com",
-					"cluster.name":            "production",
-					"cluster.address":         "https://kubernetes.default.svc",
-					"key1":                    "val1",
-					"key2.key2_1":             "val2_1",
-					"key2.key2_2.key2_2_1":    "val2_2_1",
-					"key3":                    "123",
-					"path":                    "cluster-config/production",
-					"path.basename":           "production",
-					"path[0]":                 "cluster-config",
-					"path[1]":                 "production",
-					"path.basenameNormalized": "production",
-					"path.filename":           "config.json",
-					"path.filenameNormalized": "config.json",
-				},
-			},
-		},
-		{
-			name: "filter files according to multiple file-paths with exclude",
-			files: []v1alpha1.GitFileGeneratorItem{
-				{Path: "**/config.json"},
-				{Path: "p1/app2/config.json", Exclude: true},
-				{Path: "p1/app3/config.json", Exclude: true},
-			},
-			includePattern: []string{"**/config.json"},
-			excludePattern: []string{"p1/app2/config.json", "p1/app3/config.json"},
-			includeFiles: map[string][]byte{
-				"p1/config.json": []byte(`{
-					"cluster": {
-			"owner": "john.doe@example.com",
-			"name": "production",
-			"address": "https://kubernetes.default.svc",
-			"inner": {
-				"one" : "two"
-			}
-		}
-}`),
-				"p1/app2/config.json": []byte(`{}`),
-				"p1/app3/config.json": []byte(`{}`),
-			},
-			excludeFiles: map[string][]byte{
-				"p1/app2/config.json": []byte(`{}`),
-				"p1/app3/config.json": []byte(`{}`),
-			},
-			repoPathsError: nil,
-			expected: []map[string]any{
-				{
-					"cluster.owner":           "john.doe@example.com",
-					"cluster.name":            "production",
-					"cluster.address":         "https://kubernetes.default.svc",
-					"cluster.inner.one":       "two",
-					"path":                    "p1",
-					"path.basename":           "p1",
-					"path[0]":                 "p1",
-					"path.basenameNormalized": "p1",
-					"path.filename":           "config.json",
-					"path.filenameNormalized": "config.json",
-				},
-			},
-		},
-		{
-			name:           "docs example test case to filter files according to multiple file-paths with exclude",
-			files:          []v1alpha1.GitFileGeneratorItem{{Path: "cluster-config/**/config.json"}, {Path: "cluster-config/*/dev/config.json", Exclude: true}},
-			includePattern: []string{"cluster-config/**/config.json"},
-			excludePattern: []string{"cluster-config/*/dev/config.json"},
-			includeFiles: map[string][]byte{
-				"cluster-config/engineering/prod/config.json": []byte(`
-cluster:
-  owner: john.doe@example.com
-  name: production
-  address: https://kubernetes.default.svc
-`),
-				"cluster-config/engineering/dev/config.json": []byte(`
-cluster:
-  owner: foo.bar@example.com
-  name: staging
-  address: https://kubernetes.default.svc
-`),
-			},
-			excludeFiles: map[string][]byte{
-				"cluster-config/engineering/dev/config.json": []byte(`
-cluster:
-  owner: foo.bar@example.com
-  name: staging
-  address: https://kubernetes.default.svc
-`),
-			},
-			repoPathsError: nil,
-			expected: []map[string]any{
-				{
-					"cluster.owner":           "john.doe@example.com",
-					"cluster.name":            "production",
-					"cluster.address":         "https://kubernetes.default.svc",
-					"path":                    "cluster-config/engineering/prod",
-					"path.basename":           "prod",
-					"path[0]":                 "cluster-config",
-					"path[1]":                 "engineering",
-					"path[2]":                 "prod",
-					"path.basenameNormalized": "prod",
-					"path.filename":           "config.json",
-					"path.filenameNormalized": "config.json",
-				},
-			},
-		},
-		{
-			name:           "testcase to verify new globbing pattern without any exclude",
-			files:          []v1alpha1.GitFileGeneratorItem{{Path: "some-path/*.yaml"}},
-			includePattern: []string{"some-path/*.yaml"},
-			excludePattern: nil,
-			includeFiles: map[string][]byte{
-				"some-path/values.yaml": []byte(`
-cluster:
-  owner: john.doe@example.com
-  name: production
-  address: https://kubernetes.default.svc
-`),
-			},
-			excludeFiles: map[string][]byte{},
-			noMatchFiles: map[string][]byte{
-				"some-path/staging/values.yaml": []byte(`
-cluster:
-  owner: foo.bar@example.com
-  name: staging
-  address: https://kubernetes.default.svc
-`),
-			},
-			repoPathsError: nil,
-			expected: []map[string]any{
-				{
-					"cluster.owner":           "john.doe@example.com",
-					"cluster.name":            "production",
-					"cluster.address":         "https://kubernetes.default.svc",
-					"path":                    "some-path",
-					"path.basename":           "some-path",
-					"path[0]":                 "some-path",
-					"path.basenameNormalized": "some-path",
-					"path.filename":           "values.yaml",
-					"path.filenameNormalized": "values.yaml",
-				},
-			},
-			expectedError: nil,
-		},
-		{
-			name:           "test to verify the solution for Git File Generator Problem", // https://github.com/argoproj/argo-cd/blob/master/docs/operator-manual/applicationset/Generators-Git-File-Globbing.md#git-file-generator-globbing
-			files:          []v1alpha1.GitFileGeneratorItem{{Path: "cluster-charts/*/*/values.yaml"}, {Path: "cluster-charts/*/values.yaml", Exclude: true}},
-			includePattern: []string{"cluster-charts/*/*/values.yaml"},
-			excludePattern: []string{"cluster-charts/*/values.yaml"},
-			includeFiles: map[string][]byte{
-				"cluster-charts/cluster1/mychart/values.yaml": []byte(`
-env: staging
-`),
-				"cluster-charts/cluster1/myotherchart/values.yaml": []byte(`
-env: prod
-`),
-			},
-			excludeFiles: map[string][]byte{
-				"cluster-charts/cluster2/values.yaml": []byte(`
-env: dev
-`),
-			},
-			noMatchFiles: map[string][]byte{
-				"cluster-charts/cluster1/mychart/charts/mysubchart/values.yaml": []byte(`
-env: testing
-`),
-			},
-			repoPathsError: nil,
-			expected: []map[string]any{
-				{
-					"env":                     "staging",
-					"path":                    "cluster-charts/cluster1/mychart",
-					"path.filenameNormalized": "values.yaml",
-					"path[0]":                 "cluster-charts",
-					"path[1]":                 "cluster1",
-					"path[2]":                 "mychart",
-					"path.basename":           "mychart",
-					"path.filename":           "values.yaml",
-					"path.basenameNormalized": "mychart",
-				},
-				{
-					"env":                     "prod",
-					"path":                    "cluster-charts/cluster1/myotherchart",
-					"path.filenameNormalized": "values.yaml",
-					"path[0]":                 "cluster-charts",
-					"path[1]":                 "cluster1",
-					"path[2]":                 "myotherchart",
-					"path.basename":           "myotherchart",
-					"path.filename":           "values.yaml",
-					"path.basenameNormalized": "myotherchart",
-				},
-			},
-			expectedError: nil,
-		},
-	}
-	for _, testCase := range cases {
-		testCaseCopy := testCase
-
-		t.Run(testCaseCopy.name, func(t *testing.T) {
-			t.Parallel()
-
-			argoCDServiceMock := mocks.Repos{}
-
-			// IMPORTANT: we try to get the files from the repo server that matches the patterns
-			// If we find those files also satisfy the exclude pattern, we remove them from map
-			// This is generally done by the g.repos.GetFiles() function.
-			// With the below mock setup, we make sure that if the GetFiles() function gets called
-			// for a include or exclude pattern, it should always return the includeFiles or excludeFiles.
-			for _, pattern := range testCaseCopy.excludePattern {
-				argoCDServiceMock.
-					On("GetFiles", mock.Anything, mock.Anything, mock.Anything, mock.Anything, pattern, mock.Anything, mock.Anything).
-					Return(testCaseCopy.excludeFiles, testCaseCopy.repoPathsError)
-			}
-
-			for _, pattern := range testCaseCopy.includePattern {
-				argoCDServiceMock.
-					On("GetFiles", mock.Anything, mock.Anything, mock.Anything, mock.Anything, pattern, mock.Anything, mock.Anything).
-					Return(testCaseCopy.includeFiles, testCaseCopy.repoPathsError)
-			}
-
-			gitGenerator := NewGitGenerator(&argoCDServiceMock, "")
-			applicationSetInfo := v1alpha1.ApplicationSet{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "set",
-				},
-				Spec: v1alpha1.ApplicationSetSpec{
-					Generators: []v1alpha1.ApplicationSetGenerator{{
-						Git: &v1alpha1.GitGenerator{
-							RepoURL:  "RepoURL",
-							Revision: "Revision",
-							Files:    testCaseCopy.files,
-							Values:   testCaseCopy.values,
-						},
-					}},
-				},
-			}
-
-			scheme := runtime.NewScheme()
-			err := v1alpha1.AddToScheme(scheme)
-			require.NoError(t, err)
-			appProject := v1alpha1.AppProject{}
-
-			client := fake.NewClientBuilder().WithScheme(scheme).WithObjects(&appProject).Build()
-
-			got, err := gitGenerator.GenerateParams(&applicationSetInfo.Spec.Generators[0], &applicationSetInfo, client)
-
-			if testCaseCopy.expectedError != nil {
-				require.EqualError(t, err, testCaseCopy.expectedError.Error())
-			} else {
-				require.NoError(t, err)
-				assert.ElementsMatch(t, testCaseCopy.expected, got)
-			}
-
-			argoCDServiceMock.AssertExpectations(t)
-		})
-	}
-}
-
-// TestGitGeneratorParamsFromFilesWithExcludeOptionWithOldGlobbing tests the params values generated by git file generator
-// // when exclude option is set to true. It gives the result files based on old globbing pattern - git ls-files
-func TestGitGeneratorParamsFromFilesWithExcludeOptionWithOldGlobbing(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name string
-		// files is the list of paths/globs to match
-		files []v1alpha1.GitFileGeneratorItem
-		// includePattern contains a list of file patterns that needs to be included
-		includePattern []string
-		// excludePattern contains a list of file patterns that needs to be excluded
-		excludePattern []string
-		// includeFiles is a map with key as absolute path to file and value as the content in bytes that satisfies the includePattern
-		includeFiles map[string][]byte
-		// excludeFiles is a map with key as absolute path to file and value as the content in bytes that satisfies the excludePattern
-		// This means all the files should be excluded
-		excludeFiles map[string][]byte
-		// noMatchFiles contains all the files that neither match include pattern nor exclude pattern
-		// Instead of keeping those files in the excludeFiles map, it is better to keep those files separately
-		// in a separate field like 'noMatchFiles' to avoid confusion.
-		noMatchFiles map[string][]byte
-		// if repoPathsError is non-nil, the call to GetPaths(...) will return this error value
-		repoPathsError error
-		values         map[string]string
-		expected       []map[string]any
-		expectedError  error
-	}{
-		{
-			name: "filter files according to file-path with exclude",
-			files: []v1alpha1.GitFileGeneratorItem{
-				{
-					Path: "**/config.json",
-				},
-				{
-					Path:    "p1/**/config.json",
-					Exclude: true,
-				},
-			},
-			includePattern: []string{"**/config.json"},
-			excludePattern: []string{"p1/**/config.json"},
-			includeFiles: map[string][]byte{
-				"cluster-config/production/config.json": []byte(`{
-				   "cluster": {
-				       "owner": "john.doe@example.com",
-				       "name": "production",
-				       "address": "https://kubernetes.default.svc"
-				   },
-				   "key1": "val1",
-				   "key2": {
-				       "key2_1": "val2_1",
-				       "key2_2": {
-				           "key2_2_1": "val2_2_1"
-				       }
-				   },
-				   "key3": 123
-				}
-`),
-				"p1/config.json": []byte(`{
-				  "database": {
-				    "admin": "db.admin@example.com",
-				    "name": "user-data",
-				    "host": "db.internal.local",
-				    "settings": {
-				      "replicas": 3,
-				      "backup": "daily"
-				    }
-				  }
-				}
-`),
-				"p1/p2/config.json": []byte(``),
-			},
-			excludeFiles: map[string][]byte{
-				"p1/config.json": []byte(`{
-				  "database": {
-				    "admin": "db.admin@example.com",
-				    "name": "user-data",
-				    "host": "db.internal.local",
-				    "settings": {
-				      "replicas": 3,
-				      "backup": "daily"
-				    }
-				  }
-				}
-`),
-				"p1/p2/config.json": []byte(``),
-			},
-			repoPathsError: nil,
-			expected: []map[string]any{
-				{
-					"cluster.owner":           "john.doe@example.com",
-					"cluster.name":            "production",
-					"cluster.address":         "https://kubernetes.default.svc",
-					"key1":                    "val1",
-					"key2.key2_1":             "val2_1",
-					"key2.key2_2.key2_2_1":    "val2_2_1",
-					"key3":                    "123",
-					"path":                    "cluster-config/production",
-					"path.basename":           "production",
-					"path[0]":                 "cluster-config",
-					"path[1]":                 "production",
-					"path.basenameNormalized": "production",
-					"path.filename":           "config.json",
-					"path.filenameNormalized": "config.json",
-				},
-			},
-		},
-		{
-			name: "filter files according to multiple file-paths with exclude",
-			files: []v1alpha1.GitFileGeneratorItem{
-				{Path: "**/config.json"},
-				{Path: "p1/app2/config.json", Exclude: true},
-				{Path: "p1/app3/config.json", Exclude: true},
-			},
-			includePattern: []string{"**/config.json"},
-			excludePattern: []string{"p1/app2/config.json", "p1/app3/config.json"},
-			includeFiles: map[string][]byte{
-				"p1/config.json": []byte(`{
-					"cluster": {
-			"owner": "john.doe@example.com",
-			"name": "production",
-			"address": "https://kubernetes.default.svc",
-			"inner": {
-				"one" : "two"
-			}
-		}
-}`),
-				"p1/app2/config.json": []byte(`{}`),
-				"p1/app3/config.json": []byte(`{}`),
-			},
-			excludeFiles: map[string][]byte{
-				"p1/app2/config.json": []byte(`{}`),
-				"p1/app3/config.json": []byte(`{}`),
-			},
-			repoPathsError: nil,
-			expected: []map[string]any{
-				{
-					"cluster.owner":           "john.doe@example.com",
-					"cluster.name":            "production",
-					"cluster.address":         "https://kubernetes.default.svc",
-					"cluster.inner.one":       "two",
-					"path":                    "p1",
-					"path.basename":           "p1",
-					"path[0]":                 "p1",
-					"path.basenameNormalized": "p1",
-					"path.filename":           "config.json",
-					"path.filenameNormalized": "config.json",
-				},
-			},
-		},
-		{
-			name:           "docs example test case to filter files according to multiple file-paths with exclude",
-			files:          []v1alpha1.GitFileGeneratorItem{{Path: "cluster-config/**/config.json"}, {Path: "cluster-config/*/dev/config.json", Exclude: true}},
-			includePattern: []string{"cluster-config/**/config.json"},
-			excludePattern: []string{"cluster-config/*/dev/config.json"},
-			includeFiles: map[string][]byte{
-				"cluster-config/engineering/prod/config.json": []byte(`
-cluster:
-  owner: john.doe@example.com
-  name: production
-  address: https://kubernetes.default.svc
-`),
-				"cluster-config/engineering/dev/config.json": []byte(`
-cluster:
-  owner: foo.bar@example.com
-  name: staging
-  address: https://kubernetes.default.svc
-`),
-			},
-			excludeFiles: map[string][]byte{
-				"cluster-config/engineering/dev/config.json": []byte(`
-cluster:
-  owner: foo.bar@example.com
-  name: staging
-  address: https://kubernetes.default.svc
-`),
-			},
-			repoPathsError: nil,
-			expected: []map[string]any{
-				{
-					"cluster.owner":           "john.doe@example.com",
-					"cluster.name":            "production",
-					"cluster.address":         "https://kubernetes.default.svc",
-					"path":                    "cluster-config/engineering/prod",
-					"path.basename":           "prod",
-					"path[0]":                 "cluster-config",
-					"path[1]":                 "engineering",
-					"path[2]":                 "prod",
-					"path.basenameNormalized": "prod",
-					"path.filename":           "config.json",
-					"path.filenameNormalized": "config.json",
-				},
-			},
-		},
-		{
-			name:           "testcase to verify new globbing pattern without any exclude",
-			files:          []v1alpha1.GitFileGeneratorItem{{Path: "some-path/*.yaml"}},
-			includePattern: []string{"some-path/*.yaml"},
-			excludePattern: nil,
-			includeFiles: map[string][]byte{
-				"some-path/values.yaml": []byte(`
-cluster:
-  owner: john.doe@example.com
-  name: production
-  address: https://kubernetes.default.svc
-`),
-				"some-path/staging/values.yaml": []byte(`
-cluster:
-  owner: foo.bar@example.com
-  name: staging
-  address: https://kubernetes.default.svc
-`),
-			},
-			excludeFiles:   map[string][]byte{},
-			repoPathsError: nil,
-			expected: []map[string]any{
-				{
-					"cluster.owner":           "john.doe@example.com",
-					"cluster.name":            "production",
-					"cluster.address":         "https://kubernetes.default.svc",
-					"path":                    "some-path",
-					"path.basename":           "some-path",
-					"path[0]":                 "some-path",
-					"path.basenameNormalized": "some-path",
-					"path.filename":           "values.yaml",
-					"path.filenameNormalized": "values.yaml",
-				},
-				{
-					"cluster.owner":           "foo.bar@example.com",
-					"cluster.name":            "staging",
-					"cluster.address":         "https://kubernetes.default.svc",
-					"path":                    "some-path/staging",
-					"path.basename":           "staging",
-					"path[0]":                 "some-path",
-					"path[1]":                 "staging",
-					"path.basenameNormalized": "staging",
-					"path.filename":           "values.yaml",
-					"path.filenameNormalized": "values.yaml",
-				},
-			},
-			expectedError: nil,
-		},
-		{
-			name:           "test to verify the solution for Git File Generator Problem",
-			files:          []v1alpha1.GitFileGeneratorItem{{Path: "cluster-charts/*/*/values.yaml"}, {Path: "cluster-charts/*/values.yaml", Exclude: true}},
-			includePattern: []string{"cluster-charts/*/*/values.yaml"},
-			excludePattern: []string{"cluster-charts/*/values.yaml"},
-			includeFiles: map[string][]byte{
-				"cluster-charts/cluster1/mychart/values.yaml": []byte(`
-env: staging
-`),
-				"cluster-charts/cluster1/myotherchart/values.yaml": []byte(`
-env: prod
-`),
-				"cluster-charts/cluster1/mychart/charts/mysubchart/values.yaml": []byte(``),
-			},
-			excludeFiles: map[string][]byte{
-				"cluster-charts/cluster2/values.yaml": []byte(`
-env: dev
-`),
-				"cluster-charts/cluster1/mychart/values.yaml": []byte(`
-env: staging
-`),
-				"cluster-charts/cluster1/myotherchart/values.yaml": []byte(`
-env: prod
-`),
-				"cluster-charts/cluster1/mychart/charts/mysubchart/values.yaml": []byte(``),
-			},
-			noMatchFiles: map[string][]byte{
-				"cluster-charts/cluster1/mychart/charts/mysubchart/values.yaml": []byte(`
-env: testing
-`),
-			},
-			repoPathsError: nil,
-			expected:       []map[string]any{},
-			expectedError:  nil,
-		},
-	}
-	for _, testCase := range cases {
-		testCaseCopy := testCase
-
-		t.Run(testCaseCopy.name, func(t *testing.T) {
-			t.Parallel()
-
-			argoCDServiceMock := mocks.Repos{}
-
-			// IMPORTANT: we try to get the files from the repo server that matches the patterns
-			// If we find those files also satisfy the exclude pattern, we remove them from map
-			// This is generally done by the g.repos.GetFiles() function.
-			// With the below mock setup, we make sure that if the GetFiles() function gets called
-			// for a include or exclude pattern, it should always return the includeFiles or excludeFiles.
-			for _, pattern := range testCaseCopy.excludePattern {
-				argoCDServiceMock.
-					On("GetFiles", mock.Anything, mock.Anything, mock.Anything, mock.Anything, pattern, mock.Anything, mock.Anything).
-					Return(testCaseCopy.excludeFiles, testCaseCopy.repoPathsError)
-			}
-
-			for _, pattern := range testCaseCopy.includePattern {
-				argoCDServiceMock.
-					On("GetFiles", mock.Anything, mock.Anything, mock.Anything, mock.Anything, pattern, mock.Anything, mock.Anything).
-					Return(testCaseCopy.includeFiles, testCaseCopy.repoPathsError)
-			}
-
-			gitGenerator := NewGitGenerator(&argoCDServiceMock, "")
-			applicationSetInfo := v1alpha1.ApplicationSet{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "set",
-				},
-				Spec: v1alpha1.ApplicationSetSpec{
-					Generators: []v1alpha1.ApplicationSetGenerator{{
-						Git: &v1alpha1.GitGenerator{
-							RepoURL:  "RepoURL",
-							Revision: "Revision",
-							Files:    testCaseCopy.files,
-							Values:   testCaseCopy.values,
-						},
-					}},
-				},
-			}
-
-			scheme := runtime.NewScheme()
-			err := v1alpha1.AddToScheme(scheme)
-			require.NoError(t, err)
-			appProject := v1alpha1.AppProject{}
-
-			client := fake.NewClientBuilder().WithScheme(scheme).WithObjects(&appProject).Build()
-
-			got, err := gitGenerator.GenerateParams(&applicationSetInfo.Spec.Generators[0], &applicationSetInfo, client)
-
-			if testCaseCopy.expectedError != nil {
-				require.EqualError(t, err, testCaseCopy.expectedError.Error())
-			} else {
-				require.NoError(t, err)
-				assert.ElementsMatch(t, testCaseCopy.expected, got)
-			}
-
-			argoCDServiceMock.AssertExpectations(t)
-		})
-	}
-}
-
-// TestGitGeneratorParamsFromFilesWithExcludeOption tests the params values generated by git file generator
-// when exclude option is set to true. It gives the result files based on new globbing pattern - doublestar package
-func TestGitGeneratorParamsFromFilesWithExcludeOptionGoTemplate(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		name string
-		// files is the list of paths/globs to match
-		files []v1alpha1.GitFileGeneratorItem
-		// includePattern contains a list of file patterns that needs to be included
-		includePattern []string
-		// excludePattern contains a list of file patterns that needs to be excluded
-		excludePattern []string
-		// includeFiles is a map with key as absolute path to file and value as the content in bytes that satisfies the includePattern
-		includeFiles map[string][]byte
-		// excludeFiles is a map with key as absolute path to file and value as the content in bytes that satisfies the excludePattern
-		// This means all the files should be excluded
-		excludeFiles map[string][]byte
-		// if repoPathsError is non-nil, the call to GetPaths(...) will return this error value
-		repoPathsError error
-		values         map[string]string
-		expected       []map[string]any
-		expectedError  error
-	}{
-		{
-			name: "filter files according to file-path with exclude",
-			files: []v1alpha1.GitFileGeneratorItem{
-				{
-					Path: "**/config.json",
-				},
-				{
-					Path:    "p1/**/config.json",
-					Exclude: true,
-				},
-			},
-			includePattern: []string{"**/config.json"},
-			excludePattern: []string{"p1/**/config.json"},
-			includeFiles: map[string][]byte{
-				"cluster-config/production/config.json": []byte(`{
-				   "cluster": {
-				       "owner": "john.doe@example.com",
-				       "name": "production",
-				       "address": "https://kubernetes.default.svc"
-				   },
-				   "key1": "val1",
-				   "key2": {
-				       "key2_1": "val2_1",
-				       "key2_2": {
-				           "key2_2_1": "val2_2_1"
-				       }
-				   },
-				   "key3": 123
-}
-`),
-			},
-			excludeFiles: map[string][]byte{
-				"p1/p2/config.json": []byte(`{
-				  "service": {
-				    "maintainer": "dev.team@example.com",
-				    "serviceName": "auth-service",
-				    "endpoint": "http://auth.internal.svc",
-				    "config": {
-				      "retries": 5,
-				      "timeout": "30s"
-				    }
-				  }
-				}
-`),
-			},
-			repoPathsError: nil,
-			expected: []map[string]any{
-				{
-					"cluster": map[string]any{
-						"owner":   "john.doe@example.com",
-						"name":    "production",
-						"address": "https://kubernetes.default.svc",
-					},
-					"key1": "val1",
-					"key2": map[string]any{
-						"key2_1": "val2_1",
-						"key2_2": map[string]any{
-							"key2_2_1": "val2_2_1",
-						},
-					},
-					"key3": float64(123),
-					"path": map[string]any{
-						"path":               "cluster-config/production",
-						"basename":           "production",
-						"filename":           "config.json",
-						"basenameNormalized": "production",
-						"filenameNormalized": "config.json",
-						"segments": []string{
-							"cluster-config",
-							"production",
-						},
-					},
-				},
-			},
-			expectedError: nil,
-		},
-		{
-			name: "filter files according to multiple file-paths with exclude",
-			files: []v1alpha1.GitFileGeneratorItem{
-				{Path: "**/config.json"},
-				{Path: "p1/app2/config.json", Exclude: true},
-				{Path: "p1/app3/config.json", Exclude: true},
-			},
-			includePattern: []string{"**/config.json"},
-			excludePattern: []string{"p1/app2/config.json", "p1/app3/config.json"},
-			includeFiles: map[string][]byte{
-				"p1/config.json": []byte(`{
-					"cluster": {
-					"owner": "john.doe@example.com",
-					"name": "production",
-					"address": "https://kubernetes.default.svc",
-					"inner": {
-						"one" : "two"
-					}
-				}
-}`),
-			},
-			excludeFiles: map[string][]byte{
-				"p1/app2/config.json": []byte(`{
-                    "database": {
-                        "admin": "alice.smith@example.com",
-					    "env": "staging",
-					    "url": "postgres://db.internal.svc:5432",
-					    "settings": {
-					      "replicas": 3,
-					      "backup": "enabled"
-					    }
-                    }
-				}
-`),
-				"p1/app3/config.json": []byte(`{
-					"storage": {
-					    "owner": "charlie.brown@example.com",
-					    "bucketName": "app-assets",
-					    "region": "us-west-2",
-					    "options": {
-					      "versioning": true,
-					      "encryption": "AES256"
-					    }
-					}
-				}
-`),
-			},
-			repoPathsError: nil,
-			expected: []map[string]any{
-				{
-					"cluster": map[string]any{
-						"owner":   "john.doe@example.com",
-						"name":    "production",
-						"address": "https://kubernetes.default.svc",
-						"inner": map[string]any{
-							"one": "two",
-						},
-					},
-					"path": map[string]any{
-						"path":               "p1",
-						"basename":           "p1",
-						"filename":           "config.json",
-						"basenameNormalized": "p1",
-						"filenameNormalized": "config.json",
-						"segments": []string{
-							"p1",
-						},
-					},
-				},
-			},
-			expectedError: nil,
-		},
-	}
-	for _, testCase := range cases {
-		testCaseCopy := testCase
-
-		t.Run(testCaseCopy.name, func(t *testing.T) {
-			t.Parallel()
-
-			argoCDServiceMock := mocks.Repos{}
-			// IMPORTANT: we try to get the files from the repo server that matches the patterns
-			// If we find those files also satisfy the exclude pattern, we remove them from map
-			// This is generally done by the g.repos.GetFiles() function.
-			// With the below mock setup, we make sure that if the GetFiles() function gets called
-			// for a include or exclude pattern, it should always return the includeFiles or excludeFiles.
-			for _, pattern := range testCaseCopy.excludePattern {
-				argoCDServiceMock.
-					On("GetFiles", mock.Anything, mock.Anything, mock.Anything, mock.Anything, pattern, mock.Anything, mock.Anything).
-					Return(testCaseCopy.excludeFiles, testCaseCopy.repoPathsError)
-			}
-
-			for _, pattern := range testCaseCopy.includePattern {
-				argoCDServiceMock.
-					On("GetFiles", mock.Anything, mock.Anything, mock.Anything, mock.Anything, pattern, mock.Anything, mock.Anything).
-					Return(testCaseCopy.includeFiles, testCaseCopy.repoPathsError)
-			}
-
-			gitGenerator := NewGitGenerator(&argoCDServiceMock, "")
-			applicationSetInfo := v1alpha1.ApplicationSet{
-				ObjectMeta: metav1.ObjectMeta{
-					Name: "set",
-				},
-				Spec: v1alpha1.ApplicationSetSpec{
-					GoTemplate: true,
-					Generators: []v1alpha1.ApplicationSetGenerator{{
-						Git: &v1alpha1.GitGenerator{
-							RepoURL:  "RepoURL",
-							Revision: "Revision",
-							Files:    testCaseCopy.files,
-						},
-					}},
-				},
-			}
-
-			scheme := runtime.NewScheme()
-			err := v1alpha1.AddToScheme(scheme)
-			require.NoError(t, err)
-			appProject := v1alpha1.AppProject{}
-
-			client := fake.NewClientBuilder().WithScheme(scheme).WithObjects(&appProject).Build()
-
-			got, err := gitGenerator.GenerateParams(&applicationSetInfo.Spec.Generators[0], &applicationSetInfo, client)
+			fmt.Println(got, err)

 			if testCaseCopy.expectedError != nil {
 				require.EqualError(t, err, testCaseCopy.expectedError.Error())
@@ -1955,8 +1029,6 @@ func TestGitGeneratorParamsFromFilesWithExcludeOptionGoTemplate(t *testing.T) {
 }

 func TestGitGenerateParamsFromFilesGoTemplate(t *testing.T) {
-	t.Parallel()
-
 	cases := []struct {
 		name string
 		// files is the list of paths/globs to match
@@ -2298,6 +1370,7 @@ cluster:
 			client := fake.NewClientBuilder().WithScheme(scheme).WithObjects(&appProject).Build()

 			got, err := gitGenerator.GenerateParams(&applicationSetInfo.Spec.Generators[0], &applicationSetInfo, client)
+			fmt.Println(got, err)

 			if testCaseCopy.expectedError != nil {
 				require.EqualError(t, err, testCaseCopy.expectedError.Error())
--- a/applicationset/generators/interface.go
+++ b/applicationset/generators/interface.go
@@ -27,15 +27,15 @@ type Generator interface {
 }

 var (
-	ErrEmptyAppSetGenerator = errors.New("ApplicationSet is empty")
-	NoRequeueAfter          time.Duration
+	EmptyAppSetGeneratorError = errors.New("ApplicationSet is empty")
+	NoRequeueAfter            time.Duration
 )

 const (
-	DefaultRequeueAfter = 3 * time.Minute
+	DefaultRequeueAfterSeconds = 3 * time.Minute
 )

 func getDefaultRequeueAfter() time.Duration {
 	// Default is 3 minutes, min is 1 second, max is 1 year
-	return env.ParseDurationFromEnv("ARGOCD_APPLICATIONSET_CONTROLLER_REQUEUE_AFTER", DefaultRequeueAfter, 1*time.Second, 8760*time.Hour)
+	return env.ParseDurationFromEnv("ARGOCD_APPLICATIONSET_CONTROLLER_REQUEUE_AFTER", DefaultRequeueAfterSeconds, 1*time.Second, 8760*time.Hour)
 }
--- a/applicationset/generators/interface_test.go
+++ b/applicationset/generators/interface_test.go
@@ -13,12 +13,12 @@ func Test_getDefaultRequeueAfter(t *testing.T) {
 		requeueAfterEnv string
 		want            time.Duration
 	}{
-		{name: "Default", requeueAfterEnv: "", want: DefaultRequeueAfter},
+		{name: "Default", requeueAfterEnv: "", want: DefaultRequeueAfterSeconds},
 		{name: "Min", requeueAfterEnv: "1s", want: 1 * time.Second},
 		{name: "Max", requeueAfterEnv: "8760h", want: 8760 * time.Hour},
 		{name: "Override", requeueAfterEnv: "10m", want: 10 * time.Minute},
-		{name: "LessThanMin", requeueAfterEnv: "1ms", want: DefaultRequeueAfter},
-		{name: "MoreThanMax", requeueAfterEnv: "8761h", want: DefaultRequeueAfter},
+		{name: "LessThanMin", requeueAfterEnv: "1ms", want: DefaultRequeueAfterSeconds},
+		{name: "MoreThanMax", requeueAfterEnv: "8761h", want: DefaultRequeueAfterSeconds},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
--- a/applicationset/generators/list.go
+++ b/applicationset/generators/list.go
@@ -31,11 +31,11 @@ func (g *ListGenerator) GetTemplate(appSetGenerator *argoprojiov1alpha1.Applicat

 func (g *ListGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, appSet *argoprojiov1alpha1.ApplicationSet, _ client.Client) ([]map[string]any, error) {
 	if appSetGenerator == nil {
-		return nil, ErrEmptyAppSetGenerator
+		return nil, EmptyAppSetGeneratorError
 	}

 	if appSetGenerator.List == nil {
-		return nil, ErrEmptyAppSetGenerator
+		return nil, EmptyAppSetGeneratorError
 	}

 	res := make([]map[string]any, len(appSetGenerator.List.Elements))
@@ -77,7 +77,7 @@ func (g *ListGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.Appli
 	}

 	// Append elements from ElementsYaml to the response
-	if appSetGenerator.List.ElementsYaml != "" {
+	if len(appSetGenerator.List.ElementsYaml) > 0 {
 		var yamlElements []map[string]any
 		err := yaml.Unmarshal([]byte(appSetGenerator.List.ElementsYaml), &yamlElements)
 		if err != nil {
--- a/applicationset/generators/matrix.go
+++ b/applicationset/generators/matrix.go
@@ -34,7 +34,7 @@ func NewMatrixGenerator(supportedGenerators map[string]Generator) Generator {

 func (m *MatrixGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, appSet *argoprojiov1alpha1.ApplicationSet, client client.Client) ([]map[string]any, error) {
 	if appSetGenerator.Matrix == nil {
-		return nil, ErrEmptyAppSetGenerator
+		return nil, EmptyAppSetGeneratorError
 	}

 	if len(appSetGenerator.Matrix.Generators) < 2 {
@@ -71,7 +71,7 @@ func (m *MatrixGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.App
 				if err != nil {
 					return nil, fmt.Errorf("failed to combine string maps with merging params for the matrix generator: %w", err)
 				}
-				res = append(res, val)
+				res = append(res, utils.ConvertToMapStringInterface(val))
 			}
 		}
 	}
--- a/applicationset/generators/merge.go
+++ b/applicationset/generators/merge.go
@@ -4,12 +4,12 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"maps"
 	"time"

 	"dario.cat/mergo"
 	"sigs.k8s.io/controller-runtime/pkg/client"

+	"github.com/argoproj/argo-cd/v3/applicationset/utils"
 	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v3/pkg/apis/application/v1alpha1"
 )

@@ -52,7 +52,7 @@ func (m *MergeGenerator) getParamSetsForAllGenerators(generators []argoprojiov1a
 // GenerateParams gets the params produced by the MergeGenerator.
 func (m *MergeGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, appSet *argoprojiov1alpha1.ApplicationSet, client client.Client) ([]map[string]any, error) {
 	if appSetGenerator.Merge == nil {
-		return nil, ErrEmptyAppSetGenerator
+		return nil, EmptyAppSetGeneratorError
 	}

 	if len(appSetGenerator.Merge.Generators) < 2 {
@@ -83,8 +83,11 @@ func (m *MergeGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.Appl
 					}
 					baseParamSetsByMergeKey[mergeKeyValue] = baseParamSet
 				} else {
-					maps.Copy(baseParamSet, overrideParamSet)
-					baseParamSetsByMergeKey[mergeKeyValue] = baseParamSet
+					overriddenParamSet, err := utils.CombineStringMapsAllowDuplicates(baseParamSet, overrideParamSet)
+					if err != nil {
+						return nil, fmt.Errorf("error combining string maps: %w", err)
+					}
+					baseParamSetsByMergeKey[mergeKeyValue] = utils.ConvertToMapStringInterface(overriddenParamSet)
 				}
 			}
 		}
--- a/applicationset/generators/merge_test.go
+++ b/applicationset/generators/merge_test.go
@@ -50,8 +50,6 @@ func listOfMapsToSet(maps []map[string]any) (map[string]bool, error) {
 }

 func TestMergeGenerate(t *testing.T) {
-	t.Parallel()
-
 	testCases := []struct {
 		name           string
 		baseGenerators []argoprojiov1alpha1.ApplicationSetNestedGenerator
@@ -212,8 +210,6 @@ func toAPIExtensionsJSON(t *testing.T, g any) *apiextensionsv1.JSON {
 }

 func TestParamSetsAreUniqueByMergeKeys(t *testing.T) {
-	t.Parallel()
-
 	testCases := []struct {
 		name        string
 		mergeKeys   []string
--- a/applicationset/generators/mocks/Generator.go
+++ b/applicationset/generators/mocks/Generator.go
@@ -1,17 +1,90 @@
-// Code generated by mockery; DO NOT EDIT.
-// github.com/vektra/mockery
-// template: testify
+// Code generated by mockery v2.52.4. DO NOT EDIT.

 package mocks

 import (
-	"time"
+	client "sigs.k8s.io/controller-runtime/pkg/client"

-	"github.com/argoproj/argo-cd/v3/pkg/apis/application/v1alpha1"
 	mock "github.com/stretchr/testify/mock"
-	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	time "time"
+
+	v1alpha1 "github.com/argoproj/argo-cd/v3/pkg/apis/application/v1alpha1"
 )

+// Generator is an autogenerated mock type for the Generator type
+type Generator struct {
+	mock.Mock
+}
+
+// GenerateParams provides a mock function with given fields: appSetGenerator, applicationSetInfo, _a2
+func (_m *Generator) GenerateParams(appSetGenerator *v1alpha1.ApplicationSetGenerator, applicationSetInfo *v1alpha1.ApplicationSet, _a2 client.Client) ([]map[string]interface{}, error) {
+	ret := _m.Called(appSetGenerator, applicationSetInfo, _a2)
+
+	if len(ret) == 0 {
+		panic("no return value specified for GenerateParams")
+	}
+
+	var r0 []map[string]interface{}
+	var r1 error
+	if rf, ok := ret.Get(0).(func(*v1alpha1.ApplicationSetGenerator, *v1alpha1.ApplicationSet, client.Client) ([]map[string]interface{}, error)); ok {
+		return rf(appSetGenerator, applicationSetInfo, _a2)
+	}
+	if rf, ok := ret.Get(0).(func(*v1alpha1.ApplicationSetGenerator, *v1alpha1.ApplicationSet, client.Client) []map[string]interface{}); ok {
+		r0 = rf(appSetGenerator, applicationSetInfo, _a2)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]map[string]interface{})
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(*v1alpha1.ApplicationSetGenerator, *v1alpha1.ApplicationSet, client.Client) error); ok {
+		r1 = rf(appSetGenerator, applicationSetInfo, _a2)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetRequeueAfter provides a mock function with given fields: appSetGenerator
+func (_m *Generator) GetRequeueAfter(appSetGenerator *v1alpha1.ApplicationSetGenerator) time.Duration {
+	ret := _m.Called(appSetGenerator)
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetRequeueAfter")
+	}
+
+	var r0 time.Duration
+	if rf, ok := ret.Get(0).(func(*v1alpha1.ApplicationSetGenerator) time.Duration); ok {
+		r0 = rf(appSetGenerator)
+	} else {
+		r0 = ret.Get(0).(time.Duration)
+	}
+
+	return r0
+}
+
+// GetTemplate provides a mock function with given fields: appSetGenerator
+func (_m *Generator) GetTemplate(appSetGenerator *v1alpha1.ApplicationSetGenerator) *v1alpha1.ApplicationSetTemplate {
+	ret := _m.Called(appSetGenerator)
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetTemplate")
+	}
+
+	var r0 *v1alpha1.ApplicationSetTemplate
+	if rf, ok := ret.Get(0).(func(*v1alpha1.ApplicationSetGenerator) *v1alpha1.ApplicationSetTemplate); ok {
+		r0 = rf(appSetGenerator)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*v1alpha1.ApplicationSetTemplate)
+		}
+	}
+
+	return r0
+}
+
 // NewGenerator creates a new instance of Generator. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
 // The first argument is typically a *testing.T value.
 func NewGenerator(t interface {
@@ -25,194 +98,3 @@ func NewGenerator(t interface {

 	return mock
 }
-
-// Generator is an autogenerated mock type for the Generator type
-type Generator struct {
-	mock.Mock
-}
-
-type Generator_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *Generator) EXPECT() *Generator_Expecter {
-	return &Generator_Expecter{mock: &_m.Mock}
-}
-
-// GenerateParams provides a mock function for the type Generator
-func (_mock *Generator) GenerateParams(appSetGenerator *v1alpha1.ApplicationSetGenerator, applicationSetInfo *v1alpha1.ApplicationSet, client1 client.Client) ([]map[string]any, error) {
-	ret := _mock.Called(appSetGenerator, applicationSetInfo, client1)
-
-	if len(ret) == 0 {
-		panic("no return value specified for GenerateParams")
-	}
-
-	var r0 []map[string]any
-	var r1 error
-	if returnFunc, ok := ret.Get(0).(func(*v1alpha1.ApplicationSetGenerator, *v1alpha1.ApplicationSet, client.Client) ([]map[string]any, error)); ok {
-		return returnFunc(appSetGenerator, applicationSetInfo, client1)
-	}
-	if returnFunc, ok := ret.Get(0).(func(*v1alpha1.ApplicationSetGenerator, *v1alpha1.ApplicationSet, client.Client) []map[string]any); ok {
-		r0 = returnFunc(appSetGenerator, applicationSetInfo, client1)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).([]map[string]any)
-		}
-	}
-	if returnFunc, ok := ret.Get(1).(func(*v1alpha1.ApplicationSetGenerator, *v1alpha1.ApplicationSet, client.Client) error); ok {
-		r1 = returnFunc(appSetGenerator, applicationSetInfo, client1)
-	} else {
-		r1 = ret.Error(1)
-	}
-	return r0, r1
-}
-
-// Generator_GenerateParams_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GenerateParams'
-type Generator_GenerateParams_Call struct {
-	*mock.Call
-}
-
-// GenerateParams is a helper method to define mock.On call
-//   - appSetGenerator *v1alpha1.ApplicationSetGenerator
-//   - applicationSetInfo *v1alpha1.ApplicationSet
-//   - client1 client.Client
-func (_e *Generator_Expecter) GenerateParams(appSetGenerator interface{}, applicationSetInfo interface{}, client1 interface{}) *Generator_GenerateParams_Call {
-	return &Generator_GenerateParams_Call{Call: _e.mock.On("GenerateParams", appSetGenerator, applicationSetInfo, client1)}
-}
-
-func (_c *Generator_GenerateParams_Call) Run(run func(appSetGenerator *v1alpha1.ApplicationSetGenerator, applicationSetInfo *v1alpha1.ApplicationSet, client1 client.Client)) *Generator_GenerateParams_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 *v1alpha1.ApplicationSetGenerator
-		if args[0] != nil {
-			arg0 = args[0].(*v1alpha1.ApplicationSetGenerator)
-		}
-		var arg1 *v1alpha1.ApplicationSet
-		if args[1] != nil {
-			arg1 = args[1].(*v1alpha1.ApplicationSet)
-		}
-		var arg2 client.Client
-		if args[2] != nil {
-			arg2 = args[2].(client.Client)
-		}
-		run(
-			arg0,
-			arg1,
-			arg2,
-		)
-	})
-	return _c
-}
-
-func (_c *Generator_GenerateParams_Call) Return(stringToVs []map[string]any, err error) *Generator_GenerateParams_Call {
-	_c.Call.Return(stringToVs, err)
-	return _c
-}
-
-func (_c *Generator_GenerateParams_Call) RunAndReturn(run func(appSetGenerator *v1alpha1.ApplicationSetGenerator, applicationSetInfo *v1alpha1.ApplicationSet, client1 client.Client) ([]map[string]any, error)) *Generator_GenerateParams_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// GetRequeueAfter provides a mock function for the type Generator
-func (_mock *Generator) GetRequeueAfter(appSetGenerator *v1alpha1.ApplicationSetGenerator) time.Duration {
-	ret := _mock.Called(appSetGenerator)
-
-	if len(ret) == 0 {
-		panic("no return value specified for GetRequeueAfter")
-	}
-
-	var r0 time.Duration
-	if returnFunc, ok := ret.Get(0).(func(*v1alpha1.ApplicationSetGenerator) time.Duration); ok {
-		r0 = returnFunc(appSetGenerator)
-	} else {
-		r0 = ret.Get(0).(time.Duration)
-	}
-	return r0
-}
-
-// Generator_GetRequeueAfter_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetRequeueAfter'
-type Generator_GetRequeueAfter_Call struct {
-	*mock.Call
-}
-
-// GetRequeueAfter is a helper method to define mock.On call
-//   - appSetGenerator *v1alpha1.ApplicationSetGenerator
-func (_e *Generator_Expecter) GetRequeueAfter(appSetGenerator interface{}) *Generator_GetRequeueAfter_Call {
-	return &Generator_GetRequeueAfter_Call{Call: _e.mock.On("GetRequeueAfter", appSetGenerator)}
-}
-
-func (_c *Generator_GetRequeueAfter_Call) Run(run func(appSetGenerator *v1alpha1.ApplicationSetGenerator)) *Generator_GetRequeueAfter_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 *v1alpha1.ApplicationSetGenerator
-		if args[0] != nil {
-			arg0 = args[0].(*v1alpha1.ApplicationSetGenerator)
-		}
-		run(
-			arg0,
-		)
-	})
-	return _c
-}
-
-func (_c *Generator_GetRequeueAfter_Call) Return(duration time.Duration) *Generator_GetRequeueAfter_Call {
-	_c.Call.Return(duration)
-	return _c
-}
-
-func (_c *Generator_GetRequeueAfter_Call) RunAndReturn(run func(appSetGenerator *v1alpha1.ApplicationSetGenerator) time.Duration) *Generator_GetRequeueAfter_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// GetTemplate provides a mock function for the type Generator
-func (_mock *Generator) GetTemplate(appSetGenerator *v1alpha1.ApplicationSetGenerator) *v1alpha1.ApplicationSetTemplate {
-	ret := _mock.Called(appSetGenerator)
-
-	if len(ret) == 0 {
-		panic("no return value specified for GetTemplate")
-	}
-
-	var r0 *v1alpha1.ApplicationSetTemplate
-	if returnFunc, ok := ret.Get(0).(func(*v1alpha1.ApplicationSetGenerator) *v1alpha1.ApplicationSetTemplate); ok {
-		r0 = returnFunc(appSetGenerator)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*v1alpha1.ApplicationSetTemplate)
-		}
-	}
-	return r0
-}
-
-// Generator_GetTemplate_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetTemplate'
-type Generator_GetTemplate_Call struct {
-	*mock.Call
-}
-
-// GetTemplate is a helper method to define mock.On call
-//   - appSetGenerator *v1alpha1.ApplicationSetGenerator
-func (_e *Generator_Expecter) GetTemplate(appSetGenerator interface{}) *Generator_GetTemplate_Call {
-	return &Generator_GetTemplate_Call{Call: _e.mock.On("GetTemplate", appSetGenerator)}
-}
-
-func (_c *Generator_GetTemplate_Call) Run(run func(appSetGenerator *v1alpha1.ApplicationSetGenerator)) *Generator_GetTemplate_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 *v1alpha1.ApplicationSetGenerator
-		if args[0] != nil {
-			arg0 = args[0].(*v1alpha1.ApplicationSetGenerator)
-		}
-		run(
-			arg0,
-		)
-	})
-	return _c
-}
-
-func (_c *Generator_GetTemplate_Call) Return(applicationSetTemplate *v1alpha1.ApplicationSetTemplate) *Generator_GetTemplate_Call {
-	_c.Call.Return(applicationSetTemplate)
-	return _c
-}
-
-func (_c *Generator_GetTemplate_Call) RunAndReturn(run func(appSetGenerator *v1alpha1.ApplicationSetGenerator) *v1alpha1.ApplicationSetTemplate) *Generator_GetTemplate_Call {
-	_c.Call.Return(run)
-	return _c
-}
--- a/applicationset/generators/plugin.go
+++ b/applicationset/generators/plugin.go
@@ -10,6 +10,7 @@ import (

 	"github.com/jeremywohl/flatten"
 	corev1 "k8s.io/api/core/v1"
+	"k8s.io/client-go/kubernetes"
 	"sigs.k8s.io/controller-runtime/pkg/client"

 	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v3/pkg/apis/application/v1alpha1"
@@ -19,19 +20,23 @@ import (
 )

 const (
-	DefaultPluginRequeueAfter = 30 * time.Minute
+	DefaultPluginRequeueAfterSeconds = 30 * time.Minute
 )

 var _ Generator = (*PluginGenerator)(nil)

 type PluginGenerator struct {
 	client    client.Client
+	ctx       context.Context
+	clientset kubernetes.Interface
 	namespace string
 }

-func NewPluginGenerator(client client.Client, namespace string) Generator {
+func NewPluginGenerator(ctx context.Context, client client.Client, clientset kubernetes.Interface, namespace string) Generator {
 	g := &PluginGenerator{
 		client:    client,
+		ctx:       ctx,
+		clientset: clientset,
 		namespace: namespace,
 	}
 	return g
@@ -44,7 +49,7 @@ func (g *PluginGenerator) GetRequeueAfter(appSetGenerator *argoprojiov1alpha1.Ap
 		return time.Duration(*appSetGenerator.Plugin.RequeueAfterSeconds) * time.Second
 	}

-	return DefaultPluginRequeueAfter
+	return DefaultPluginRequeueAfterSeconds
 }

 func (g *PluginGenerator) GetTemplate(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator) *argoprojiov1alpha1.ApplicationSetTemplate {
@@ -53,11 +58,11 @@ func (g *PluginGenerator) GetTemplate(appSetGenerator *argoprojiov1alpha1.Applic

 func (g *PluginGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, applicationSetInfo *argoprojiov1alpha1.ApplicationSet, _ client.Client) ([]map[string]any, error) {
 	if appSetGenerator == nil {
-		return nil, ErrEmptyAppSetGenerator
+		return nil, EmptyAppSetGeneratorError
 	}

 	if appSetGenerator.Plugin == nil {
-		return nil, ErrEmptyAppSetGenerator
+		return nil, EmptyAppSetGeneratorError
 	}

 	ctx := context.Background()
--- a/applicationset/generators/plugin_test.go
+++ b/applicationset/generators/plugin_test.go
@@ -14,6 +14,8 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	kubefake "k8s.io/client-go/kubernetes/fake"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"

@@ -626,6 +628,8 @@ func TestPluginGenerateParams(t *testing.T) {
 		},
 	}

+	ctx := t.Context()
+
 	for _, testCase := range testCases {
 		t.Run(testCase.name, func(t *testing.T) {
 			generatorConfig := argoprojiov1alpha1.ApplicationSetGenerator{
@@ -662,9 +666,11 @@ func TestPluginGenerateParams(t *testing.T) {
 				testCase.configmap.Data["baseUrl"] = fakeServer.URL
 			}

+			fakeClient := kubefake.NewSimpleClientset(append([]runtime.Object{}, testCase.configmap, testCase.secret)...)
+
 			fakeClientWithCache := fake.NewClientBuilder().WithObjects([]client.Object{testCase.configmap, testCase.secret}...).Build()

-			pluginGenerator := NewPluginGenerator(fakeClientWithCache, "default")
+			pluginGenerator := NewPluginGenerator(ctx, fakeClientWithCache, fakeClient, "default")

 			applicationSetInfo := argoprojiov1alpha1.ApplicationSet{
 				ObjectMeta: metav1.ObjectMeta{
--- a/applicationset/generators/pull_request.go
+++ b/applicationset/generators/pull_request.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"net/http"
 	"strconv"
 	"time"

@@ -12,7 +11,6 @@ import (

 	"github.com/gosimple/slug"

-	"github.com/argoproj/argo-cd/v3/applicationset/services"
 	pullrequest "github.com/argoproj/argo-cd/v3/applicationset/services/pull_request"
 	"github.com/argoproj/argo-cd/v3/applicationset/utils"
 	argoprojiov1alpha1 "github.com/argoproj/argo-cd/v3/pkg/apis/application/v1alpha1"
@@ -21,7 +19,7 @@ import (
 var _ Generator = (*PullRequestGenerator)(nil)

 const (
-	DefaultPullRequestRequeueAfter = 30 * time.Minute
+	DefaultPullRequestRequeueAfterSeconds = 30 * time.Minute
 )

 type PullRequestGenerator struct {
@@ -46,7 +44,7 @@ func (g *PullRequestGenerator) GetRequeueAfter(appSetGenerator *argoprojiov1alph
 		return time.Duration(*appSetGenerator.PullRequest.RequeueAfterSeconds) * time.Second
 	}

-	return DefaultPullRequestRequeueAfter
+	return DefaultPullRequestRequeueAfterSeconds
 }

 func (g *PullRequestGenerator) GetTemplate(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator) *argoprojiov1alpha1.ApplicationSetTemplate {
@@ -55,11 +53,11 @@ func (g *PullRequestGenerator) GetTemplate(appSetGenerator *argoprojiov1alpha1.A

 func (g *PullRequestGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, applicationSetInfo *argoprojiov1alpha1.ApplicationSet, _ client.Client) ([]map[string]any, error) {
 	if appSetGenerator == nil {
-		return nil, ErrEmptyAppSetGenerator
+		return nil, EmptyAppSetGeneratorError
 	}

 	if appSetGenerator.PullRequest == nil {
-		return nil, ErrEmptyAppSetGenerator
+		return nil, EmptyAppSetGeneratorError
 	}

 	ctx := context.Background()
@@ -159,8 +157,7 @@ func (g *PullRequestGenerator) selectServiceProvider(ctx context.Context, genera
 		if err != nil {
 			return nil, fmt.Errorf("error fetching Secret token: %w", err)
 		}
-
-		return pullrequest.NewGiteaService(token, providerConfig.API, providerConfig.Owner, providerConfig.Repo, providerConfig.Labels, providerConfig.Insecure)
+		return pullrequest.NewGiteaService(token, providerConfig.API, providerConfig.Owner, providerConfig.Repo, providerConfig.Insecure)
 	}
 	if generatorConfig.BitbucketServer != nil {
 		providerConfig := generatorConfig.BitbucketServer
@@ -216,27 +213,12 @@ func (g *PullRequestGenerator) selectServiceProvider(ctx context.Context, genera
 }

 func (g *PullRequestGenerator) github(ctx context.Context, cfg *argoprojiov1alpha1.PullRequestGeneratorGithub, applicationSetInfo *argoprojiov1alpha1.ApplicationSet) (pullrequest.PullRequestService, error) {
-	var metricsCtx *services.MetricsContext
-	var httpClient *http.Client
-
-	if g.enableGitHubAPIMetrics {
-		metricsCtx = &services.MetricsContext{
-			AppSetNamespace: applicationSetInfo.Namespace,
-			AppSetName:      applicationSetInfo.Name,
-		}
-		httpClient = services.NewGitHubMetricsClient(metricsCtx)
-	}
-
 	// use an app if it was configured
 	if cfg.AppSecretName != "" {
 		auth, err := g.GitHubApps.GetAuthSecret(ctx, cfg.AppSecretName)
 		if err != nil {
 			return nil, fmt.Errorf("error getting GitHub App secret: %w", err)
 		}
-
-		if g.enableGitHubAPIMetrics {
-			return pullrequest.NewGithubAppService(*auth, cfg.API, cfg.Owner, cfg.Repo, cfg.Labels, httpClient)
-		}
 		return pullrequest.NewGithubAppService(*auth, cfg.API, cfg.Owner, cfg.Repo, cfg.Labels)
 	}

@@ -245,9 +227,5 @@ func (g *PullRequestGenerator) github(ctx context.Context, cfg *argoprojiov1alph
 	if err != nil {
 		return nil, fmt.Errorf("error fetching Secret token: %w", err)
 	}
-
-	if g.enableGitHubAPIMetrics {
-		return pullrequest.NewGithubService(token, cfg.API, cfg.Owner, cfg.Repo, cfg.Labels, httpClient)
-	}
 	return pullrequest.NewGithubService(token, cfg.API, cfg.Owner, cfg.Repo, cfg.Labels)
 }
--- a/applicationset/generators/pull_request_test.go
+++ b/applicationset/generators/pull_request_test.go
@@ -275,8 +275,6 @@ func TestPullRequestGithubGenerateParams(t *testing.T) {
 }

 func TestAllowedSCMProviderPullRequest(t *testing.T) {
-	t.Parallel()
-
 	cases := []struct {
 		name           string
 		providerConfig *argoprojiov1alpha1.PullRequestGenerator
@@ -327,7 +325,7 @@ func TestAllowedSCMProviderPullRequest(t *testing.T) {
 				"gitea.myorg.com",
 				"bitbucket.myorg.com",
 				"azuredevops.myorg.com",
-			}, true, true, nil, true))
+			}, true, nil, true))

 			applicationSetInfo := argoprojiov1alpha1.ApplicationSet{
 				ObjectMeta: metav1.ObjectMeta{
@@ -350,7 +348,7 @@ func TestAllowedSCMProviderPullRequest(t *testing.T) {
 }

 func TestSCMProviderDisabled_PRGenerator(t *testing.T) {
-	generator := NewPullRequestGenerator(nil, NewSCMConfig("", []string{}, false, true, nil, true))
+	generator := NewPullRequestGenerator(nil, NewSCMConfig("", []string{}, false, nil, true))

 	applicationSetInfo := argoprojiov1alpha1.ApplicationSet{
 		ObjectMeta: metav1.ObjectMeta{
--- a/applicationset/generators/scm_provider.go
+++ b/applicationset/generators/scm_provider.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"net/http"
 	"strings"
 	"time"

@@ -12,7 +11,6 @@ import (

 	log "github.com/sirupsen/logrus"

-	"github.com/argoproj/argo-cd/v3/applicationset/services"
 	"github.com/argoproj/argo-cd/v3/applicationset/services/github_app_auth"
 	"github.com/argoproj/argo-cd/v3/applicationset/services/scm_provider"
 	"github.com/argoproj/argo-cd/v3/applicationset/utils"
@@ -23,7 +21,7 @@ import (
 var _ Generator = (*SCMProviderGenerator)(nil)

 const (
-	DefaultSCMProviderRequeueAfter = 30 * time.Minute
+	DefaultSCMProviderRequeueAfterSeconds = 30 * time.Minute
 )

 type SCMProviderGenerator struct {
@@ -33,22 +31,20 @@ type SCMProviderGenerator struct {
 	SCMConfig
 }
 type SCMConfig struct {
-	scmRootCAPath          string
-	allowedSCMProviders    []string
-	enableSCMProviders     bool
-	enableGitHubAPIMetrics bool
-	GitHubApps             github_app_auth.Credentials
-	tokenRefStrictMode     bool
+	scmRootCAPath       string
+	allowedSCMProviders []string
+	enableSCMProviders  bool
+	GitHubApps          github_app_auth.Credentials
+	tokenRefStrictMode  bool
 }

-func NewSCMConfig(scmRootCAPath string, allowedSCMProviders []string, enableSCMProviders bool, enableGitHubAPIMetrics bool, gitHubApps github_app_auth.Credentials, tokenRefStrictMode bool) SCMConfig {
+func NewSCMConfig(scmRootCAPath string, allowedSCMProviders []string, enableSCMProviders bool, gitHubApps github_app_auth.Credentials, tokenRefStrictMode bool) SCMConfig {
 	return SCMConfig{
-		scmRootCAPath:          scmRootCAPath,
-		allowedSCMProviders:    allowedSCMProviders,
-		enableSCMProviders:     enableSCMProviders,
-		enableGitHubAPIMetrics: enableGitHubAPIMetrics,
-		GitHubApps:             gitHubApps,
-		tokenRefStrictMode:     tokenRefStrictMode,
+		scmRootCAPath:       scmRootCAPath,
+		allowedSCMProviders: allowedSCMProviders,
+		enableSCMProviders:  enableSCMProviders,
+		GitHubApps:          gitHubApps,
+		tokenRefStrictMode:  tokenRefStrictMode,
 	}
 }

@@ -73,7 +69,7 @@ func (g *SCMProviderGenerator) GetRequeueAfter(appSetGenerator *argoprojiov1alph
 		return time.Duration(*appSetGenerator.SCMProvider.RequeueAfterSeconds) * time.Second
 	}

-	return DefaultSCMProviderRequeueAfter
+	return DefaultSCMProviderRequeueAfterSeconds
 }

 func (g *SCMProviderGenerator) GetTemplate(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator) *argoprojiov1alpha1.ApplicationSetTemplate {
@@ -122,11 +118,11 @@ func ScmProviderAllowed(applicationSetInfo *argoprojiov1alpha1.ApplicationSet, g

 func (g *SCMProviderGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha1.ApplicationSetGenerator, applicationSetInfo *argoprojiov1alpha1.ApplicationSet, _ client.Client) ([]map[string]any, error) {
 	if appSetGenerator == nil {
-		return nil, ErrEmptyAppSetGenerator
+		return nil, EmptyAppSetGeneratorError
 	}

 	if appSetGenerator.SCMProvider == nil {
-		return nil, ErrEmptyAppSetGenerator
+		return nil, EmptyAppSetGeneratorError
 	}

 	if !g.enableSCMProviders {
@@ -257,7 +253,6 @@ func (g *SCMProviderGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha
 		params := map[string]any{
 			"organization":     repo.Organization,
 			"repository":       repo.Repository,
-			"repository_id":    repo.RepositoryId,
 			"url":              repo.URL,
 			"branch":           repo.Branch,
 			"sha":              repo.SHA,
@@ -278,36 +273,23 @@ func (g *SCMProviderGenerator) GenerateParams(appSetGenerator *argoprojiov1alpha
 }

 func (g *SCMProviderGenerator) githubProvider(ctx context.Context, github *argoprojiov1alpha1.SCMProviderGeneratorGithub, applicationSetInfo *argoprojiov1alpha1.ApplicationSet) (scm_provider.SCMProviderService, error) {
-	var metricsCtx *services.MetricsContext
-	var httpClient *http.Client
-
-	if g.enableGitHubAPIMetrics {
-		metricsCtx = &services.MetricsContext{
-			AppSetNamespace: applicationSetInfo.Namespace,
-			AppSetName:      applicationSetInfo.Name,
-		}
-		httpClient = services.NewGitHubMetricsClient(metricsCtx)
-	}
-
 	if github.AppSecretName != "" {
 		auth, err := g.GitHubApps.GetAuthSecret(ctx, github.AppSecretName)
 		if err != nil {
 			return nil, fmt.Errorf("error fetching Github app secret: %w", err)
 		}

-		if g.enableGitHubAPIMetrics {
-			return scm_provider.NewGithubAppProviderFor(*auth, github.Organization, github.API, github.AllBranches, httpClient)
-		}
-		return scm_provider.NewGithubAppProviderFor(*auth, github.Organization, github.API, github.AllBranches)
+		return scm_provider.NewGithubAppProviderFor(
+			*auth,
+			github.Organization,
+			github.API,
+			github.AllBranches,
+		)
 	}

 	token, err := utils.GetSecretRef(ctx, g.client, github.TokenRef, applicationSetInfo.Namespace, g.tokenRefStrictMode)
 	if err != nil {
 		return nil, fmt.Errorf("error fetching Github token: %w", err)
 	}
-
-	if g.enableGitHubAPIMetrics {
-		return scm_provider.NewGithubProvider(github.Organization, token, github.API, github.AllBranches, httpClient)
-	}
 	return scm_provider.NewGithubProvider(github.Organization, token, github.API, github.AllBranches)
 }
--- a/applicationset/generators/scm_provider_test.go
+++ b/applicationset/generators/scm_provider_test.go
@@ -12,8 +12,6 @@ import (
 )

 func TestSCMProviderGenerateParams(t *testing.T) {
-	t.Parallel()
-
 	cases := []struct {
 		name          string
 		repos         []*scm_provider.Repository
@@ -27,7 +25,6 @@ func TestSCMProviderGenerateParams(t *testing.T) {
 				{
 					Organization: "myorg",
 					Repository:   "repo1",
-					RepositoryId: 190320251,
 					URL:          "git@github.com:myorg/repo1.git",
 					Branch:       "main",
 					SHA:          "0bc57212c3cbbec69d20b34c507284bd300def5b",
@@ -36,7 +33,6 @@ func TestSCMProviderGenerateParams(t *testing.T) {
 				{
 					Organization: "myorg",
 					Repository:   "repo2",
-					RepositoryId: 190320252,
 					URL:          "git@github.com:myorg/repo2.git",
 					Branch:       "main",
 					SHA:          "59d0",
@@ -46,7 +42,6 @@ func TestSCMProviderGenerateParams(t *testing.T) {
 				{
 					"organization":     "myorg",
 					"repository":       "repo1",
-					"repository_id":    190320251,
 					"url":              "git@github.com:myorg/repo1.git",
 					"branch":           "main",
 					"branchNormalized": "main",
@@ -58,7 +53,6 @@ func TestSCMProviderGenerateParams(t *testing.T) {
 				{
 					"organization":     "myorg",
 					"repository":       "repo2",
-					"repository_id":    190320252,
 					"url":              "git@github.com:myorg/repo2.git",
 					"branch":           "main",
 					"branchNormalized": "main",
@@ -75,7 +69,6 @@ func TestSCMProviderGenerateParams(t *testing.T) {
 				{
 					Organization: "myorg",
 					Repository:   "repo3",
-					RepositoryId: 190320253,
 					URL:          "git@github.com:myorg/repo3.git",
 					Branch:       "main",
 					SHA:          "0bc57212c3cbbec69d20b34c507284bd300def5b",
@@ -90,7 +83,6 @@ func TestSCMProviderGenerateParams(t *testing.T) {
 				{
 					"organization":                  "myorg",
 					"repository":                    "repo3",
-					"repository_id":                 190320253,
 					"url":                           "git@github.com:myorg/repo3.git",
 					"branch":                        "main",
 					"branchNormalized":              "main",
@@ -103,52 +95,6 @@ func TestSCMProviderGenerateParams(t *testing.T) {
 				},
 			},
 		},
-		{
-			name: "Repos with and without id",
-			repos: []*scm_provider.Repository{
-				{
-					Organization: "myorg",
-					Repository:   "repo4",
-					RepositoryId: "idaz09",
-					URL:          "git@github.com:myorg/repo4.git",
-					Branch:       "main",
-					SHA:          "0bc57212c3cbbec69d20b34c507284bd300def5b",
-				},
-				{
-					Organization: "myorg",
-					Repository:   "repo5",
-					URL:          "git@github.com:myorg/repo5.git",
-					Branch:       "main",
-					SHA:          "0bc57212c3cbbec69d20b34c507284bd300def5b",
-				},
-			},
-			expected: []map[string]any{
-				{
-					"organization":     "myorg",
-					"repository":       "repo4",
-					"repository_id":    "idaz09",
-					"url":              "git@github.com:myorg/repo4.git",
-					"branch":           "main",
-					"branchNormalized": "main",
-					"sha":              "0bc57212c3cbbec69d20b34c507284bd300def5b",
-					"short_sha":        "0bc57212",
-					"short_sha_7":      "0bc5721",
-					"labels":           "",
-				},
-				{
-					"organization":     "myorg",
-					"repository":       "repo5",
-					"repository_id":    nil,
-					"url":              "git@github.com:myorg/repo5.git",
-					"branch":           "main",
-					"branchNormalized": "main",
-					"sha":              "0bc57212c3cbbec69d20b34c507284bd300def5b",
-					"short_sha":        "0bc57212",
-					"short_sha_7":      "0bc5721",
-					"labels":           "",
-				},
-			},
-		},
 	}

 	for _, testCase := range cases {
@@ -187,8 +133,6 @@ func TestSCMProviderGenerateParams(t *testing.T) {
 }

 func TestAllowedSCMProvider(t *testing.T) {
-	t.Parallel()
-
 	cases := []struct {
 		name           string
 		providerConfig *argoprojiov1alpha1.SCMProviderGenerator
--- a/applicationset/generators/utils.go
+++ b/applicationset/generators/utils.go
@@ -10,15 +10,15 @@ import (
 	"github.com/argoproj/argo-cd/v3/applicationset/services"
 )

-func GetGenerators(ctx context.Context, c client.Client, k8sClient kubernetes.Interface, namespace string, argoCDService services.Repos, dynamicClient dynamic.Interface, scmConfig SCMConfig) map[string]Generator {
+func GetGenerators(ctx context.Context, c client.Client, k8sClient kubernetes.Interface, controllerNamespace string, argoCDService services.Repos, dynamicClient dynamic.Interface, scmConfig SCMConfig) map[string]Generator {
 	terminalGenerators := map[string]Generator{
 		"List":                    NewListGenerator(),
-		"Clusters":                NewClusterGenerator(ctx, c, k8sClient, namespace),
-		"Git":                     NewGitGenerator(argoCDService, namespace),
+		"Clusters":                NewClusterGenerator(ctx, c, k8sClient, controllerNamespace),
+		"Git":                     NewGitGenerator(argoCDService, controllerNamespace),
 		"SCMProvider":             NewSCMProviderGenerator(c, scmConfig),
-		"ClusterDecisionResource": NewDuckTypeGenerator(ctx, dynamicClient, k8sClient, namespace),
+		"ClusterDecisionResource": NewDuckTypeGenerator(ctx, dynamicClient, k8sClient, controllerNamespace),
 		"PullRequest":             NewPullRequestGenerator(c, scmConfig),
-		"Plugin":                  NewPluginGenerator(c, namespace),
+		"Plugin":                  NewPluginGenerator(ctx, c, k8sClient, controllerNamespace),
 	}

 	nestedGenerators := map[string]Generator{
--- a/applicationset/generators/value_interpolation_test.go
+++ b/applicationset/generators/value_interpolation_test.go
@@ -57,7 +57,7 @@ func TestValueInterpolation(t *testing.T) {
 		t.Run(testCase.name, func(t *testing.T) {
 			err := appendTemplatedValues(testCase.values, testCase.params, false, nil)
 			require.NoError(t, err)
-			assert.Equal(t, testCase.expected, testCase.params)
+			assert.EqualValues(t, testCase.expected, testCase.params)
 		})
 	}
 }
@@ -118,7 +118,7 @@ func TestValueInterpolationWithGoTemplating(t *testing.T) {
 		t.Run(testCase.name, func(t *testing.T) {
 			err := appendTemplatedValues(testCase.values, testCase.params, true, nil)
 			require.NoError(t, err)
-			assert.Equal(t, testCase.expected, testCase.params)
+			assert.EqualValues(t, testCase.expected, testCase.params)
 		})
 	}
 }
--- a/applicationset/metrics/metrics_test.go
+++ b/applicationset/metrics/metrics_test.go
@@ -174,7 +174,7 @@ func TestApplicationsetCollector(t *testing.T) {
 	appsetCollector := newAppsetCollector(utils.NewAppsetLister(client), collectedLabels, filter)

 	metrics.Registry.MustRegister(appsetCollector)
-	req, err := http.NewRequest(http.MethodGet, "/metrics", http.NoBody)
+	req, err := http.NewRequest(http.MethodGet, "/metrics", nil)
 	require.NoError(t, err)
 	rr := httptest.NewRecorder()
 	handler := promhttp.HandlerFor(metrics.Registry, promhttp.HandlerOpts{})
@@ -216,7 +216,7 @@ func TestObserveReconcile(t *testing.T) {

 	appsetMetrics := NewApplicationsetMetrics(utils.NewAppsetLister(client), collectedLabels, filter)

-	req, err := http.NewRequest(http.MethodGet, "/metrics", http.NoBody)
+	req, err := http.NewRequest(http.MethodGet, "/metrics", nil)
 	require.NoError(t, err)
 	rr := httptest.NewRecorder()
 	handler := promhttp.HandlerFor(metrics.Registry, promhttp.HandlerOpts{})
--- a/applicationset/services/github_metrics.go
+++ b/applicationset/services/github_metrics.go
@@ -1,241 +0,0 @@
-package services
-
-import (
-	"net/http"
-	"strconv"
-	"time"
-
-	"github.com/prometheus/client_golang/prometheus"
-	log "github.com/sirupsen/logrus"
-	"sigs.k8s.io/controller-runtime/pkg/metrics"
-)
-
-// Doc for the GitHub API rate limit headers:
-// https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api?apiVersion=2022-11-28#checking-the-status-of-your-rate-limit
-
-// Metric names as constants
-const (
-	githubAPIRequestTotalMetricName       = "argocd_github_api_requests_total"
-	githubAPIRequestDurationMetricName    = "argocd_github_api_request_duration_seconds"
-	githubAPIRateLimitRemainingMetricName = "argocd_github_api_rate_limit_remaining"
-	githubAPIRateLimitLimitMetricName     = "argocd_github_api_rate_limit_limit"
-	githubAPIRateLimitResetMetricName     = "argocd_github_api_rate_limit_reset_seconds"
-	githubAPIRateLimitUsedMetricName      = "argocd_github_api_rate_limit_used"
-)
-
-// GitHubMetrics groups all metric vectors for easier injection and registration
-type GitHubMetrics struct {
-	RequestTotal       *prometheus.CounterVec
-	RequestDuration    *prometheus.HistogramVec
-	RateLimitRemaining *prometheus.GaugeVec
-	RateLimitLimit     *prometheus.GaugeVec
-	RateLimitReset     *prometheus.GaugeVec
-	RateLimitUsed      *prometheus.GaugeVec
-}
-
-// Factory for a new set of GitHub metrics (for tests or custom registries)
-func NewGitHubMetrics() *GitHubMetrics {
-	return &GitHubMetrics{
-		RequestTotal:       NewGitHubAPIRequestTotal(),
-		RequestDuration:    NewGitHubAPIRequestDuration(),
-		RateLimitRemaining: NewGitHubAPIRateLimitRemaining(),
-		RateLimitLimit:     NewGitHubAPIRateLimitLimit(),
-		RateLimitReset:     NewGitHubAPIRateLimitReset(),
-		RateLimitUsed:      NewGitHubAPIRateLimitUsed(),
-	}
-}
-
-// Factory functions for each metric vector
-func NewGitHubAPIRequestTotal() *prometheus.CounterVec {
-	return prometheus.NewCounterVec(
-		prometheus.CounterOpts{
-			Name: githubAPIRequestTotalMetricName,
-			Help: "Total number of GitHub API requests",
-		},
-		[]string{"method", "endpoint", "status", "appset_namespace", "appset_name"},
-	)
-}
-
-func NewGitHubAPIRequestDuration() *prometheus.HistogramVec {
-	return prometheus.NewHistogramVec(
-		prometheus.HistogramOpts{
-			Name:    githubAPIRequestDurationMetricName,
-			Help:    "GitHub API request duration in seconds",
-			Buckets: prometheus.DefBuckets,
-		},
-		[]string{"method", "endpoint", "appset_namespace", "appset_name"},
-	)
-}
-
-func NewGitHubAPIRateLimitRemaining() *prometheus.GaugeVec {
-	return prometheus.NewGaugeVec(
-		prometheus.GaugeOpts{
-			Name: githubAPIRateLimitRemainingMetricName,
-			Help: "The number of requests remaining in the current rate limit window",
-		},
-		[]string{"endpoint", "appset_namespace", "appset_name", "resource"},
-	)
-}
-
-func NewGitHubAPIRateLimitLimit() *prometheus.GaugeVec {
-	return prometheus.NewGaugeVec(
-		prometheus.GaugeOpts{
-			Name: githubAPIRateLimitLimitMetricName,
-			Help: "The maximum number of requests that you can make per hour",
-		},
-		[]string{"endpoint", "appset_namespace", "appset_name", "resource"},
-	)
-}
-
-func NewGitHubAPIRateLimitReset() *prometheus.GaugeVec {
-	return prometheus.NewGaugeVec(
-		prometheus.GaugeOpts{
-			Name: githubAPIRateLimitResetMetricName,
-			Help: "The time left till the current rate limit window resets, in seconds",
-		},
-		[]string{"endpoint", "appset_namespace", "appset_name", "resource"},
-	)
-}
-
-func NewGitHubAPIRateLimitUsed() *prometheus.GaugeVec {
-	return prometheus.NewGaugeVec(
-		prometheus.GaugeOpts{
-			Name: githubAPIRateLimitUsedMetricName,
-			Help: "The number of requests used in the current rate limit window",
-		},
-		[]string{"endpoint", "appset_namespace", "appset_name", "resource"},
-	)
-}
-
-// Global metrics (registered with the default registry)
-var globalGitHubMetrics = NewGitHubMetrics()
-
-func init() {
-	log.Debug("Registering GitHub API AppSet metrics")
-	metrics.Registry.MustRegister(globalGitHubMetrics.RequestTotal)
-	metrics.Registry.MustRegister(globalGitHubMetrics.RequestDuration)
-	metrics.Registry.MustRegister(globalGitHubMetrics.RateLimitRemaining)
-	metrics.Registry.MustRegister(globalGitHubMetrics.RateLimitLimit)
-	metrics.Registry.MustRegister(globalGitHubMetrics.RateLimitReset)
-	metrics.Registry.MustRegister(globalGitHubMetrics.RateLimitUsed)
-}
-
-type MetricsContext struct {
-	AppSetNamespace string
-	AppSetName      string
-}
-
-// GitHubMetricsTransport is a custom http.RoundTripper that collects GitHub API metrics
-type GitHubMetricsTransport struct {
-	transport      http.RoundTripper
-	metricsContext *MetricsContext
-	metrics        *GitHubMetrics
-}
-
-// RoundTrip implements http.RoundTripper interface and collects metrics along with debug logging
-func (t *GitHubMetricsTransport) RoundTrip(req *http.Request) (*http.Response, error) {
-	endpoint := req.URL.Path
-	method := req.Method
-
-	appsetNamespace := "unknown"
-	appsetName := "unknown"
-
-	if t.metricsContext != nil {
-		appsetNamespace = t.metricsContext.AppSetNamespace
-		appsetName = t.metricsContext.AppSetName
-	}
-
-	log.WithFields(log.Fields{
-		"method":         method,
-		"endpoint":       endpoint,
-		"applicationset": map[string]string{"name": appsetName, "namespace": appsetNamespace},
-	}).Debugf("Invoking GitHub API")
-
-	startTime := time.Now()
-	resp, err := t.transport.RoundTrip(req)
-	duration := time.Since(startTime)
-
-	// Record metrics
-	t.metrics.RequestDuration.WithLabelValues(method, endpoint, appsetNamespace, appsetName).Observe(duration.Seconds())
-
-	status := "0"
-	if resp != nil {
-		status = strconv.Itoa(resp.StatusCode)
-	}
-	t.metrics.RequestTotal.WithLabelValues(method, endpoint, status, appsetNamespace, appsetName).Inc()
-
-	if resp != nil {
-		resetHumanReadableTime := ""
-		remainingInt := 0
-		limitInt := 0
-		usedInt := 0
-		resource := resp.Header.Get("X-RateLimit-Resource")
-
-		// Record rate limit metrics if available
-		if resetTime := resp.Header.Get("X-RateLimit-Reset"); resetTime != "" {
-			if resetUnix, err := strconv.ParseInt(resetTime, 10, 64); err == nil {
-				// Calculate seconds until reset (reset timestamp - current time)
-				secondsUntilReset := resetUnix - time.Now().Unix()
-				t.metrics.RateLimitReset.WithLabelValues(endpoint, appsetNamespace, appsetName, resource).Set(float64(secondsUntilReset))
-				resetHumanReadableTime = time.Unix(resetUnix, 0).Local().Format("2006-01-02 15:04:05 MST")
-			}
-		}
-		if remaining := resp.Header.Get("X-RateLimit-Remaining"); remaining != "" {
-			if remainingInt, err = strconv.Atoi(remaining); err == nil {
-				t.metrics.RateLimitRemaining.WithLabelValues(endpoint, appsetNamespace, appsetName, resource).Set(float64(remainingInt))
-			}
-		}
-		if limit := resp.Header.Get("X-RateLimit-Limit"); limit != "" {
-			if limitInt, err = strconv.Atoi(limit); err == nil {
-				t.metrics.RateLimitLimit.WithLabelValues(endpoint, appsetNamespace, appsetName, resource).Set(float64(limitInt))
-			}
-		}
-		if used := resp.Header.Get("X-RateLimit-Used"); used != "" {
-			if usedInt, err = strconv.Atoi(used); err == nil {
-				t.metrics.RateLimitUsed.WithLabelValues(endpoint, appsetNamespace, appsetName, resource).Set(float64(usedInt))
-			}
-		}
-
-		log.WithFields(log.Fields{
-			"endpoint":       endpoint,
-			"reset":          resetHumanReadableTime,
-			"remaining":      remainingInt,
-			"limit":          limitInt,
-			"used":           usedInt,
-			"resource":       resource,
-			"applicationset": map[string]string{"name": appsetName, "namespace": appsetNamespace},
-		}).Debugf("GitHub API rate limit info")
-	}
-
-	return resp, err
-}
-
-// Full constructor (for tests and advanced use)
-func NewGitHubMetricsTransport(
-	transport http.RoundTripper,
-	metricsContext *MetricsContext,
-	metrics *GitHubMetrics,
-) *GitHubMetricsTransport {
-	return &GitHubMetricsTransport{
-		transport:      transport,
-		metricsContext: metricsContext,
-		metrics:        metrics,
-	}
-}
-
-// Default constructor
-func NewDefaultGitHubMetricsTransport(transport http.RoundTripper, metricsContext *MetricsContext) *GitHubMetricsTransport {
-	return NewGitHubMetricsTransport(
-		transport,
-		metricsContext,
-		globalGitHubMetrics,
-	)
-}
-
-// NewGitHubMetricsClient wraps an http.Client with metrics middleware
-func NewGitHubMetricsClient(metricsContext *MetricsContext) *http.Client {
-	log.Debug("Creating new GitHub metrics client")
-	return &http.Client{
-		Transport: NewDefaultGitHubMetricsTransport(http.DefaultTransport, metricsContext),
-	}
-}
--- a/applicationset/services/github_metrics_test.go
+++ b/applicationset/services/github_metrics_test.go
@@ -1,221 +0,0 @@
-package services
-
-import (
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"sort"
-	"strconv"
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/prometheus/client_golang/prometheus"
-	"github.com/prometheus/client_golang/prometheus/promhttp"
-	"github.com/stretchr/testify/assert"
-)
-
-type Metric struct {
-	name   string
-	labels []string
-	value  string
-}
-
-var (
-	endpointLabel        = "endpoint=\"/api/test\""
-	URL                  = "/api/test"
-	appsetNamespaceLabel = "appset_namespace=\"test-ns\""
-	appsetNamespace      = "test-ns"
-	appsetName           = "test-appset"
-	appsetNameLabel      = "appset_name=\"test-appset\""
-	resourceLabel        = "resource=\"core\""
-
-	rateLimitMetrics = []Metric{
-		{
-			name:   githubAPIRateLimitRemainingMetricName,
-			labels: []string{endpointLabel, appsetNamespaceLabel, appsetNameLabel, resourceLabel},
-			value:  "42",
-		},
-		{
-			name:   githubAPIRateLimitLimitMetricName,
-			labels: []string{endpointLabel, appsetNamespaceLabel, appsetNameLabel, resourceLabel},
-			value:  "100",
-		},
-		{
-			name:   githubAPIRateLimitUsedMetricName,
-			labels: []string{endpointLabel, appsetNamespaceLabel, appsetNameLabel, resourceLabel},
-			value:  "58",
-		},
-		{
-			name:   githubAPIRateLimitResetMetricName,
-			labels: []string{endpointLabel, appsetNamespaceLabel, appsetNameLabel, resourceLabel},
-			value:  "1",
-		},
-	}
-	successRequestMetrics = Metric{
-		name:   githubAPIRequestTotalMetricName,
-		labels: []string{"method=\"GET\"", endpointLabel, "status=\"201\"", appsetNamespaceLabel, appsetNameLabel},
-		value:  "1",
-	}
-	failureRequestMetrics = Metric{
-		name:   githubAPIRequestTotalMetricName,
-		labels: []string{"method=\"GET\"", endpointLabel, "status=\"0\"", appsetNamespaceLabel, appsetNameLabel},
-		value:  "1",
-	}
-)
-
-func TestGitHubMetrics_CollectorApproach_Success(t *testing.T) {
-	metrics := NewGitHubMetrics()
-	reg := prometheus.NewRegistry()
-	reg.MustRegister(
-		metrics.RequestTotal,
-		metrics.RequestDuration,
-		metrics.RateLimitRemaining,
-		metrics.RateLimitLimit,
-		metrics.RateLimitReset,
-		metrics.RateLimitUsed,
-	)
-
-	// Setup a fake HTTP server
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-		w.Header().Set("X-RateLimit-Reset", strconv.FormatInt(time.Now().Unix()+1, 10))
-		w.Header().Set("X-RateLimit-Remaining", "42")
-		w.Header().Set("X-RateLimit-Limit", "100")
-		w.Header().Set("X-RateLimit-Used", "58")
-		w.Header().Set("X-RateLimit-Resource", "core")
-		w.WriteHeader(http.StatusCreated)
-		_, _ = w.Write([]byte("ok"))
-	}))
-	defer ts.Close()
-
-	metricsCtx := &MetricsContext{AppSetNamespace: appsetNamespace, AppSetName: appsetName}
-	client := &http.Client{
-		Transport: NewGitHubMetricsTransport(
-			http.DefaultTransport,
-			metricsCtx,
-			metrics,
-		),
-	}
-
-	req, _ := http.NewRequest(http.MethodGet, ts.URL+URL, http.NoBody)
-	resp, err := client.Do(req)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	resp.Body.Close()
-
-	// Expose and scrape metrics
-	handler := promhttp.HandlerFor(reg, promhttp.HandlerOpts{})
-	server := httptest.NewServer(handler)
-	defer server.Close()
-
-	resp, err = http.Get(server.URL)
-	if err != nil {
-		t.Fatalf("failed to scrape metrics: %v", err)
-	}
-	defer resp.Body.Close()
-	body, _ := io.ReadAll(resp.Body)
-	metricsOutput := string(body)
-
-	sort.Strings(successRequestMetrics.labels)
-	assert.Contains(t, metricsOutput, successRequestMetrics.name+"{"+strings.Join(successRequestMetrics.labels, ",")+"} "+successRequestMetrics.value)
-
-	for _, metric := range rateLimitMetrics {
-		sort.Strings(metric.labels)
-		assert.Contains(t, metricsOutput, metric.name+"{"+strings.Join(metric.labels, ",")+"} "+metric.value)
-	}
-}
-
-type RoundTripperFunc func(*http.Request) (*http.Response, error)
-
-func (f RoundTripperFunc) RoundTrip(r *http.Request) (*http.Response, error) { return f(r) }
-
-func TestGitHubMetrics_CollectorApproach_NoRateLimitMetricsOnNilResponse(t *testing.T) {
-	metrics := NewGitHubMetrics()
-	reg := prometheus.NewRegistry()
-	reg.MustRegister(
-		metrics.RequestTotal,
-		metrics.RequestDuration,
-		metrics.RateLimitRemaining,
-		metrics.RateLimitLimit,
-		metrics.RateLimitReset,
-		metrics.RateLimitUsed,
-	)
-
-	client := &http.Client{
-		Transport: &GitHubMetricsTransport{
-			transport: RoundTripperFunc(func(*http.Request) (*http.Response, error) {
-				return nil, http.ErrServerClosed
-			}),
-			metricsContext: &MetricsContext{AppSetNamespace: appsetNamespace, AppSetName: appsetName},
-			metrics:        metrics,
-		},
-	}
-
-	req, _ := http.NewRequest(http.MethodGet, URL, http.NoBody)
-	_, _ = client.Do(req)
-
-	handler := promhttp.HandlerFor(reg, promhttp.HandlerOpts{})
-	server := httptest.NewServer(handler)
-	defer server.Close()
-
-	resp, err := http.Get(server.URL)
-	if err != nil {
-		t.Fatalf("failed to scrape metrics: %v", err)
-	}
-	defer resp.Body.Close()
-	body, _ := io.ReadAll(resp.Body)
-	metricsOutput := string(body)
-
-	// Verify request metric exists with status "0"
-	sort.Strings(failureRequestMetrics.labels)
-	assert.Contains(t, metricsOutput, failureRequestMetrics.name+"{"+strings.Join(failureRequestMetrics.labels, ",")+"} "+failureRequestMetrics.value)
-
-	// Verify rate limit metrics don't exist
-	for _, metric := range rateLimitMetrics {
-		sort.Strings(metric.labels)
-		assert.NotContains(t, metricsOutput, metric.name+"{"+strings.Join(metric.labels, ",")+"} "+metric.value)
-	}
-}
-
-func TestNewGitHubMetricsClient(t *testing.T) {
-	// Test cases
-	testCases := []struct {
-		name       string
-		metricsCtx *MetricsContext
-	}{
-		{
-			name: "with metrics context",
-			metricsCtx: &MetricsContext{
-				AppSetNamespace: appsetNamespace,
-				AppSetName:      appsetName,
-			},
-		},
-		{
-			name:       "with nil metrics context",
-			metricsCtx: nil,
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			// Create client
-			client := NewGitHubMetricsClient(tc.metricsCtx)
-
-			// Assert client is not nil
-			assert.NotNil(t, client)
-
-			// Assert transport is properly configured
-			transport, ok := client.Transport.(*GitHubMetricsTransport)
-			assert.True(t, ok, "Transport should be GitHubMetricsTransport")
-
-			// Verify transport configuration
-			assert.Equal(t, tc.metricsCtx, transport.metricsContext)
-			assert.NotNil(t, transport.metrics, "Metrics should not be nil")
-			assert.Equal(t, http.DefaultTransport, transport.transport, "Base transport should be http.DefaultTransport")
-
-			// Verify metrics are global metrics
-			assert.Equal(t, globalGitHubMetrics, transport.metrics, "Should use global metrics")
-		})
-	}
-}
--- a/applicationset/services/internal/github_app/client.go
+++ b/applicationset/services/internal/github_app/client.go
@@ -5,27 +5,14 @@ import (
 	"net/http"

 	"github.com/bradleyfalzon/ghinstallation/v2"
-	"github.com/google/go-github/v69/github"
+	"github.com/google/go-github/v66/github"

 	"github.com/argoproj/argo-cd/v3/applicationset/services/github_app_auth"
-	appsetutils "github.com/argoproj/argo-cd/v3/applicationset/utils"
 )

-func getOptionalHTTPClientAndTransport(optionalHTTPClient ...*http.Client) (*http.Client, http.RoundTripper) {
-	httpClient := appsetutils.GetOptionalHTTPClient(optionalHTTPClient...)
-	if len(optionalHTTPClient) > 0 && optionalHTTPClient[0] != nil && optionalHTTPClient[0].Transport != nil {
-		// will either use the provided custom httpClient and it's transport
-		return httpClient, optionalHTTPClient[0].Transport
-	}
-	// or the default httpClient and transport
-	return httpClient, http.DefaultTransport
-}
-
 // Client builds a github client for the given app authentication.
-func Client(g github_app_auth.Authentication, url string, optionalHTTPClient ...*http.Client) (*github.Client, error) {
-	httpClient, transport := getOptionalHTTPClientAndTransport(optionalHTTPClient...)
-
-	rt, err := ghinstallation.New(transport, g.Id, g.InstallationId, []byte(g.PrivateKey))
+func Client(g github_app_auth.Authentication, url string) (*github.Client, error) {
+	rt, err := ghinstallation.New(http.DefaultTransport, g.Id, g.InstallationId, []byte(g.PrivateKey))
 	if err != nil {
 		return nil, fmt.Errorf("failed to create github app install: %w", err)
 	}
@@ -33,12 +20,13 @@ func Client(g github_app_auth.Authentication, url string, optionalHTTPClient ...
 		url = g.EnterpriseBaseURL
 	}
 	var client *github.Client
-	httpClient.Transport = rt
 	if url == "" {
-		client = github.NewClient(httpClient)
+		httpClient := http.Client{Transport: rt}
+		client = github.NewClient(&httpClient)
 	} else {
 		rt.BaseURL = url
-		client, err = github.NewClient(httpClient).WithEnterpriseURLs(url, url)
+		httpClient := http.Client{Transport: rt}
+		client, err = github.NewClient(&httpClient).WithEnterpriseURLs(url, url)
 		if err != nil {
 			return nil, fmt.Errorf("failed to create github enterprise client: %w", err)
 		}
--- a/applicationset/services/internal/http/client.go
+++ b/applicationset/services/internal/http/client.go
@@ -91,7 +91,7 @@ func (c *Client) NewRequestWithContext(ctx context.Context, method, path string,
 		req.Header.Set("Content-Type", "application/json")
 	}

-	if c.token != "" {
+	if len(c.token) != 0 {
 		req.Header.Set("Authorization", "Bearer "+c.token)
 	}

--- a/applicationset/services/mocks/Repos.go
+++ b/applicationset/services/mocks/Repos.go
@@ -1,15 +1,78 @@
-// Code generated by mockery; DO NOT EDIT.
-// github.com/vektra/mockery
-// template: testify
+// Code generated by mockery v2.52.4. DO NOT EDIT.

 package mocks

 import (
-	"context"
+	context "context"

 	mock "github.com/stretchr/testify/mock"
 )

+// Repos is an autogenerated mock type for the Repos type
+type Repos struct {
+	mock.Mock
+}
+
+// GetDirectories provides a mock function with given fields: ctx, repoURL, revision, project, noRevisionCache, verifyCommit
+func (_m *Repos) GetDirectories(ctx context.Context, repoURL string, revision string, project string, noRevisionCache bool, verifyCommit bool) ([]string, error) {
+	ret := _m.Called(ctx, repoURL, revision, project, noRevisionCache, verifyCommit)
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetDirectories")
+	}
+
+	var r0 []string
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string, string, string, bool, bool) ([]string, error)); ok {
+		return rf(ctx, repoURL, revision, project, noRevisionCache, verifyCommit)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, string, string, string, bool, bool) []string); ok {
+		r0 = rf(ctx, repoURL, revision, project, noRevisionCache, verifyCommit)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]string)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, string, string, string, bool, bool) error); ok {
+		r1 = rf(ctx, repoURL, revision, project, noRevisionCache, verifyCommit)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetFiles provides a mock function with given fields: ctx, repoURL, revision, project, pattern, noRevisionCache, verifyCommit
+func (_m *Repos) GetFiles(ctx context.Context, repoURL string, revision string, project string, pattern string, noRevisionCache bool, verifyCommit bool) (map[string][]byte, error) {
+	ret := _m.Called(ctx, repoURL, revision, project, pattern, noRevisionCache, verifyCommit)
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetFiles")
+	}
+
+	var r0 map[string][]byte
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, string, string, string, string, bool, bool) (map[string][]byte, error)); ok {
+		return rf(ctx, repoURL, revision, project, pattern, noRevisionCache, verifyCommit)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, string, string, string, string, bool, bool) map[string][]byte); ok {
+		r0 = rf(ctx, repoURL, revision, project, pattern, noRevisionCache, verifyCommit)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(map[string][]byte)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, string, string, string, string, bool, bool) error); ok {
+		r1 = rf(ctx, repoURL, revision, project, pattern, noRevisionCache, verifyCommit)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
 // NewRepos creates a new instance of Repos. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
 // The first argument is typically a *testing.T value.
 func NewRepos(t interface {
@@ -23,206 +86,3 @@ func NewRepos(t interface {

 	return mock
 }
-
-// Repos is an autogenerated mock type for the Repos type
-type Repos struct {
-	mock.Mock
-}
-
-type Repos_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *Repos) EXPECT() *Repos_Expecter {
-	return &Repos_Expecter{mock: &_m.Mock}
-}
-
-// GetDirectories provides a mock function for the type Repos
-func (_mock *Repos) GetDirectories(ctx context.Context, repoURL string, revision string, project string, noRevisionCache bool, verifyCommit bool) ([]string, error) {
-	ret := _mock.Called(ctx, repoURL, revision, project, noRevisionCache, verifyCommit)
-
-	if len(ret) == 0 {
-		panic("no return value specified for GetDirectories")
-	}
-
-	var r0 []string
-	var r1 error
-	if returnFunc, ok := ret.Get(0).(func(context.Context, string, string, string, bool, bool) ([]string, error)); ok {
-		return returnFunc(ctx, repoURL, revision, project, noRevisionCache, verifyCommit)
-	}
-	if returnFunc, ok := ret.Get(0).(func(context.Context, string, string, string, bool, bool) []string); ok {
-		r0 = returnFunc(ctx, repoURL, revision, project, noRevisionCache, verifyCommit)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).([]string)
-		}
-	}
-	if returnFunc, ok := ret.Get(1).(func(context.Context, string, string, string, bool, bool) error); ok {
-		r1 = returnFunc(ctx, repoURL, revision, project, noRevisionCache, verifyCommit)
-	} else {
-		r1 = ret.Error(1)
-	}
-	return r0, r1
-}
-
-// Repos_GetDirectories_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetDirectories'
-type Repos_GetDirectories_Call struct {
-	*mock.Call
-}
-
-// GetDirectories is a helper method to define mock.On call
-//   - ctx context.Context
-//   - repoURL string
-//   - revision string
-//   - project string
-//   - noRevisionCache bool
-//   - verifyCommit bool
-func (_e *Repos_Expecter) GetDirectories(ctx interface{}, repoURL interface{}, revision interface{}, project interface{}, noRevisionCache interface{}, verifyCommit interface{}) *Repos_GetDirectories_Call {
-	return &Repos_GetDirectories_Call{Call: _e.mock.On("GetDirectories", ctx, repoURL, revision, project, noRevisionCache, verifyCommit)}
-}
-
-func (_c *Repos_GetDirectories_Call) Run(run func(ctx context.Context, repoURL string, revision string, project string, noRevisionCache bool, verifyCommit bool)) *Repos_GetDirectories_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 context.Context
-		if args[0] != nil {
-			arg0 = args[0].(context.Context)
-		}
-		var arg1 string
-		if args[1] != nil {
-			arg1 = args[1].(string)
-		}
-		var arg2 string
-		if args[2] != nil {
-			arg2 = args[2].(string)
-		}
-		var arg3 string
-		if args[3] != nil {
-			arg3 = args[3].(string)
-		}
-		var arg4 bool
-		if args[4] != nil {
-			arg4 = args[4].(bool)
-		}
-		var arg5 bool
-		if args[5] != nil {
-			arg5 = args[5].(bool)
-		}
-		run(
-			arg0,
-			arg1,
-			arg2,
-			arg3,
-			arg4,
-			arg5,
-		)
-	})
-	return _c
-}
-
-func (_c *Repos_GetDirectories_Call) Return(strings []string, err error) *Repos_GetDirectories_Call {
-	_c.Call.Return(strings, err)
-	return _c
-}
-
-func (_c *Repos_GetDirectories_Call) RunAndReturn(run func(ctx context.Context, repoURL string, revision string, project string, noRevisionCache bool, verifyCommit bool) ([]string, error)) *Repos_GetDirectories_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// GetFiles provides a mock function for the type Repos
-func (_mock *Repos) GetFiles(ctx context.Context, repoURL string, revision string, project string, pattern string, noRevisionCache bool, verifyCommit bool) (map[string][]byte, error) {
-	ret := _mock.Called(ctx, repoURL, revision, project, pattern, noRevisionCache, verifyCommit)
-
-	if len(ret) == 0 {
-		panic("no return value specified for GetFiles")
-	}
-
-	var r0 map[string][]byte
-	var r1 error
-	if returnFunc, ok := ret.Get(0).(func(context.Context, string, string, string, string, bool, bool) (map[string][]byte, error)); ok {
-		return returnFunc(ctx, repoURL, revision, project, pattern, noRevisionCache, verifyCommit)
-	}
-	if returnFunc, ok := ret.Get(0).(func(context.Context, string, string, string, string, bool, bool) map[string][]byte); ok {
-		r0 = returnFunc(ctx, repoURL, revision, project, pattern, noRevisionCache, verifyCommit)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(map[string][]byte)
-		}
-	}
-	if returnFunc, ok := ret.Get(1).(func(context.Context, string, string, string, string, bool, bool) error); ok {
-		r1 = returnFunc(ctx, repoURL, revision, project, pattern, noRevisionCache, verifyCommit)
-	} else {
-		r1 = ret.Error(1)
-	}
-	return r0, r1
-}
-
-// Repos_GetFiles_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetFiles'
-type Repos_GetFiles_Call struct {
-	*mock.Call
-}
-
-// GetFiles is a helper method to define mock.On call
-//   - ctx context.Context
-//   - repoURL string
-//   - revision string
-//   - project string
-//   - pattern string
-//   - noRevisionCache bool
-//   - verifyCommit bool
-func (_e *Repos_Expecter) GetFiles(ctx interface{}, repoURL interface{}, revision interface{}, project interface{}, pattern interface{}, noRevisionCache interface{}, verifyCommit interface{}) *Repos_GetFiles_Call {
-	return &Repos_GetFiles_Call{Call: _e.mock.On("GetFiles", ctx, repoURL, revision, project, pattern, noRevisionCache, verifyCommit)}
-}
-
-func (_c *Repos_GetFiles_Call) Run(run func(ctx context.Context, repoURL string, revision string, project string, pattern string, noRevisionCache bool, verifyCommit bool)) *Repos_GetFiles_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 context.Context
-		if args[0] != nil {
-			arg0 = args[0].(context.Context)
-		}
-		var arg1 string
-		if args[1] != nil {
-			arg1 = args[1].(string)
-		}
-		var arg2 string
-		if args[2] != nil {
-			arg2 = args[2].(string)
-		}
-		var arg3 string
-		if args[3] != nil {
-			arg3 = args[3].(string)
-		}
-		var arg4 string
-		if args[4] != nil {
-			arg4 = args[4].(string)
-		}
-		var arg5 bool
-		if args[5] != nil {
-			arg5 = args[5].(bool)
-		}
-		var arg6 bool
-		if args[6] != nil {
-			arg6 = args[6].(bool)
-		}
-		run(
-			arg0,
-			arg1,
-			arg2,
-			arg3,
-			arg4,
-			arg5,
-			arg6,
-		)
-	})
-	return _c
-}
-
-func (_c *Repos_GetFiles_Call) Return(stringToBytes map[string][]byte, err error) *Repos_GetFiles_Call {
-	_c.Call.Return(stringToBytes, err)
-	return _c
-}
-
-func (_c *Repos_GetFiles_Call) RunAndReturn(run func(ctx context.Context, repoURL string, revision string, project string, pattern string, noRevisionCache bool, verifyCommit bool) (map[string][]byte, error)) *Repos_GetFiles_Call {
-	_c.Call.Return(run)
-	return _c
-}
--- a/applicationset/services/pull_request/azure_devops.go
+++ b/applicationset/services/pull_request/azure_devops.go
@@ -5,9 +5,9 @@ import (
 	"fmt"
 	"strings"

-	"github.com/microsoft/azure-devops-go-api/azuredevops/v7"
-	"github.com/microsoft/azure-devops-go-api/azuredevops/v7/core"
-	"github.com/microsoft/azure-devops-go-api/azuredevops/v7/git"
+	"github.com/microsoft/azure-devops-go-api/azuredevops"
+	"github.com/microsoft/azure-devops-go-api/azuredevops/core"
+	"github.com/microsoft/azure-devops-go-api/azuredevops/git"
 )

 const AZURE_DEVOPS_DEFAULT_URL = "https://dev.azure.com"
--- a/applicationset/services/pull_request/azure_devops_test.go
+++ b/applicationset/services/pull_request/azure_devops_test.go
@@ -4,9 +4,10 @@ import (
 	"context"
 	"testing"

-	"github.com/microsoft/azure-devops-go-api/azuredevops/v7/core"
-	"github.com/microsoft/azure-devops-go-api/azuredevops/v7/git"
-	"github.com/microsoft/azure-devops-go-api/azuredevops/v7/webapi"
+	"github.com/microsoft/azure-devops-go-api/azuredevops/webapi"
+
+	"github.com/microsoft/azure-devops-go-api/azuredevops/core"
+	"github.com/microsoft/azure-devops-go-api/azuredevops/git"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"
--- a/applicationset/services/pull_request/bitbucket_cloud.go
+++ b/applicationset/services/pull_request/bitbucket_cloud.go
@@ -17,19 +17,10 @@ type BitbucketCloudService struct {
 }

 type BitbucketCloudPullRequest struct {
-	ID          int                                  `json:"id"`
-	Title       string                               `json:"title"`
-	Source      BitbucketCloudPullRequestSource      `json:"source"`
-	Author      BitbucketCloudPullRequestAuthor      `json:"author"`
-	Destination BitbucketCloudPullRequestDestination `json:"destination"`
-}
-
-type BitbucketCloudPullRequestDestination struct {
-	Branch BitbucketCloudPullRequestDestinationBranch `json:"branch"`
-}
-
-type BitbucketCloudPullRequestDestinationBranch struct {
-	Name string `json:"name"`
+	ID     int                             `json:"id"`
+	Title  string                          `json:"title"`
+	Source BitbucketCloudPullRequestSource `json:"source"`
+	Author BitbucketCloudPullRequestAuthor `json:"author"`
 }

 type BitbucketCloudPullRequestSource struct {
@@ -145,12 +136,11 @@ func (b *BitbucketCloudService) List(_ context.Context) ([]*PullRequest, error)
 	pullRequests := []*PullRequest{}
 	for _, pull := range pulls {
 		pullRequests = append(pullRequests, &PullRequest{
-			Number:       pull.ID,
-			Title:        pull.Title,
-			Branch:       pull.Source.Branch.Name,
-			TargetBranch: pull.Destination.Branch.Name,
-			HeadSHA:      pull.Source.Commit.Hash,
-			Author:       pull.Author.Nickname,
+			Number:  pull.ID,
+			Title:   pull.Title,
+			Branch:  pull.Source.Branch.Name,
+			HeadSHA: pull.Source.Commit.Hash,
+			Author:  pull.Author.Nickname,
 		})
 	}

--- a/applicationset/services/pull_request/bitbucket_cloud_test.go
+++ b/applicationset/services/pull_request/bitbucket_cloud_test.go
@@ -138,7 +138,7 @@ func TestListPullRequestPaginationCloud(t *testing.T) {
 		var err error
 		switch r.RequestURI {
 		case "/repositories/OWNER/REPO/pullrequests/":
-			_, err = fmt.Fprintf(w, `{
+			_, err = io.WriteString(w, fmt.Sprintf(`{
 				"size": 2,
 				"pagelen": 1,
 				"page": 1,
@@ -177,9 +177,9 @@ func TestListPullRequestPaginationCloud(t *testing.T) {
 						}
 					}
 				]
-			}`, r.Host)
+			}`, r.Host))
 		case "/repositories/OWNER/REPO/pullrequests/?pagelen=1&page=2":
-			_, err = fmt.Fprintf(w, `{
+			_, err = io.WriteString(w, fmt.Sprintf(`{
 				"size": 2,
 				"pagelen": 1,
 				"page": 2,
@@ -202,7 +202,7 @@ func TestListPullRequestPaginationCloud(t *testing.T) {
 						}
 					}
 				]
-			}`, r.Host)
+			}`, r.Host))
 		default:
 			t.Fail()
 		}
@@ -329,7 +329,7 @@ func TestListPullRequestBranchMatchCloud(t *testing.T) {
 		var err error
 		switch r.RequestURI {
 		case "/repositories/OWNER/REPO/pullrequests/":
-			_, err = fmt.Fprintf(w, `{
+			_, err = io.WriteString(w, fmt.Sprintf(`{
 				"size": 2,
 				"pagelen": 1,
 				"page": 1,
@@ -349,11 +349,6 @@ func TestListPullRequestBranchMatchCloud(t *testing.T) {
 						},
 						"author": {
 							"nickname": "testName"
-						},
-						"destination": {
-							"branch": {
-								"name": "master"
-							}
 						}
 					},
 					{
@@ -370,17 +365,12 @@ func TestListPullRequestBranchMatchCloud(t *testing.T) {
 						},
 						"author": {
 							"nickname": "testName"
-						},
-						"destination": {
-							"branch": {
-								"name": "branch-200"
-							}
 						}
 					}
 				]
-			}`, r.Host)
+			}`, r.Host))
 		case "/repositories/OWNER/REPO/pullrequests/?pagelen=1&page=2":
-			_, err = fmt.Fprintf(w, `{
+			_, err = io.WriteString(w, fmt.Sprintf(`{
 				"size": 2,
 				"pagelen": 1,
 				"page": 2,
@@ -400,15 +390,10 @@ func TestListPullRequestBranchMatchCloud(t *testing.T) {
 						},
 						"author": {
 							"nickname": "testName"
-						},
-						"destination": {
-							"branch": {
-								"name": "master"
-							}
 						}
 					}
 				]
-			}`, r.Host)
+			}`, r.Host))
 		default:
 			t.Fail()
 		}
@@ -428,20 +413,18 @@ func TestListPullRequestBranchMatchCloud(t *testing.T) {
 	require.NoError(t, err)
 	assert.Len(t, pullRequests, 2)
 	assert.Equal(t, PullRequest{
-		Number:       101,
-		Title:        "feat(101)",
-		Branch:       "feature-101",
-		HeadSHA:      "1a8dd249c04a",
-		Author:       "testName",
-		TargetBranch: "master",
+		Number:  101,
+		Title:   "feat(101)",
+		Branch:  "feature-101",
+		HeadSHA: "1a8dd249c04a",
+		Author:  "testName",
 	}, *pullRequests[0])
 	assert.Equal(t, PullRequest{
-		Number:       102,
-		Title:        "feat(102)",
-		Branch:       "feature-102",
-		HeadSHA:      "6344d9623e3b",
-		Author:       "testName",
-		TargetBranch: "master",
+		Number:  102,
+		Title:   "feat(102)",
+		Branch:  "feature-102",
+		HeadSHA: "6344d9623e3b",
+		Author:  "testName",
 	}, *pullRequests[1])

 	regexp = `.*2$`
@@ -455,12 +438,11 @@ func TestListPullRequestBranchMatchCloud(t *testing.T) {
 	require.NoError(t, err)
 	assert.Len(t, pullRequests, 1)
 	assert.Equal(t, PullRequest{
-		Number:       102,
-		Title:        "feat(102)",
-		Branch:       "feature-102",
-		HeadSHA:      "6344d9623e3b",
-		Author:       "testName",
-		TargetBranch: "master",
+		Number:  102,
+		Title:   "feat(102)",
+		Branch:  "feature-102",
+		HeadSHA: "6344d9623e3b",
+		Author:  "testName",
 	}, *pullRequests[0])

 	regexp = `[\d{2}`
@@ -472,23 +454,4 @@ func TestListPullRequestBranchMatchCloud(t *testing.T) {
 		},
 	})
 	require.Error(t, err)
-
-	regexp = `feature-2[\d]{2}`
-	targetRegexp := `branch.*`
-	pullRequests, err = ListPullRequests(t.Context(), svc, []v1alpha1.PullRequestGeneratorFilter{
-		{
-			BranchMatch:       &regexp,
-			TargetBranchMatch: &targetRegexp,
-		},
-	})
-	require.NoError(t, err)
-	assert.Len(t, pullRequests, 1)
-	assert.Equal(t, PullRequest{
-		Number:       200,
-		Title:        "feat(200)",
-		Branch:       "feature-200",
-		HeadSHA:      "4cf807e67a6d",
-		Author:       "testName",
-		TargetBranch: "branch-200",
-	}, *pullRequests[0])
 }
--- a/applicationset/services/pull_request/bitbucket_server.go
+++ b/applicationset/services/pull_request/bitbucket_server.go
@@ -3,12 +3,11 @@ package pull_request
 import (
 	"context"
 	"fmt"
-	"net/http"

 	bitbucketv1 "github.com/gfleury/go-bitbucket-v1"
 	log "github.com/sirupsen/logrus"

-	"github.com/argoproj/argo-cd/v3/applicationset/utils"
+	"github.com/argoproj/argo-cd/v3/applicationset/services"
 )

 type BitbucketService struct {
@@ -49,15 +48,10 @@ func NewBitbucketServiceNoAuth(ctx context.Context, url, projectKey, repositoryS
 }

 func newBitbucketService(ctx context.Context, bitbucketConfig *bitbucketv1.Configuration, projectKey, repositorySlug string, scmRootCAPath string, insecure bool, caCerts []byte) (PullRequestService, error) {
-	bitbucketConfig.BasePath = utils.NormalizeBitbucketBasePath(bitbucketConfig.BasePath)
-	tlsConfig := utils.GetTlsConfig(scmRootCAPath, insecure, caCerts)
-	bitbucketConfig.HTTPClient = &http.Client{Transport: &http.Transport{
-		TLSClientConfig: tlsConfig,
-	}}
-	bitbucketClient := bitbucketv1.NewAPIClient(ctx, bitbucketConfig)
+	bbClient := services.SetupBitbucketClient(ctx, bitbucketConfig, scmRootCAPath, insecure, caCerts)

 	return &BitbucketService{
-		client:         bitbucketClient,
+		client:         bbClient,
 		projectKey:     projectKey,
 		repositorySlug: repositorySlug,
 	}, nil
--- a/applicationset/services/pull_request/gitea.go
+++ b/applicationset/services/pull_request/gitea.go
@@ -14,12 +14,11 @@ type GiteaService struct {
 	client *gitea.Client
 	owner  string
 	repo   string
-	labels []string
 }

 var _ PullRequestService = (*GiteaService)(nil)

-func NewGiteaService(token, url, owner, repo string, labels []string, insecure bool) (PullRequestService, error) {
+func NewGiteaService(token, url, owner, repo string, insecure bool) (PullRequestService, error) {
 	if token == "" {
 		token = os.Getenv("GITEA_TOKEN")
 	}
@@ -43,7 +42,6 @@ func NewGiteaService(token, url, owner, repo string, labels []string, insecure b
 		client: client,
 		owner:  owner,
 		repo:   repo,
-		labels: labels,
 	}, nil
 }

@@ -58,9 +56,6 @@ func (g *GiteaService) List(ctx context.Context) ([]*PullRequest, error) {
 	}
 	list := []*PullRequest{}
 	for _, pr := range prs {
-		if !giteaContainLabels(g.labels, pr.Labels) {
-			continue
-		}
 		list = append(list, &PullRequest{
 			Number:       int(pr.Index),
 			Title:        pr.Title,
@@ -74,21 +69,6 @@ func (g *GiteaService) List(ctx context.Context) ([]*PullRequest, error) {
 	return list, nil
 }

-// containLabels returns true if gotLabels contains expectedLabels
-func giteaContainLabels(expectedLabels []string, gotLabels []*gitea.Label) bool {
-	gotLabelNamesMap := make(map[string]bool)
-	for i := 0; i < len(gotLabels); i++ {
-		gotLabelNamesMap[gotLabels[i].Name] = true
-	}
-	for _, expected := range expectedLabels {
-		v, ok := gotLabelNamesMap[expected]
-		if !v || !ok {
-			return false
-		}
-	}
-	return true
-}
-
 // Get the Gitea pull request label names.
 func getGiteaPRLabelNames(giteaLabels []*gitea.Label) []string {
 	var labelNames []string
--- a/applicationset/services/pull_request/gitea_test.go
+++ b/applicationset/services/pull_request/gitea_test.go
@@ -52,7 +52,7 @@ func giteaMockHandler(t *testing.T) func(http.ResponseWriter, *http.Request) {
 				},
 				"title": "add an empty file",
 				"body": "",
-				"labels": [{"id": 1, "name": "label1", "color": "00aabb", "description": "foo", "url": ""}],
+				"labels": [],
 				"milestone": null,
 				"assignee": null,
 				"assignees": null,
@@ -246,59 +246,11 @@ func giteaMockHandler(t *testing.T) func(http.ResponseWriter, *http.Request) {
 	}
 }

-func TestGiteaContainLabels(t *testing.T) {
-	cases := []struct {
-		Name       string
-		Labels     []string
-		PullLabels []*gitea.Label
-		Expect     bool
-	}{
-		{
-			Name:   "Match labels",
-			Labels: []string{"label1", "label2"},
-			PullLabels: []*gitea.Label{
-				{Name: "label1"},
-				{Name: "label2"},
-				{Name: "label3"},
-			},
-			Expect: true,
-		},
-		{
-			Name:   "Not match labels",
-			Labels: []string{"label1", "label4"},
-			PullLabels: []*gitea.Label{
-				{Name: "label1"},
-				{Name: "label2"},
-				{Name: "label3"},
-			},
-			Expect: false,
-		},
-		{
-			Name:   "No specify",
-			Labels: []string{},
-			PullLabels: []*gitea.Label{
-				{Name: "label1"},
-				{Name: "label2"},
-				{Name: "label3"},
-			},
-			Expect: true,
-		},
-	}
-
-	for _, c := range cases {
-		t.Run(c.Name, func(t *testing.T) {
-			if got := giteaContainLabels(c.Labels, c.PullLabels); got != c.Expect {
-				t.Errorf("expect: %v, got: %v", c.Expect, got)
-			}
-		})
-	}
-}
-
 func TestGiteaList(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		giteaMockHandler(t)(w, r)
 	}))
-	host, err := NewGiteaService("", ts.URL, "test-argocd", "pr-test", []string{"label1"}, false)
+	host, err := NewGiteaService("", ts.URL, "test-argocd", "pr-test", false)
 	require.NoError(t, err)
 	prs, err := host.List(t.Context())
 	require.NoError(t, err)
--- a/applicationset/services/pull_request/github.go
+++ b/applicationset/services/pull_request/github.go
@@ -6,9 +6,7 @@ import (
 	"net/http"
 	"os"

-	"github.com/google/go-github/v69/github"
-
-	appsetutils "github.com/argoproj/argo-cd/v3/applicationset/utils"
+	"github.com/google/go-github/v66/github"
 )

 type GithubService struct {
@@ -20,15 +18,13 @@ type GithubService struct {

 var _ PullRequestService = (*GithubService)(nil)

-func NewGithubService(token, url, owner, repo string, labels []string, optionalHTTPClient ...*http.Client) (PullRequestService, error) {
+func NewGithubService(token, url, owner, repo string, labels []string) (PullRequestService, error) {
 	// Undocumented environment variable to set a default token, to be used in testing to dodge anonymous rate limits.
 	if token == "" {
 		token = os.Getenv("GITHUB_TOKEN")
 	}
-
+	httpClient := &http.Client{}
 	var client *github.Client
-	httpClient := appsetutils.GetOptionalHTTPClient(optionalHTTPClient...)
-
 	if url == "" {
 		if token == "" {
 			client = github.NewClient(httpClient)
@@ -37,7 +33,11 @@ func NewGithubService(token, url, owner, repo string, labels []string, optionalH
 		}
 	} else {
 		var err error
-		client, err = github.NewClient(httpClient).WithEnterpriseURLs(url, url)
+		if token == "" {
+			client, err = github.NewClient(httpClient).WithEnterpriseURLs(url, url)
+		} else {
+			client, err = github.NewClient(httpClient).WithAuthToken(token).WithEnterpriseURLs(url, url)
+		}
 		if err != nil {
 			return nil, err
 		}
--- a/applicationset/services/pull_request/github_app.go
+++ b/applicationset/services/pull_request/github_app.go
@@ -1,16 +1,12 @@
 package pull_request

 import (
-	"net/http"
-
 	"github.com/argoproj/argo-cd/v3/applicationset/services/github_app_auth"
 	"github.com/argoproj/argo-cd/v3/applicationset/services/internal/github_app"
-	appsetutils "github.com/argoproj/argo-cd/v3/applicationset/utils"
 )

-func NewGithubAppService(g github_app_auth.Authentication, url, owner, repo string, labels []string, optionalHTTPClient ...*http.Client) (PullRequestService, error) {
-	httpClient := appsetutils.GetOptionalHTTPClient(optionalHTTPClient...)
-	client, err := github_app.Client(g, url, httpClient)
+func NewGithubAppService(g github_app_auth.Authentication, url, owner, repo string, labels []string) (PullRequestService, error) {
+	client, err := github_app.Client(g, url)
 	if err != nil {
 		return nil, err
 	}
--- a/applicationset/services/pull_request/github_test.go
+++ b/applicationset/services/pull_request/github_test.go
@@ -3,7 +3,7 @@ package pull_request
 import (
 	"testing"

-	"github.com/google/go-github/v69/github"
+	"github.com/google/go-github/v66/github"
 	"github.com/stretchr/testify/require"
 )

--- a/applicationset/services/repo_service.go
+++ b/applicationset/services/repo_service.go
@@ -7,7 +7,7 @@ import (
 	"github.com/argoproj/argo-cd/v3/pkg/apis/application/v1alpha1"
 	"github.com/argoproj/argo-cd/v3/reposerver/apiclient"
 	"github.com/argoproj/argo-cd/v3/util/db"
-	utilio "github.com/argoproj/argo-cd/v3/util/io"
+	"github.com/argoproj/argo-cd/v3/util/io"
 )

 type argoCDService struct {
@@ -36,7 +36,7 @@ func NewArgoCDService(db db.ArgoDB, submoduleEnabled bool, repoClientset apiclie
 			if err != nil {
 				return nil, fmt.Errorf("error initializing new repo server client: %w", err)
 			}
-			defer utilio.Close(closer)
+			defer io.Close(closer)
 			return client.GetGitFiles(ctx, fileRequest)
 		},
 		getGitDirectoriesFromRepoServer: func(ctx context.Context, dirRequest *apiclient.GitDirectoriesRequest) (*apiclient.GitDirectoriesResponse, error) {
@@ -44,7 +44,7 @@ func NewArgoCDService(db db.ArgoDB, submoduleEnabled bool, repoClientset apiclie
 			if err != nil {
 				return nil, fmt.Errorf("error initialising new repo server client: %w", err)
 			}
-			defer utilio.Close(closer)
+			defer io.Close(closer)
 			return client.GetGitDirectories(ctx, dirRequest)
 		},
 	}
--- a/applicationset/services/scm_provider/aws_codecommit.go
+++ b/applicationset/services/scm_provider/aws_codecommit.go
@@ -4,21 +4,22 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"maps"
 	pathpkg "path"
 	"path/filepath"
-	"slices"
 	"strings"

+	"github.com/aws/aws-sdk-go/aws/request"
+
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/aws/awserr"
 	"github.com/aws/aws-sdk-go/aws/credentials/stscreds"
-	"github.com/aws/aws-sdk-go/aws/request"
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/codecommit"
 	"github.com/aws/aws-sdk-go/service/resourcegroupstaggingapi"
 	log "github.com/sirupsen/logrus"
+	"golang.org/x/exp/maps"
+	"k8s.io/utils/strings/slices"

 	application "github.com/argoproj/argo-cd/v3/pkg/apis/application/v1alpha1"
 )
@@ -298,7 +299,7 @@ func (p *AWSCodeCommitProvider) getTagFilters() []*resourcegroupstaggingapi.TagF
 			filter.Values = append(filter.Values, aws.String(tagFilter.Value))
 		}
 	}
-	return slices.Collect(maps.Values(filters))
+	return maps.Values(filters)
 }

 func getCodeCommitRepoName(repoArn string) (string, error) {
@@ -340,7 +341,7 @@ func toAbsolutePath(path string) string {
 	if filepath.IsAbs(path) {
 		return path
 	}
-	return filepath.ToSlash(filepath.Join("/", path)) //nolint:gocritic // Prepend slash to have an absolute path
+	return filepath.ToSlash(filepath.Join("/", path))
 }

 func createAWSDiscoveryClients(_ context.Context, role string, region string) (*resourcegroupstaggingapi.ResourceGroupsTaggingAPI, *codecommit.CodeCommit, error) {
--- a/applicationset/services/scm_provider/aws_codecommit/mocks/AWSCodeCommitClient.go
+++ b/applicationset/services/scm_provider/aws_codecommit/mocks/AWSCodeCommitClient.go
@@ -1,16 +1,170 @@
-// Code generated by mockery; DO NOT EDIT.
-// github.com/vektra/mockery
-// template: testify
+// Code generated by mockery v2.52.4. DO NOT EDIT.

 package mocks

 import (
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/request"
-	"github.com/aws/aws-sdk-go/service/codecommit"
+	context "context"
+
+	codecommit "github.com/aws/aws-sdk-go/service/codecommit"
+
 	mock "github.com/stretchr/testify/mock"
+
+	request "github.com/aws/aws-sdk-go/aws/request"
 )

+// AWSCodeCommitClient is an autogenerated mock type for the AWSCodeCommitClient type
+type AWSCodeCommitClient struct {
+	mock.Mock
+}
+
+// GetFolderWithContext provides a mock function with given fields: _a0, _a1, _a2
+func (_m *AWSCodeCommitClient) GetFolderWithContext(_a0 context.Context, _a1 *codecommit.GetFolderInput, _a2 ...request.Option) (*codecommit.GetFolderOutput, error) {
+	_va := make([]interface{}, len(_a2))
+	for _i := range _a2 {
+		_va[_i] = _a2[_i]
+	}
+	var _ca []interface{}
+	_ca = append(_ca, _a0, _a1)
+	_ca = append(_ca, _va...)
+	ret := _m.Called(_ca...)
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetFolderWithContext")
+	}
+
+	var r0 *codecommit.GetFolderOutput
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *codecommit.GetFolderInput, ...request.Option) (*codecommit.GetFolderOutput, error)); ok {
+		return rf(_a0, _a1, _a2...)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *codecommit.GetFolderInput, ...request.Option) *codecommit.GetFolderOutput); ok {
+		r0 = rf(_a0, _a1, _a2...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*codecommit.GetFolderOutput)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *codecommit.GetFolderInput, ...request.Option) error); ok {
+		r1 = rf(_a0, _a1, _a2...)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GetRepositoryWithContext provides a mock function with given fields: _a0, _a1, _a2
+func (_m *AWSCodeCommitClient) GetRepositoryWithContext(_a0 context.Context, _a1 *codecommit.GetRepositoryInput, _a2 ...request.Option) (*codecommit.GetRepositoryOutput, error) {
+	_va := make([]interface{}, len(_a2))
+	for _i := range _a2 {
+		_va[_i] = _a2[_i]
+	}
+	var _ca []interface{}
+	_ca = append(_ca, _a0, _a1)
+	_ca = append(_ca, _va...)
+	ret := _m.Called(_ca...)
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetRepositoryWithContext")
+	}
+
+	var r0 *codecommit.GetRepositoryOutput
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *codecommit.GetRepositoryInput, ...request.Option) (*codecommit.GetRepositoryOutput, error)); ok {
+		return rf(_a0, _a1, _a2...)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *codecommit.GetRepositoryInput, ...request.Option) *codecommit.GetRepositoryOutput); ok {
+		r0 = rf(_a0, _a1, _a2...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*codecommit.GetRepositoryOutput)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *codecommit.GetRepositoryInput, ...request.Option) error); ok {
+		r1 = rf(_a0, _a1, _a2...)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// ListBranchesWithContext provides a mock function with given fields: _a0, _a1, _a2
+func (_m *AWSCodeCommitClient) ListBranchesWithContext(_a0 context.Context, _a1 *codecommit.ListBranchesInput, _a2 ...request.Option) (*codecommit.ListBranchesOutput, error) {
+	_va := make([]interface{}, len(_a2))
+	for _i := range _a2 {
+		_va[_i] = _a2[_i]
+	}
+	var _ca []interface{}
+	_ca = append(_ca, _a0, _a1)
+	_ca = append(_ca, _va...)
+	ret := _m.Called(_ca...)
+
+	if len(ret) == 0 {
+		panic("no return value specified for ListBranchesWithContext")
+	}
+
+	var r0 *codecommit.ListBranchesOutput
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *codecommit.ListBranchesInput, ...request.Option) (*codecommit.ListBranchesOutput, error)); ok {
+		return rf(_a0, _a1, _a2...)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *codecommit.ListBranchesInput, ...request.Option) *codecommit.ListBranchesOutput); ok {
+		r0 = rf(_a0, _a1, _a2...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*codecommit.ListBranchesOutput)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *codecommit.ListBranchesInput, ...request.Option) error); ok {
+		r1 = rf(_a0, _a1, _a2...)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// ListRepositoriesWithContext provides a mock function with given fields: _a0, _a1, _a2
+func (_m *AWSCodeCommitClient) ListRepositoriesWithContext(_a0 context.Context, _a1 *codecommit.ListRepositoriesInput, _a2 ...request.Option) (*codecommit.ListRepositoriesOutput, error) {
+	_va := make([]interface{}, len(_a2))
+	for _i := range _a2 {
+		_va[_i] = _a2[_i]
+	}
+	var _ca []interface{}
+	_ca = append(_ca, _a0, _a1)
+	_ca = append(_ca, _va...)
+	ret := _m.Called(_ca...)
+
+	if len(ret) == 0 {
+		panic("no return value specified for ListRepositoriesWithContext")
+	}
+
+	var r0 *codecommit.ListRepositoriesOutput
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *codecommit.ListRepositoriesInput, ...request.Option) (*codecommit.ListRepositoriesOutput, error)); ok {
+		return rf(_a0, _a1, _a2...)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *codecommit.ListRepositoriesInput, ...request.Option) *codecommit.ListRepositoriesOutput); ok {
+		r0 = rf(_a0, _a1, _a2...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*codecommit.ListRepositoriesOutput)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *codecommit.ListRepositoriesInput, ...request.Option) error); ok {
+		r1 = rf(_a0, _a1, _a2...)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
 // NewAWSCodeCommitClient creates a new instance of AWSCodeCommitClient. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
 // The first argument is typically a *testing.T value.
 func NewAWSCodeCommitClient(t interface {
@@ -24,364 +178,3 @@ func NewAWSCodeCommitClient(t interface {

 	return mock
 }
-
-// AWSCodeCommitClient is an autogenerated mock type for the AWSCodeCommitClient type
-type AWSCodeCommitClient struct {
-	mock.Mock
-}
-
-type AWSCodeCommitClient_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *AWSCodeCommitClient) EXPECT() *AWSCodeCommitClient_Expecter {
-	return &AWSCodeCommitClient_Expecter{mock: &_m.Mock}
-}
-
-// GetFolderWithContext provides a mock function for the type AWSCodeCommitClient
-func (_mock *AWSCodeCommitClient) GetFolderWithContext(v aws.Context, getFolderInput *codecommit.GetFolderInput, options ...request.Option) (*codecommit.GetFolderOutput, error) {
-	// request.Option
-	_va := make([]interface{}, len(options))
-	for _i := range options {
-		_va[_i] = options[_i]
-	}
-	var _ca []interface{}
-	_ca = append(_ca, v, getFolderInput)
-	_ca = append(_ca, _va...)
-	ret := _mock.Called(_ca...)
-
-	if len(ret) == 0 {
-		panic("no return value specified for GetFolderWithContext")
-	}
-
-	var r0 *codecommit.GetFolderOutput
-	var r1 error
-	if returnFunc, ok := ret.Get(0).(func(aws.Context, *codecommit.GetFolderInput, ...request.Option) (*codecommit.GetFolderOutput, error)); ok {
-		return returnFunc(v, getFolderInput, options...)
-	}
-	if returnFunc, ok := ret.Get(0).(func(aws.Context, *codecommit.GetFolderInput, ...request.Option) *codecommit.GetFolderOutput); ok {
-		r0 = returnFunc(v, getFolderInput, options...)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*codecommit.GetFolderOutput)
-		}
-	}
-	if returnFunc, ok := ret.Get(1).(func(aws.Context, *codecommit.GetFolderInput, ...request.Option) error); ok {
-		r1 = returnFunc(v, getFolderInput, options...)
-	} else {
-		r1 = ret.Error(1)
-	}
-	return r0, r1
-}
-
-// AWSCodeCommitClient_GetFolderWithContext_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetFolderWithContext'
-type AWSCodeCommitClient_GetFolderWithContext_Call struct {
-	*mock.Call
-}
-
-// GetFolderWithContext is a helper method to define mock.On call
-//   - v aws.Context
-//   - getFolderInput *codecommit.GetFolderInput
-//   - options ...request.Option
-func (_e *AWSCodeCommitClient_Expecter) GetFolderWithContext(v interface{}, getFolderInput interface{}, options ...interface{}) *AWSCodeCommitClient_GetFolderWithContext_Call {
-	return &AWSCodeCommitClient_GetFolderWithContext_Call{Call: _e.mock.On("GetFolderWithContext",
-		append([]interface{}{v, getFolderInput}, options...)...)}
-}
-
-func (_c *AWSCodeCommitClient_GetFolderWithContext_Call) Run(run func(v aws.Context, getFolderInput *codecommit.GetFolderInput, options ...request.Option)) *AWSCodeCommitClient_GetFolderWithContext_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 aws.Context
-		if args[0] != nil {
-			arg0 = args[0].(aws.Context)
-		}
-		var arg1 *codecommit.GetFolderInput
-		if args[1] != nil {
-			arg1 = args[1].(*codecommit.GetFolderInput)
-		}
-		var arg2 []request.Option
-		variadicArgs := make([]request.Option, len(args)-2)
-		for i, a := range args[2:] {
-			if a != nil {
-				variadicArgs[i] = a.(request.Option)
-			}
-		}
-		arg2 = variadicArgs
-		run(
-			arg0,
-			arg1,
-			arg2...,
-		)
-	})
-	return _c
-}
-
-func (_c *AWSCodeCommitClient_GetFolderWithContext_Call) Return(getFolderOutput *codecommit.GetFolderOutput, err error) *AWSCodeCommitClient_GetFolderWithContext_Call {
-	_c.Call.Return(getFolderOutput, err)
-	return _c
-}
-
-func (_c *AWSCodeCommitClient_GetFolderWithContext_Call) RunAndReturn(run func(v aws.Context, getFolderInput *codecommit.GetFolderInput, options ...request.Option) (*codecommit.GetFolderOutput, error)) *AWSCodeCommitClient_GetFolderWithContext_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// GetRepositoryWithContext provides a mock function for the type AWSCodeCommitClient
-func (_mock *AWSCodeCommitClient) GetRepositoryWithContext(v aws.Context, getRepositoryInput *codecommit.GetRepositoryInput, options ...request.Option) (*codecommit.GetRepositoryOutput, error) {
-	// request.Option
-	_va := make([]interface{}, len(options))
-	for _i := range options {
-		_va[_i] = options[_i]
-	}
-	var _ca []interface{}
-	_ca = append(_ca, v, getRepositoryInput)
-	_ca = append(_ca, _va...)
-	ret := _mock.Called(_ca...)
-
-	if len(ret) == 0 {
-		panic("no return value specified for GetRepositoryWithContext")
-	}
-
-	var r0 *codecommit.GetRepositoryOutput
-	var r1 error
-	if returnFunc, ok := ret.Get(0).(func(aws.Context, *codecommit.GetRepositoryInput, ...request.Option) (*codecommit.GetRepositoryOutput, error)); ok {
-		return returnFunc(v, getRepositoryInput, options...)
-	}
-	if returnFunc, ok := ret.Get(0).(func(aws.Context, *codecommit.GetRepositoryInput, ...request.Option) *codecommit.GetRepositoryOutput); ok {
-		r0 = returnFunc(v, getRepositoryInput, options...)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*codecommit.GetRepositoryOutput)
-		}
-	}
-	if returnFunc, ok := ret.Get(1).(func(aws.Context, *codecommit.GetRepositoryInput, ...request.Option) error); ok {
-		r1 = returnFunc(v, getRepositoryInput, options...)
-	} else {
-		r1 = ret.Error(1)
-	}
-	return r0, r1
-}
-
-// AWSCodeCommitClient_GetRepositoryWithContext_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetRepositoryWithContext'
-type AWSCodeCommitClient_GetRepositoryWithContext_Call struct {
-	*mock.Call
-}
-
-// GetRepositoryWithContext is a helper method to define mock.On call
-//   - v aws.Context
-//   - getRepositoryInput *codecommit.GetRepositoryInput
-//   - options ...request.Option
-func (_e *AWSCodeCommitClient_Expecter) GetRepositoryWithContext(v interface{}, getRepositoryInput interface{}, options ...interface{}) *AWSCodeCommitClient_GetRepositoryWithContext_Call {
-	return &AWSCodeCommitClient_GetRepositoryWithContext_Call{Call: _e.mock.On("GetRepositoryWithContext",
-		append([]interface{}{v, getRepositoryInput}, options...)...)}
-}
-
-func (_c *AWSCodeCommitClient_GetRepositoryWithContext_Call) Run(run func(v aws.Context, getRepositoryInput *codecommit.GetRepositoryInput, options ...request.Option)) *AWSCodeCommitClient_GetRepositoryWithContext_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 aws.Context
-		if args[0] != nil {
-			arg0 = args[0].(aws.Context)
-		}
-		var arg1 *codecommit.GetRepositoryInput
-		if args[1] != nil {
-			arg1 = args[1].(*codecommit.GetRepositoryInput)
-		}
-		var arg2 []request.Option
-		variadicArgs := make([]request.Option, len(args)-2)
-		for i, a := range args[2:] {
-			if a != nil {
-				variadicArgs[i] = a.(request.Option)
-			}
-		}
-		arg2 = variadicArgs
-		run(
-			arg0,
-			arg1,
-			arg2...,
-		)
-	})
-	return _c
-}
-
-func (_c *AWSCodeCommitClient_GetRepositoryWithContext_Call) Return(getRepositoryOutput *codecommit.GetRepositoryOutput, err error) *AWSCodeCommitClient_GetRepositoryWithContext_Call {
-	_c.Call.Return(getRepositoryOutput, err)
-	return _c
-}
-
-func (_c *AWSCodeCommitClient_GetRepositoryWithContext_Call) RunAndReturn(run func(v aws.Context, getRepositoryInput *codecommit.GetRepositoryInput, options ...request.Option) (*codecommit.GetRepositoryOutput, error)) *AWSCodeCommitClient_GetRepositoryWithContext_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// ListBranchesWithContext provides a mock function for the type AWSCodeCommitClient
-func (_mock *AWSCodeCommitClient) ListBranchesWithContext(v aws.Context, listBranchesInput *codecommit.ListBranchesInput, options ...request.Option) (*codecommit.ListBranchesOutput, error) {
-	// request.Option
-	_va := make([]interface{}, len(options))
-	for _i := range options {
-		_va[_i] = options[_i]
-	}
-	var _ca []interface{}
-	_ca = append(_ca, v, listBranchesInput)
-	_ca = append(_ca, _va...)
-	ret := _mock.Called(_ca...)
-
-	if len(ret) == 0 {
-		panic("no return value specified for ListBranchesWithContext")
-	}
-
-	var r0 *codecommit.ListBranchesOutput
-	var r1 error
-	if returnFunc, ok := ret.Get(0).(func(aws.Context, *codecommit.ListBranchesInput, ...request.Option) (*codecommit.ListBranchesOutput, error)); ok {
-		return returnFunc(v, listBranchesInput, options...)
-	}
-	if returnFunc, ok := ret.Get(0).(func(aws.Context, *codecommit.ListBranchesInput, ...request.Option) *codecommit.ListBranchesOutput); ok {
-		r0 = returnFunc(v, listBranchesInput, options...)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*codecommit.ListBranchesOutput)
-		}
-	}
-	if returnFunc, ok := ret.Get(1).(func(aws.Context, *codecommit.ListBranchesInput, ...request.Option) error); ok {
-		r1 = returnFunc(v, listBranchesInput, options...)
-	} else {
-		r1 = ret.Error(1)
-	}
-	return r0, r1
-}
-
-// AWSCodeCommitClient_ListBranchesWithContext_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ListBranchesWithContext'
-type AWSCodeCommitClient_ListBranchesWithContext_Call struct {
-	*mock.Call
-}
-
-// ListBranchesWithContext is a helper method to define mock.On call
-//   - v aws.Context
-//   - listBranchesInput *codecommit.ListBranchesInput
-//   - options ...request.Option
-func (_e *AWSCodeCommitClient_Expecter) ListBranchesWithContext(v interface{}, listBranchesInput interface{}, options ...interface{}) *AWSCodeCommitClient_ListBranchesWithContext_Call {
-	return &AWSCodeCommitClient_ListBranchesWithContext_Call{Call: _e.mock.On("ListBranchesWithContext",
-		append([]interface{}{v, listBranchesInput}, options...)...)}
-}
-
-func (_c *AWSCodeCommitClient_ListBranchesWithContext_Call) Run(run func(v aws.Context, listBranchesInput *codecommit.ListBranchesInput, options ...request.Option)) *AWSCodeCommitClient_ListBranchesWithContext_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 aws.Context
-		if args[0] != nil {
-			arg0 = args[0].(aws.Context)
-		}
-		var arg1 *codecommit.ListBranchesInput
-		if args[1] != nil {
-			arg1 = args[1].(*codecommit.ListBranchesInput)
-		}
-		var arg2 []request.Option
-		variadicArgs := make([]request.Option, len(args)-2)
-		for i, a := range args[2:] {
-			if a != nil {
-				variadicArgs[i] = a.(request.Option)
-			}
-		}
-		arg2 = variadicArgs
-		run(
-			arg0,
-			arg1,
-			arg2...,
-		)
-	})
-	return _c
-}
-
-func (_c *AWSCodeCommitClient_ListBranchesWithContext_Call) Return(listBranchesOutput *codecommit.ListBranchesOutput, err error) *AWSCodeCommitClient_ListBranchesWithContext_Call {
-	_c.Call.Return(listBranchesOutput, err)
-	return _c
-}
-
-func (_c *AWSCodeCommitClient_ListBranchesWithContext_Call) RunAndReturn(run func(v aws.Context, listBranchesInput *codecommit.ListBranchesInput, options ...request.Option) (*codecommit.ListBranchesOutput, error)) *AWSCodeCommitClient_ListBranchesWithContext_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// ListRepositoriesWithContext provides a mock function for the type AWSCodeCommitClient
-func (_mock *AWSCodeCommitClient) ListRepositoriesWithContext(v aws.Context, listRepositoriesInput *codecommit.ListRepositoriesInput, options ...request.Option) (*codecommit.ListRepositoriesOutput, error) {
-	// request.Option
-	_va := make([]interface{}, len(options))
-	for _i := range options {
-		_va[_i] = options[_i]
-	}
-	var _ca []interface{}
-	_ca = append(_ca, v, listRepositoriesInput)
-	_ca = append(_ca, _va...)
-	ret := _mock.Called(_ca...)
-
-	if len(ret) == 0 {
-		panic("no return value specified for ListRepositoriesWithContext")
-	}
-
-	var r0 *codecommit.ListRepositoriesOutput
-	var r1 error
-	if returnFunc, ok := ret.Get(0).(func(aws.Context, *codecommit.ListRepositoriesInput, ...request.Option) (*codecommit.ListRepositoriesOutput, error)); ok {
-		return returnFunc(v, listRepositoriesInput, options...)
-	}
-	if returnFunc, ok := ret.Get(0).(func(aws.Context, *codecommit.ListRepositoriesInput, ...request.Option) *codecommit.ListRepositoriesOutput); ok {
-		r0 = returnFunc(v, listRepositoriesInput, options...)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*codecommit.ListRepositoriesOutput)
-		}
-	}
-	if returnFunc, ok := ret.Get(1).(func(aws.Context, *codecommit.ListRepositoriesInput, ...request.Option) error); ok {
-		r1 = returnFunc(v, listRepositoriesInput, options...)
-	} else {
-		r1 = ret.Error(1)
-	}
-	return r0, r1
-}
-
-// AWSCodeCommitClient_ListRepositoriesWithContext_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ListRepositoriesWithContext'
-type AWSCodeCommitClient_ListRepositoriesWithContext_Call struct {
-	*mock.Call
-}
-
-// ListRepositoriesWithContext is a helper method to define mock.On call
-//   - v aws.Context
-//   - listRepositoriesInput *codecommit.ListRepositoriesInput
-//   - options ...request.Option
-func (_e *AWSCodeCommitClient_Expecter) ListRepositoriesWithContext(v interface{}, listRepositoriesInput interface{}, options ...interface{}) *AWSCodeCommitClient_ListRepositoriesWithContext_Call {
-	return &AWSCodeCommitClient_ListRepositoriesWithContext_Call{Call: _e.mock.On("ListRepositoriesWithContext",
-		append([]interface{}{v, listRepositoriesInput}, options...)...)}
-}
-
-func (_c *AWSCodeCommitClient_ListRepositoriesWithContext_Call) Run(run func(v aws.Context, listRepositoriesInput *codecommit.ListRepositoriesInput, options ...request.Option)) *AWSCodeCommitClient_ListRepositoriesWithContext_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 aws.Context
-		if args[0] != nil {
-			arg0 = args[0].(aws.Context)
-		}
-		var arg1 *codecommit.ListRepositoriesInput
-		if args[1] != nil {
-			arg1 = args[1].(*codecommit.ListRepositoriesInput)
-		}
-		var arg2 []request.Option
-		variadicArgs := make([]request.Option, len(args)-2)
-		for i, a := range args[2:] {
-			if a != nil {
-				variadicArgs[i] = a.(request.Option)
-			}
-		}
-		arg2 = variadicArgs
-		run(
-			arg0,
-			arg1,
-			arg2...,
-		)
-	})
-	return _c
-}
-
-func (_c *AWSCodeCommitClient_ListRepositoriesWithContext_Call) Return(listRepositoriesOutput *codecommit.ListRepositoriesOutput, err error) *AWSCodeCommitClient_ListRepositoriesWithContext_Call {
-	_c.Call.Return(listRepositoriesOutput, err)
-	return _c
-}
-
-func (_c *AWSCodeCommitClient_ListRepositoriesWithContext_Call) RunAndReturn(run func(v aws.Context, listRepositoriesInput *codecommit.ListRepositoriesInput, options ...request.Option) (*codecommit.ListRepositoriesOutput, error)) *AWSCodeCommitClient_ListRepositoriesWithContext_Call {
-	_c.Call.Return(run)
-	return _c
-}
--- a/applicationset/services/scm_provider/aws_codecommit/mocks/AWSTaggingClient.go
+++ b/applicationset/services/scm_provider/aws_codecommit/mocks/AWSTaggingClient.go
@@ -1,16 +1,58 @@
-// Code generated by mockery; DO NOT EDIT.
-// github.com/vektra/mockery
-// template: testify
+// Code generated by mockery v2.52.4. DO NOT EDIT.

 package mocks

 import (
-	"github.com/aws/aws-sdk-go/aws"
-	"github.com/aws/aws-sdk-go/aws/request"
-	"github.com/aws/aws-sdk-go/service/resourcegroupstaggingapi"
+	context "context"
+
+	request "github.com/aws/aws-sdk-go/aws/request"
 	mock "github.com/stretchr/testify/mock"
+
+	resourcegroupstaggingapi "github.com/aws/aws-sdk-go/service/resourcegroupstaggingapi"
 )

+// AWSTaggingClient is an autogenerated mock type for the AWSTaggingClient type
+type AWSTaggingClient struct {
+	mock.Mock
+}
+
+// GetResourcesWithContext provides a mock function with given fields: _a0, _a1, _a2
+func (_m *AWSTaggingClient) GetResourcesWithContext(_a0 context.Context, _a1 *resourcegroupstaggingapi.GetResourcesInput, _a2 ...request.Option) (*resourcegroupstaggingapi.GetResourcesOutput, error) {
+	_va := make([]interface{}, len(_a2))
+	for _i := range _a2 {
+		_va[_i] = _a2[_i]
+	}
+	var _ca []interface{}
+	_ca = append(_ca, _a0, _a1)
+	_ca = append(_ca, _va...)
+	ret := _m.Called(_ca...)
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetResourcesWithContext")
+	}
+
+	var r0 *resourcegroupstaggingapi.GetResourcesOutput
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *resourcegroupstaggingapi.GetResourcesInput, ...request.Option) (*resourcegroupstaggingapi.GetResourcesOutput, error)); ok {
+		return rf(_a0, _a1, _a2...)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *resourcegroupstaggingapi.GetResourcesInput, ...request.Option) *resourcegroupstaggingapi.GetResourcesOutput); ok {
+		r0 = rf(_a0, _a1, _a2...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*resourcegroupstaggingapi.GetResourcesOutput)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *resourcegroupstaggingapi.GetResourcesInput, ...request.Option) error); ok {
+		r1 = rf(_a0, _a1, _a2...)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
 // NewAWSTaggingClient creates a new instance of AWSTaggingClient. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
 // The first argument is typically a *testing.T value.
 func NewAWSTaggingClient(t interface {
@@ -24,103 +66,3 @@ func NewAWSTaggingClient(t interface {

 	return mock
 }
-
-// AWSTaggingClient is an autogenerated mock type for the AWSTaggingClient type
-type AWSTaggingClient struct {
-	mock.Mock
-}
-
-type AWSTaggingClient_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *AWSTaggingClient) EXPECT() *AWSTaggingClient_Expecter {
-	return &AWSTaggingClient_Expecter{mock: &_m.Mock}
-}
-
-// GetResourcesWithContext provides a mock function for the type AWSTaggingClient
-func (_mock *AWSTaggingClient) GetResourcesWithContext(v aws.Context, getResourcesInput *resourcegroupstaggingapi.GetResourcesInput, options ...request.Option) (*resourcegroupstaggingapi.GetResourcesOutput, error) {
-	// request.Option
-	_va := make([]interface{}, len(options))
-	for _i := range options {
-		_va[_i] = options[_i]
-	}
-	var _ca []interface{}
-	_ca = append(_ca, v, getResourcesInput)
-	_ca = append(_ca, _va...)
-	ret := _mock.Called(_ca...)
-
-	if len(ret) == 0 {
-		panic("no return value specified for GetResourcesWithContext")
-	}
-
-	var r0 *resourcegroupstaggingapi.GetResourcesOutput
-	var r1 error
-	if returnFunc, ok := ret.Get(0).(func(aws.Context, *resourcegroupstaggingapi.GetResourcesInput, ...request.Option) (*resourcegroupstaggingapi.GetResourcesOutput, error)); ok {
-		return returnFunc(v, getResourcesInput, options...)
-	}
-	if returnFunc, ok := ret.Get(0).(func(aws.Context, *resourcegroupstaggingapi.GetResourcesInput, ...request.Option) *resourcegroupstaggingapi.GetResourcesOutput); ok {
-		r0 = returnFunc(v, getResourcesInput, options...)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*resourcegroupstaggingapi.GetResourcesOutput)
-		}
-	}
-	if returnFunc, ok := ret.Get(1).(func(aws.Context, *resourcegroupstaggingapi.GetResourcesInput, ...request.Option) error); ok {
-		r1 = returnFunc(v, getResourcesInput, options...)
-	} else {
-		r1 = ret.Error(1)
-	}
-	return r0, r1
-}
-
-// AWSTaggingClient_GetResourcesWithContext_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetResourcesWithContext'
-type AWSTaggingClient_GetResourcesWithContext_Call struct {
-	*mock.Call
-}
-
-// GetResourcesWithContext is a helper method to define mock.On call
-//   - v aws.Context
-//   - getResourcesInput *resourcegroupstaggingapi.GetResourcesInput
-//   - options ...request.Option
-func (_e *AWSTaggingClient_Expecter) GetResourcesWithContext(v interface{}, getResourcesInput interface{}, options ...interface{}) *AWSTaggingClient_GetResourcesWithContext_Call {
-	return &AWSTaggingClient_GetResourcesWithContext_Call{Call: _e.mock.On("GetResourcesWithContext",
-		append([]interface{}{v, getResourcesInput}, options...)...)}
-}
-
-func (_c *AWSTaggingClient_GetResourcesWithContext_Call) Run(run func(v aws.Context, getResourcesInput *resourcegroupstaggingapi.GetResourcesInput, options ...request.Option)) *AWSTaggingClient_GetResourcesWithContext_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 aws.Context
-		if args[0] != nil {
-			arg0 = args[0].(aws.Context)
-		}
-		var arg1 *resourcegroupstaggingapi.GetResourcesInput
-		if args[1] != nil {
-			arg1 = args[1].(*resourcegroupstaggingapi.GetResourcesInput)
-		}
-		var arg2 []request.Option
-		variadicArgs := make([]request.Option, len(args)-2)
-		for i, a := range args[2:] {
-			if a != nil {
-				variadicArgs[i] = a.(request.Option)
-			}
-		}
-		arg2 = variadicArgs
-		run(
-			arg0,
-			arg1,
-			arg2...,
-		)
-	})
-	return _c
-}
-
-func (_c *AWSTaggingClient_GetResourcesWithContext_Call) Return(getResourcesOutput *resourcegroupstaggingapi.GetResourcesOutput, err error) *AWSTaggingClient_GetResourcesWithContext_Call {
-	_c.Call.Return(getResourcesOutput, err)
-	return _c
-}
-
-func (_c *AWSTaggingClient_GetResourcesWithContext_Call) RunAndReturn(run func(v aws.Context, getResourcesInput *resourcegroupstaggingapi.GetResourcesInput, options ...request.Option) (*resourcegroupstaggingapi.GetResourcesOutput, error)) *AWSTaggingClient_GetResourcesWithContext_Call {
-	_c.Call.Return(run)
-	return _c
-}
--- a/applicationset/services/scm_provider/azure_devops.go
+++ b/applicationset/services/scm_provider/azure_devops.go
@@ -8,8 +8,8 @@ import (
 	"strings"

 	"github.com/google/uuid"
-	"github.com/microsoft/azure-devops-go-api/azuredevops/v7"
-	azureGit "github.com/microsoft/azure-devops-go-api/azuredevops/v7/git"
+	"github.com/microsoft/azure-devops-go-api/azuredevops"
+	azureGit "github.com/microsoft/azure-devops-go-api/azuredevops/git"
 )

 const AZURE_DEVOPS_DEFAULT_URL = "https://dev.azure.com"
@@ -47,6 +47,7 @@ func (factory *devopsFactoryImpl) GetClient(ctx context.Context) (azureGit.Clien
 type AzureDevOpsProvider struct {
 	organization  string
 	teamProject   string
+	accessToken   string
 	clientFactory AzureDevOpsClientFactory
 	allBranches   bool
 }
@@ -68,7 +69,7 @@ func NewAzureDevOpsProvider(accessToken string, org string, url string, project

 	connection := azuredevops.NewPatConnection(devOpsURL, accessToken)

-	return &AzureDevOpsProvider{organization: org, teamProject: project, clientFactory: &devopsFactoryImpl{connection: connection}, allBranches: allBranches}, nil
+	return &AzureDevOpsProvider{organization: org, teamProject: project, accessToken: accessToken, clientFactory: &devopsFactoryImpl{connection: connection}, allBranches: allBranches}, nil
 }

 func (g *AzureDevOpsProvider) ListRepos(ctx context.Context, _ string) ([]*Repository, error) {
--- a/applicationset/services/scm_provider/azure_devops/git/mocks/Client.go
+++ b/applicationset/services/scm_provider/azure_devops/git/mocks/Client.go
--- a/applicationset/services/scm_provider/azure_devops_test.go
+++ b/applicationset/services/scm_provider/azure_devops_test.go
@@ -12,8 +12,8 @@ import (
 	"github.com/stretchr/testify/require"
 	"k8s.io/utils/ptr"

-	"github.com/microsoft/azure-devops-go-api/azuredevops/v7"
-	azureGit "github.com/microsoft/azure-devops-go-api/azuredevops/v7/git"
+	"github.com/microsoft/azure-devops-go-api/azuredevops"
+	azureGit "github.com/microsoft/azure-devops-go-api/azuredevops/git"

 	azureMock "github.com/argoproj/argo-cd/v3/applicationset/services/scm_provider/azure_devops/git/mocks"
 )
--- a/applicationset/services/scm_provider/bitbucket_server.go
+++ b/applicationset/services/scm_provider/bitbucket_server.go
@@ -10,7 +10,7 @@ import (
 	bitbucketv1 "github.com/gfleury/go-bitbucket-v1"
 	log "github.com/sirupsen/logrus"

-	"github.com/argoproj/argo-cd/v3/applicationset/utils"
+	"github.com/argoproj/argo-cd/v3/applicationset/services"
 )

 type BitbucketServerProvider struct {
@@ -49,15 +49,10 @@ func NewBitbucketServerProviderNoAuth(ctx context.Context, url, projectKey strin
 }

 func newBitbucketServerProvider(ctx context.Context, bitbucketConfig *bitbucketv1.Configuration, projectKey string, allBranches bool, scmRootCAPath string, insecure bool, caCerts []byte) (*BitbucketServerProvider, error) {
-	bitbucketConfig.BasePath = utils.NormalizeBitbucketBasePath(bitbucketConfig.BasePath)
-	tlsConfig := utils.GetTlsConfig(scmRootCAPath, insecure, caCerts)
-	bitbucketConfig.HTTPClient = &http.Client{Transport: &http.Transport{
-		TLSClientConfig: tlsConfig,
-	}}
-	bitbucketClient := bitbucketv1.NewAPIClient(ctx, bitbucketConfig)
+	bbClient := services.SetupBitbucketClient(ctx, bitbucketConfig, scmRootCAPath, insecure, caCerts)

 	return &BitbucketServerProvider{
-		client:      bitbucketClient,
+		client:      bbClient,
 		projectKey:  projectKey,
 		allBranches: allBranches,
 	}, nil
--- a/applicationset/services/scm_provider/bitbucket_server_test.go
+++ b/applicationset/services/scm_provider/bitbucket_server_test.go
@@ -350,7 +350,6 @@ func TestGetBranchesMissingDefault(t *testing.T) {
 		assert.Empty(t, r.Header.Get("Authorization"))
 		if r.RequestURI == "/rest/api/1.0/projects/PROJECT/repos/REPO/branches/default" {
 			http.Error(w, "Not found", http.StatusNotFound)
-			return
 		}
 		defaultHandler(t)(w, r)
 	}))
@@ -394,7 +393,6 @@ func TestGetBranchesErrorDefaultBranch(t *testing.T) {
 		assert.Empty(t, r.Header.Get("Authorization"))
 		if r.RequestURI == "/rest/api/1.0/projects/PROJECT/repos/REPO/branches/default" {
 			http.Error(w, "Internal server error", http.StatusInternalServerError)
-			return
 		}
 		defaultHandler(t)(w, r)
 	}))
@@ -545,7 +543,6 @@ func TestListReposMissingDefaultBranch(t *testing.T) {
 		assert.Empty(t, r.Header.Get("Authorization"))
 		if r.RequestURI == "/rest/api/1.0/projects/PROJECT/repos/REPO/branches/default" {
 			http.Error(w, "Not found", http.StatusNotFound)
-			return
 		}
 		defaultHandler(t)(w, r)
 	}))
@@ -562,7 +559,6 @@ func TestListReposErrorDefaultBranch(t *testing.T) {
 		assert.Empty(t, r.Header.Get("Authorization"))
 		if r.RequestURI == "/rest/api/1.0/projects/PROJECT/repos/REPO/branches/default" {
 			http.Error(w, "Internal server error", http.StatusInternalServerError)
-			return
 		}
 		defaultHandler(t)(w, r)
 	}))
--- a/applicationset/services/scm_provider/github.go
+++ b/applicationset/services/scm_provider/github.go
@@ -6,9 +6,7 @@ import (
 	"net/http"
 	"os"

-	"github.com/google/go-github/v69/github"
-
-	appsetutils "github.com/argoproj/argo-cd/v3/applicationset/utils"
+	"github.com/google/go-github/v66/github"
 )

 type GithubProvider struct {
@@ -19,15 +17,13 @@ type GithubProvider struct {

 var _ SCMProviderService = &GithubProvider{}

-func NewGithubProvider(organization string, token string, url string, allBranches bool, optionalHTTPClient ...*http.Client) (*GithubProvider, error) {
+func NewGithubProvider(organization string, token string, url string, allBranches bool) (*GithubProvider, error) {
 	// Undocumented environment variable to set a default token, to be used in testing to dodge anonymous rate limits.
 	if token == "" {
 		token = os.Getenv("GITHUB_TOKEN")
 	}
-
+	httpClient := &http.Client{}
 	var client *github.Client
-	httpClient := appsetutils.GetOptionalHTTPClient(optionalHTTPClient...)
-
 	if url == "" {
 		if token == "" {
 			client = github.NewClient(httpClient)
@@ -36,7 +32,11 @@ func NewGithubProvider(organization string, token string, url string, allBranche
 		}
 	} else {
 		var err error
-		client, err = github.NewClient(httpClient).WithEnterpriseURLs(url, url)
+		if token == "" {
+			client, err = github.NewClient(httpClient).WithEnterpriseURLs(url, url)
+		} else {
+			client, err = github.NewClient(httpClient).WithAuthToken(token).WithEnterpriseURLs(url, url)
+		}
 		if err != nil {
 			return nil, err
 		}
--- a/applicationset/services/scm_provider/github_app.go
+++ b/applicationset/services/scm_provider/github_app.go
@@ -1,16 +1,12 @@
 package scm_provider

 import (
-	"net/http"
-
 	"github.com/argoproj/argo-cd/v3/applicationset/services/github_app_auth"
 	"github.com/argoproj/argo-cd/v3/applicationset/services/internal/github_app"
-	appsetutils "github.com/argoproj/argo-cd/v3/applicationset/utils"
 )

-func NewGithubAppProviderFor(g github_app_auth.Authentication, organization string, url string, allBranches bool, optionalHTTPClient ...*http.Client) (*GithubProvider, error) {
-	httpClient := appsetutils.GetOptionalHTTPClient(optionalHTTPClient...)
-	client, err := github_app.Client(g, url, httpClient)
+func NewGithubAppProviderFor(g github_app_auth.Authentication, organization string, url string, allBranches bool) (*GithubProvider, error) {
+	client, err := github_app.Client(g, url)
 	if err != nil {
 		return nil, err
 	}
--- a/applicationset/services/scm_provider/github_test.go
+++ b/applicationset/services/scm_provider/github_test.go
@@ -267,14 +267,6 @@ func TestGithubListRepos(t *testing.T) {
 	}
 }

-/*
-	metricsCtx := &services.MetricsContext{
-		AppSetNamespace: "test-ns",
-		AppSetName:      "test-appset",
-	}
-
-httpClient := services.NewGitHubMetricsClient(metricsCtx)
-*/
 func TestGithubHasPath(t *testing.T) {
 	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		githubMockHandler(t)(w, r)
--- a/applicationset/services/scm_provider/gitlab.go
+++ b/applicationset/services/scm_provider/gitlab.go
@@ -104,7 +104,6 @@ func (g *GitlabProvider) ListRepos(_ context.Context, cloneProtocol string) ([]*
 			var repoLabels []string
 			if len(gitlabRepo.Topics) == 0 {
 				// fallback to for gitlab prior to 14.5
-				//nolint:staticcheck
 				repoLabels = gitlabRepo.TagList
 			} else {
 				repoLabels = gitlabRepo.Topics
--- a/applicationset/services/scm_provider/utils.go
+++ b/applicationset/services/scm_provider/utils.go
@@ -172,10 +172,9 @@ func getApplicableFilters(filters []*Filter) map[FilterType][]*Filter {
 		FilterTypeRepo:   {},
 	}
 	for _, filter := range filters {
-		switch filter.FilterType {
-		case FilterTypeBranch:
+		if filter.FilterType == FilterTypeBranch {
 			filterMap[FilterTypeBranch] = append(filterMap[FilterTypeBranch], filter)
-		case FilterTypeRepo:
+		} else if filter.FilterType == FilterTypeRepo {
 			filterMap[FilterTypeRepo] = append(filterMap[FilterTypeRepo], filter)
 		}
 	}
--- a/applicationset/services/util.go
+++ b/applicationset/services/util.go
@@ -0,0 +1,22 @@
+package services
+
+import (
+	"context"
+	"net/http"
+
+	bitbucketv1 "github.com/gfleury/go-bitbucket-v1"
+
+	"github.com/argoproj/argo-cd/v3/applicationset/utils"
+)
+
+// SetupBitbucketClient configures and creates a Bitbucket API client with TLS settings
+func SetupBitbucketClient(ctx context.Context, config *bitbucketv1.Configuration, scmRootCAPath string, insecure bool, caCerts []byte) *bitbucketv1.APIClient {
+	config.BasePath = utils.NormalizeBitbucketBasePath(config.BasePath)
+	tlsConfig := utils.GetTlsConfig(scmRootCAPath, insecure, caCerts)
+
+	transport := http.DefaultTransport.(*http.Transport).Clone()
+	transport.TLSClientConfig = tlsConfig
+	config.HTTPClient = &http.Client{Transport: transport}
+
+	return bitbucketv1.NewAPIClient(ctx, config)
+}
--- a/applicationset/services/util_test.go
+++ b/applicationset/services/util_test.go
@@ -0,0 +1,36 @@
+package services
+
+import (
+	"crypto/tls"
+	"net/http"
+	"testing"
+	"time"
+
+	bitbucketv1 "github.com/gfleury/go-bitbucket-v1"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSetupBitbucketClient(t *testing.T) {
+	ctx := t.Context()
+	cfg := &bitbucketv1.Configuration{}
+
+	// Act
+	client := SetupBitbucketClient(ctx, cfg, "", false, nil)
+
+	// Assert
+	require.NotNil(t, client, "expected client to be created")
+	require.NotNil(t, cfg.HTTPClient, "expected HTTPClient to be set")
+
+	// The transport should be a clone of DefaultTransport
+	tr, ok := cfg.HTTPClient.Transport.(*http.Transport)
+	require.True(t, ok, "expected HTTPClient.Transport to be *http.Transport")
+	require.NotSame(t, http.DefaultTransport, tr, "transport should be a clone, not the global DefaultTransport")
+
+	// Ensure TLSClientConfig is set
+	require.IsType(t, &tls.Config{}, tr.TLSClientConfig)
+
+	// Defaults from http.DefaultTransport.Clone() should be preserved
+	require.Greater(t, tr.IdleConnTimeout, time.Duration(0), "IdleConnTimeout should be non-zero")
+	require.Positive(t, tr.MaxIdleConns, "MaxIdleConns should be non-zero")
+	require.Greater(t, tr.TLSHandshakeTimeout, time.Duration(0), "TLSHandshakeTimeout should be non-zero")
+}
--- a/applicationset/status/resource_status.go
+++ b/applicationset/status/resource_status.go
@@ -17,7 +17,7 @@ func BuildResourceStatus(statusMap map[string]argov1alpha1.ResourceStatus, apps
 		status.Name = app.Name
 		status.Namespace = app.Namespace
 		status.Status = app.Status.Sync.Status
-		status.Health = &argov1alpha1.HealthStatus{Status: app.Status.Health.Status}
+		status.Health = app.Status.Health.DeepCopy()

 		statusMap[app.Name] = status
 	}
--- a/applicationset/utils/applicationset_lister.go
+++ b/applicationset/utils/applicationset_lister.go
@@ -6,8 +6,8 @@ import (
 	"k8s.io/apimachinery/pkg/labels"
 	ctrlclient "sigs.k8s.io/controller-runtime/pkg/client"

-	"github.com/argoproj/argo-cd/v3/pkg/apis/application/v1alpha1"
-	listers "github.com/argoproj/argo-cd/v3/pkg/client/listers/application/v1alpha1"
+	. "github.com/argoproj/argo-cd/v3/pkg/apis/application/v1alpha1"
+	. "github.com/argoproj/argo-cd/v3/pkg/client/listers/application/v1alpha1"
 )

 // Implements AppsetLister interface with controller-runtime client
@@ -15,16 +15,16 @@ type AppsetLister struct {
 	Client ctrlclient.Client
 }

-func NewAppsetLister(client ctrlclient.Client) listers.ApplicationSetLister {
+func NewAppsetLister(client ctrlclient.Client) ApplicationSetLister {
 	return &AppsetLister{Client: client}
 }

-func (l *AppsetLister) List(_ labels.Selector) (ret []*v1alpha1.ApplicationSet, err error) {
+func (l *AppsetLister) List(_ labels.Selector) (ret []*ApplicationSet, err error) {
 	return clientListAppsets(l.Client, ctrlclient.ListOptions{})
 }

 // ApplicationSets returns an object that can list and get ApplicationSets.
-func (l *AppsetLister) ApplicationSets(namespace string) listers.ApplicationSetNamespaceLister {
+func (l *AppsetLister) ApplicationSets(namespace string) ApplicationSetNamespaceLister {
 	return &appsetNamespaceLister{
 		Client:    l.Client,
 		Namespace: namespace,
@@ -37,19 +37,19 @@ type appsetNamespaceLister struct {
 	Namespace string
 }

-func (n *appsetNamespaceLister) List(_ labels.Selector) (ret []*v1alpha1.ApplicationSet, err error) {
+func (n *appsetNamespaceLister) List(_ labels.Selector) (ret []*ApplicationSet, err error) {
 	return clientListAppsets(n.Client, ctrlclient.ListOptions{Namespace: n.Namespace})
 }

-func (n *appsetNamespaceLister) Get(_ string) (*v1alpha1.ApplicationSet, error) {
-	appset := v1alpha1.ApplicationSet{}
+func (n *appsetNamespaceLister) Get(_ string) (*ApplicationSet, error) {
+	appset := ApplicationSet{}
 	err := n.Client.Get(context.TODO(), ctrlclient.ObjectKeyFromObject(&appset), &appset)
 	return &appset, err
 }

-func clientListAppsets(client ctrlclient.Client, listOptions ctrlclient.ListOptions) (ret []*v1alpha1.ApplicationSet, err error) {
-	var appsetlist v1alpha1.ApplicationSetList
-	var results []*v1alpha1.ApplicationSet
+func clientListAppsets(client ctrlclient.Client, listOptions ctrlclient.ListOptions) (ret []*ApplicationSet, err error) {
+	var appsetlist ApplicationSetList
+	var results []*ApplicationSet

 	err = client.List(context.TODO(), &appsetlist, &listOptions)

--- a/applicationset/utils/createOrUpdate.go
+++ b/applicationset/utils/createOrUpdate.go
@@ -79,10 +79,10 @@ func CreateOrUpdate(ctx context.Context, logCtx *log.Entry, c client.Client, ign
 			return a.Cmp(b) == 0
 		},
 		func(a, b metav1.MicroTime) bool {
-			return a.UTC().Equal(b.UTC())
+			return a.UTC() == b.UTC()
 		},
 		func(a, b metav1.Time) bool {
-			return a.UTC().Equal(b.UTC())
+			return a.UTC() == b.UTC()
 		},
 		func(a, b labels.Selector) bool {
 			return a.String() == b.String()
--- a/applicationset/utils/createOrUpdate_test.go
+++ b/applicationset/utils/createOrUpdate_test.go
@@ -13,8 +13,6 @@ import (
 )

 func Test_applyIgnoreDifferences(t *testing.T) {
-	t.Parallel()
-
 	appMeta := metav1.TypeMeta{
 		APIVersion: v1alpha1.ApplicationSchemaGroupVersionKind.GroupVersion().String(),
 		Kind:       v1alpha1.ApplicationSchemaGroupVersionKind.Kind,
--- a/applicationset/utils/map.go
+++ b/applicationset/utils/map.go
@@ -13,11 +13,20 @@ func ConvertToMapStringString(mapStringInterface map[string]any) map[string]stri
 	return mapStringString
 }

-func CombineStringMaps(aSI map[string]any, bSI map[string]any) (map[string]any, error) {
+func ConvertToMapStringInterface(mapStringString map[string]string) map[string]any {
+	mapStringInterface := make(map[string]any, len(mapStringString))
+
+	for key, value := range mapStringString {
+		mapStringInterface[key] = value
+	}
+	return mapStringInterface
+}
+
+func CombineStringMaps(aSI map[string]any, bSI map[string]any) (map[string]string, error) {
 	a := ConvertToMapStringString(aSI)
 	b := ConvertToMapStringString(bSI)

-	res := map[string]any{}
+	res := map[string]string{}

 	for k, v := range a {
 		res[k] = v
@@ -33,3 +42,21 @@ func CombineStringMaps(aSI map[string]any, bSI map[string]any) (map[string]any,

 	return res, nil
 }
+
+// CombineStringMapsAllowDuplicates merges two maps. Where there are duplicates, take the latter map's value.
+func CombineStringMapsAllowDuplicates(aSI map[string]any, bSI map[string]any) (map[string]string, error) {
+	a := ConvertToMapStringString(aSI)
+	b := ConvertToMapStringString(bSI)
+
+	res := map[string]string{}
+
+	for k, v := range a {
+		res[k] = v
+	}
+
+	for k, v := range b {
+		res[k] = v
+	}
+
+	return res, nil
+}
--- a/applicationset/utils/map_test.go
+++ b/applicationset/utils/map_test.go
@@ -9,34 +9,32 @@ import (
 )

 func TestCombineStringMaps(t *testing.T) {
-	t.Parallel()
-
 	testCases := []struct {
 		name        string
 		left        map[string]any
 		right       map[string]any
-		expected    map[string]any
+		expected    map[string]string
 		expectedErr error
 	}{
 		{
 			name:        "combines the maps",
 			left:        map[string]any{"foo": "bar"},
 			right:       map[string]any{"a": "b"},
-			expected:    map[string]any{"a": "b", "foo": "bar"},
+			expected:    map[string]string{"a": "b", "foo": "bar"},
 			expectedErr: nil,
 		},
 		{
 			name:        "fails if keys are the same but value isn't",
 			left:        map[string]any{"foo": "bar", "a": "fail"},
 			right:       map[string]any{"a": "b", "c": "d"},
-			expected:    map[string]any{"a": "b", "foo": "bar"},
+			expected:    map[string]string{"a": "b", "foo": "bar"},
 			expectedErr: errors.New("found duplicate key a with different value, a: fail ,b: b"),
 		},
 		{
 			name:        "pass if keys & values are the same",
 			left:        map[string]any{"foo": "bar", "a": "b"},
 			right:       map[string]any{"a": "b", "c": "d"},
-			expected:    map[string]any{"a": "b", "c": "d", "foo": "bar"},
+			expected:    map[string]string{"a": "b", "c": "d", "foo": "bar"},
 			expectedErr: nil,
 		},
 	}
--- a/applicationset/utils/mocks/Renderer.go
+++ b/applicationset/utils/mocks/Renderer.go
@@ -1,14 +1,76 @@
-// Code generated by mockery; DO NOT EDIT.
-// github.com/vektra/mockery
-// template: testify
+// Code generated by mockery v2.52.4. DO NOT EDIT.

 package mocks

 import (
-	"github.com/argoproj/argo-cd/v3/pkg/apis/application/v1alpha1"
 	mock "github.com/stretchr/testify/mock"
+
+	v1alpha1 "github.com/argoproj/argo-cd/v3/pkg/apis/application/v1alpha1"
 )

+// Renderer is an autogenerated mock type for the Renderer type
+type Renderer struct {
+	mock.Mock
+}
+
+// RenderTemplateParams provides a mock function with given fields: tmpl, syncPolicy, params, useGoTemplate, goTemplateOptions
+func (_m *Renderer) RenderTemplateParams(tmpl *v1alpha1.Application, syncPolicy *v1alpha1.ApplicationSetSyncPolicy, params map[string]interface{}, useGoTemplate bool, goTemplateOptions []string) (*v1alpha1.Application, error) {
+	ret := _m.Called(tmpl, syncPolicy, params, useGoTemplate, goTemplateOptions)
+
+	if len(ret) == 0 {
+		panic("no return value specified for RenderTemplateParams")
+	}
+
+	var r0 *v1alpha1.Application
+	var r1 error
+	if rf, ok := ret.Get(0).(func(*v1alpha1.Application, *v1alpha1.ApplicationSetSyncPolicy, map[string]interface{}, bool, []string) (*v1alpha1.Application, error)); ok {
+		return rf(tmpl, syncPolicy, params, useGoTemplate, goTemplateOptions)
+	}
+	if rf, ok := ret.Get(0).(func(*v1alpha1.Application, *v1alpha1.ApplicationSetSyncPolicy, map[string]interface{}, bool, []string) *v1alpha1.Application); ok {
+		r0 = rf(tmpl, syncPolicy, params, useGoTemplate, goTemplateOptions)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*v1alpha1.Application)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(*v1alpha1.Application, *v1alpha1.ApplicationSetSyncPolicy, map[string]interface{}, bool, []string) error); ok {
+		r1 = rf(tmpl, syncPolicy, params, useGoTemplate, goTemplateOptions)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// Replace provides a mock function with given fields: tmpl, replaceMap, useGoTemplate, goTemplateOptions
+func (_m *Renderer) Replace(tmpl string, replaceMap map[string]interface{}, useGoTemplate bool, goTemplateOptions []string) (string, error) {
+	ret := _m.Called(tmpl, replaceMap, useGoTemplate, goTemplateOptions)
+
+	if len(ret) == 0 {
+		panic("no return value specified for Replace")
+	}
+
+	var r0 string
+	var r1 error
+	if rf, ok := ret.Get(0).(func(string, map[string]interface{}, bool, []string) (string, error)); ok {
+		return rf(tmpl, replaceMap, useGoTemplate, goTemplateOptions)
+	}
+	if rf, ok := ret.Get(0).(func(string, map[string]interface{}, bool, []string) string); ok {
+		r0 = rf(tmpl, replaceMap, useGoTemplate, goTemplateOptions)
+	} else {
+		r0 = ret.Get(0).(string)
+	}
+
+	if rf, ok := ret.Get(1).(func(string, map[string]interface{}, bool, []string) error); ok {
+		r1 = rf(tmpl, replaceMap, useGoTemplate, goTemplateOptions)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
 // NewRenderer creates a new instance of Renderer. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
 // The first argument is typically a *testing.T value.
 func NewRenderer(t interface {
@@ -22,180 +84,3 @@ func NewRenderer(t interface {

 	return mock
 }
-
-// Renderer is an autogenerated mock type for the Renderer type
-type Renderer struct {
-	mock.Mock
-}
-
-type Renderer_Expecter struct {
-	mock *mock.Mock
-}
-
-func (_m *Renderer) EXPECT() *Renderer_Expecter {
-	return &Renderer_Expecter{mock: &_m.Mock}
-}
-
-// RenderTemplateParams provides a mock function for the type Renderer
-func (_mock *Renderer) RenderTemplateParams(tmpl *v1alpha1.Application, syncPolicy *v1alpha1.ApplicationSetSyncPolicy, params map[string]any, useGoTemplate bool, goTemplateOptions []string) (*v1alpha1.Application, error) {
-	ret := _mock.Called(tmpl, syncPolicy, params, useGoTemplate, goTemplateOptions)
-
-	if len(ret) == 0 {
-		panic("no return value specified for RenderTemplateParams")
-	}
-
-	var r0 *v1alpha1.Application
-	var r1 error
-	if returnFunc, ok := ret.Get(0).(func(*v1alpha1.Application, *v1alpha1.ApplicationSetSyncPolicy, map[string]any, bool, []string) (*v1alpha1.Application, error)); ok {
-		return returnFunc(tmpl, syncPolicy, params, useGoTemplate, goTemplateOptions)
-	}
-	if returnFunc, ok := ret.Get(0).(func(*v1alpha1.Application, *v1alpha1.ApplicationSetSyncPolicy, map[string]any, bool, []string) *v1alpha1.Application); ok {
-		r0 = returnFunc(tmpl, syncPolicy, params, useGoTemplate, goTemplateOptions)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).(*v1alpha1.Application)
-		}
-	}
-	if returnFunc, ok := ret.Get(1).(func(*v1alpha1.Application, *v1alpha1.ApplicationSetSyncPolicy, map[string]any, bool, []string) error); ok {
-		r1 = returnFunc(tmpl, syncPolicy, params, useGoTemplate, goTemplateOptions)
-	} else {
-		r1 = ret.Error(1)
-	}
-	return r0, r1
-}
-
-// Renderer_RenderTemplateParams_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'RenderTemplateParams'
-type Renderer_RenderTemplateParams_Call struct {
-	*mock.Call
-}
-
-// RenderTemplateParams is a helper method to define mock.On call
-//   - tmpl *v1alpha1.Application
-//   - syncPolicy *v1alpha1.ApplicationSetSyncPolicy
-//   - params map[string]any
-//   - useGoTemplate bool
-//   - goTemplateOptions []string
-func (_e *Renderer_Expecter) RenderTemplateParams(tmpl interface{}, syncPolicy interface{}, params interface{}, useGoTemplate interface{}, goTemplateOptions interface{}) *Renderer_RenderTemplateParams_Call {
-	return &Renderer_RenderTemplateParams_Call{Call: _e.mock.On("RenderTemplateParams", tmpl, syncPolicy, params, useGoTemplate, goTemplateOptions)}
-}
-
-func (_c *Renderer_RenderTemplateParams_Call) Run(run func(tmpl *v1alpha1.Application, syncPolicy *v1alpha1.ApplicationSetSyncPolicy, params map[string]any, useGoTemplate bool, goTemplateOptions []string)) *Renderer_RenderTemplateParams_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 *v1alpha1.Application
-		if args[0] != nil {
-			arg0 = args[0].(*v1alpha1.Application)
-		}
-		var arg1 *v1alpha1.ApplicationSetSyncPolicy
-		if args[1] != nil {
-			arg1 = args[1].(*v1alpha1.ApplicationSetSyncPolicy)
-		}
-		var arg2 map[string]any
-		if args[2] != nil {
-			arg2 = args[2].(map[string]any)
-		}
-		var arg3 bool
-		if args[3] != nil {
-			arg3 = args[3].(bool)
-		}
-		var arg4 []string
-		if args[4] != nil {
-			arg4 = args[4].([]string)
-		}
-		run(
-			arg0,
-			arg1,
-			arg2,
-			arg3,
-			arg4,
-		)
-	})
-	return _c
-}
-
-func (_c *Renderer_RenderTemplateParams_Call) Return(application *v1alpha1.Application, err error) *Renderer_RenderTemplateParams_Call {
-	_c.Call.Return(application, err)
-	return _c
-}
-
-func (_c *Renderer_RenderTemplateParams_Call) RunAndReturn(run func(tmpl *v1alpha1.Application, syncPolicy *v1alpha1.ApplicationSetSyncPolicy, params map[string]any, useGoTemplate bool, goTemplateOptions []string) (*v1alpha1.Application, error)) *Renderer_RenderTemplateParams_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
-// Replace provides a mock function for the type Renderer
-func (_mock *Renderer) Replace(tmpl string, replaceMap map[string]any, useGoTemplate bool, goTemplateOptions []string) (string, error) {
-	ret := _mock.Called(tmpl, replaceMap, useGoTemplate, goTemplateOptions)
-
-	if len(ret) == 0 {
-		panic("no return value specified for Replace")
-	}
-
-	var r0 string
-	var r1 error
-	if returnFunc, ok := ret.Get(0).(func(string, map[string]any, bool, []string) (string, error)); ok {
-		return returnFunc(tmpl, replaceMap, useGoTemplate, goTemplateOptions)
-	}
-	if returnFunc, ok := ret.Get(0).(func(string, map[string]any, bool, []string) string); ok {
-		r0 = returnFunc(tmpl, replaceMap, useGoTemplate, goTemplateOptions)
-	} else {
-		r0 = ret.Get(0).(string)
-	}
-	if returnFunc, ok := ret.Get(1).(func(string, map[string]any, bool, []string) error); ok {
-		r1 = returnFunc(tmpl, replaceMap, useGoTemplate, goTemplateOptions)
-	} else {
-		r1 = ret.Error(1)
-	}
-	return r0, r1
-}
-
-// Renderer_Replace_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'Replace'
-type Renderer_Replace_Call struct {
-	*mock.Call
-}
-
-// Replace is a helper method to define mock.On call
-//   - tmpl string
-//   - replaceMap map[string]any
-//   - useGoTemplate bool
-//   - goTemplateOptions []string
-func (_e *Renderer_Expecter) Replace(tmpl interface{}, replaceMap interface{}, useGoTemplate interface{}, goTemplateOptions interface{}) *Renderer_Replace_Call {
-	return &Renderer_Replace_Call{Call: _e.mock.On("Replace", tmpl, replaceMap, useGoTemplate, goTemplateOptions)}
-}
-
-func (_c *Renderer_Replace_Call) Run(run func(tmpl string, replaceMap map[string]any, useGoTemplate bool, goTemplateOptions []string)) *Renderer_Replace_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 string
-		if args[0] != nil {
-			arg0 = args[0].(string)
-		}
-		var arg1 map[string]any
-		if args[1] != nil {
-			arg1 = args[1].(map[string]any)
-		}
-		var arg2 bool
-		if args[2] != nil {
-			arg2 = args[2].(bool)
-		}
-		var arg3 []string
-		if args[3] != nil {
-			arg3 = args[3].([]string)
-		}
-		run(
-			arg0,
-			arg1,
-			arg2,
-			arg3,
-		)
-	})
-	return _c
-}
-
-func (_c *Renderer_Replace_Call) Return(s string, err error) *Renderer_Replace_Call {
-	_c.Call.Return(s, err)
-	return _c
-}
-
-func (_c *Renderer_Replace_Call) RunAndReturn(run func(tmpl string, replaceMap map[string]any, useGoTemplate bool, goTemplateOptions []string) (string, error)) *Renderer_Replace_Call {
-	_c.Call.Return(run)
-	return _c
-}
--- a/applicationset/utils/utils.go
+++ b/applicationset/utils/utils.go
@@ -8,7 +8,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"net/http"
 	"os"
 	"reflect"
 	"regexp"
@@ -59,14 +58,14 @@ func copyValueIntoUnexported(destination, value reflect.Value) {
 		Set(value)
 }

-func copyUnexported(destination, original reflect.Value) {
+func copyUnexported(copy, original reflect.Value) {
 	unexported := reflect.NewAt(original.Type(), unsafe.Pointer(original.UnsafeAddr())).Elem()
-	copyValueIntoUnexported(destination, unexported)
+	copyValueIntoUnexported(copy, unexported)
 }

 func IsJSONStr(str string) bool {
 	str = strings.TrimSpace(str)
-	return str != "" && str[0] == '{'
+	return len(str) > 0 && str[0] == '{'
 }

 func ConvertYAMLToJSON(str string) (string, error) {
@@ -82,7 +81,7 @@ func ConvertYAMLToJSON(str string) (string, error) {

 // This function is in charge of searching all String fields of the object recursively and apply templating
 // thanks to https://gist.github.com/randallmlough/1fd78ec8a1034916ca52281e3b886dc7
-func (r *Render) deeplyReplace(destination, original reflect.Value, replaceMap map[string]any, useGoTemplate bool, goTemplateOptions []string) error {
+func (r *Render) deeplyReplace(copy, original reflect.Value, replaceMap map[string]any, useGoTemplate bool, goTemplateOptions []string) error {
 	switch original.Kind() {
 	// The first cases handle nested structures and translate them recursively
 	// If it is a pointer we need to unwrap and call once again
@@ -97,12 +96,12 @@ func (r *Render) deeplyReplace(destination, original reflect.Value, replaceMap m
 		}
 		// Allocate a new object and set the pointer to it
 		if originalValue.CanSet() {
-			destination.Set(reflect.New(originalValue.Type()))
+			copy.Set(reflect.New(originalValue.Type()))
 		} else {
-			copyUnexported(destination, original)
+			copyUnexported(copy, original)
 		}
 		// Unwrap the newly created pointer
-		if err := r.deeplyReplace(destination.Elem(), originalValue, replaceMap, useGoTemplate, goTemplateOptions); err != nil {
+		if err := r.deeplyReplace(copy.Elem(), originalValue, replaceMap, useGoTemplate, goTemplateOptions); err != nil {
 			// Not wrapping the error, since this is a recursive function. Avoids excessively long error messages.
 			return err
 		}
@@ -127,7 +126,7 @@ func (r *Render) deeplyReplace(destination, original reflect.Value, replaceMap m
 				// Not wrapping the error, since this is a recursive function. Avoids excessively long error messages.
 				return err
 			}
-			destination.Set(copyValue)
+			copy.Set(copyValue)
 		}

 	// If it is a struct we translate each field
@@ -136,7 +135,7 @@ func (r *Render) deeplyReplace(destination, original reflect.Value, replaceMap m
 			currentType := fmt.Sprintf("%s.%s", original.Type().Field(i).Name, original.Type().PkgPath())
 			// specific case time
 			if currentType == "time.Time" {
-				destination.Field(i).Set(original.Field(i))
+				copy.Field(i).Set(original.Field(i))
 			} else if currentType == "Raw.k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1" || currentType == "Raw.k8s.io/apimachinery/pkg/runtime" {
 				var unmarshaled any
 				originalBytes := original.Field(i).Bytes()
@@ -159,8 +158,8 @@ func (r *Render) deeplyReplace(destination, original reflect.Value, replaceMap m
 				if err != nil {
 					return fmt.Errorf("failed to marshal templated JSON field: %w", err)
 				}
-				destination.Field(i).Set(reflect.ValueOf(data))
-			} else if err := r.deeplyReplace(destination.Field(i), original.Field(i), replaceMap, useGoTemplate, goTemplateOptions); err != nil {
+				copy.Field(i).Set(reflect.ValueOf(data))
+			} else if err := r.deeplyReplace(copy.Field(i), original.Field(i), replaceMap, useGoTemplate, goTemplateOptions); err != nil {
 				// Not wrapping the error, since this is a recursive function. Avoids excessively long error messages.
 				return err
 			}
@@ -168,14 +167,14 @@ func (r *Render) deeplyReplace(destination, original reflect.Value, replaceMap m

 	// If it is a slice we create a new slice and translate each element
 	case reflect.Slice:
-		if destination.CanSet() {
-			destination.Set(reflect.MakeSlice(original.Type(), original.Len(), original.Cap()))
+		if copy.CanSet() {
+			copy.Set(reflect.MakeSlice(original.Type(), original.Len(), original.Cap()))
 		} else {
-			copyValueIntoUnexported(destination, reflect.MakeSlice(original.Type(), original.Len(), original.Cap()))
+			copyValueIntoUnexported(copy, reflect.MakeSlice(original.Type(), original.Len(), original.Cap()))
 		}

 		for i := 0; i < original.Len(); i++ {
-			if err := r.deeplyReplace(destination.Index(i), original.Index(i), replaceMap, useGoTemplate, goTemplateOptions); err != nil {
+			if err := r.deeplyReplace(copy.Index(i), original.Index(i), replaceMap, useGoTemplate, goTemplateOptions); err != nil {
 				// Not wrapping the error, since this is a recursive function. Avoids excessively long error messages.
 				return err
 			}
@@ -183,10 +182,10 @@ func (r *Render) deeplyReplace(destination, original reflect.Value, replaceMap m

 	// If it is a map we create a new map and translate each value
 	case reflect.Map:
-		if destination.CanSet() {
-			destination.Set(reflect.MakeMap(original.Type()))
+		if copy.CanSet() {
+			copy.Set(reflect.MakeMap(original.Type()))
 		} else {
-			copyValueIntoUnexported(destination, reflect.MakeMap(original.Type()))
+			copyValueIntoUnexported(copy, reflect.MakeMap(original.Type()))
 		}
 		for _, key := range original.MapKeys() {
 			originalValue := original.MapIndex(key)
@@ -211,7 +210,7 @@ func (r *Render) deeplyReplace(destination, original reflect.Value, replaceMap m
 				key = reflect.ValueOf(templatedKey)
 			}

-			destination.SetMapIndex(key, copyValue)
+			copy.SetMapIndex(key, copyValue)
 		}

 	// Otherwise we cannot traverse anywhere so this finishes the recursion
@@ -223,19 +222,19 @@ func (r *Render) deeplyReplace(destination, original reflect.Value, replaceMap m
 			// Not wrapping the error, since this is a recursive function. Avoids excessively long error messages.
 			return err
 		}
-		if destination.CanSet() {
-			destination.SetString(templated)
+		if copy.CanSet() {
+			copy.SetString(templated)
 		} else {
-			copyValueIntoUnexported(destination, reflect.ValueOf(templated))
+			copyValueIntoUnexported(copy, reflect.ValueOf(templated))
 		}
 		return nil

 	// And everything else will simply be taken from the original
 	default:
-		if destination.CanSet() {
-			destination.Set(original)
+		if copy.CanSet() {
+			copy.Set(original)
 		} else {
-			copyUnexported(destination, original)
+			copyUnexported(copy, original)
 		}
 	}
 	return nil
@@ -261,13 +260,13 @@ func (r *Render) RenderTemplateParams(tmpl *argoappsv1.Application, syncPolicy *
 	}

 	original := reflect.ValueOf(tmpl)
-	destination := reflect.New(original.Type()).Elem()
+	copy := reflect.New(original.Type()).Elem()

-	if err := r.deeplyReplace(destination, original, params, useGoTemplate, goTemplateOptions); err != nil {
+	if err := r.deeplyReplace(copy, original, params, useGoTemplate, goTemplateOptions); err != nil {
 		return nil, err
 	}

-	replacedTmpl := destination.Interface().(*argoappsv1.Application)
+	replacedTmpl := copy.Interface().(*argoappsv1.Application)

 	// Add the 'resources-finalizer' finalizer if:
 	// The template application doesn't have any finalizers, and:
@@ -275,8 +274,8 @@ func (r *Render) RenderTemplateParams(tmpl *argoappsv1.Application, syncPolicy *
 	// b) there IS a syncPolicy, but preserveResourcesOnDeletion is set to false
 	// See TestRenderTemplateParamsFinalizers in util_test.go for test-based definition of behaviour
 	if (syncPolicy == nil || !syncPolicy.PreserveResourcesOnDeletion) &&
-		len(replacedTmpl.Finalizers) == 0 {
-		replacedTmpl.Finalizers = []string{argoappsv1.ResourcesFinalizerName}
+		len(replacedTmpl.ObjectMeta.Finalizers) == 0 {
+		replacedTmpl.ObjectMeta.Finalizers = []string{"resources-finalizer.argocd.argoproj.io"}
 	}

 	return replacedTmpl, nil
@@ -292,13 +291,13 @@ func (r *Render) RenderGeneratorParams(gen *argoappsv1.ApplicationSetGenerator,
 	}

 	original := reflect.ValueOf(gen)
-	destination := reflect.New(original.Type()).Elem()
+	copy := reflect.New(original.Type()).Elem()

-	if err := r.deeplyReplace(destination, original, params, useGoTemplate, goTemplateOptions); err != nil {
+	if err := r.deeplyReplace(copy, original, params, useGoTemplate, goTemplateOptions); err != nil {
 		return nil, fmt.Errorf("failed to replace parameters in generator: %w", err)
 	}

-	replacedGen := destination.Interface().(*argoappsv1.ApplicationSetGenerator)
+	replacedGen := copy.Interface().(*argoappsv1.ApplicationSetGenerator)

 	return replacedGen, nil
 }
@@ -336,8 +335,8 @@ func (r *Render) Replace(tmpl string, replaceMap map[string]any, useGoTemplate b
 	replacedTmpl := fstTmpl.ExecuteFuncString(func(w io.Writer, tag string) (int, error) {
 		trimmedTag := strings.TrimSpace(tag)
 		replacement, ok := replaceMap[trimmedTag].(string)
-		if trimmedTag == "" || !ok {
-			return fmt.Fprintf(w, "{{%s}}", tag)
+		if len(trimmedTag) == 0 || !ok {
+			return w.Write([]byte(fmt.Sprintf("{{%s}}", tag)))
 		}
 		return w.Write([]byte(replacement))
 	})
@@ -354,12 +353,12 @@ func CheckInvalidGenerators(applicationSetInfo *argoappsv1.ApplicationSet) error
 			gnames = append(gnames, n)
 		}
 		sort.Strings(gnames)
-		aname := applicationSetInfo.Name
+		aname := applicationSetInfo.ObjectMeta.Name
 		msg := "ApplicationSet %s contains unrecognized generators: %s"
 		errorMessage = fmt.Errorf(msg, aname, strings.Join(gnames, ", "))
 		log.Warnf(msg, aname, strings.Join(gnames, ", "))
 	} else if hasInvalidGenerators {
-		name := applicationSetInfo.Name
+		name := applicationSetInfo.ObjectMeta.Name
 		msg := "ApplicationSet %s contains unrecognized generators"
 		errorMessage = fmt.Errorf(msg, name)
 		log.Warnf(msg, name)
@@ -395,7 +394,7 @@ func invalidGenerators(applicationSetInfo *argoappsv1.ApplicationSet) (bool, map

 func addInvalidGeneratorNames(names map[string]bool, applicationSetInfo *argoappsv1.ApplicationSet, index int) {
 	// The generator names are stored in the "kubectl.kubernetes.io/last-applied-configuration" annotation
-	config := applicationSetInfo.Annotations["kubectl.kubernetes.io/last-applied-configuration"]
+	config := applicationSetInfo.ObjectMeta.Annotations["kubectl.kubernetes.io/last-applied-configuration"]
 	var values map[string]any
 	err := json.Unmarshal([]byte(config), &values)
 	if err != nil {
@@ -527,10 +526,3 @@ func GetTlsConfig(scmRootCAPath string, insecure bool, caCerts []byte) *tls.Conf
 	}
 	return tlsConfig
 }
-
-func GetOptionalHTTPClient(optionalHTTPClient ...*http.Client) *http.Client {
-	if len(optionalHTTPClient) > 0 && optionalHTTPClient[0] != nil {
-		return optionalHTTPClient[0]
-	}
-	return &http.Client{}
-}
--- a/applicationset/utils/utils_test.go
+++ b/applicationset/utils/utils_test.go
@@ -180,14 +180,14 @@ func TestRenderTemplateParams(t *testing.T) {
 				// the target field has been templated into the expected value
 				actualValue := *getPtrFunc(newApplication)
 				assert.Equal(t, test.expectedVal, actualValue, "Field '%s' had an unexpected value. expected: '%s' value: '%s'", fieldName, test.expectedVal, actualValue)
-				assert.Equal(t, "annotation-value", newApplication.Annotations["annotation-key"])
-				assert.Equal(t, "annotation-value2", newApplication.Annotations["annotation-key2"])
-				assert.Equal(t, "label-value", newApplication.Labels["label-key"])
-				assert.Equal(t, "label-value2", newApplication.Labels["label-key2"])
-				assert.Equal(t, "application-one", newApplication.Name)
-				assert.Equal(t, "default", newApplication.Namespace)
-				assert.Equal(t, newApplication.UID, types.UID("d546da12-06b7-4f9a-8ea2-3adb16a20e2b"))
-				assert.Equal(t, newApplication.CreationTimestamp, application.CreationTimestamp)
+				assert.Equal(t, "annotation-value", newApplication.ObjectMeta.Annotations["annotation-key"])
+				assert.Equal(t, "annotation-value2", newApplication.ObjectMeta.Annotations["annotation-key2"])
+				assert.Equal(t, "label-value", newApplication.ObjectMeta.Labels["label-key"])
+				assert.Equal(t, "label-value2", newApplication.ObjectMeta.Labels["label-key2"])
+				assert.Equal(t, "application-one", newApplication.ObjectMeta.Name)
+				assert.Equal(t, "default", newApplication.ObjectMeta.Namespace)
+				assert.Equal(t, newApplication.ObjectMeta.UID, types.UID("d546da12-06b7-4f9a-8ea2-3adb16a20e2b"))
+				assert.Equal(t, newApplication.ObjectMeta.CreationTimestamp, application.ObjectMeta.CreationTimestamp)
 				require.NoError(t, err)
 			}
 		})
@@ -627,14 +627,14 @@ func TestRenderTemplateParamsGoTemplate(t *testing.T) {
 					require.NoError(t, err)
 					actualValue := *getPtrFunc(newApplication)
 					assert.Equal(t, test.expectedVal, actualValue, "Field '%s' had an unexpected value. expected: '%s' value: '%s'", fieldName, test.expectedVal, actualValue)
-					assert.Equal(t, "annotation-value", newApplication.Annotations["annotation-key"])
-					assert.Equal(t, "annotation-value2", newApplication.Annotations["annotation-key2"])
-					assert.Equal(t, "label-value", newApplication.Labels["label-key"])
-					assert.Equal(t, "label-value2", newApplication.Labels["label-key2"])
-					assert.Equal(t, "application-one", newApplication.Name)
-					assert.Equal(t, "default", newApplication.Namespace)
-					assert.Equal(t, newApplication.UID, types.UID("d546da12-06b7-4f9a-8ea2-3adb16a20e2b"))
-					assert.Equal(t, newApplication.CreationTimestamp, application.CreationTimestamp)
+					assert.Equal(t, "annotation-value", newApplication.ObjectMeta.Annotations["annotation-key"])
+					assert.Equal(t, "annotation-value2", newApplication.ObjectMeta.Annotations["annotation-key2"])
+					assert.Equal(t, "label-value", newApplication.ObjectMeta.Labels["label-key"])
+					assert.Equal(t, "label-value2", newApplication.ObjectMeta.Labels["label-key2"])
+					assert.Equal(t, "application-one", newApplication.ObjectMeta.Name)
+					assert.Equal(t, "default", newApplication.ObjectMeta.Namespace)
+					assert.Equal(t, newApplication.ObjectMeta.UID, types.UID("d546da12-06b7-4f9a-8ea2-3adb16a20e2b"))
+					assert.Equal(t, newApplication.ObjectMeta.CreationTimestamp, application.ObjectMeta.CreationTimestamp)
 				}
 			}
 		})
@@ -687,8 +687,8 @@ func TestRenderTemplateKeys(t *testing.T) {
 		render := Render{}
 		newApplication, err := render.RenderTemplateParams(application, nil, params, false, nil)
 		require.NoError(t, err)
-		require.Contains(t, newApplication.Annotations, "annotation-some-key")
-		assert.Equal(t, "annotation-some-value", newApplication.Annotations["annotation-some-key"])
+		require.Contains(t, newApplication.ObjectMeta.Annotations, "annotation-some-key")
+		assert.Equal(t, "annotation-some-value", newApplication.ObjectMeta.Annotations["annotation-some-key"])
 	})
 	t.Run("gotemplate", func(t *testing.T) {
 		application := &argoappsv1.Application{
@@ -707,8 +707,8 @@ func TestRenderTemplateKeys(t *testing.T) {
 		render := Render{}
 		newApplication, err := render.RenderTemplateParams(application, nil, params, true, nil)
 		require.NoError(t, err)
-		require.Contains(t, newApplication.Annotations, "annotation-some-key")
-		assert.Equal(t, "annotation-some-value", newApplication.Annotations["annotation-some-key"])
+		require.Contains(t, newApplication.ObjectMeta.Annotations, "annotation-some-key")
+		assert.Equal(t, "annotation-some-value", newApplication.ObjectMeta.Annotations["annotation-some-key"])
 	})
 }

@@ -752,35 +752,35 @@ func TestRenderTemplateParamsFinalizers(t *testing.T) {
 		},
 		{
 			testName:           "background finalizer should be preserved",
-			existingFinalizers: []string{argoappsv1.BackgroundPropagationPolicyFinalizer},
+			existingFinalizers: []string{"resources-finalizer.argocd.argoproj.io/background"},
 			syncPolicy:         nil,
-			expectedFinalizers: []string{argoappsv1.BackgroundPropagationPolicyFinalizer},
+			expectedFinalizers: []string{"resources-finalizer.argocd.argoproj.io/background"},
 		},

 		{
 			testName:           "empty finalizer and empty sync should use standard finalizer",
 			existingFinalizers: nil,
 			syncPolicy:         nil,
-			expectedFinalizers: []string{argoappsv1.ResourcesFinalizerName},
+			expectedFinalizers: []string{"resources-finalizer.argocd.argoproj.io"},
 		},

 		{
 			testName:           "standard finalizer should be preserved",
-			existingFinalizers: []string{argoappsv1.ResourcesFinalizerName},
+			existingFinalizers: []string{"resources-finalizer.argocd.argoproj.io"},
 			syncPolicy:         nil,
-			expectedFinalizers: []string{argoappsv1.ResourcesFinalizerName},
+			expectedFinalizers: []string{"resources-finalizer.argocd.argoproj.io"},
 		},
 		{
 			testName:           "empty array finalizers should use standard finalizer",
 			existingFinalizers: []string{},
 			syncPolicy:         nil,
-			expectedFinalizers: []string{argoappsv1.ResourcesFinalizerName},
+			expectedFinalizers: []string{"resources-finalizer.argocd.argoproj.io"},
 		},
 		{
 			testName:           "non-nil sync policy should use standard finalizer",
 			existingFinalizers: nil,
 			syncPolicy:         &argoappsv1.ApplicationSetSyncPolicy{},
-			expectedFinalizers: []string{argoappsv1.ResourcesFinalizerName},
+			expectedFinalizers: []string{"resources-finalizer.argocd.argoproj.io"},
 		},
 		{
 			testName:           "preserveResourcesOnDeletion should not have a finalizer",
@@ -792,11 +792,11 @@ func TestRenderTemplateParamsFinalizers(t *testing.T) {
 		},
 		{
 			testName:           "user-specified finalizer should overwrite preserveResourcesOnDeletion",
-			existingFinalizers: []string{argoappsv1.BackgroundPropagationPolicyFinalizer},
+			existingFinalizers: []string{"resources-finalizer.argocd.argoproj.io/background"},
 			syncPolicy: &argoappsv1.ApplicationSetSyncPolicy{
 				PreserveResourcesOnDeletion: true,
 			},
-			expectedFinalizers: []string{argoappsv1.BackgroundPropagationPolicyFinalizer},
+			expectedFinalizers: []string{"resources-finalizer.argocd.argoproj.io/background"},
 		},
 	} {
 		t.Run(c.testName, func(t *testing.T) {
--- a/applicationset/webhook/webhook.go
+++ b/applicationset/webhook/webhook.go
@@ -7,7 +7,6 @@ import (
 	"net/http"
 	"net/url"
 	"regexp"
-	"slices"
 	"strconv"
 	"strings"
 	"sync"
@@ -26,12 +25,17 @@ import (
 	"github.com/go-playground/webhooks/v6/github"
 	"github.com/go-playground/webhooks/v6/gitlab"
 	log "github.com/sirupsen/logrus"
+
+	"github.com/argoproj/argo-cd/v3/util/guard"
 )

 const payloadQueueSize = 50000

+const panicMsgAppSet = "panic while processing applicationset-controller webhook event"
+
 type WebhookHandler struct {
 	sync.WaitGroup // for testing
+	namespace      string
 	github         *github.Webhook
 	gitlab         *gitlab.Webhook
 	azuredevops    *azuredevops.Webhook
@@ -68,26 +72,27 @@ type prGeneratorGitlabInfo struct {
 	APIHostname string
 }

-func NewWebhookHandler(webhookParallelism int, argocdSettingsMgr *argosettings.SettingsManager, client client.Client, generators map[string]generators.Generator) (*WebhookHandler, error) {
+func NewWebhookHandler(namespace string, webhookParallelism int, argocdSettingsMgr *argosettings.SettingsManager, client client.Client, generators map[string]generators.Generator) (*WebhookHandler, error) {
 	// register the webhook secrets stored under "argocd-secret" for verifying incoming payloads
 	argocdSettings, err := argocdSettingsMgr.GetSettings()
 	if err != nil {
-		return nil, fmt.Errorf("failed to get argocd settings: %w", err)
+		return nil, fmt.Errorf("Failed to get argocd settings: %w", err)
 	}
 	githubHandler, err := github.New(github.Options.Secret(argocdSettings.WebhookGitHubSecret))
 	if err != nil {
-		return nil, fmt.Errorf("unable to init GitHub webhook: %w", err)
+		return nil, fmt.Errorf("Unable to init GitHub webhook: %w", err)
 	}
 	gitlabHandler, err := gitlab.New(gitlab.Options.Secret(argocdSettings.WebhookGitLabSecret))
 	if err != nil {
-		return nil, fmt.Errorf("unable to init GitLab webhook: %w", err)
+		return nil, fmt.Errorf("Unable to init GitLab webhook: %w", err)
 	}
 	azuredevopsHandler, err := azuredevops.New(azuredevops.Options.BasicAuth(argocdSettings.WebhookAzureDevOpsUsername, argocdSettings.WebhookAzureDevOpsPassword))
 	if err != nil {
-		return nil, fmt.Errorf("unable to init Azure DevOps webhook: %w", err)
+		return nil, fmt.Errorf("Unable to init Azure DevOps webhook: %w", err)
 	}

 	webhookHandler := &WebhookHandler{
+		namespace:   namespace,
 		github:      githubHandler,
 		gitlab:      gitlabHandler,
 		azuredevops: azuredevopsHandler,
@@ -102,6 +107,7 @@ func NewWebhookHandler(webhookParallelism int, argocdSettingsMgr *argosettings.S
 }

 func (h *WebhookHandler) startWorkerPool(webhookParallelism int) {
+	compLog := log.WithField("component", "applicationset-webhook")
 	for i := 0; i < webhookParallelism; i++ {
 		h.Add(1)
 		go func() {
@@ -111,7 +117,7 @@ func (h *WebhookHandler) startWorkerPool(webhookParallelism int) {
 				if !ok {
 					return
 				}
-				h.HandleEvent(payload)
+				guard.RecoverAndLog(func() { h.HandleEvent(payload) }, compLog, panicMsgAppSet)
 			}
 		}()
 	}
@@ -233,7 +239,7 @@ func getPRGeneratorInfo(payload any) *prGeneratorInfo {
 	var info prGeneratorInfo
 	switch payload := payload.(type) {
 	case github.PullRequestPayload:
-		if !slices.Contains(githubAllowedPullRequestActions, payload.Action) {
+		if !isAllowedGithubPullRequestAction(payload.Action) {
 			return nil
 		}

@@ -249,7 +255,7 @@ func getPRGeneratorInfo(payload any) *prGeneratorInfo {
 			APIRegexp: apiRegexp,
 		}
 	case gitlab.MergeRequestEventPayload:
-		if !slices.Contains(gitlabAllowedPullRequestActions, payload.ObjectAttributes.Action) {
+		if !isAllowedGitlabPullRequestAction(payload.ObjectAttributes.Action) {
 			return nil
 		}

@@ -265,7 +271,7 @@ func getPRGeneratorInfo(payload any) *prGeneratorInfo {
 			APIHostname: urlObj.Hostname(),
 		}
 	case azuredevops.GitPullRequestEvent:
-		if !slices.Contains(azuredevopsAllowedPullRequestActions, string(payload.EventType)) {
+		if !isAllowedAzureDevOpsPullRequestAction(string(payload.EventType)) {
 			return nil
 		}

@@ -310,6 +316,33 @@ var azuredevopsAllowedPullRequestActions = []string{
 	"git.pullrequest.updated",
 }

+func isAllowedGithubPullRequestAction(action string) bool {
+	for _, allow := range githubAllowedPullRequestActions {
+		if allow == action {
+			return true
+		}
+	}
+	return false
+}
+
+func isAllowedGitlabPullRequestAction(action string) bool {
+	for _, allow := range gitlabAllowedPullRequestActions {
+		if allow == action {
+			return true
+		}
+	}
+	return false
+}
+
+func isAllowedAzureDevOpsPullRequestAction(action string) bool {
+	for _, allow := range azuredevopsAllowedPullRequestActions {
+		if allow == action {
+			return true
+		}
+	}
+	return false
+}
+
 func shouldRefreshGitGenerator(gen *v1alpha1.GitGenerator, info *gitGeneratorInfo) bool {
 	if gen == nil || info == nil {
 		return false
--- a/applicationset/webhook/webhook_test.go
+++ b/applicationset/webhook/webhook_test.go
@@ -230,10 +230,10 @@ func TestWebhookHandler(t *testing.T) {
 				fakeAppWithMergeAndNestedGitGenerator("merge-nested-git-github", namespace, "https://github.com/org/repo"),
 			).Build()
 			set := argosettings.NewSettingsManager(t.Context(), fakeClient, namespace)
-			h, err := NewWebhookHandler(webhookParallelism, set, fc, mockGenerators())
+			h, err := NewWebhookHandler(namespace, webhookParallelism, set, fc, mockGenerators())
 			require.NoError(t, err)

-			req := httptest.NewRequest(http.MethodPost, "/api/webhook", http.NoBody)
+			req := httptest.NewRequest(http.MethodPost, "/api/webhook", nil)
 			req.Header.Set(test.headerKey, test.headerValue)
 			eventJSON, err := os.ReadFile(filepath.Join("testdata", test.payloadFile))
 			require.NoError(t, err)
--- a/assets/swagger.json
+++ b/assets/swagger.json
@@ -1490,8 +1490,43 @@
            "in": "body",
            "required": true,
            "schema": {
-              "$ref": "#/definitions/applicationResourceActionRunRequest"
+              "type": "string"
            }
+          },
+          {
+            "type": "string",
+            "name": "namespace",
+            "in": "query"
+          },
+          {
+            "type": "string",
+            "name": "resourceName",
+            "in": "query"
+          },
+          {
+            "type": "string",
+            "name": "version",
+            "in": "query"
+          },
+          {
+            "type": "string",
+            "name": "group",
+            "in": "query"
+          },
+          {
+            "type": "string",
+            "name": "kind",
+            "in": "query"
+          },
+          {
+            "type": "string",
+            "name": "appNamespace",
+            "in": "query"
+          },
+          {
+            "type": "string",
+            "name": "project",
+            "in": "query"
          }
        ],
        "responses": {
@@ -1704,70 +1739,6 @@
        }
      }
    },
-    "/api/v1/applications/{name}/revisions/{revision}/ocimetadata": {
-      "get": {
-        "tags": [
-          "ApplicationService"
-        ],
-        "summary": "Get the chart metadata (description, maintainers, home) for a specific revision of the application",
-        "operationId": "ApplicationService_GetOCIMetadata",
-        "parameters": [
-          {
-            "type": "string",
-            "description": "the application's name",
-            "name": "name",
-            "in": "path",
-            "required": true
-          },
-          {
-            "type": "string",
-            "description": "the revision of the app",
-            "name": "revision",
-            "in": "path",
-            "required": true
-          },
-          {
-            "type": "string",
-            "description": "the application's namespace.",
-            "name": "appNamespace",
-            "in": "query"
-          },
-          {
-            "type": "string",
-            "name": "project",
-            "in": "query"
-          },
-          {
-            "type": "integer",
-            "format": "int32",
-            "description": "source index (for multi source apps).",
-            "name": "sourceIndex",
-            "in": "query"
-          },
-          {
-            "type": "integer",
-            "format": "int32",
-            "description": "versionId from historical data (for multi source apps).",
-            "name": "versionId",
-            "in": "query"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "A successful response.",
-            "schema": {
-              "$ref": "#/definitions/v1alpha1OCIMetadata"
-            }
-          },
-          "default": {
-            "description": "An unexpected error response.",
-            "schema": {
-              "$ref": "#/definitions/runtimeError"
-            }
-          }
-        }
-      }
-    },
    "/api/v1/applications/{name}/rollback": {
      "post": {
        "tags": [
@@ -3640,49 +3611,6 @@
        }
      }
    },
-    "/api/v1/repositories/{repo}/oci-tags": {
-      "get": {
-        "tags": [
-          "RepositoryService"
-        ],
-        "operationId": "RepositoryService_ListOCITags",
-        "parameters": [
-          {
-            "type": "string",
-            "description": "Repo URL for query",
-            "name": "repo",
-            "in": "path",
-            "required": true
-          },
-          {
-            "type": "boolean",
-            "description": "Whether to force a cache refresh on repo's connection state.",
-            "name": "forceRefresh",
-            "in": "query"
-          },
-          {
-            "type": "string",
-            "description": "App project for query.",
-            "name": "appProject",
-            "in": "query"
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "A successful response.",
-            "schema": {
-              "$ref": "#/definitions/repositoryRefs"
-            }
-          },
-          "default": {
-            "description": "An unexpected error response.",
-            "schema": {
-              "$ref": "#/definitions/runtimeError"
-            }
-          }
-        }
-      }
-    },
    "/api/v1/repositories/{repo}/refs": {
      "get": {
        "tags": [
@@ -3865,12 +3793,6 @@
            "description": "BearerToken contains the bearer token used for Git auth at the repo server.",
            "name": "bearerToken",
            "in": "query"
-          },
-          {
-            "type": "boolean",
-            "description": "Whether https should be disabled for an OCI repo.",
-            "name": "insecureOciForceHttp",
-            "in": "query"
          }
        ],
        "responses": {
@@ -4709,12 +4631,6 @@
            "description": "BearerToken contains the bearer token used for Git auth at the repo server.",
            "name": "bearerToken",
            "in": "query"
-          },
-          {
-            "type": "boolean",
-            "description": "Whether https should be disabled for an OCI repo.",
-            "name": "insecureOciForceHttp",
-            "in": "query"
          }
        ],
        "responses": {
@@ -5116,55 +5032,6 @@
    "applicationOperationTerminateResponse": {
      "type": "object"
    },
-    "applicationResourceActionParameters": {
-      "type": "object",
-      "properties": {
-        "name": {
-          "type": "string"
-        },
-        "value": {
-          "type": "string"
-        }
-      }
-    },
-    "applicationResourceActionRunRequest": {
-      "type": "object",
-      "properties": {
-        "action": {
-          "type": "string"
-        },
-        "appNamespace": {
-          "type": "string"
-        },
-        "group": {
-          "type": "string"
-        },
-        "kind": {
-          "type": "string"
-        },
-        "name": {
-          "type": "string"
-        },
-        "namespace": {
-          "type": "string"
-        },
-        "project": {
-          "type": "string"
-        },
-        "resourceActionParameters": {
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/applicationResourceActionParameters"
-          }
-        },
-        "resourceName": {
-          "type": "string"
-        },
-        "version": {
-          "type": "string"
-        }
-      }
-    },
    "applicationResourceActionsListResponse": {
      "type": "object",
      "properties": {
@@ -6379,17 +6246,6 @@
        }
      }
    },
-    "v1NodeSwapStatus": {
-      "description": "NodeSwapStatus represents swap memory information.",
-      "type": "object",
-      "properties": {
-        "capacity": {
-          "type": "integer",
-          "format": "int64",
-          "title": "Total amount of swap memory in bytes.\n+optional"
-        }
-      }
-    },
    "v1NodeSystemInfo": {
      "description": "NodeSystemInfo is a set of ids/uuids to uniquely identify the node.",
      "type": "object",
@@ -6430,9 +6286,6 @@
          "description": "OS Image reported by the node from /etc/os-release (e.g. Debian GNU/Linux 7 (wheezy)).",
          "type": "string"
        },
-        "swap": {
-          "$ref": "#/definitions/v1NodeSwapStatus"
-        },
        "systemUUID": {
          "type": "string",
          "title": "SystemUUID reported by the node. For unique machine identification\nMachineID is preferred. This field is specific to Red Hat hosts\nhttps://access.redhat.com/documentation/en-us/red_hat_subscription_management/1/html/rhsm/uuid"
@@ -6626,24 +6479,6 @@
        }
      }
    },
-    "v1alpha1AppHealthStatus": {
-      "type": "object",
-      "title": "AppHealthStatus contains information about the currently observed health state of an application",
-      "properties": {
-        "lastTransitionTime": {
-          "$ref": "#/definitions/v1Time"
-        },
-        "message": {
-          "description": "Deprecated: this field is not used and will be removed in a future release.",
-          "type": "string",
-          "title": "Message is a human-readable informational message describing the health status"
-        },
-        "status": {
-          "type": "string",
-          "title": "Status holds the status code of the application"
-        }
-      }
-    },
    "v1alpha1AppProject": {
      "type": "object",
      "title": "AppProject provides a logical grouping of applications, providing controls for:\n* where the apps may deploy to (cluster whitelist)\n* what may be deployed (repository whitelist, resource whitelist/blacklist)\n* who can access these applications (roles, OIDC group claims bindings)\n* and what they can do (RBAC policies)\n* automation access to these roles (JWT tokens)\n+genclient\n+genclient:noStatus\n+k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object\n+kubebuilder:resource:path=appprojects,shortName=appproj;appprojs",
@@ -6694,7 +6529,7 @@
        },
        "description": {
          "type": "string",
-          "title": "Description contains optional project description\n+kubebuilder:validation:MaxLength=255"
+          "title": "Description contains optional project description"
        },
        "destinationServiceAccounts": {
          "description": "DestinationServiceAccounts holds information about the service accounts to be impersonated for the application sync operation for each destination.",
@@ -7640,7 +7475,7 @@
          "title": "ControllerNamespace indicates the namespace in which the application controller is located"
        },
        "health": {
-          "$ref": "#/definitions/v1alpha1AppHealthStatus"
+          "$ref": "#/definitions/v1alpha1HealthStatus"
        },
        "history": {
          "type": "array",
@@ -8026,36 +7861,6 @@
        }
      }
    },
-    "v1alpha1CommitMetadata": {
-      "description": "CommitMetadata contains metadata about a commit that is related in some way to another commit.",
-      "type": "object",
-      "properties": {
-        "author": {
-          "description": "Author is the author of the commit, i.e. `git show -s --format=%an <%ae>`.\nMust be formatted according to RFC 5322 (mail.Address.String()).\nComes from the Argocd-reference-commit-author trailer.",
-          "type": "string"
-        },
-        "body": {
-          "description": "Body is the commit message body minus the subject line, i.e. `git show -s --format=%b`.\nComes from the Argocd-reference-commit-body trailer.",
-          "type": "string"
-        },
-        "date": {
-          "description": "Date is the date of the commit, formatted as by `git show -s --format=%aI` (RFC 3339).\nIt can also be an empty string if the date is unknown.\nComes from the Argocd-reference-commit-date trailer.",
-          "type": "string"
-        },
-        "repoUrl": {
-          "description": "RepoURL is the URL of the repository where the commit is located.\nComes from the Argocd-reference-commit-repourl trailer.\nThis value is not validated and should not be used to construct UI links unless it is properly\nvalidated and/or sanitized first.",
-          "type": "string"
-        },
-        "sha": {
-          "description": "SHA is the commit hash.\nComes from the Argocd-reference-commit-sha trailer.",
-          "type": "string"
-        },
-        "subject": {
-          "description": "Subject is the commit message subject line, i.e. `git show -s --format=%s`.\nComes from the Argocd-reference-commit-subject trailer.",
-          "type": "string"
-        }
-      }
-    },
    "v1alpha1ComparedTo": {
      "type": "object",
      "title": "ComparedTo contains application source and target which was used for resources comparison",
@@ -8223,9 +8028,6 @@
    "v1alpha1GitFileGeneratorItem": {
      "type": "object",
      "properties": {
-        "exclude": {
-          "type": "boolean"
-        },
        "path": {
          "type": "string"
        }
@@ -8293,7 +8095,7 @@
        },
        "subType": {
          "type": "string",
-          "title": "SubType holds the key's subtype (e.g. rsa4096)"
+          "title": "SubType holds the key's sub type (e.g. rsa4096)"
        },
        "trust": {
          "type": "string",
@@ -8318,7 +8120,7 @@
    },
    "v1alpha1HealthStatus": {
      "type": "object",
-      "title": "HealthStatus contains information about the currently observed health state of a resource",
+      "title": "HealthStatus contains information about the currently observed health state of an application or resource",
      "properties": {
        "lastTransitionTime": {
          "$ref": "#/definitions/v1Time"
@@ -8329,7 +8131,7 @@
        },
        "status": {
          "type": "string",
-          "title": "Status holds the status code of the resource"
+          "title": "Status holds the status code of the application or resource"
        }
      }
    },
@@ -8369,13 +8171,6 @@
      "description": "HostInfo holds metadata and resource usage metrics for a specific host in the cluster.",
      "type": "object",
      "properties": {
-        "labels": {
-          "description": "Labels holds the labels attached to the host.",
-          "type": "object",
-          "additionalProperties": {
-            "type": "string"
-          }
-        },
        "name": {
          "description": "Name is the hostname or node name in the Kubernetes cluster.",
          "type": "string"
@@ -8701,33 +8496,6 @@
        }
      }
    },
-    "v1alpha1OCIMetadata": {
-      "type": "object",
-      "title": "OCIMetadata contains metadata for a specific revision in an OCI repository",
-      "properties": {
-        "authors": {
-          "type": "string"
-        },
-        "createdAt": {
-          "type": "string"
-        },
-        "description": {
-          "type": "string"
-        },
-        "docsUrl": {
-          "type": "string"
-        },
-        "imageUrl": {
-          "type": "string"
-        },
-        "sourceUrl": {
-          "type": "string"
-        },
-        "version": {
-          "type": "string"
-        }
-      }
-    },
    "v1alpha1Operation": {
      "type": "object",
      "title": "Operation contains information about a requested or running operation",
@@ -9109,8 +8877,8 @@
          "type": "string"
        },
        "pullRequestState": {
-          "description": "PullRequestState is an additional MRs filter to get only those with a certain state. Default: \"\" (all states).\nValid values: opened, closed, merged, locked\".",
-          "type": "string"
+          "type": "string",
+          "title": "PullRequestState is an additional MRs filter to get only those with a certain state. Default: \"\" (all states)"
        },
        "tokenRef": {
          "$ref": "#/definitions/v1alpha1SecretRef"
@@ -9129,13 +8897,6 @@
          "description": "Allow insecure tls, for self-signed certificates; default: false.",
          "type": "boolean"
        },
-        "labels": {
-          "type": "array",
-          "title": "Labels is used to filter the PRs that you want to target",
-          "items": {
-            "type": "string"
-          }
-        },
        "owner": {
          "description": "Gitea org or user to scan. Required.",
          "type": "string"
@@ -9219,10 +8980,6 @@
          "type": "string",
          "title": "GithubAppPrivateKey specifies the private key PEM data for authentication via GitHub app"
        },
-        "insecureOCIForceHttp": {
-          "description": "InsecureOCIForceHttp specifies whether the connection to the repository uses TLS at _all_. If true, no TLS. This flag is applicable for OCI repos only.",
-          "type": "boolean"
-        },
        "noProxy": {
          "type": "string",
          "title": "NoProxy specifies a list of targets where the proxy isn't used, applies only in cases where the proxy is applied"
@@ -9337,10 +9094,6 @@
          "type": "boolean",
          "title": "InsecureIgnoreHostKey should not be used anymore, Insecure is favoured\nUsed only for Git repos"
        },
-        "insecureOCIForceHttp": {
-          "description": "InsecureOCIForceHttp specifies whether the connection to the repository uses TLS at _all_. If true, no TLS. This flag is applicable for OCI repos only.",
-          "type": "boolean"
-        },
        "name": {
          "type": "string",
          "title": "Name specifies a name to be used for this repo. Only used with Helm repos"
@@ -9748,13 +9501,6 @@
          "type": "string",
          "title": "HookType specifies the type of the hook. Empty for non-hook resources"
        },
-        "images": {
-          "type": "array",
-          "title": "Images contains the images related to the ResourceResult",
-          "items": {
-            "type": "string"
-          }
-        },
        "kind": {
          "type": "string",
          "title": "Kind specifies the API kind of the resource"
@@ -9841,8 +9587,8 @@
      }
    },
    "v1alpha1RevisionMetadata": {
-      "description": "RevisionMetadata contains metadata for a specific revision in a Git repository. This field is used by the\nSource Hydrator feature which may be removed in the future.",
      "type": "object",
+      "title": "RevisionMetadata contains metadata for a specific revision in a Git repository",
      "properties": {
        "author": {
          "type": "string",
@@ -9855,13 +9601,6 @@
          "description": "Message contains the message associated with the revision, most likely the commit message.",
          "type": "string"
        },
-        "references": {
-          "description": "References contains references to information that's related to this commit in some way.",
-          "type": "array",
-          "items": {
-            "$ref": "#/definitions/v1alpha1RevisionReference"
-          }
-        },
        "signatureInfo": {
          "description": "SignatureInfo contains a hint on the signer if the revision was signed with GPG, and signature verification is enabled.",
          "type": "string"
@@ -9875,15 +9614,6 @@
        }
      }
    },
-    "v1alpha1RevisionReference": {
-      "description": "RevisionReference contains a reference to a some information that is related in some way to another commit. For now,\nit supports only references to a commit. In the future, it may support other types of references.",
-      "type": "object",
-      "properties": {
-        "commit": {
-          "$ref": "#/definitions/v1alpha1CommitMetadata"
-        }
-      }
-    },
    "v1alpha1SCMProviderGenerator": {
      "description": "SCMProviderGenerator defines a generator that scrapes a SCMaaS API to find candidate repos.",
      "type": "object",
@@ -10376,10 +10106,6 @@
          "type": "boolean",
          "title": "AllowEmpty allows apps have zero live resources (default: false)"
        },
-        "enable": {
-          "type": "boolean",
-          "title": "Enable allows apps to explicitly control automated sync"
-        },
        "prune": {
          "type": "boolean",
          "title": "Prune specifies whether to delete resources from the cluster that are not found in the sources anymore as part of automated sync (default: false)"
@@ -10481,10 +10207,6 @@
            "type": "string"
          }
        },
-        "description": {
-          "type": "string",
-          "title": "Description of the sync that will be applied to the schedule, can be used to add any information such as a ticket number for example"
-        },
        "duration": {
          "type": "string",
          "title": "Duration is the amount of time the sync window will be open"
--- a/cmd/argocd-application-controller/commands/argocd_application_controller.go
+++ b/cmd/argocd-application-controller/commands/argocd_application_controller.go
@@ -10,7 +10,7 @@ import (
 	"syscall"
 	"time"

-	"github.com/argoproj/pkg/v2/stats"
+	"github.com/argoproj/pkg/stats"
 	"github.com/redis/go-redis/v9"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
--- a/cmd/argocd-applicationset-controller/commands/applicationset_controller.go
+++ b/cmd/argocd-applicationset-controller/commands/applicationset_controller.go
@@ -8,7 +8,7 @@ import (
 	"runtime/debug"
 	"time"

-	"github.com/argoproj/pkg/v2/stats"
+	"github.com/argoproj/pkg/stats"
 	"k8s.io/apimachinery/pkg/runtime"
 	ctrl "sigs.k8s.io/controller-runtime"

@@ -47,10 +47,6 @@ import (

 var gitSubmoduleEnabled = env.ParseBoolFromEnv(common.EnvGitSubmoduleEnabled, true)

-const (
-	cliName = common.ApplicationSetController
-)
-
 func NewCommand() *cobra.Command {
 	var (
 		clientConfig                 clientcmd.ClientConfig
@@ -74,19 +70,18 @@ func NewCommand() *cobra.Command {
 		allowedScmProviders          []string
 		globalPreservedAnnotations   []string
 		globalPreservedLabels        []string
-		enableGitHubAPIMetrics       bool
 		metricsAplicationsetLabels   []string
 		enableScmProviders           bool
 		webhookParallelism           int
 		tokenRefStrictMode           bool
+		maxResourcesStatusCount      int
 	)
 	scheme := runtime.NewScheme()
 	_ = clientgoscheme.AddToScheme(scheme)
 	_ = appv1alpha1.AddToScheme(scheme)
 	command := cobra.Command{
-		Use:               cliName,
-		Short:             "Starts Argo CD ApplicationSet controller",
-		DisableAutoGenTag: true,
+		Use:   "controller",
+		Short: "Starts Argo CD ApplicationSet controller",
 		RunE: func(c *cobra.Command, _ []string) error {
 			ctx := c.Context()

@@ -177,7 +172,7 @@ func NewCommand() *cobra.Command {
 			argoSettingsMgr := argosettings.NewSettingsManager(ctx, k8sClient, namespace)
 			argoCDDB := db.NewDB(namespace, argoSettingsMgr, k8sClient)

-			scmConfig := generators.NewSCMConfig(scmRootCAPath, allowedScmProviders, enableScmProviders, enableGitHubAPIMetrics, github_app.NewAuthCredentials(argoCDDB.(db.RepoCredsDB)), tokenRefStrictMode)
+			scmConfig := generators.NewSCMConfig(scmRootCAPath, allowedScmProviders, enableScmProviders, github_app.NewAuthCredentials(argoCDDB.(db.RepoCredsDB)), tokenRefStrictMode)

 			tlsConfig := apiclient.TLSConfiguration{
 				DisableTLS:       repoServerPlaintext,
@@ -199,7 +194,7 @@ func NewCommand() *cobra.Command {
 			topLevelGenerators := generators.GetGenerators(ctx, mgr.GetClient(), k8sClient, namespace, argoCDService, dynamicClient, scmConfig)

 			// start a webhook server that listens to incoming webhook payloads
-			webhookHandler, err := webhook.NewWebhookHandler(webhookParallelism, argoSettingsMgr, mgr.GetClient(), topLevelGenerators)
+			webhookHandler, err := webhook.NewWebhookHandler(namespace, webhookParallelism, argoSettingsMgr, mgr.GetClient(), topLevelGenerators)
 			if err != nil {
 				log.Error(err, "failed to create webhook handler")
 			}
@@ -231,6 +226,7 @@ func NewCommand() *cobra.Command {
 				GlobalPreservedAnnotations: globalPreservedAnnotations,
 				GlobalPreservedLabels:      globalPreservedLabels,
 				Metrics:                    &metrics,
+				MaxResourcesStatusCount:    maxResourcesStatusCount,
 			}).SetupWithManager(mgr, enableProgressiveSyncs, maxConcurrentReconciliations); err != nil {
 				log.Error(err, "unable to create controller", "controller", "ApplicationSet")
 				os.Exit(1)
@@ -274,8 +270,7 @@ func NewCommand() *cobra.Command {
 	command.Flags().StringSliceVar(&globalPreservedLabels, "preserved-labels", env.StringsFromEnv("ARGOCD_APPLICATIONSET_CONTROLLER_GLOBAL_PRESERVED_LABELS", []string{}, ","), "Sets global preserved field values for labels")
 	command.Flags().IntVar(&webhookParallelism, "webhook-parallelism-limit", env.ParseNumFromEnv("ARGOCD_APPLICATIONSET_CONTROLLER_WEBHOOK_PARALLELISM_LIMIT", 50, 1, 1000), "Number of webhook requests processed concurrently")
 	command.Flags().StringSliceVar(&metricsAplicationsetLabels, "metrics-applicationset-labels", []string{}, "List of Application labels that will be added to the argocd_applicationset_labels metric")
-	command.Flags().BoolVar(&enableGitHubAPIMetrics, "enable-github-api-metrics", env.ParseBoolFromEnv("ARGOCD_APPLICATIONSET_CONTROLLER_ENABLE_GITHUB_API_METRICS", false), "Enable GitHub API metrics for generators that use the GitHub API")
-
+	command.Flags().IntVar(&maxResourcesStatusCount, "max-resources-status-count", env.ParseNumFromEnv("ARGOCD_APPLICATIONSET_CONTROLLER_MAX_RESOURCES_STATUS_COUNT", 0, 0, math.MaxInt), "Max number of resources stored in appset status.")
 	return &command
 }

--- a/cmd/argocd-cmp-server/commands/argocd_cmp_server.go
+++ b/cmd/argocd-cmp-server/commands/argocd_cmp_server.go
@@ -4,7 +4,7 @@ import (
 	"runtime/debug"
 	"time"

-	"github.com/argoproj/pkg/v2/stats"
+	"github.com/argoproj/pkg/stats"
 	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"

--- a/Show More
+++ b/Show More
@@ -1 +1 @@
 .1.0
 .0.23