Is it possible to do a --dry-run sync for an app that hasn't been added to ArgoCD yet?

[risset]

We have a CI setup where essentially we want to be able to do a pre-merge --dry-run install of all apps being deployed or updated within our GitOps repo.

For apps that are already tracked by ArgoCD, I've established a means of doing this via the /applications/{app_name}/sync endpoint with dryRun: true in the request body (we also pass the new manifests in the body). It seems logical to assume that this request would only work for apps that are already tracked by ArgoCD, but I'm wondering that since I get a 403 from that endpoint with an untracked app name passed to it, that it is possible with certain RBAC policies added to argocd-rbac-cm. I've tried with the following policies:

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
  labels:
    app.kubernetes.io/name: argocd-rbac-cm
    app.kubernetes.io/part-of: argocd
data:
  policy.csv: |
    p, ci-account, applications, override, *, allow
    p, ci-account, applications, sync, *, allow
    p, ci-account, applications, get, *, allow
    p, ci-account, applications, create, *, allow    

  policy.default: role:readonly

Otherwise, I'm assuming that the way to go here would be to somehow use the /api/v1/applications endpoint to do a dry install in our CI for newly added apps.

[jsolana]

Any news related? Still happening at least with 2.12.3 version.