Argo CD repo-server returns cached manifests after generator policy changes

Checklist:

• I've included steps to reproduce the bug.
• I've included the tested Argo CD version and source commit.
• I've included the relevant output below and in the attached evidence.

Describe the bug

In Argo CD v3.5.3, repo-server's manifest cache key omits request values that change manifest-generation semantics. A cache entry generated with permissive Kustomize or Helm settings, or with one Config Management Plugin input path, is returned after that policy or input path changes.

The fresh request uses the current policy or input path and produces an error or a different manifest, while the ordinary cache-hit request returns the old manifest.

To Reproduce

The attached runner executes the real reposerver/repository package and checks three cases: Kustomize LoadRestrictionsNone, Helm allowed value-file schemes, and CMP manifest-generation paths.

git clone --branch v3.5.3 --depth 1 https://github.com/argoproj/argo-cd.git argo-cd-v3.5.3
test "$(git -C argo-cd-v3.5.3 rev-parse HEAD)" = \
  c9c369efcc5b2a0bd720803f8d14a1c3eaddf579

ARGO_CD_DIR="$PWD/argo-cd-v3.5.3" \
KUSTOMIZE_BIN=/path/to/kustomize-v5.8.1 \
  ./attachments/reproduce.sh result

The complete command and dependency details are in report.md and attachments/README.md.

Expected behavior

A cache hit should be used only when the cached request and the current request have equivalent manifest-generation inputs and policy. A policy or input-path change should cause a fresh generation or an invalidation.

Screenshots

Not applicable; this affects the repo-server repository service.

Version

Argo CD v3.5.3
Source commit: c9c369efcc5b2a0bd720803f8d14a1c3eaddf579
Go: go1.23.5 linux/amd64
Kustomize: v5.8.1

Logs

The sanitized run is attached as attachments/evidence/v3.5.3-run.log. The key observations are:

cached-after-policy-change=[{"apiVersion":"v1","kind":"ConfigMap","metadata":{"name":"shared"}}]
fresh-strict-policy-error=... security ... file is not in or below ...
cached-after-scheme-removal=[{"apiVersion":"v1","kind":"ConfigMap","metadata":{"name":"remote-values-accepted"}}]
fresh-disallowed-scheme-error=... the URL scheme 'https' is not allowed
cached-after-path-change=[{"apiVersion":"v1","kind":"ConfigMap","metadata":{"name":"app-only"}}]
fresh-shared-root=[{"apiVersion":"v1","kind":"ConfigMap","metadata":{"name":"saw-shared-policy"}}]

Attachments

detailed report.md

attachments.zip