For those that are using ArgoCD, how do you automatically update the container version that is referenced in the Kubernetes manifest? Is this a process that is performed by the CI? Is your CI pushing changes in the repository and therefore has write access? Is this not a security issue? I have found that for some companies this is a security issue, because it means that anybody with write access in the repo, can perform changes like (removing all the repo contents and the history) from a PR.