fix(github): stop signoff-blocked update retries

[devantler]

🤖 Generated by the Agentic Engineer

Root cause

platform-tenant-template retains a failed asynchronous Repository update. provider-upjet-github v0.19.1 embeds terraform-provider-github v6.6.0, which sends web_commit_signoff_required on every Repository PATCH; GitHub rejects that field while organization-level signoff is enforced. Matching the live value advanced the CR generation but did not cancel the provider retry loop.

Fix

• keep this existing repository on Observe/Create while the provider compatibility boundary is active
• retain its matching-live hasProjects: false declaration
• pin the temporary no-Update boundary in the rendered policy test and consumer documentation

Proof

• RED: policy test rejected Create,Observe,Update
• GREEN: kubectl kustomize deploy
• GREEN: admin team, declarative coverage, fail-closed coverage, repository update policy, release contract, and repository drift tests

[devantler]

🤖 Generated by the Agentic Engineer

Please review exact head 5e9e5a21a207729088531d80e58faf3b46f22b21. The focused test was RED with Create,Observe,Update and GREEN after pinning the resource to Create,Observe; all baseline validations pass.

@coderabbitai review

[devantler]

🤖 Generated by the Agentic Engineer

Correction: the exact current head is 5e9e5a26b419cdf64a8ebc23860ada0dffbeff5b; the prior review request contained a mistyped SHA.

@coderabbitai review

[coderabbitai]

@devantler I will review the pull request at the corrected current head 5e9e5a26b419cdf64a8ebc23860ada0dffbeff5b.

---

🧠 Learnings used

Learnt from: devantler
Repo: devantler-tech/.github PR: 127
File: deploy/repositories/agent-plugins.yaml:14-15
Timestamp: 2026-07-27T11:40:09.973Z
Learning: For Crossplane GitHub `Repository` resources in `deploy/repositories/*.yaml`, removing `LateInitialize` stops future observed fields from being copied into `spec.forProvider`, so newly undeclared settings are unmanaged. Fields that were late-initialized before that policy change may already persist in `spec.forProvider`, are owned by the provider field manager rather than Flux's `kustomize-controller`, and can remain in provider update payloads; comments must distinguish these two cases.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

@devantler I will review the changes at 5e9e5a26b419cdf64a8ebc23860ada0dffbeff5b.

🐇

⚠️ Action not completed

Already reviewed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 35bf16ab-af17-4c7a-97d7-465ec5d6c925

📥 Commits

Reviewing files that changed from the base of the PR and between 4a55c0f and 5e9e5a2.

📒 Files selected for processing (3)

• AGENTS.md
• deploy/repositories/platform-tenant-template.yaml
• tests/repository-update-policy.sh

Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review.

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (5)

AGENTS.md

📄 CodeRabbit inference engine (CLAUDE.md)

Follow the instructions defined in AGENTS.md.

Files:

• AGENTS.md

**/AGENTS.md

📄 CodeRabbit inference engine (GEMINI.md)

Follow the coding guidelines and instructions defined in AGENTS.md.

Files:

• AGENTS.md

tests/*.sh

📄 CodeRabbit inference engine (AGENTS.md)

tests/*.sh: bash tests/admin-team-policy.sh # Admins policy invariants
bash tests/declarative-coverage.sh # every repo declared in every rendered dimension
bash tests/declarative-coverage-fail-closed.sh # rendered-label reads fail closed
bash tests/repository-update-policy.sh # active Repository update invariants
bash tests/release-contract.sh # deploy/ changes must trigger a release
bash tests/repository-drift.sh # declared-vs-live comparison logic

Files:

• tests/repository-update-policy.sh

deploy/**/*.{yaml,yml}

📄 CodeRabbit inference engine (AGENTS.md)

deploy/**/*.{yaml,yml}: Manage GitHub declaratively — never imperatively.
Ownership goes to a team, not an individual.
Observe-first when adopting an existing resource.
kubectl kustomize deploy/ > /dev/null # must build clean

Files:

• deploy/repositories/platform-tenant-template.yaml

deploy/repositories/*.yaml

📄 CodeRabbit inference engine (AGENTS.md)

one Repository per managed repo (settings, merge/signoff, metadata)

Files:

• deploy/repositories/platform-tenant-template.yaml

🧠 Learnings (2)

📚 Learning: 2026-08-06T20:18:26.789Z

Learnt from: devantler
Repo: devantler-tech/.github PR: 138
File: deploy/repositories/ascoachingogvaner.yaml:0-0
Timestamp: 2026-08-06T20:18:26.789Z
Learning: When reviewing comments in repository deployment manifests under deploy/repositories/*.yaml, ensure they describe the current state only. Do not add comments that narrate migrations, historical changes, or before/after states, in accordance with the repository's AGENTS.md guidance.

Applied to files:

• deploy/repositories/platform-tenant-template.yaml

📚 Learning: 2026-07-27T11:40:06.755Z

Learnt from: devantler
Repo: devantler-tech/.github PR: 127
File: deploy/repositories/agent-plugins.yaml:14-15
Timestamp: 2026-07-27T11:40:06.755Z
Learning: When reviewing Crossplane GitHub `Repository` resources under `deploy/repositories/*.yaml`, note that removing `LateInitialize` prevents newly observed/undeclared fields from being copied into `spec.forProvider`. As a result, those newly added settings become unmanaged until explicitly declared. However, fields that were late-initialized before this policy change may already exist in `spec.forProvider`; they are then owned by the provider field manager (not Flux `kustomize-controller`) and may remain in provider update payloads. Require comments to clearly distinguish these two cases so reviewers know whether a field is newly unmanaged vs. pre-existing provider-owned data.

Applied to files:

• deploy/repositories/platform-tenant-template.yaml

🔇 Additional comments (3)

deploy/repositories/platform-tenant-template.yaml (1)

8-14: LGTM!

Also applies to: 24-25

AGENTS.md (1)

61-64: LGTM!

tests/repository-update-policy.sh (1)

152-156: LGTM!

Also applies to: 169-183

---

📝 Walkthrough

Walkthrough

The platform-tenant-template repository policy now permits only Observe and Create. Repository guidance documents the provider compatibility constraint that blocks updates. The policy test verifies the rendered management policies and updates related validation messages.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the main change: stopping retries for signoff-blocked GitHub repository updates.
Description check	✅ Passed	The description explains the root cause, fix, and validation for the repository update policy change.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Ready at exact head 5e9e5a26b419cdf64a8ebc23860ada0dffbeff5b: render and all baseline policy tests pass, all GitHub checks are terminal-success, CodeRabbit generated no actionable comments, and the temporary no-Update boundary is directly pinned by the test.

[devantler]

🤖 Generated by the Agentic Engineer

Production proof: merged as c129905490730bcd7bac6a9ee4b280f5203fa130, released as v1.22.7, and signed-manifest CD run 31964019644 succeeded. Flux verified and applied 1.22.7@sha256:3daa470b2afbc64c0c328df111a835cb783725bada2bd9e03ddbcaa367ac3422. agent-plugins, agent-skills, and platform-tenant-template now report Synced=True, Ready=True; the namespace-wide Repository inventory has zero unsynced resources.

[devantler]

🤖 Generated by the Agentic Engineer

Terminal alert proof: the scheduled 18:30 UTC crossplane-sync-alerter run reported all watched managed resources are syncing; exporter healthy; Alertmanager now reports zero active CrossplaneManagedResourceNotSynced alerts, and the live Repository inventory remains at zero unsynced resources.