From 5e9e5a26b419cdf64a8ebc23860ada0dffbeff5b Mon Sep 17 00:00:00 2001
From: Nikolai Emil Damm <nikolaiemildamm@icloud.com>
Date: Sun, 16 Aug 2026 20:11:05 +0200
Subject: [PATCH] fix(github): stop signoff-blocked update retries

---
 AGENTS.md                                     |  6 +++--
 .../platform-tenant-template.yaml             | 14 ++++-------
 tests/repository-update-policy.sh             | 24 +++++++++++++++----
 3 files changed, 29 insertions(+), 15 deletions(-)

diff --git a/AGENTS.md b/AGENTS.md
index 9299060..ad0f983 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -58,8 +58,10 @@ for the architecture, the GitHub App credential setup, and the Observe-first ado
   ([upstream #2077](https://github.com/integrations/terraform-provider-github/issues/2077)). Until a
   provider-upjet-github release includes the upstream v6.12.0 fix, do not introduce new Repository
   drift merely for optional discovery metadata; `agent-plugins` and `agent-skills` topics are
-  deliberately omitted. `tests/repository-update-policy.sh` pins both the required live signoff
-  value and this temporary compatibility boundary. Verify
+  deliberately omitted. `platform-tenant-template` remains on `Observe`/`Create` without `Update`
+  because its failed asynchronous update otherwise keeps replaying the rejected PATCH.
+  `tests/repository-update-policy.sh` pins both the required live signoff value and this temporary
+  compatibility boundary. Verify
   the provider kind/field schema against the authoritative source
   ([crossplane-contrib/provider-upjet-github `package/crds/`](https://github.com/crossplane-contrib/provider-upjet-github)
   + `examples-generated/namespaced/`) — the CRs cannot be schema-validated locally (no cluster; CI
diff --git a/deploy/repositories/platform-tenant-template.yaml b/deploy/repositories/platform-tenant-template.yaml
index 323912b..60230c6 100644
--- a/deploy/repositories/platform-tenant-template.yaml
+++ b/deploy/repositories/platform-tenant-template.yaml
@@ -5,16 +5,13 @@ metadata:
   annotations:
     crossplane.io/external-name: platform-tenant-template
 spec:
-  # Managed (Observe/Create/Update). forProvider declares the discoverability
-  # metadata (description/topics), so the config is AUTHORITATIVE for it; the
-  # org-wide squash-only merge policy comes from the shared patch in
-  # kustomization.yaml. Settings in neither
-  # are unmanaged: nothing new is copied into the spec, and values adopted
-  # earlier stay.
+  # Managed for Observe/Create. Update is compatibility-blocked because the
+  # deployed provider sends the organization-enforced signoff field on every
+  # Repository PATCH and GitHub rejects it. The org-wide squash-only merge
+  # policy comes from the shared patch in kustomization.yaml.
   managementPolicies:
     - Observe
     - Create
-    - Update
   forProvider:
     name: platform-tenant-template
     # Pinned because this resource carries no adopted values: it is the one
@@ -24,8 +21,7 @@ spec:
     # restoring the write path (#112) unable to change it.
     visibility: public
     hasIssues: true
-    # Matches live state and advances this MR's generation so Crossplane drops
-    # the failed asynchronous update queued before the provider workaround.
+    # Matches live state while Repository updates are compatibility-blocked.
     hasProjects: false
     description: "Template for platform tenants on the devantler-tech platform — framework-agnostic CI/CD plumbing kept current via template-sync."
   providerConfigRef:
diff --git a/tests/repository-update-policy.sh b/tests/repository-update-policy.sh
index 5108007..b22ed13 100755
--- a/tests/repository-update-policy.sh
+++ b/tests/repository-update-policy.sh
@@ -149,9 +149,11 @@ blocked_topic_updates="$(
 [[ -z "$blocked_topic_updates" ]] ||
   fail "provider-upjet-github v0.19.1 cannot update repository topics under org-enforced signoff: $blocked_topic_updates"
 
-# Pin a matching live value to advance this resource's generation and cancel
-# the failed async update which predates the signoff workaround. The template
-# intentionally does not use GitHub Projects.
+# The template intentionally does not use GitHub Projects. Its resource also
+# carries a failed asynchronous update from before the signoff workaround.
+# Observe/Create keeps the existing repository healthy and recreatable without
+# re-entering the provider's broken update path; restore Update with the same
+# provider release that removes the compatibility boundary above.
 platform_tenant_projects="$(
   yq -N '
     select(
@@ -164,6 +166,20 @@ platform_tenant_projects="$(
   ' "$render"
 )"
 [[ "$platform_tenant_projects" == "false" ]] ||
-  fail "platform-tenant-template must pin forProvider.hasProjects: false while resetting its failed async update"
+  fail "platform-tenant-template must pin forProvider.hasProjects: false while updates are compatibility-blocked"
+
+platform_tenant_management_policies="$(
+  yq -N '
+    select(
+      .kind == "Repository" and
+      .metadata.name == "platform-tenant-template"
+    ) |
+    .spec.managementPolicies |
+    sort |
+    join(",")
+  ' "$render"
+)"
+[[ "$platform_tenant_management_policies" == "Create,Observe" ]] ||
+  fail "platform-tenant-template must remain Observe/Create without Update until the provider signoff fix is deployed: $platform_tenant_management_policies"
 
 echo "repository-update-policy: OK — $active_count active repositories declare org-enforced signoff and the provider-v0.19.1 update workaround"