Bootstrap kyverno-policies repo to unblock production reconciliation

[devantler]

🤖 Generated by the Daily AI Engineer

Problem

The devantler-tech/kyverno-policies repository required a one-time organization-admin bootstrap because provider-upjet-github's Repository CRD cannot send required organization custom properties during creation.

The repository now exists and the declarative resources have reconciled, but one required property is still wrong: AutomaticallyRequestCopilotCodeReview=false. The live Type=Library value is correct for a shared policy library; the earlier Type=Infrastructure acceptance criterion was copied from the unrelated AWS bootstrap.

Live evidence (2026-07-14)

• devantler-tech/kyverno-policies exists as a public repository with issues enabled and initialized, protected main.
• Required custom properties are live as Type=Library, EnableAutoMerge=true, ScanGitHubActions=true, AutomaticallyRequestCopilotCodeReview=false, and LintDocumentation=false.
• Repository, DefaultBranch, TeamRepository, and IssueLabels managed resources are Ready.
• Production github-config and parent apps Kustomizations are Ready and Healthy on the current platform artifact.
• The provider CRD still has no field for custom properties, so reconciliation cannot correct the remaining value.
• PR docs(repositories): correct kyverno bootstrap contract #100 merged the corrected adoption/provider-gap documentation without changing any managed setting.

Proposed direction

Keep Type=Library. An organization admin should patch only AutomaticallyRequestCopilotCodeReview to true through GitHub's repository custom-properties endpoint, then verify all five values. Keep the existing Crossplane resources as the source of truth for every representable setting; do not weaken Flux health checks or remove managed resources.

Acceptance criteria

• devantler-tech/kyverno-policies exists as a public repository with issues enabled and initialized main.
• Required custom properties are explicit: Type=Library, EnableAutoMerge=true, ScanGitHubActions=true, AutomaticallyRequestCopilotCodeReview=true, LintDocumentation=false.
• Production Repository, DefaultBranch, TeamRepository, and IssueLabels managed resources are Ready.
• github-config and parent apps Kustomizations are Ready on the current platform artifact.
• The bootstrap/provider-gap procedure is linked from deploy/repositories/kyverno-policies.yaml without referring to the unrelated AWS issue.

Rough size: XS (one narrow org-admin property correction plus live verification).

[coderabbitai]

🔗 Related PRs

#67 - feat: require actions pinned to a full-length commit SHA on all repos but actions [merged]
#78 - feat(repositories): declare provider-upjet-unifi (net-new Library repo) [merged]
#82 - feat: declare the devantler-tech/aws config-tenant repo [merged]
#88 - feat: archived-repo pattern + reusable-workflows archival groundwork [merged]
#90 - feat: archive the reusable-workflows repository (phase 2) [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!