From 7567f492b98b26fa2c137a4039e43d6b5f7ee67a Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Fri, 10 Jul 2026 14:32:30 +0200 Subject: [PATCH] feat: add archived-repo pattern and adopt reusable-workflows for archival MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Phase 1 of devantler-tech/actions#425 AC3: a new deploy/archived-repositories/ dir (outside the repositories/ shared merge-policy patch, which would 422 against a read-only repo every reconcile) Observe-adopts reusable-workflows, and the repo's three active management CRs (labels, repository-permissions, team-repositories) are removed — all omit Delete, so pruning never touches live GitHub. Phase 2 (the archived: true flip) follows once the org required-workflow rulesets are repointed off the repo (.github#87). Co-Authored-By: Claude Fable 5 --- deploy/README.md | 5 ++++ .../archived-repositories/kustomization.yaml | 22 +++++++++++++++ .../reusable-workflows.yaml | 19 +++++++++++++ deploy/kustomization.yaml | 1 + deploy/labels/kustomization.yaml | 1 - deploy/labels/reusable-workflows.yaml | 27 ------------------- .../repository-permissions/kustomization.yaml | 1 - .../reusable-workflows.yaml | 21 --------------- ...ant-maintainers-on-reusable-workflows.yaml | 18 ------------- deploy/team-repositories/kustomization.yaml | 1 - 10 files changed, 47 insertions(+), 69 deletions(-) create mode 100644 deploy/archived-repositories/kustomization.yaml create mode 100644 deploy/archived-repositories/reusable-workflows.yaml delete mode 100644 deploy/labels/reusable-workflows.yaml delete mode 100644 deploy/repository-permissions/reusable-workflows.yaml delete mode 100644 deploy/team-repositories/grant-maintainers-on-reusable-workflows.yaml diff --git a/deploy/README.md b/deploy/README.md index 557e1c1..056922e 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -14,6 +14,11 @@ reconcile the live GitHub org to match these manifests — including reverting out-of-band changes made in the GitHub UI. - `repositories/` — one `Repository` per managed repo. +- `archived-repositories/` — one `Repository` per archived (or archival-bound) + repo, kept outside `repositories/` so its shared merge-policy patch never + targets a read-only repo (each patched reconcile would 422). Observe-first, + then a single `archived: true` flip; the two-phase lifecycle is documented in + that dir's `kustomization.yaml`. - `teams/` — one `Team` per file (the `maintainers` team, Observe-adopted). - `team-memberships/` — one `TeamMembership` per file (`add--to-.yaml`). - `team-repositories/` — one `TeamRepository` per file (`grant--on-.yaml`), diff --git a/deploy/archived-repositories/kustomization.yaml b/deploy/archived-repositories/kustomization.yaml new file mode 100644 index 0000000..0a102ab --- /dev/null +++ b/deploy/archived-repositories/kustomization.yaml @@ -0,0 +1,22 @@ +# Archived (or archival-bound) repositories, kept OUTSIDE ../repositories/ on +# purpose: that kustomization's shared merge-policy patch (squash-only + +# webCommitSignoffRequired) targets every Repository it renders, and an archived +# repo is read-only for settings — each patched reconcile would 422 forever. +# CRs here get NO shared patches; they carry only what an archived repo can hold. +# +# Lifecycle (two-phase, per devantler-tech/actions#425 AC3): +# 1. Adopt Observe-only (read-only mirror; this phase) and remove the repo's +# active management CRs (labels/, repository-permissions/, +# team-repositories/) — all omit Delete, so pruning them never touches +# live GitHub. +# 2. After the org required-workflow rulesets are repointed off the repo +# (devantler-tech/.github#87), promote to Observe+Update+LateInitialize +# with `archived: true` — LateInitialize backfills the remaining live +# settings first, so the only write the provider ever sends is the single +# archive PATCH; once archived, desired == observed and it stays silent. +# Delete is omitted everywhere (same guarantee as ../repositories/: a CR/Flux +# prune can never delete a real repository). +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - reusable-workflows.yaml diff --git a/deploy/archived-repositories/reusable-workflows.yaml b/deploy/archived-repositories/reusable-workflows.yaml new file mode 100644 index 0000000..41a7e26 --- /dev/null +++ b/deploy/archived-repositories/reusable-workflows.yaml @@ -0,0 +1,19 @@ +# Legacy reusable-workflow library, merged INTO devantler-tech/actions (#314, +# v7.0.0) and bound for archival (devantler-tech/actions#425 AC3). Phase 1: +# Observe-only adoption — Crossplane mirrors live state into status.atProvider +# and never writes. Phase 2 (a follow-up PR, gated on the org required-workflow +# rulesets repointing off this repo — devantler-tech/.github#87): promote to +# Observe+Update+LateInitialize and set `archived: true` under forProvider. +apiVersion: repo.github.m.upbound.io/v1alpha1 +kind: Repository +metadata: + name: reusable-workflows + annotations: + crossplane.io/external-name: reusable-workflows +spec: + managementPolicies: ["Observe"] + forProvider: + name: reusable-workflows + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/kustomization.yaml b/deploy/kustomization.yaml index f4e11f8..941e9d9 100644 --- a/deploy/kustomization.yaml +++ b/deploy/kustomization.yaml @@ -16,6 +16,7 @@ resources: - external-secret.yaml - provider-config.yaml - repositories/ + - archived-repositories/ - teams/ - team-memberships/ - team-repositories/ diff --git a/deploy/labels/kustomization.yaml b/deploy/labels/kustomization.yaml index dedde20..2e1e152 100644 --- a/deploy/labels/kustomization.yaml +++ b/deploy/labels/kustomization.yaml @@ -37,7 +37,6 @@ resources: - dotnet-template.yaml - homebrew-tap.yaml - actions.yaml - - reusable-workflows.yaml # Private repos. - ascoachingogvaner.yaml - wedding-app.yaml diff --git a/deploy/labels/reusable-workflows.yaml b/deploy/labels/reusable-workflows.yaml deleted file mode 100644 index cfeb66b..0000000 --- a/deploy/labels/reusable-workflows.yaml +++ /dev/null @@ -1,27 +0,0 @@ -# Issue labels for devantler-tech/reusable-workflows. The canonical org taxonomy -# (22 labels) is appended to every IssueLabels by the shared patch in -# kustomization.yaml; this file adds only reusable-workflows's repo-specific extras -# (the dependency/ecosystem labels Dependabot/Renovate apply), declared so the -# authoritative set doesn't churn against the bots. See ../README.md. -apiVersion: repo.github.m.upbound.io/v1alpha1 -kind: IssueLabels -metadata: - name: reusable-workflows - annotations: - crossplane.io/external-name: reusable-workflows -spec: - managementPolicies: - - Observe - - Create - - Update - - LateInitialize - forProvider: - repository: reusable-workflows - label: - - name: "dependencies" - color: "0366d6" - - name: "github_actions" - color: "000000" - providerConfigRef: - kind: ProviderConfig - name: default diff --git a/deploy/repository-permissions/kustomization.yaml b/deploy/repository-permissions/kustomization.yaml index fc78a40..3f09e2a 100644 --- a/deploy/repository-permissions/kustomization.yaml +++ b/deploy/repository-permissions/kustomization.yaml @@ -36,7 +36,6 @@ resources: - go-template.yaml - dotnet-template.yaml - homebrew-tap.yaml - - reusable-workflows.yaml # Private repos. - ascoachingogvaner.yaml - wedding-app.yaml diff --git a/deploy/repository-permissions/reusable-workflows.yaml b/deploy/repository-permissions/reusable-workflows.yaml deleted file mode 100644 index c046b38..0000000 --- a/deploy/repository-permissions/reusable-workflows.yaml +++ /dev/null @@ -1,21 +0,0 @@ -# Actions permissions for devantler-tech/reusable-workflows — binds the org-wide -# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo. -# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning -# on SHA-pinning never disturbs them. See ../README.md. -apiVersion: actions.github.m.upbound.io/v1alpha1 -kind: RepositoryPermissions -metadata: - name: reusable-workflows - annotations: - crossplane.io/external-name: reusable-workflows -spec: - managementPolicies: - - Observe - - Create - - Update - - LateInitialize - forProvider: - repository: reusable-workflows - providerConfigRef: - kind: ProviderConfig - name: default diff --git a/deploy/team-repositories/grant-maintainers-on-reusable-workflows.yaml b/deploy/team-repositories/grant-maintainers-on-reusable-workflows.yaml deleted file mode 100644 index 9eefbaa..0000000 --- a/deploy/team-repositories/grant-maintainers-on-reusable-workflows.yaml +++ /dev/null @@ -1,18 +0,0 @@ -# Team → repository access, adopted Observe-first (read-only). -# external-name = `:`. -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamRepository -metadata: - name: maintainers-reusable-workflows - annotations: - crossplane.io/external-name: "17046606:reusable-workflows" -spec: - managementPolicies: ["Observe"] - forProvider: - teamIdRef: - name: maintainers - repository: reusable-workflows - permission: maintain - providerConfigRef: - kind: ProviderConfig - name: default diff --git a/deploy/team-repositories/kustomization.yaml b/deploy/team-repositories/kustomization.yaml index 96eaae6..f9f4e9e 100644 --- a/deploy/team-repositories/kustomization.yaml +++ b/deploy/team-repositories/kustomization.yaml @@ -13,7 +13,6 @@ resources: - grant-maintainers-on-ksail.yaml - grant-maintainers-on-monorepo.yaml - grant-maintainers-on-platform.yaml - - grant-maintainers-on-reusable-workflows.yaml # Created (grant did not exist yet). - grant-maintainers-on-gitops-tenant-template.yaml - grant-maintainers-on-platform-template.yaml