feat: archived-repo pattern + reusable-workflows archival groundwork

deploy/README.md

@@ -14,6 +14,11 @@ reconcile the live GitHub org to match these manifests — including reverting
 out-of-band changes made in the GitHub UI.
 
 - `repositories/` — one `Repository` per managed repo.
+- `archived-repositories/` — one `Repository` per archived (or archival-bound)
+  repo, kept outside `repositories/` so its shared merge-policy patch never
+  targets a read-only repo (each patched reconcile would 422). Observe-first,
+  then a single `archived: true` flip; the two-phase lifecycle is documented in
+  that dir's `kustomization.yaml`.
 - `teams/` — one `Team` per file (the `maintainers` team, Observe-adopted).
 - `team-memberships/` — one `TeamMembership` per file (`add-<user>-to-<team>.yaml`).
 - `team-repositories/` — one `TeamRepository` per file (`grant-<team>-on-<repo>.yaml`),

deploy/archived-repositories/kustomization.yaml

@@ -0,0 +1,22 @@
+# Archived (or archival-bound) repositories, kept OUTSIDE ../repositories/ on
+# purpose: that kustomization's shared merge-policy patch (squash-only +
+# webCommitSignoffRequired) targets every Repository it renders, and an archived
+# repo is read-only for settings — each patched reconcile would 422 forever.
+# CRs here get NO shared patches; they carry only what an archived repo can hold.
+#
+# Lifecycle (two-phase, per devantler-tech/actions#425 AC3):
+#   1. Adopt Observe-only (read-only mirror; this phase) and remove the repo's
+#      active management CRs (labels/, repository-permissions/,
+#      team-repositories/) — all omit Delete, so pruning them never touches
+#      live GitHub.
+#   2. After the org required-workflow rulesets are repointed off the repo
+#      (devantler-tech/.github#87), promote to Observe+Update+LateInitialize
+#      with `archived: true` — LateInitialize backfills the remaining live
+#      settings first, so the only write the provider ever sends is the single
+#      archive PATCH; once archived, desired == observed and it stays silent.
+# Delete is omitted everywhere (same guarantee as ../repositories/: a CR/Flux
+# prune can never delete a real repository).
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - reusable-workflows.yaml

deploy/archived-repositories/reusable-workflows.yaml

@@ -0,0 +1,19 @@
+# Legacy reusable-workflow library, merged INTO devantler-tech/actions (#314,
+# v7.0.0) and bound for archival (devantler-tech/actions#425 AC3). Phase 1:
+# Observe-only adoption — Crossplane mirrors live state into status.atProvider
+# and never writes. Phase 2 (a follow-up PR, gated on the org required-workflow
+# rulesets repointing off this repo — devantler-tech/.github#87): promote to
+# Observe+Update+LateInitialize and set `archived: true` under forProvider.
+apiVersion: repo.github.m.upbound.io/v1alpha1
+kind: Repository
+metadata:
+  name: reusable-workflows
+  annotations:
+    crossplane.io/external-name: reusable-workflows
+spec:
+  managementPolicies: ["Observe"]
+  forProvider:
+    name: reusable-workflows
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/kustomization.yaml

@@ -16,6 +16,7 @@ resources:
   - external-secret.yaml
   - provider-config.yaml
   - repositories/
+  - archived-repositories/
   - teams/
   - team-memberships/
   - team-repositories/

deploy/labels/kustomization.yaml

@@ -37,7 +37,6 @@ resources:
   - dotnet-template.yaml
   - homebrew-tap.yaml
   - actions.yaml
-  - reusable-workflows.yaml
   # Private repos.
   - ascoachingogvaner.yaml
   - wedding-app.yaml

deploy/repository-permissions/kustomization.yaml

@@ -36,7 +36,6 @@ resources:
   - go-template.yaml
   - dotnet-template.yaml
   - homebrew-tap.yaml
-  - reusable-workflows.yaml
   # Private repos.
   - ascoachingogvaner.yaml
   - wedding-app.yaml

deploy/team-repositories/kustomization.yaml

@@ -13,7 +13,6 @@ resources:
   - grant-maintainers-on-ksail.yaml
   - grant-maintainers-on-monorepo.yaml
   - grant-maintainers-on-platform.yaml
-  - grant-maintainers-on-reusable-workflows.yaml
   # Created (grant did not exist yet).
   - grant-maintainers-on-gitops-tenant-template.yaml
   - grant-maintainers-on-platform-template.yaml