feat(teams): add default-off Admins policy

.github/workflows/ci.yaml

@@ -29,6 +29,9 @@ jobs:
         # CRDs are applied/validated on-cluster, not here.
         run: kubectl kustomize deploy/ > /dev/null
 
+      - name: 🧪 Test default-off Admins policy
+        run: bash tests/admin-team-policy.sh
+
   ci-required-checks:
     name: CI - Required Checks
     runs-on: ubuntu-latest

AGENTS.md

@@ -59,7 +59,10 @@ for the architecture, the GitHub App credential setup, and the Observe-first ado
 | Path | Contents |
 |---|---|
 | `deploy/repositories/<repo>.yaml` | one `Repository` per managed repo (settings, merge/signoff, metadata) |
-| `deploy/teams/` | the `maintainers` team and its `TeamRepository` → repo access bindings |
+| `deploy/teams/` | one `Team` per file; default-off teams remain unlisted until activation |
+| `deploy/team-memberships/` | one explicit user-to-team membership per file |
+| `deploy/team-repositories/` | one team-to-repository permission grant per file |
+| `tests/fixtures/` | validation-only enabled renders for default-off policy slices |
 | `deploy/labels/<repo>.yaml` | one `IssueLabels` per repo; canonical taxonomy in `labels/kustomization.yaml` |
 | `deploy/provider-config.yaml` | the provider-upjet-github `ProviderConfig` (App credentials) |
 | `deploy/external-secret.yaml` | the `ExternalSecret` sourcing the GitHub App credentials |

deploy/README.md

@@ -19,10 +19,13 @@ out-of-band changes made in the GitHub UI.
   targets a read-only repo (each patched reconcile would 422). Observe-first,
   then a single `archived: true` flip; the two-phase lifecycle is documented in
   that dir's `kustomization.yaml`.
-- `teams/` — one `Team` per file (the `maintainers` team, Observe-adopted).
+- `teams/` — one `Team` per file. `maintainers` is Observe-adopted; the
+  separate `admins` policy remains default-off until its resources are listed.
 - `team-memberships/` — one `TeamMembership` per file (`add-<user>-to-<team>.yaml`).
 - `team-repositories/` — one `TeamRepository` per file (`grant-<team>-on-<repo>.yaml`),
-  each granting a team a permission on a repo.
+  each granting a team a permission on a repo. A file is inert until its
+  directory Kustomization lists it; the Admins policy uses this as its
+  default-off activation boundary.
 - `labels/` — one `IssueLabels` per managed repo. The canonical org label
   taxonomy lives once in `labels/kustomization.yaml` (a shared patch appended to
   every repo); each `<repo>.yaml` adds only that repo's Dependabot/Renovate
@@ -97,3 +100,25 @@ See the platform repo's
 for the architecture, the GitHub App credential setup, and the **Observe-first**
 adoption flow for bringing an existing repository under management without any
 risk of recreating or deleting it.
+
+## Default-off Admins policy
+
+Issue [#95](https://github.com/devantler-tech/.github/issues/95) defines the
+separate `Admins` team, its explicit maintainer membership, and `admin`
+grants for the 19 active portfolio repositories. The archived
+`reusable-workflows` repository and not-yet-active `kyverno-policies`
+repository are excluded.
+
+The policy files deliberately remain absent from the production
+`teams/`, `team-memberships/`, and `team-repositories/` resource lists.
+Validate both states with:
+
+```sh
+kubectl kustomize deploy/ > /dev/null
+kubectl kustomize tests/fixtures/admin-team-enabled \
+  --load-restrictor LoadRestrictionsNone > /dev/null
+bash tests/admin-team-policy.sh
+```
+
+Activation is a separate issue-backed change that lists the reviewed policy
+files in those three production Kustomizations.

deploy/team-memberships/add-devantler-to-admins.yaml

@@ -0,0 +1,16 @@
+# Default-off Admins-team membership. Activation lists this file alongside the
+# team and grants in their three production Kustomizations.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamMembership
+metadata:
+  name: admins-devantler
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: admins
+    username: devantler
+    role: maintainer
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-admins-on-actions.yaml

@@ -0,0 +1,17 @@
+# Default-off Admins-team repository grant. No external-name is set because the
+# separate team and its admin grant do not exist yet; activation creates them
+# without claiming Delete management.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: admins-actions
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: admins
+    repository: actions
+    permission: admin
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-admins-on-agent-plugins.yaml

@@ -0,0 +1,17 @@
+# Default-off Admins-team repository grant. No external-name is set because the
+# separate team and its admin grant do not exist yet; activation creates them
+# without claiming Delete management.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: admins-agent-plugins
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: admins
+    repository: agent-plugins
+    permission: admin
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-admins-on-agent-skills.yaml

@@ -0,0 +1,17 @@
+# Default-off Admins-team repository grant. No external-name is set because the
+# separate team and its admin grant do not exist yet; activation creates them
+# without claiming Delete management.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: admins-agent-skills
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: admins
+    repository: agent-skills
+    permission: admin
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-admins-on-ascoachingogvaner.yaml

@@ -0,0 +1,17 @@
+# Default-off Admins-team repository grant. No external-name is set because the
+# separate team and its admin grant do not exist yet; activation creates them
+# without claiming Delete management.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: admins-ascoachingogvaner
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: admins
+    repository: ascoachingogvaner
+    permission: admin
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-admins-on-aws.yaml

@@ -0,0 +1,17 @@
+# Default-off Admins-team repository grant. No external-name is set because the
+# separate team and its admin grant do not exist yet; activation creates them
+# without claiming Delete management.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: admins-aws
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: admins
+    repository: aws
+    permission: admin
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-admins-on-dot-github.yaml

@@ -0,0 +1,17 @@
+# Default-off Admins-team repository grant. No external-name is set because the
+# separate team and its admin grant do not exist yet; activation creates them
+# without claiming Delete management.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: admins-dot-github
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: admins
+    repository: .github
+    permission: admin
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-admins-on-dotnet-template.yaml

@@ -0,0 +1,17 @@
+# Default-off Admins-team repository grant. No external-name is set because the
+# separate team and its admin grant do not exist yet; activation creates them
+# without claiming Delete management.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: admins-dotnet-template
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: admins
+    repository: dotnet-template
+    permission: admin
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-admins-on-fleet-gitops.yaml

@@ -0,0 +1,17 @@
+# Default-off Admins-team repository grant. No external-name is set because the
+# separate team and its admin grant do not exist yet; activation creates them
+# without claiming Delete management.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: admins-fleet-gitops
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: admins
+    repository: fleet-gitops
+    permission: admin
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-admins-on-gitops-tenant-template.yaml

@@ -0,0 +1,17 @@
+# Default-off Admins-team repository grant. No external-name is set because the
+# separate team and its admin grant do not exist yet; activation creates them
+# without claiming Delete management.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: admins-gitops-tenant-template
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: admins
+    repository: gitops-tenant-template
+    permission: admin
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-admins-on-go-template.yaml

@@ -0,0 +1,17 @@
+# Default-off Admins-team repository grant. No external-name is set because the
+# separate team and its admin grant do not exist yet; activation creates them
+# without claiming Delete management.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: admins-go-template
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: admins
+    repository: go-template
+    permission: admin
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-admins-on-homebrew-tap.yaml

@@ -0,0 +1,17 @@
+# Default-off Admins-team repository grant. No external-name is set because the
+# separate team and its admin grant do not exist yet; activation creates them
+# without claiming Delete management.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: admins-homebrew-tap
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: admins
+    repository: homebrew-tap
+    permission: admin
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-admins-on-ksail.yaml

@@ -0,0 +1,17 @@
+# Default-off Admins-team repository grant. No external-name is set because the
+# separate team and its admin grant do not exist yet; activation creates them
+# without claiming Delete management.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: admins-ksail
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: admins
+    repository: ksail
+    permission: admin
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-admins-on-maintenance.yaml

@@ -0,0 +1,17 @@
+# Default-off Admins-team repository grant. No external-name is set because the
+# separate team and its admin grant do not exist yet; activation creates them
+# without claiming Delete management.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: admins-maintenance
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: admins
+    repository: maintenance
+    permission: admin
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-admins-on-monorepo.yaml

@@ -0,0 +1,17 @@
+# Default-off Admins-team repository grant. No external-name is set because the
+# separate team and its admin grant do not exist yet; activation creates them
+# without claiming Delete management.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: admins-monorepo
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: admins
+    repository: monorepo
+    permission: admin
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-admins-on-platform-template.yaml

@@ -0,0 +1,17 @@
+# Default-off Admins-team repository grant. No external-name is set because the
+# separate team and its admin grant do not exist yet; activation creates them
+# without claiming Delete management.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: admins-platform-template
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: admins
+    repository: platform-template
+    permission: admin
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-admins-on-platform.yaml

@@ -0,0 +1,17 @@
+# Default-off Admins-team repository grant. No external-name is set because the
+# separate team and its admin grant do not exist yet; activation creates them
+# without claiming Delete management.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: admins-platform
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: admins
+    repository: platform
+    permission: admin
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-admins-on-provider-upjet-unifi.yaml

@@ -0,0 +1,17 @@
+# Default-off Admins-team repository grant. No external-name is set because the
+# separate team and its admin grant do not exist yet; activation creates them
+# without claiming Delete management.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: admins-provider-upjet-unifi
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: admins
+    repository: provider-upjet-unifi
+    permission: admin
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default