fix(github): avoid signoff-blocked repository updates - #158
Merged
Conversation
devantler
marked this pull request as ready for review
August 16, 2026 17:59
Contributor
Author
@coderabbitai review Please review exact head f533170, including the fail-closed provider compatibility test. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
requested_head='f5331707fab35f367de79a87b6f0cc4a3a52ac70'
printf '%s\n' '== HEAD =='
git rev-parse HEAD
printf '%s\n' '== requested commit =='
git show -s --format='%H%n%P%n%s' "$requested_head"
printf '%s\n' '== repository status =='
git status --short
printf '%s\n' '== merge base and changed files =='
base="$(git merge-base "$requested_head" origin/main 2>/dev/null || true)"
if [ -n "$base" ]; then
printf 'base=%s\n' "$base"
git diff --name-status "$base" "$requested_head"
else
printf '%s\n' 'Could not determine merge base with origin/main; show commit files instead.'
git diff-tree --no-commit-id --name-status -r "$requested_head"
fi
printf '%s\n' '== changed-file outlines =='
if [ -n "$base" ]; then
git diff --name-only "$base" "$requested_head" | while IFS= read -r file; do
printf '\n--- %s ---\n' "$file"
case "$file" in
*.yaml|*.yml|*.json|*.ts|*.js|*.py|*.sh)
ast-grep outline "$file" --items all 2>&1 || true
;;
*)
sed -n '1,240p' "$file"
;;
esac
done
fiLength of output: 12208 🏁 Script executed: #!/bin/bash
set -euo pipefail
base='e7fcd79de70aa5f8fcfbd9f6950da34d2e2b3bf2'
head='f5331707fab35f367de79a87b6f0cc4a3a52ac70'
printf '%s\n' '== complete PR diff =='
git diff --find-renames --find-copies --unified=80 "$base" "$head" -- \
AGENTS.md \
deploy/repositories/agent-plugins.yaml \
deploy/repositories/agent-skills.yaml \
deploy/repositories/platform-tenant-template.yaml \
tests/repository-update-policy.sh
printf '%s\n' '== repository update policy test =='
nl -ba tests/repository-update-policy.sh
printf '%s\n' '== managed repository manifests and relevant fields =='
fd --type f --extension yaml . deploy/repositories | sort | while IFS= read -r file; do
printf '\n--- %s ---\n' "$file"
rg -n -C2 '^(kind: Repository| name:| webCommitSignoffRequired:| topics:| hasProjects:)' "$file" || true
done
printf '%s\n' '== test references and CI invocation =='
rg -n -C3 'repository-update-policy\.sh|webCommitSignoffRequired|agent-plugins|agent-skills|hasProjects' \
AGENTS.md .github tests deploy -g '*.yaml' -g '*.yml' -g '*.sh' -g '*.md'Length of output: 24398 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== complete repository update policy test =='
sed -n '=' tests/repository-update-policy.sh | sed 'N;s/\n/\t/'
printf '%s\n' '== deploy kustomization and repository patch references =='
sed -n '=' deploy/kustomization.yaml | sed 'N;s/\n/\t/'
rg -n -C4 'webCommitSignoffRequired|patches|repositories/' deploy -g '*.yaml' -g '*.yml'
printf '%s\n' '== CI references =='
rg -n -C5 'repository-update-policy\.sh|CI - Required Checks' .github -g '*.yaml' -g '*.yml'
printf '%s\n' '== rendered target resource fields =='
if command -v kubectl >/dev/null 2>&1; then
render="$(mktemp)"
trap 'rm -f "$render"' EXIT
kubectl kustomize deploy/ > "$render"
yq -N '
select(.kind == "Repository" and
(.metadata.name == "agent-plugins" or
.metadata.name == "agent-skills" or
.metadata.name == "platform-tenant-template")) |
{
name: .metadata.name,
managementPolicies: .spec.managementPolicies,
forProvider: {
topics: .spec.forProvider.topics,
hasIssues: .spec.forProvider.hasIssues,
hasProjects: .spec.forProvider.hasProjects,
webCommitSignoffRequired: .spec.forProvider.webCommitSignoffRequired
}
}
' "$render"
else
printf '%s\n' 'kubectl is unavailable; rendering could not be verified.'
fiLength of output: 14886 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== repository update policy test =='
sed -n '1,220p' tests/repository-update-policy.sh
printf '%s\n' '== active repository kustomization =='
sed -n '1,180p' deploy/repositories/kustomization.yaml
printf '%s\n' '== coverage and failure-mode assertions =='
for file in tests/declarative-coverage.sh tests/declarative-coverage-fail-closed.sh; do
if [ -f "$file" ]; then
printf '\n--- %s ---\n' "$file"
sed -n '1,260p' "$file"
fi
done
printf '%s\n' '== direct assertions for target resource presence or counts =='
rg -n -C4 \
'agent-plugins|agent-skills|platform-tenant-template|active_count|expected.*count|count.*expected|Repository resources' \
tests deploy .github -g '*.sh' -g '*.yaml' -g '*.yml'Length of output: 58876
I found one issue in the fail-closed compatibility test.
I could not run You are interacting with an AI system. |
Contributor
Author
Addressed the fail-open review finding in exact head 3a12e5b: the guard now requires the exact agent-plugins and agent-skills Repository set before asserting topics are absent. All seven baseline validations pass at this head. @coderabbitai review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='3a12e5bd86e766ea3bf43ad3d629de184d7ac802'
printf '%s\n' '== exact commit =='
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
printf '%s\n' '== checked-out HEAD =='
git rev-parse HEAD
parent="$(git rev-parse "${head}^")"
printf '%s\n' '== changed files =='
git diff --name-status "$parent" "$head"
printf '%s\n' '== complete exact-head diff =='
git diff --find-renames --find-copies --unified=100 "$parent" "$head" -- \
tests/repository-update-policy.sh \
deploy/repositories/agent-plugins.yaml \
deploy/repositories/agent-skills.yaml \
deploy/repositories/kustomization.yaml \
AGENTS.md \
.github
printf '%s\n' '== policy test with line numbers =='
nl -ba tests/repository-update-policy.sh
printf '%s\n' '== target Repository manifests =='
for file in deploy/repositories/agent-plugins.yaml deploy/repositories/agent-skills.yaml; do
if [ -f "$file" ]; then
printf '\n--- %s ---\n' "$file"
sed -n '1,220p' "$file"
fi
done
printf '%s\n' '== repository kustomization =='
sed -n '1,220p' deploy/repositories/kustomization.yaml
printf '%s\n' '== baseline-policy invocations =='
rg -n -C3 'repository-update-policy\.sh|administrative-policy\.sh|declarative-coverage|fail-closed|release-contract' \
AGENTS.md .github tests -g '*.md' -g '*.yaml' -g '*.yml' -g '*.sh'Length of output: 1994 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='devantler-tech/.github'
pr='158'
requested='3a12e5bd86e766ea3bf43ad3d629de184d7ac802'
printf '%s\n' '== GitHub pull request head =='
gh pr view "$pr" --repo "$repo" --json number,url,headRefName,headRefOid,baseRefName \
--jq '{number, url, headRefName, headRefOid, baseRefName}'
actual="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq .headRefOid)"
if [ "$actual" != "$requested" ]; then
printf 'Requested SHA does not match the current PR head.\nrequested=%s\nactual=%s\n' \
"$requested" "$actual"
exit 0
fi
git fetch --no-tags origin "refs/pull/${pr}/head:refs/remotes/origin/pr-${pr}"
git cat-file -e "${requested}^{commit}"
parent="$(git rev-parse "${requested}^")"
printf '%s\n' '== exact-head changed files =='
git diff --name-status "$parent" "$requested"
printf '%s\n' '== exact-head policy diff =='
git diff --unified=100 "$parent" "$requested" -- tests/repository-update-policy.sh
printf '%s\n' '== policy test at exact head =='
git show "${requested}:tests/repository-update-policy.sh" | nl -ba
printf '%s\n' '== target manifests at exact head =='
for file in deploy/repositories/agent-plugins.yaml deploy/repositories/agent-skills.yaml deploy/repositories/kustomization.yaml; do
printf '\n--- %s ---\n' "$file"
git show "${requested}:${file}"
doneLength of output: 1849
PR
The requested SHA:
is not available from the repository remote. Please confirm that the current PR head is the intended revision, or provide the correct commit SHA. 🧠 Learnings usedYou are interacting with an AI system. |
Contributor
Author
Correction: the exact current head is 3a12e5b. The previous invocation captured a mistyped SHA before its comment was corrected. @coderabbitai review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='devantler-tech/.github'
pr='158'
requested='3a12e5b9a6c5a25e9b735bc97ce6aaa220dbd126'
printf '%s\n' '== PR metadata =='
gh pr view "$pr" --repo "$repo" \
--json number,url,baseRefOid,baseRefName,headRefName,headRefOid \
--jq '{number,url,baseRefName,baseRefOid,headRefName,headRefOid}'
actual="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')"
if [ "$actual" != "$requested" ]; then
printf 'ERROR: requested head differs from current PR head\nrequested=%s\nactual=%s\n' \
"$requested" "$actual"
exit 0
fi
git fetch --no-tags origin "refs/pull/${pr}/head:refs/remotes/origin/pr-${pr}"
git cat-file -e "${requested}^{commit}"
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq '.baseRefOid')"
printf '== exact commit ==\n'
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$requested"
printf '== changed files, base to exact head ==\n'
git diff --name-status "$base" "$requested"
printf '== complete PR diff ==\n'
git diff --find-renames --find-copies --unified=80 "$base" "$requested"
printf '== policy test at exact head ==\n'
git show "${requested}:tests/repository-update-policy.sh" | nl -ba
printf '== affected repository manifests at exact head ==\n'
for path in \
deploy/repositories/agent-plugins.yaml \
deploy/repositories/agent-skills.yaml \
deploy/repositories/platform-tenant-template.yaml \
deploy/repositories/kustomization.yaml \
deploy/kustomization.yaml \
AGENTS.md
do
printf '\n--- %s ---\n' "$path"
git show "${requested}:${path}" 2>&1 || true
done
printf '== policy-test input and target references ==\n'
git grep -n -E \
'repository-update-policy\.sh|agent-plugins|agent-skills|platform-tenant-template|webCommitSignoffRequired|managementPolicies|topics:' \
"$requested" -- AGENTS.md .github tests deploy 2>&1 || trueLength of output: 26456 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='3a12e5b9a6c5a25e9b735bc97ce6aaa220dbd126'
printf '%s\n' '== complete repository-update-policy.sh =='
git show "${head}:tests/repository-update-policy.sh"
printf '%s\n' '== repository kustomization =='
git show "${head}:deploy/repositories/kustomization.yaml"
printf '%s\n' '== top-level kustomization =='
git show "${head}:deploy/kustomization.yaml"
printf '%s\n' '== target resources =='
for path in \
deploy/repositories/agent-plugins.yaml \
deploy/repositories/agent-skills.yaml \
deploy/repositories/platform-tenant-template.yaml
do
printf '\n--- %s ---\n' "$path"
git show "${head}:${path}"
done
printf '%s\n' '== test helper and rendering command references =='
git grep -n -E \
'kubectl kustomize|render=|render\)|active_count|compatibility_repositories|expected_compatibility_repositories|blocked_topic_updates|platform_tenant_projects' \
"$head" -- tests .github AGENTS.md
printf '%s\n' '== CI baseline validation declarations =='
git show "${head}:.github/workflows/ci.yaml" 2>&1 || true
printf '%s\n' '== policy test history for the exact-set guard =='
git diff --unified=30 "${head}^" "$head" -- tests/repository-update-policy.shLength of output: 29024
The exact-set guard addresses the prior fail-open finding. It fails if either target Repository is missing, duplicated, or renamed before it checks that I found one documentation issue.
🧠 Learnings usedYou are interacting with an AI system. |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='devantler-tech/.github'
pr='158'
head='3a12e5b9a6c5a25e9b735bc97ce6aaa220dbd126'
printf '%s\n' '== live PR head =='
gh pr view "$pr" --repo "$repo" --json number,url,headRefOid,baseRefOid \
--jq '{number,url,headRefOid,baseRefOid}'
actual="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')"
if [ "$actual" != "$head" ]; then
printf 'HEAD_MISMATCH requested=%s actual=%s\n' "$head" "$actual"
exit 0
fi
git cat-file -e "${head}^{commit}"
base="$(git merge-base "$head" origin/main)"
printf 'base=%s\nhead=%s\n' "$base" "$head"
printf '%s\n' '== complete PR changed files =='
git diff --name-status "$base" "$head"
printf '%s\n' '== exact-head complete diff =='
git diff --find-renames --find-copies --unified=100 "$base" "$head"
printf '%s\n' '== policy-test outline =='
ast-grep outline tests/repository-update-policy.sh --items all 2>&1 || true
printf '%s\n' '== policy test at exact head =='
git show "${head}:tests/repository-update-policy.sh" | nl -ba
printf '%s\n' '== exact-head repository manifests =='
for file in \
deploy/repositories/agent-plugins.yaml \
deploy/repositories/agent-skills.yaml \
deploy/repositories/platform-tenant-template.yaml \
deploy/repositories/kustomization.yaml \
deploy/kustomization.yaml \
AGENTS.md; do
printf '\n--- %s ---\n' "$file"
git show "${head}:${file}" 2>&1 || true
done
printf '%s\n' '== policy references and baseline workflow invocations =='
rg -n -C4 \
'repository-update-policy\.sh|agent-plugins|agent-skills|webCommitSignoffRequired|managementPolicies|LateInitialize' \
.github AGENTS.md tests deploy \
-g '*.sh' -g '*.yaml' -g '*.yml' -g '*.md' || trueLength of output: 27010 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='3a12e5b9a6c5a25e9b735bc97ce6aaa220dbd126'
printf '%s\n' '== complete policy test at exact head =='
git show "${head}:tests/repository-update-policy.sh" | sed -n '=' | sed 'N;s/\n/\t/'
printf '%s\n' '== deployment configuration at exact head =='
for file in \
deploy/kustomization.yaml \
deploy/repositories/kustomization.yaml \
deploy/repositories/agent-plugins.yaml \
deploy/repositories/agent-skills.yaml \
deploy/repositories/platform-tenant-template.yaml; do
printf '\n--- %s ---\n' "$file"
git show "${head}:${file}" | sed -n '1,260p'
done
printf '%s\n' '== shared Repository patches and target references =='
rg -n -C5 \
'webCommitSignoffRequired|kind: Repository|name: agent-plugins|name: agent-skills|name: platform-tenant-template|resources:|patches:' \
deploy -g '*.yaml' -g '*.yml'
printf '%s\n' '== CI and test invocation references =='
rg -n -C4 \
'repository-update-policy\.sh|CI - Required Checks|kubectl kustomize deploy' \
.github AGENTS.md tests -g '*.yaml' -g '*.yml' -g '*.md' -g '*.sh' || true
printf '%s\n' '== required command availability =='
for command in yq kubectl; do
if command -v "$command" >/dev/null 2>&1; then
printf '%s=%s\n' "$command" "$(command -v "$command")"
else
printf '%s=unavailable\n' "$command"
fi
done
if command -v kubectl >/dev/null 2>&1 && command -v yq >/dev/null 2>&1; then
printf '%s\n' '== rendered target Repository fields =='
temp="$(mktemp)"
trap 'rm -f "$temp"' EXIT
kubectl kustomize deploy > "$temp"
yq -N '
select(
.kind == "Repository" and
(.metadata.name == "agent-plugins" or
.metadata.name == "agent-skills" or
.metadata.name == "platform-tenant-template")
) |
{
name: .metadata.name,
archived: .spec.forProvider.archived,
managementPolicies: .spec.managementPolicies,
topics: .spec.forProvider.topics,
hasIssues: .spec.forProvider.hasIssues,
hasProjects: .spec.forProvider.hasProjects,
webCommitSignoffRequired: .spec.forProvider.webCommitSignoffRequired
}
' "$temp"
fiLength of output: 75184
I found one issue.
The new exact-name assertion does fix the prior case where a target resource was absent from the rendered output. I could not run 🧠 Learnings usedYou are interacting with an AI system. |
Contributor
Author
Addressed the exact-head documentation finding: both remaining signoff comments now distinguish the required live true declaration from the deployed provider compatibility boundary for any other Repository drift. Focused policy validation remains green. @coderabbitai review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='devantler-tech/.github'
pr='158'
prior='3a12e5b9a6c5a25e9b735bc97ce6aaa220dbd126'
printf '%s\n' '== PR metadata =='
gh pr view "$pr" --repo "$repo" \
--json number,url,baseRefName,baseRefOid,headRefName,headRefOid \
--jq '{number,url,baseRefName,baseRefOid,headRefName,headRefOid}'
head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')"
git fetch --no-tags origin "refs/pull/${pr}/head:refs/remotes/origin/pr-${pr}"
git cat-file -e "${head}^{commit}"
printf '%s\n' '== current head =='
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$head"
printf '%s\n' '== changes since prior reviewed head =='
if git merge-base --is-ancestor "$prior" "$head"; then
git diff --find-renames --find-copies --unified=80 "$prior" "$head"
else
printf '%s\n' 'Prior reviewed head is not an ancestor of the current head.'
fi
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq '.baseRefOid')"
printf '%s\n' '== complete current PR changed files =='
git diff --name-status "$base" "$head"
printf '%s\n' '== repository policy test at current head =='
git show "${head}:tests/repository-update-policy.sh" | nl -ba
printf '%s\n' '== corrected documentation locations =='
for file in tests/repository-update-policy.sh deploy/repositories/kustomization.yaml AGENTS.md; do
printf '\n--- %s ---\n' "$file"
git show "${head}:${file}" | rg -n -C4 \
'webCommitSignoffRequired|web_commit_signoff_required|signoff|compatibility|drift|agent-plugins|agent-skills' || true
done
printf '%s\n' '== target Repository manifests at current head =='
for file in deploy/repositories/agent-plugins.yaml deploy/repositories/agent-skills.yaml; do
printf '\n--- %s ---\n' "$file"
git show "${head}:${file}"
doneLength of output: 15933 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='devantler-tech/.github'
pr='158'
head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')"
printf '%s\n' '== policy test with portable line numbers =='
git show "${head}:tests/repository-update-policy.sh" |
awk '{ printf "%6d\t%s\n", NR, $0 }'
printf '%s\n' '== compatibility selector and all active-state assertions =='
git show "${head}:tests/repository-update-policy.sh" |
rg -n -C6 \
'compatibility_repositories|expected_compatibility_repositories|blocked_topic_updates|archived|agent-plugins|agent-skills|active_count'
printf '%s\n' '== target resource active-state declarations =='
for file in deploy/repositories/agent-plugins.yaml deploy/repositories/agent-skills.yaml; do
printf '\n--- %s ---\n' "$file"
git show "${head}:${file}" |
rg -n -C5 '^(kind: Repository|metadata:| name:|spec:| forProvider:| archived:| managementPolicies:)' || true
done
printf '%s\n' '== exact current-head documentation diff =='
parent="$(git rev-parse "${head}^")"
git diff --unified=20 "$parent" "$head" -- \
deploy/repositories/kustomization.yaml \
tests/repository-update-policy.shLength of output: 23606
The two corrected comments now distinguish the required live One issue remains.
🧠 Learnings usedIf you found this review helpful, would you consider giving us a shout-out on X? Thank you for using CodeRabbit! You are interacting with an AI system. |
Contributor
Author
Addressed the final exact-head review finding at @coderabbitai review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='devantler-tech/.github'
pr='158'
requested='40881ebdc0302601758a0c1eb0a6c66c16e4dab7'
printf '%s\n' '== PR metadata =='
gh pr view "$pr" --repo "$repo" \
--json number,url,baseRefName,baseRefOid,headRefName,headRefOid \
--jq '{number,url,baseRefName,baseRefOid,headRefName,headRefOid}'
actual="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')"
if [ "$actual" != "$requested" ]; then
printf 'HEAD_MISMATCH requested=%s actual=%s\n' "$requested" "$actual"
exit 0
fi
git fetch --no-tags origin "refs/pull/${pr}/head:refs/remotes/origin/pr-${pr}"
git cat-file -e "${requested}^{commit}"
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq '.baseRefOid')"
printf '%s\n' '== exact commit =='
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$requested"
printf '%s\n' '== changed files, base to exact head =='
git diff --name-status "$base" "$requested"
printf '%s\n' '== complete PR diff =='
git diff --find-renames --find-copies --unified=80 "$base" "$requested"
printf '%s\n' '== policy test at exact head =='
git show "${requested}:tests/repository-update-policy.sh" | nl -ba
printf '%s\n' '== compatibility guard references =='
git show "${requested}:tests/repository-update-policy.sh" |
rg -n -C6 \
'compatibility_repositories|expected_compatibility_repositories|blocked_topic_updates|archived|webCommitSignoffRequired|agent-plugins|agent-skills|active_count'
printf '%s\n' '== affected manifests and kustomizations =='
for file in \
deploy/repositories/agent-plugins.yaml \
deploy/repositories/agent-skills.yaml \
deploy/repositories/platform-tenant-template.yaml \
deploy/repositories/kustomization.yaml \
deploy/kustomization.yaml \
AGENTS.md
do
printf '\n--- %s ---\n' "$file"
git show "${requested}:${file}" 2>&1 || true
done
printf '%s\n' '== policy and workflow references =='
git grep -n -E \
'repository-update-policy\.sh|agent-plugins|agent-skills|webCommitSignoffRequired|web_commit_signoff_required|LateInitialize|topics:' \
"$requested" -- AGENTS.md .github tests deploy 2>&1 || trueLength of output: 34407 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='40881ebdc0302601758a0c1eb0a6c66c16e4dab7'
base='e7fcd79de70aa5f8fcfbd9f6950da34d2e2b3bf2'
printf '%s\n' '== policy test with portable line numbers =='
git show "${head}:tests/repository-update-policy.sh" |
awk '{ printf "%6d\t%s\n", NR, $0 }'
printf '%s\n' '== final commit diff =='
git diff --unified=50 "${head}^" "$head" -- \
tests/repository-update-policy.sh \
AGENTS.md \
deploy/repositories/agent-plugins.yaml \
deploy/repositories/agent-skills.yaml \
deploy/repositories/kustomization.yaml \
deploy/repositories/platform-tenant-template.yaml
printf '%s\n' '== affected exact-head source files =='
for file in \
deploy/repositories/agent-plugins.yaml \
deploy/repositories/agent-skills.yaml \
deploy/repositories/platform-tenant-template.yaml \
deploy/repositories/kustomization.yaml \
deploy/kustomization.yaml \
.github/workflows/ci.yaml \
AGENTS.md
do
printf '\n--- %s ---\n' "$file"
git show "${head}:${file}" 2>&1 || true
done
printf '%s\n' '== relevant exact-head references =='
git grep -n -E \
'repository-update-policy\.sh|agent-plugins|agent-skills|archived != true|webCommitSignoffRequired|web_commit_signoff_required|topics:' \
"$head" -- AGENTS.md .github tests deploy 2>&1 || true
printf '%s\n' '== available validation tools =='
for tool in kubectl yq; do
if command -v "$tool" >/dev/null 2>&1; then
printf '%s=%s\n' "$tool" "$(command -v "$tool")"
else
printf '%s=unavailable\n' "$tool"
fi
done
printf '%s\n' '== structural policy invariants at exact head =='
git show "${head}:tests/repository-update-policy.sh" |
awk '
/compatibility_repositories=/ { in_guard=1 }
/blocked_topic_updates=/ { in_guard=0 }
in_guard { print }
'Length of output: 48886
The compatibility guard now requires the exact This addresses the final active-state finding. I found no new actionable issue. I could not run the rendered-manifest validation or test suite because the sandbox does not provide 🧠 Learnings usedYou are interacting with an AI system. |
Contributor
Author
Ready at exact head |
Contributor
Author
Production follow-through: this change recovered |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Root cause
After platform#3164 and platform#3170 restored direct GitHub API connectivity, the affected Repository resources reached GitHub and exposed HTTP 422. Production runs provider-upjet-github v0.19.1, which embeds terraform-provider-github v6.6.0. Its repository update includes web_commit_signoff_required when another field changes; GitHub rejects that field when the organization enforces signoff, aborting the entire PATCH. Upstream fixed this in terraform-provider-github v6.12, but provider-upjet-github has not released a package containing it.
The only unapplied desired fields are agent-plugins and agent-skills topics. They are optional discovery metadata and are not live today. Omitting them removes the update plan without imperatively changing GitHub.
Proof