Roadmap: declarative GitHub-org-as-code — extend coverage & sustain the source of truth #56

🤖 Generated by the Agentic Engineer

Product outcome

Keep organization configuration and repository automation in one reviewed source of truth. Crossplane remains the settings writer; complete read-only audits detect drift and missing ownership without introducing another settings writer.

Delivered foundation

The original delivery issues are closed and remain linked for evidence:

• Manage issue labels declaratively in deploy/ #51 — declarative issue labels
• Model org-level settings, rulesets & branch protection in deploy/ #52 — organization rulesets and branch policy
• Complete declarative team coverage (admin team + gap repos) #53 — declared team coverage
• Populate repository metadata (description, topics, homepage) on managed Repository CRs #54 — repository descriptions, topics and homepages
• Complete canonical agent shims and deploy contributor guidance #55 — repository instructions and contribution guidance

Labels and roadmap structure now exist; the earlier June inventory and missing-label explanation no longer describe the product.

Current delivery sequence

• Adopt supported GitHub rulesets and track remaining provider gaps #69 — adopt supported ruleset capabilities through Observe-first resources; retain explicit provider, approval and native-control gaps for unsupported policies.
• Migrate governance intent from devantler-tech/maintenance into .github (declarative) and retire the maintenance repo #84 — establish recurring complete repository/admin-team evidence and issue-on-gap reporting before retiring legacy maintenance. Manual App coverage is proven; Run the complete governance audits routinely and report gaps #406 supplies the routine delivery, and Return UNKNOWN when governance audits abort before completion #407 fixes premature auditor success.
• Model org-wide GitHub settings (webCommitSignoffRequired, default permission, 2FA) once the provider supports it #85 — obtain upstream provider support and adopt organization settings through the approved provider path. The read-only observer in Detect drift in the four declared organization settings #403 does not fulfill adoption, and its relationship to the earlier no-workaround direction awaits maintainer clarification. Roll out and retire the organization-settings audit opt-in #404 remains its lifecycle gate.

Completion standard

A rendered declaration is desired state, not proof of effective GitHub state. Read back the full stable live universe, exact targets and bypasses, require native positive and negative controls where enforcement changes, and preserve UNKNOWN for incomplete joins. Routine monitoring, rollout-input retirement, provider adoption and maintenance archive remain separate deliveries. No security policy, grant, archive or irreversible deletion is authorized by a successful audit alone.