Repository navigation
Adopt supported GitHub rulesets and track remaining provider gaps #69
Description
🤖 Generated by the Agentic Engineer
Problem
Some GitHub governance policies still lack a reviewed declarative owner. This issue tracks adoption in deploy/organization-rulesets/ and the remaining provider gaps. A schema inventory does not establish the current number of live or UI-managed rulesets.
Reviewed capability matrix
The released provider v0.20.0 OrganizationRuleset CRD at commit a211e095e2fe49c477836acec2ad4a28aa60e030 exposes the following capabilities. Its Git blob is 566bb7e5736b64f4e60920e2f52e986c26a53ce4; SHA-256 is f50cfddb37f198f32ed950172fbf1c7891ca70806b379aa325098e85c5dacfad. The inspected current-main commit 0609e5fcca24d0f737c8cd9c6b4a39439f51f3ba contains identical bytes.
| Capability | Schema status | Remaining work |
|---|---|---|
| Custom-property conditions | Present: repositoryProperty |
Observe-first inventory, full adoption and selector readback |
| Copilot review | Present: copilotCodeReview |
Maintainer activation decision before adoption |
| Push-file restrictions | Present: target push and all four restriction types |
Reviewed policy, scope and native controls |
| Required status checks | Present: typed doNotEnforceOnCreate |
Actual create/reconcile evaluation; schema alone is not proof |
| Enterprise-owner bypass | Present: EnterpriseOwner |
Exact approved bypass list |
| Code-quality rules | Absent: codeQuality |
Provider support |
| Repository name/transfer policies | Absent: target repository and repositoryTransfer |
Provider support; bypass support does not supply these rules |
| Actor/event workflow execution protection | No generated resource in the complete CRD tree | Separate adapter/adoption work in #226 |
| Secret-scanning alert resolution | Rule and parameters absent | Provider or approved adapter support, plus native controls in #194 |
Adoption procedure
Rebind the live non-archived repository and ruleset universe before adopting each policy. Observe first, declare the complete approved resource and bypass list, then verify effective GitHub targets and enforcement. Keep unsupported capabilities as named gaps; do not infer clearance from a successful team audit.
Acceptance
Every policy in the freshly verified live inventory has an authoritative declarative owner and live readback, or an explicitly documented provider/approval blocker. Push and workflow-execution policies follow the same evidence standard. No policy is enabled by this schema inspection.
Evidence: immutable OrganizationRuleset CRD, complete release CRD tree. The repository capability matrix and its integration assertions are updated in PR #400. Related: #121, #194, #226.
Activity
docs(crossplane): correct stale org-ruleset adoption comment
feat(github): manage org/repo rulesets declaratively + add v* tag pro…
devantler commentedon Jul 16, 2026
Priority raised — maintainer directive (2026-07-16): "We do not want ANY non-declarative config on GitHub, everything as code." That converts this issue from a passive watch-upstream item into an actively-pursued goal, and makes the residual UI-managed set a standing defect rather than an accepted limitation.
Fresh cost evidence — #87 (closed today). The five required-workflow rulesets (EnableAutoMerge
3716878, DependencyReview17213449, ScanGitHubActions14426226, .NET3716863, Go10320335) had drifted onto the archived, frozenreusable-workflowssource. Because they are exactly the set this issue lists as inexpressible (all scoped by custom/system properties →repository_property), the fix could not be a PR: it required a manual maintainer UI session, produced no GitOps record, and the agent could not even read the result (403on org rulesets). The inert LintDocumentation ruleset was deleted in the same session. This is the concrete toil this gap imposes — and it will recur on every future change to those five.The unblock is one capability:
repository_propertyconditions unblock 6 of the 10 at once (code-scanning, EnableAutoMerge, LintDocumentation→now deleted, ScanGitHubActions, .NET, Go). Everything else here is a long tail.Sharpened next step (was left open in the body): determine where the gap actually lives before proposing a fix —
integrations/terraform-provider-githubalready expressrepository_propertyconditions ongithub_organization_ruleset? If yes → the gap isprovider-upjet-githubCRD generation/config → a regeneration/bump may be sufficient. If no → the feature request belongs in the Terraform provider first, and upjet follows.required_status_checkscreate panic documented indeploy/organization-rulesets/README.md(do_not_enforce_on_createnil type-assert) — that one looks like a genuine upstream bug, not a missing feature, and may be the cheapest high-value upstream contribution here.Per contribute-upstream-dont-fork, the real fix is upstream, not a local workaround. Filing those upstream issues/PRs is gated on explicit maintainer approval (outward-facing artifacts outside
devantler-tech, plus an AI-contribution-policy check on each target repo) — that approval is being requested now; this comment records the plan, not a filing.Housekeeping: this issues body still points at
deploy/rulesets/; the tree is now split intodeploy/organization-rulesets/anddeploy/repository-rulesets/. Also the LintDocumentation row is now moot (ruleset deleted in #87), so the blocked set is 9, not 10.devantler commentedon Jul 25, 2026
Status update — most of the blocked table above is now unblocked upstream.
provider-upjet-github#295 bumped the bundled terraform-provider-github 6.6.0 → 6.13.0 (merged 2026-07-24, closing #289). Verified against the provider's
maingenerated CRDs:repositoryPropertyconditions — unblocks the 6 custom-property-scoped org rulesetscopilotCodeReviewrule typeshaPinningRequiredon bothRepositoryPermissionsandOrganizationPermissionscode_quality, targetrepository, rule typerepository_transfermainis 22 commits ahead of v0.19.1 and no release has been cut, so nothing here is actionable until a release ships and the platform repins.Adoption work + the full verified table is captured in #121 (blocked by devantler-tech/platform#2800). Leaving this epic's body as-is for history; #121 supersedes the table for planning.
One correction worth folding into #85 separately:
github_organization_settingsdoes exist in terraform-provider-github v6.13.0 — it is simply not wrapped by provider-upjet-github. That makes #85 an upstream resource-generation addition rather than a wait-for-upstream-feature item.[-]Adopt remaining rulesets declaratively as provider-upjet-github gains support (10 org rulesets + push + Actions policies)[/-][+]Adopt supported GitHub rulesets and track remaining provider gaps[/+]chore: agent-claim #69 nonce=ebf9409cf76d90f56212f50310bfdce9