Migrate governance intent from devantler-tech/maintenance into .github (declarative) and retire the maintenance repo

🤖 Generated by the Agentic Engineer

Problem

Retire the legacy maintenance reports after their useful policy checks are owned and verified here. Declaring a team grant does not prevent an additional unmanaged admin grant, and Observe-only resources do not revert live state. Rendered policy checks therefore need a complete live repository/team join before retirement.

Desired behavior

Every active, non-archived organization repository has exactly one effective admin team: the secret, non-inheritable Admins team. The rendered Admins policy and repository coverage remain authoritative desired-state checks; the live audit must additionally include undeclared repositories, every permissions page and repeated stable joins. Incomplete visibility returns UNKNOWN, never PASS.

PR #400 is merged as 6d7a19f3b37722806610ade51da745d939eef7e5. On 2026-10-03, both the independent organization-admin audit and the reviewed main App audit passed all 23 active repositories with repeated stable census/team joins. The App run requested read-only permissions and completed token revocation. The false-input control skipped the audit job and every credential step. This establishes manual App census coverage. Scheduled replacement, routine activation and experiment retirement are complete, as recorded below; maintenance retirement remains separate.

Tooling decision

Retain Crossplane as the settings writer and use the dedicated coverage/admin joins for this exact invariant. Decline a new Allstar deployment and keep Scorecard as supplementary security evidence. OpenSSF reports community-hosted Allstar ended in August 2026; self-hosting adds another operated settings writer. Allstar's settings enforcement and Scorecard's security heuristics do not replace authoritative ownership and the complete effective-team join required here.

Acceptance criteria

Verify the full live repository universe is declared and satisfies the current Admins grant policy; backfill any gaps. (Verified 2026-10-10: all 25 active repositories pass; the only undeclared one is actions, the deliberate exemption tracked in Archive devantler-tech/actions once nothing references it #240.)
Prove the reviewed main-only App audit can read the complete census and every effective team assignment (Audit live repository admin-team parity before maintenance retirement #395).
Activate one scheduled completeness/admin check with issue-on-gap behavior before replacing the legacy reports.
Record the Allstar/Scorecard adoption decision and reasons.
Archive maintenance only after the replacement is verified and references are cleared; remove its declarative resources through reviewed deletion guards. The maintainer performs any final irreversible deletion.

No archive, deletion or policy activation is authorized by the audit result alone. Related: #305, #306, #395 and the provider adoption gates in #69/#121. This issue remains open for rollout and retirement.

Natural scheduled observation

The first natural daily run completed on 2026-10-04 from reviewed main 6ae9a67. Admission, both complete coverage/admin checks and the separate reporter all succeeded; the audit covered all 23 active repositories and revoked its read-only App token. The reporter executed its actual complete-success path. Failure/UNKNOWN-to-open behavior remains protected by the existing independent report controls; this successful run does not claim a native failure-issue creation.

PR #444 is merged and completes experiment retirement in #395. The input-free combined main audit and standalone main audit both pass from the merged source; the combined success-path reporter also completes. The complete desired-state adoption/exemption join and archive/reference/deletion gates remain open. No maintenance archival or irreversible deletion follows from this observation.

🔗 Related PRs

#74 - feat(rulesets): require the CodeRabbit review status check org-wide [merged]
#78 - feat(repositories): declare provider-upjet-unifi (net-new Library repo) [merged]
#79 - feat(labels): bring devantler-tech/monorepo under declarative IssueLabels management [merged]
#82 - feat: declare the devantler-tech/aws config-tenant repo [merged]

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

Create Plan

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

chore: agent-claim #84 nonce=63c667443e9389816a1531dc35e25ab3

🤖 Generated by the Agentic Engineer

Started the migration with the one piece worth keeping from the maintenance reports: a live-org completeness check (#305, delivered by #307). Running it today already finds two public repositories outside deploy/ with no team at all; adopting them is #306. Removing the maintenance repository stays last, once both are in.

feat(governance): report live repositories that deploy/ does not decl…

🤖 Generated by the Agentic Engineer

Decision for this retirement: retain Crossplane as the authoritative settings writer and the dedicated repository-coverage/admin-team joins. Decline a new Allstar deployment; use Scorecard signals as supplementary security evidence rather than as proof of this exact team policy.

OpenSSF's September 2026 update reports that community-hosted Allstar ended in August and users must self-host. Allstar can monitor and change repository settings; adding another operated writer would duplicate the ownership already held here. Scorecard measures security heuristics, which do not establish a complete join of every active repository and its effective Admins team. These are the reasons for the decision, not a claim that the tools are interchangeable.

PR #400 supplies the default-off, read-only admin audit. Scheduling/issue-on-gap, native App coverage, and archive/remove sequencing still need their own evidence. This resolves the tooling-decision item only and does not retire maintenance.

chore: agent-claim #84 nonce=836010820bf3eb4afa002f1444ce585c

🤖 Generated by the Agentic Engineer

PR #409 merged as 906a5bc. All three actual main controls now pass from that source:

Enabled combined audit: both complete checks pass, the separate reporter completes, and the App token is revoked.
Disabled control: audit and report jobs are skipped with zero steps and no App mint.
Repaired standalone coverage workflow: the authenticated installation/census client and its reporter pass, with token revocation.

The routine workflow is delivered; its daily schedule is still disabled pending the reviewed activation change. Actual scheduled observation, opt-in/rollout-flag retirement and legacy maintenance retirement remain open. Organization-settings monitoring remains separate in #85/#404. The existing deliberate coverage exemption remains tracked by the Actions migration; this evidence does not claim every live repository has been adopted or authorize an archive/deletion.

🤖 Generated by the Agentic Engineer

The replacement has now handled a real gap by itself

The earlier note here said the failure path had not yet been seen natively. It has now:

Found. On 2026-10-09 both scheduled checks failed on two repositories that were not yet declared: the coverage check at 05:38Z (run 37889531347) and the governance audit at 06:49Z (run 37895580980). Each opened its own issue about a minute later (Scheduled repository coverage check is failing on main #556, Scheduled governance audits need attention #561).
Closed. fix(deploy): adopt client repositories in coverage #560 declared both repositories. The workflow closed Scheduled repository coverage check is failing on main #556 at 10:48Z, four minutes after that merged, and the next complete passing audit (run 37978993388) closed Scheduled governance audits need attention #561 in its report step. Both issues were opened and closed by the workflow, not by hand.
Clean today. Today's scheduled audit (run 38032008703, 06:44Z) passed both complete checks: all 25 active repositories have exactly one Admins admin team.

For comparison, the three legacy reports in maintenance each run once a week (last on 5, 6 and 7 October), so their next look would have been 12 to 14 October.

Acceptance

First item ticked. The Admins policy holds on every active repository, and every one is declared except actions, the one deliberate exemption (tracked in Archive devantler-tech/actions once nothing references it #240).
The last item, archiving maintenance, is the only one left, and it is not ready: references are not cleared. An organization-wide code search today, checked against a known reference as a control, still finds devantler-tech/maintenance outside this repository in two places:
- the monorepo carries it as a submodule (.gitmodules) and names it in two agent guides;
- the business site lists it in src/content/docs/projects/active.mdx.
It also has one open Dependabot pull request (build(deps-dev): Bump typescript from 6.0.2 to 7.0.2 maintenance#92), and its three weekly reports are still switched on.

Next steps, in order

This card is in Icebox, so nothing below is started by this note. The steps are recorded for when it is pulled into Ready, and the board's In Review and Verifying stages are both over their limits today.

Clear the two references above (monorepo and business site). Both are outside this repository.
Phase 1 here, following the lifecycle written in deploy/archived-repositories/kustomization.yaml and the shape of fix(deploy): declare the archived client-portal repository as archived #564: make the repository a read-only mirror under archived-repositories/ and remove its label, permission and team-grant resources. Nothing on GitHub changes in this phase. One difference from fix(deploy): declare the archived client-portal repository as archived #564 to prove before merging: client-portal was already archived, while maintenance will still be live, so run the drift, coverage and admin-team checks from the branch and show they pass for a repository that is declared there but not yet archived.
Phase 2: close the open Dependabot pull request there, then make the single archive write. Phase 3: back to read-only once GitHub reports it archived. Deleting the repository stays with the maintainer.

No archive, settings change or declaration change was made in this run.

chore: agent-claim #84 nonce=3b32cd7e098bb1e39876827d91c4e555

Navigation Menu

Repository navigation

Migrate governance intent from devantler-tech/maintenance into .github (declarative) and retire the maintenance repo #84

Problem

Desired behavior

Tooling decision

Acceptance criteria

Natural scheduled observation

The replacement has now handled a real gap by itself

Acceptance

Next steps, in order

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Migrate governance intent from devantler-tech/maintenance into .github (declarative) and retire the maintenance repo #84

Description

Problem

Desired behavior

Tooling decision

Acceptance criteria

Natural scheduled observation

Activity

coderabbitai commented on Jul 7, 2026

devantler commented on Sep 27, 2026

devantler commented on Oct 3, 2026

devantler commented on Oct 3, 2026

devantler commented on Oct 10, 2026

The replacement has now handled a real gap by itself

Acceptance

Next steps, in order

Metadata

Metadata

Assignees

Labels

Type

Fields

Projects

Milestone

Relationships

Development

Issue actions