feat: adopt world-at-ruin declaratively (repository, labels, team grants)

deploy/README.md

@@ -106,7 +106,7 @@ risk of recreating or deleting it.
 
 Issue [#95](https://github.com/devantler-tech/.github/issues/95) defines the
 separate `Admins` team, its explicit maintainer membership, and `admin`
-grants for the 19 active portfolio repositories. The archived
+grants for the 20 active portfolio repositories. The archived
 `reusable-workflows` repository and not-yet-active `kyverno-policies`
 repository are excluded.
 

deploy/labels/kustomization.yaml

@@ -42,6 +42,7 @@ resources:
   - ascoachingogvaner.yaml
   - wedding-app.yaml
   - fleet-gitops.yaml
+  - world-at-ruin.yaml
 # Canonical org-wide label taxonomy, appended to EVERY IssueLabels (single source
 # of truth — was actions/.github/labels.yaml). Verbatim names + colours from that
 # file so the switch from label-sync to Crossplane changes no labels.

deploy/labels/world-at-ruin.yaml

@@ -0,0 +1,24 @@
+# Issue labels for devantler-tech/world-at-ruin. The canonical org taxonomy (22 labels)
+# is appended to every IssueLabels by the shared patch in kustomization.yaml; this
+# file adds only world-at-ruin's repo-specific extras (none yet). See ../README.md.
+#
+# Observe-only for now: this CR binds to a pre-existing repo whose live labels it
+# has not yet observed — with Update active from the first deploy it could replace
+# the live label set before adoption. Promote to the full policy set (all except
+# Delete) once Synced/Ready shows the observed state matches the declared one.
+apiVersion: repo.github.m.upbound.io/v1alpha1
+kind: IssueLabels
+metadata:
+  name: world-at-ruin
+  annotations:
+    crossplane.io/external-name: world-at-ruin
+spec:
+  managementPolicies:
+    - Observe
+  forProvider:
+    repository: world-at-ruin
+    # No repo-specific extras; the shared patch supplies the full canonical set.
+    label: []
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/repositories/kustomization.yaml

@@ -23,6 +23,7 @@ resources:
   - go-template.yaml
   - dotnet-template.yaml
   - homebrew-tap.yaml
+  - world-at-ruin.yaml
   # Private repos.
   - ascoachingogvaner.yaml
   - wedding-app.yaml

deploy/repositories/world-at-ruin.yaml

@@ -0,0 +1,20 @@
+apiVersion: repo.github.m.upbound.io/v1alpha1
+kind: Repository
+metadata:
+  name: world-at-ruin
+  annotations:
+    crossplane.io/external-name: world-at-ruin
+spec:
+  # Observe-only for now: adopts the imperatively bootstrapped repo (org
+  # custom-property requirement — see the repo-creation bootstrap pattern)
+  # without writing to it; the shared merge-policy patch would otherwise apply
+  # before the observed state is reviewed. Promote to the full set except
+  # Delete (and pin visibility/description as authoritative) once Synced/Ready
+  # shows the observed state, per the two-stage flow in kustomization.yaml.
+  managementPolicies:
+    - Observe
+  forProvider:
+    name: world-at-ruin
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/repository-permissions/kustomization.yaml

@@ -38,6 +38,7 @@ resources:
   - go-template.yaml
   - dotnet-template.yaml
   - homebrew-tap.yaml
+  - world-at-ruin.yaml
   # Private repos.
   - ascoachingogvaner.yaml
   - wedding-app.yaml

deploy/repository-permissions/world-at-ruin.yaml

@@ -0,0 +1,21 @@
+# Actions permissions for devantler-tech/world-at-ruin — binds the org-wide
+# shaPinningRequired policy (asserted once in kustomization.yaml) to this repo.
+# Observe+LateInitialize adopts the repo's live enabled/allowedActions so turning
+# on SHA-pinning never disturbs them. See ../README.md.
+apiVersion: actions.github.m.upbound.io/v1alpha1
+kind: RepositoryPermissions
+metadata:
+  name: world-at-ruin
+  annotations:
+    crossplane.io/external-name: world-at-ruin
+spec:
+  managementPolicies:
+    - Observe
+    - Create
+    - Update
+    - LateInitialize
+  forProvider:
+    repository: world-at-ruin
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-admins-on-world-at-ruin.yaml

@@ -0,0 +1,17 @@
+# Default-off Admins-team repository grant. No external-name is set because the
+# separate team and its admin grant do not exist yet; activation creates them
+# without claiming Delete management.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: admins-world-at-ruin
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: admins
+    repository: world-at-ruin
+    permission: admin
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-maintainers-on-world-at-ruin.yaml

@@ -0,0 +1,16 @@
+# Team → repository access. No external-name: this grant does not exist yet, so it is
+# Created (full management except Delete) rather than adopted.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: maintainers-world-at-ruin
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: maintainers
+    repository: world-at-ruin
+    permission: maintain
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/kustomization.yaml

@@ -21,3 +21,4 @@ resources:
   - grant-maintainers-on-provider-upjet-unifi.yaml
   - grant-maintainers-on-aws.yaml
   - grant-maintainers-on-kyverno-policies.yaml
+  - grant-maintainers-on-world-at-ruin.yaml

tests/admin-team-policy.sh

@@ -37,20 +37,20 @@ fi
 
 require_count 1 '^  name: admins$' "$enabled_render"
 require_count 1 '^  name: admins-devantler$' "$enabled_render"
-require_count 20 '^  name: admins-' "$enabled_render"
-require_count 19 '^    permission: admin$' "$enabled_render"
-require_count 20 '^      name: admins$' "$enabled_render"
+require_count 21 '^  name: admins-' "$enabled_render"
+require_count 20 '^    permission: admin$' "$enabled_render"
+require_count 21 '^      name: admins$' "$enabled_render"
 
 grant_files=("$repo_root"/deploy/team-repositories/grant-admins-on-*.yaml)
 policy_files=(
   "$repo_root/deploy/teams/admins.yaml"
   "$repo_root/deploy/team-memberships/add-devantler-to-admins.yaml"
   "${grant_files[@]}"
 )
-[[ "${#grant_files[@]}" == 19 ]] ||
-  fail "expected 19 Admins grants, got ${#grant_files[@]}"
-[[ "${#policy_files[@]}" == 21 ]] ||
-  fail "expected 21 Admins policy files, got ${#policy_files[@]}"
+[[ "${#grant_files[@]}" == 20 ]] ||
+  fail "expected 20 Admins grants, got ${#grant_files[@]}"
+[[ "${#policy_files[@]}" == 22 ]] ||
+  fail "expected 22 Admins policy files, got ${#policy_files[@]}"
 cat "${policy_files[@]}" >"$policy_source"
 
 repositories=(
@@ -73,6 +73,7 @@ repositories=(
   provider-upjet-unifi
   unifi
   wedding-app
+  world-at-ruin
 )
 
 for repository in "${repositories[@]}"; do

tests/fixtures/admin-team-enabled/kustomization.yaml

@@ -26,3 +26,4 @@ resources:
   - ../../../deploy/team-repositories/grant-admins-on-provider-upjet-unifi.yaml
   - ../../../deploy/team-repositories/grant-admins-on-unifi.yaml
   - ../../../deploy/team-repositories/grant-admins-on-wedding-app.yaml
+  - ../../../deploy/team-repositories/grant-admins-on-world-at-ruin.yaml