Model org-wide GitHub settings (webCommitSignoffRequired, default permission, 2FA) once the provider supports it

[devantler]

🤖 Generated by the Daily AI Assistant

Problem

The devantler-tech org enforces real org-wide settings (as opposed to rulesets) that are not in the declarative deploy/ source of truth: web_commit_signoff_required (live: true), default_repository_permission (live: read), members_can_create_repositories (live: true), two_factor_requirement_enabled (live: true). These can drift via the GitHub UI with no audit trail through GitOps — the same hole #52 identified, but the ruleset half of that issue is now fully delivered (deploy/organization-rulesets/ + deploy/repository-rulesets/, Observe-first); this issue narrows to the remaining settings-only gap.

Why this is blocked today

provider-upjet-github's CRD set (package/crds/) has no general org-settings resource. The only org-scoped resource is enterprise.github.m.upbound.io_organizations (Organization), which creates a new org under a GitHub Enterprise account (requires enterpriseId, adminLogins, billingEmail) — it does not fit adopting settings on an existing non-Enterprise org. There is no github_organization_settings-equivalent (the upstream Terraform provider integrations/terraform-provider-github has one; it isn't wrapped by the Crossplane provider we consume).

Proposed direction

• Watch crossplane-contrib/provider-upjet-github releases for a settings-shaped resource wrapping github_organization_settings; adopt Observe-first the moment one ships, same pattern as the rulesets.
• If it never ships, the fallback is a small custom mechanism (e.g. a scheduled read-only drift-check workflow comparing live GET /orgs/devantler-tech against a small deploy/organization-settings.yaml doc, alerting on drift) rather than blocking forever on the provider — but prefer the Crossplane path first.

Rough size

S once the provider supports it (a single Observe-first CR, mirroring the ruleset pattern); otherwise this stays parked pending upstream.

[coderabbitai]

🔗 Related PRs

#74 - feat(rulesets): require the CodeRabbit review status check org-wide [merged]
#75 - revert(rulesets): drop the provider-uncreatable CodeRabbit required-check ruleset [merged]
#78 - feat(repositories): declare provider-upjet-unifi (net-new Library repo) [merged]
#82 - feat: declare the devantler-tech/aws config-tenant repo [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[devantler]

Upstream contribution is the second option. We do not want to do a custom workaround.

[devantler]

🤖 Generated by the Daily AI Assistant

Investigated the upstream-contribution path per your direction (no custom workaround).

Plan for crossplane-contrib/provider-upjet-github (mirrors the existing github_organization_ruleset resource, mechanical/well-precedented):

• config/external_name.go — add "github_organization_settings": config.IdentifierFromProvider (no natural external name; org settings import by numeric org ID).
• New config/cluster/organizationsettings/config.go + config/namespaced/organizationsettings/config.go (~12 lines each, duplicated per this repo's cluster/namespaced convention) — Kind = "OrganizationSettings", ShortGroup = "organization" (note: the existing organizationruleset resource sets ShortGroup = "enterprise", which looks like a stale mismatch vs. its README section — worth using the correct group for the new resource rather than copying that inconsistency).
• Wire into config/provider_cluster.go / config/provider_namespaced.go + a README "Supported resources" row.
• make generate && make reviewable regenerates the CRDs/types/schema/examples from there — no manual boilerplate.
• Add a test case under tests/ per the repo's contribution guidance (1 resource per PR).
• No CONTRIBUTING.md or AI-contribution policy found in the repo — nothing blocking an AI-assisted PR there.
• Land the already-open devantler-authored #288 (terraform provider 6.6.0→6.12.1 bump) first — it touches the same generated files (schema.json, provider-metadata.yaml, CRDs), so sequencing avoids a noisy regenerate-diff rebase on the new-resource PR.

Scope correction: confirmed via the wrapped Terraform provider's resource_github_organization_settings.go that only 3 of the 4 settings named in this issue are covered by that resource — web_commit_signoff_required, default_repository_permission, members_can_create_repositories. two_factor_requirement_enabled has no writable Terraform field (GitHub's API doesn't expose it as settable) — it only appears as a read-only attribute on the github_organization data source. That setting needs a different mechanism (or stays out of scope here); suggest narrowing this issue's title/problem statement to the 3 settings the new resource actually covers, and tracking 2FA enforcement separately if desired.

Per the upstream-contribution gate (never autonomously open an issue/PR outside devantler-tech), I have not opened the PR on crossplane-contrib/provider-upjet-github — this comment is the prepared plan awaiting your go-ahead. Ready to execute (est. size S) once approved.