fix(rulesets): use bare numeric external-name for repository rulesets#72
Merged
Merged
Conversation
The two RepositoryRuleset resources set crossplane.io/external-name to the
Terraform *import* id format `<repo>:<ruleset_id>` (`ksail:14699634`,
`platform:5275020`) instead of the bare numeric ruleset id the upjet provider
stores (RepositoryRuleset is config.IdentifierFromProvider, exactly like the
working OrganizationRuleset siblings, which all use bare numeric ids and sync
fine). The provider strconv.ParseInt's the external-name and fails:
observe failed: ... Unexpected ID format ("ksail:14699634"), expected
numerical ID. strconv.ParseInt: parsing "ksail:14699634": invalid syntax
so both resources are stuck SYNCED=False and Coroot raises recurring
`CannotObserveExternalResource` events on prod. Strip the `<repo>:` prefix (the
numeric part is already the correct ruleset id, verified against the live GitHub
API) and fix the misleading convention note here and in the README. These are
managementPolicies: ["Observe"] (read-only) so there is zero blast radius on the
real GitHub rulesets.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The two
RepositoryRulesetresources are stuckSYNCED=Falseand theprovider-upjet-githubcontroller errors on every reconcile, which Corootsurfaces on prod as recurring
CannotObserveExternalResourceevents:Root cause
crossplane.io/external-namewas set to the Terraform import-id form<repo>:<ruleset_id>(ksail:14699634,platform:5275020) instead of thebare numeric ruleset id the provider actually stores.
RepositoryRulesetisconfig.IdentifierFromProvider— same as theOrganizationRulesetsiblings in../organization-rulesets/, which all use bare numeric ids ("6986186", …) andsync fine. The provider
strconv.ParseInts the external-name, so the<repo>:prefix makes it unparseable and the resource never observes.
Fix
Strip the
<repo>:prefix on both (the numeric part is already the correct id,verified against the live GitHub API: ksail "Restrict deletions" =
14699634,platform "Require merge queue" =
5275020) and correct the misleadingconvention note in both files + the README.
Blast radius: none. Both are
managementPolicies: ["Observe"](read-onlyadoption) — the provider only reads GitHub state, so this never modifies the
real rulesets; it just lets the observe succeed and populate
status.atProvider.kubectl kustomize deploy/repository-rulesets/builds clean.🤖 Generated with Claude Code