From 927e4cfcd9ff08e8c9e117d1c09f7b303477408f Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Thu, 9 Jul 2026 04:25:57 +0200 Subject: [PATCH 1/2] fix: gate repository-permissions/ until provider-upjet-github supports shaPinningRequired MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes #67's shaPinningRequired patch is applied to every RepositoryPermissions resource, but the field is absent from the deployed provider-upjet-github v0.19.1 CRD schema (it embeds terraform-provider-github 6.6.0; the field landed in 6.11.0). Dry-run rejects the patch, so the prod tenant's `apps` Kustomization health-check times out after 20m every reconcile cycle, stalling deploys and kicking merge-queue PRs out. Unwire repository-permissions/ from the root kustomization until the provider bump (own upstream PR crossplane-contrib/provider-upjet-github#288) lands. 🤖 Generated by the Daily AI Assistant --- deploy/kustomization.yaml | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/deploy/kustomization.yaml b/deploy/kustomization.yaml index 60e9d09..b17fae4 100644 --- a/deploy/kustomization.yaml +++ b/deploy/kustomization.yaml @@ -22,4 +22,16 @@ resources: - labels/ - organization-rulesets/ - repository-rulesets/ - - repository-permissions/ + # repository-permissions/ is intentionally NOT wired in yet — the + # `shaPinningRequired` field it patches onto every RepositoryPermissions is + # absent from the currently-deployed provider-upjet-github v0.19.1 CRD + # schema (it embeds terraform-provider-github 6.6.0; the field landed in + # 6.11.0). Applying it makes dry-run reject the patch and the tenant's + # `apps` Kustomization health-check times out after 20m, stalling every + # prod deploy and kicking PRs out of the merge queue (hit live 2026-07-09, + # ~4h after #67 merged and republished as v1.12.0). Re-add once the + # provider bump lands — tracked upstream at + # crossplane-contrib/provider-upjet-github#288 (own PR, open, blocked on + # maintainer review) — and the repository-permissions/kustomization.yaml + # header's own gate note confirms the same precondition. + # - repository-permissions/ From 3a8491033ce1af64e4719d0fffb90eac567b1e99 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Thu, 9 Jul 2026 04:28:27 +0200 Subject: [PATCH 2/2] docs: trim duplicated gate rationale in root kustomization comment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CodeRabbit: the precondition/tracking note was fully restated in both deploy/kustomization.yaml and repository-permissions/kustomization.yaml. Point to the latter as the canonical source instead of duplicating it. 🤖 Generated by the Daily AI Assistant --- deploy/kustomization.yaml | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-) diff --git a/deploy/kustomization.yaml b/deploy/kustomization.yaml index b17fae4..f4e11f8 100644 --- a/deploy/kustomization.yaml +++ b/deploy/kustomization.yaml @@ -22,16 +22,10 @@ resources: - labels/ - organization-rulesets/ - repository-rulesets/ - # repository-permissions/ is intentionally NOT wired in yet — the - # `shaPinningRequired` field it patches onto every RepositoryPermissions is - # absent from the currently-deployed provider-upjet-github v0.19.1 CRD - # schema (it embeds terraform-provider-github 6.6.0; the field landed in - # 6.11.0). Applying it makes dry-run reject the patch and the tenant's - # `apps` Kustomization health-check times out after 20m, stalling every - # prod deploy and kicking PRs out of the merge queue (hit live 2026-07-09, - # ~4h after #67 merged and republished as v1.12.0). Re-add once the - # provider bump lands — tracked upstream at - # crossplane-contrib/provider-upjet-github#288 (own PR, open, blocked on - # maintainer review) — and the repository-permissions/kustomization.yaml - # header's own gate note confirms the same precondition. + # repository-permissions/ is intentionally NOT wired in yet — its own + # kustomization.yaml header documents the precondition (provider-upjet-github + # bump for `sha_pinning_required`, crossplane-contrib/provider-upjet-github#288). + # Hit live 2026-07-09: publishing it stalled the tenant `apps` Kustomization's + # health check for 20m every reconcile, blocking prod deploys and the merge + # queue. Re-add once that provider bump lands. # - repository-permissions/