From a76e6e5998fe0426d763d447bbd6215f517e6f3a Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Thu, 25 Jun 2026 20:04:20 +0200 Subject: [PATCH] docs(crossplane): correct stale org-ruleset adoption comment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The org-ruleset activation comment said "~19 UI-managed org rules ... adopted Observe-first" — but provider-upjet-github can faithfully express only 10 of the org's 20 org rulesets. Update it to the real split: 10 adopted Observe-first in devantler-tech/.github deploy/rulesets/ (+ a net-new tag ruleset); the other 10 (repository_property conditions, code_quality/copilot rules, repository-target), plus push rulesets and the new Actions workflow-execution-protections, aren't expressible and stay UI-managed (tracked in devantler-tech/.github#69). Comment-only; no resource/behaviour change. Co-Authored-By: Claude Opus 4.8 --- .../managed-resource-activation-policy.yaml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/k8s/providers/hetzner/infrastructure/crossplane/managed-resource-activation-policy.yaml b/k8s/providers/hetzner/infrastructure/crossplane/managed-resource-activation-policy.yaml index 3107479a3..a738e0fd2 100644 --- a/k8s/providers/hetzner/infrastructure/crossplane/managed-resource-activation-policy.yaml +++ b/k8s/providers/hetzner/infrastructure/crossplane/managed-resource-activation-policy.yaml @@ -21,9 +21,14 @@ spec: - branchprotections.repo.github.m.upbound.io - repositoryrulesets.repo.github.m.upbound.io - issuelabels.repo.github.m.upbound.io - # Org-level rulesets (the ~19 UI-managed org rules that gate every repo) — - # adopted Observe-first in devantler-tech/.github deploy/. The tenant Role - # already covers the enterprise.github.m.upbound.io group. + # Org-level rulesets. Of the org's 20 org rules, the 10 provider-upjet-github + # can express are adopted Observe-first in devantler-tech/.github + # deploy/rulesets/ (+ a net-new tag-protection ruleset); the other 10 + # (repository_property conditions, code_quality/copilot_code_review rules, + # repository-target rulesets) plus push rulesets and the new Actions + # workflow-execution-protections aren't expressible by the provider and stay + # UI-managed (tracked in devantler-tech/.github#69). The tenant Role already + # covers the enterprise.github.m.upbound.io group. - organizationrulesets.enterprise.github.m.upbound.io # Team management — the maintainers team + its membership and team->repo # access (declared in devantler-tech/.github deploy/teams/). Lets a team be