Repository navigation
Roadmap: declarative GitHub-org-as-code — extend coverage & sustain the source of truth #56
Description
🤖 Generated by the Agentic Engineer
Product outcome
Keep organization configuration and repository automation in one reviewed source of truth. Crossplane remains the settings writer; complete read-only audits detect drift and missing ownership without introducing another settings writer.
Delivered foundation
The original delivery issues are closed and remain linked for evidence:
- Manage issue labels declaratively in deploy/ #51 — declarative issue labels
- Model org-level settings, rulesets & branch protection in deploy/ #52 — organization rulesets and branch policy
- Complete declarative team coverage (admin team + gap repos) #53 — declared team coverage
- Populate repository metadata (description, topics, homepage) on managed Repository CRs #54 — repository descriptions, topics and homepages
- Complete canonical agent shims and deploy contributor guidance #55 — repository instructions and contribution guidance
Labels and roadmap structure now exist; the earlier June inventory and missing-label explanation no longer describe the product.
Current delivery sequence
- Adopt supported GitHub rulesets and track remaining provider gaps #69 — adopt supported ruleset capabilities through Observe-first resources; retain explicit provider, approval and native-control gaps for unsupported policies.
- Migrate governance intent from devantler-tech/maintenance into .github (declarative) and retire the maintenance repo #84 — establish recurring complete repository/admin-team evidence and issue-on-gap reporting before retiring legacy maintenance. Manual App coverage is proven; Run the complete governance audits routinely and report gaps #406 supplies the routine delivery, and Return UNKNOWN when governance audits abort before completion #407 fixes premature auditor success.
- Model org-wide GitHub settings (webCommitSignoffRequired, default permission, 2FA) once the provider supports it #85 — obtain upstream provider support and adopt organization settings through the approved provider path. The read-only observer in Detect drift in the four declared organization settings #403 does not fulfill adoption, and its relationship to the earlier no-workaround direction awaits maintainer clarification. Roll out and retire the organization-settings audit opt-in #404 remains its lifecycle gate.
Completion standard
A rendered declaration is desired state, not proof of effective GitHub state. Read back the full stable live universe, exact targets and bypasses, require native positive and negative controls where enforcement changes, and preserve UNKNOWN for incomplete joins. Routine monitoring, rollout-input retirement, provider adoption and maintenance archive remain separate deliveries. No security policy, grant, archive or irreversible deletion is authorized by a successful audit alone.
Activity
feat(deploy): declare labels for actions + reusable-workflows (#66)
devantler commentedon Jul 18, 2026
Roadmap refresh — 2026-07-18
All five original children are delivered and closed, so the extend coverage half of this epic
is complete:
The sustain the source of truth half had no enforcing code, and had already slipped. Measured
against the 21 non-archived org repos today:
labels/andgrant-admins-on-*are 21/21, butrepositories/is 18/21,repository-permissions/17/21, andgrant-maintainers-on-*14/21 — 14(dimension, repo)pairs undeclared. Two dimensions being complete is what makes the rest driftrather than a designed boundary.
New children:
Remaining coverage work already tracked outside this list: #69 (rulesets awaiting provider support),
#84 (retire the
maintenancerepo), #85 (org-wide settings awaiting provider support), #112(repository-settings writes 422-blocked — gates the
repositories/half of #115).fix(labels): adopt world-at-ruin labels with the full policy set (#117)
test: guard declarative coverage of deploy/ (#114)
chore: agent-claim #56 nonce=fb64699f0ef590260f23c85427a3fff8
devantler commentedon Oct 21, 2026
The maintainer clarified the workflow ownership target: organization-required workflows are for genuinely cross-repository PR concerns; a product-specific job belongs to the product's own CI/CD and is enforced by a repository ruleset. Local actions may separate manageable units. This does not call for another App.
Current cutover evidence and remaining work:
No old organization protection was disabled in this round. Native required statuses identify their producing App but do not carry the immutable workflow-source identity of an organization-required workflow; the final evidence must state the actual protection provided, not claim source equivalence.
For reusable-workflow ownership, the .NET publisher's only production consumer has moved to its native publisher. #687 removes the unused maintained export and its skip-only catalogue smoke job while preserving the real shared action controls. World lint remains single-consumer; world-at-ruin#1494 is still parked on its independently tracked runtime blocker #1495, so the shared lint export cannot yet be retired.
The Go validator is genuinely shared across multiple products and organization-direct invocations; catalogue fixtures were not counted as production reuse. The inventory also verified that the former data-product-controller repository redirects to khoist and that the frozen Actions catalogue is still active. Its remaining consumer migration must be included before claiming the maintained catalogue is the only source.
Both #687 and #688 remain drafts with pending hosted checks, not delivered changes. #475 now includes measured runner-queue evidence from #687. A source/configuration test or green subset of checks is not merge, deployment, enforcement or complete portfolio-cleanup proof.