Repository navigation
Manage meaningful custom properties and explicit portfolio values #773
Description
🤖 Generated by the Agentic Engineer
Description
Repositories report missing required custom-property values. All five live organization definitions require explicit values, while the declarative catalogue owns neither their schema nor their repository values. Effective API values may be inherited defaults and do not establish explicit compliance.
Expected Behavior
The organization maintains a small, documented property set with a concrete classification or policy purpose. Every managed portfolio repository has explicit reviewed values. Native GitHub metadata such as language and visibility is reused rather than duplicated.
Actual Behavior
The required properties are Type, EnableAutoMerge, ScanGitHubActions, AutomaticallyRequestCopilotCodeReview and LintDocumentation. Auto-merge and workflow scanning have declared policy consumers. The last two require a complete consumer check before retirement. The installed provider supports RepositoryCustomProperty values but exposes no organization-property schema resource.
Acceptance Criteria
- Inventory schema, effective values, rule consumers and provider capabilities.
- Retain only useful properties, document their decisions and editing authority, and retire unused requirements without weakening active policies.
- Declare explicit values for every managed active repository, with deliberate classification and no implied Copilot review activation.
- Reconcile through reviewed declarative sources; no UI or ad-hoc API configuration changes.
- Add coverage checks that reject missing/duplicate values and undeclared properties.
- Verify publication, Crossplane reconciliation, native schema/value readback and disappearance of the warning in representative repository UIs.
Scope
Maintainer requested this portfolio-wide review on 26 October 2026. Use Crossplane where the installed provider supports the resource; record the exact schema capability gap and use the existing reviewed-main configuration pattern only where necessary. Preserve existing security controls and private repository metadata.
Activity
chore: agent-claim #773 nonce=0f1f206b3a617f3cfa0a35812b99cdc6
fix(governance): manage explicit portfolio custom properties (#774)
devantler commentedon Oct 27, 2026
Post-merge verification of #774 found a real retained consumer: organization ruleset 14426508, Automatically request Copilot code review, is Disabled but still selects
props.AutomaticallyRequestCopilotCodeReview:true. This was observed in the authenticated native organization rules UI. Disabled policies still reference the property, so the retirement guard correctly refused schema changes in run 40422016649.The minimal source repair is to retain
AutomaticallyRequestCopilotCodeReviewas a fourth meaningful property with default false and an explicit false value across all 26 active repositories. This preserves the standing no-Copilot-review direction and leaves the existing disabled policy unchanged.LintDocumentationcan still be retired only after the complete native ruleset and Actions-policy census finds no consumer. No guard relaxation or imperative ruleset change is needed.Platform #5394 is merged and independently verified: the namespaced CRD is served and established, and the tenant has exactly the required resource authorization. The two approved App grants are installed and the schema workflow minted its token successfully. Remaining acceptance is schema success, signed publication, explicit Crossplane creation and successful reconciliation for all 104 assignments, native readback and repository UI compliance. #773 remains Verifying.
An active sibling run acquired
agent-claim/773at 23:58:56Z before this run's follow-up acquisition. This run has preserved its clean local branch and is continuing independent rollout verification; it has made no competing source edits or pushes.devantler commentedon Oct 27, 2026
Further live verification: signed release 13.3.1 is deployed and source verification passed. Crossplane has 78 property resources, with 61 Ready/Synced. The remaining native writes expose an initial-value dependency: GitHub rejects a single-property PATCH when the repository still lacks other required explicit values. The response identifies every other required property, including the retained Copilot switch and the still-unretired documentation switch. Four starter templates also await the new
Templateschema option.Schema recovery alone may therefore leave repositories without existing explicit values unable to bootstrap through independent one-property resources. Please preserve required/explicit enforcement and account for an atomic initial assignment of the complete declared property set through a reviewed source owner before claiming all-repository convergence. The already approved organization Custom-properties Admin authority includes the organization values endpoint; no broader grant or personal-credential substitution is justified by this finding.
The organization Actions policy UI lists ten execution policies. The complete API consumer census in the reviewed workflow remains the authoritative retirement gate; UI names alone do not prove that a property is unused.
devantler commentedon Oct 27, 2026
One additional acceptance gate needs a source repair: the existing organization CodeQL rule 6455804 targets
Typevalues Application, Library, Marketplace or Infrastructure, as documented indeploy/organization-rulesets/README.mdunder Organization CodeQL observation. Moving the four starter repositories toType: Templatewould remove their existing coverage unless a complementary policy includes them. The rule is intentionally Observe-only, so it must not be silently adopted or changed.The pre-rollout native baseline is complete for all 26 active repositories and contains 429 active ruleset assignments. Final verification will compare each repository's active policy identities, not just their aggregate count. A reviewed complementary stable-repository-ID CodeQL rule, preserving the existing thresholds and no-bypass approach already used for Metadata repositories, can preserve template coverage without changing the observed legacy rule. Alternatively, retain existing meaningful classifications until a safe selector migration is ready. A new classification must not silently drop a security gate.
chore: agent-claim #773 nonce=ae3d9a6811b0bf33fe308d23d07f79d0
chore: agent-claim #773 nonce=2268b88f9539cf456efd0ec6940c8993
chore: agent-claim #773 nonce=badee63ad77fcbb6a4b51b5b1c936021
chore: agent-claim #773 nonce=9d8593c94a0a79d34e71d8540e2bc844
chore: agent-claim #773 nonce=76a94b727324968a20726d2713be4284
fix(governance): initialize complete custom-property assignments (#777)
chore: agent-claim #773 nonce=7a9364af5fd0bea3c6e52e803a20f497
devantler commentedon Oct 27, 2026
Post-merge verification has advanced to a different failure. #777 merged at
2d44f4df61a01f34d0f224dd69b8d82e20f8ca5f; its CI and CD succeeded. The same revision's schema reconciliation applied four schema updates, then failed complete repository readback withcatalogue repository missing from property readback. The earlier consumer-retirement refusal is therefore no longer the current failing phase, and successful CI/CD does not establish rollout acceptance.The active follow-up is #778 at
b5aaba145f3e602988caa993d213123df96123b5. Its owner has prepared separate read-only verification while preserving the existing writer selection, and has recorded the required approval of the verification selection. Keep this issue in verification until the reviewed follow-up passes native complete readback and retirement, all 104 desired assignments converge, retained policy identities are independently checked, and representative repository pages pass the existing acceptance criteria.devantler commentedon Oct 27, 2026
The platform prerequisite (#5389 / platform PR5394), original catalogue PR774 and initialization repair PR777 are merged. Signed release13.3.2 is reconciled, and all104 property assignments are Ready and Synced. Independent native inspection confirms matching values on all26 active declared repositories. The Go template now shows explicit values rather than defaults, and its previously observed missing-property warning is absent.
The complete native policy comparison retains all429 active assignments across the same26 repositories, including the templates' existing security coverage. The disabled legacy review policy remains unchanged, with its property explicitly false everywhere.
Delivery remains Verifying: the protected-main schema workflow stopped at incomplete readback and correctly retained the unused documentation property. Follow-up #778 has265 passing/appropriately skipped checks and a clean exact-commit Codex review; it remains draft pending maintainer authorization through the native private channel. Close this issue only after that follow-up's workflow succeeds, the unused property is retired, the signed deployment and complete native checks pass, and representative UI pages show the final four explicit properties without the missing-value warning.
chore: agent-claim #773 nonce=74daf4e84d7b129f0613e2d76715254c
chore: agent-claim #773 nonce=02cbb812569943f96162b77159604a17
devantler commentedon Oct 27, 2026
The custom-property cleanup is deployed and verified. Only Type, EnableAutoMerge and ScanGitHubActions remain, with explicit matching values on all 26 active repositories; both unused definitions and their disabled legacy consumer are absent.
The signed configuration release reconciles all 78 property resources as Ready and Synced. A fresh complete policy comparison retains all 429 pre-existing active repository policy assignments. Representative repository settings show exactly three explicit values, and the missing-property warning is absent.
The native cleanup verified complete repository readback, retired the disabled legacy review policy, deleted both schemas, and verified their absence. Release v13.3.4 maps to signed merge
7c9e3dfd669dc9a6268a2e6940728b879966a2f2; its CD run passed, and the signed artifact is verified and applied at that exact version.Main CI, CodeQL, code quality, release, CD and the schema reconciler all completed successfully at the merged revision.
All changes for this rollout are merged: platform#5394 and .github#774, #777, #778 and #781. The independent resource audit checks the provider-defined IDs, observed values, current-generation successful synchronization, creation receipts, and management policies that exclude deletion.