fix(deploy): record why world-at-ruin cannot be promoted out of Observe-only

[devantler]

🤖 Generated by the Agentic Engineer

Motivation

world-at-ruin's declaration told the next reader to promote it out of Observe-only "once Synced/Ready shows the observed state". That condition is now met, so the instruction reads as ready to act on — but acting on it would quietly make things worse rather than fixing the repository's merge policy.

Changes

Records why promotion is currently unavailable: the provider release we run cannot apply a repository update while the organization enforces commit signoff, so promoting would leave the resource stuck on a failed update instead of applying the policy — the same state platform-tenant-template is already in. The note says what has to ship upstream before promotion becomes the right move, and points at #188 for the divergence itself.

Comment-only. The rendered manifest is byte-identical, so nothing deployed changes.

Part of #188

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

@devantler I will review the changes.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Advanced

Run ID: da45f7f9-f1f9-43df-856d-dbfacf4f1f38

📥 Commits

Reviewing files that changed from the base of the PR and between a8ccdb3 and b2d6a45.

📒 Files selected for processing (1)

• deploy/repositories/world-at-ruin.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

🧰 Additional context used

🧠 Learnings (1)

📚 Learning: 2026-08-06T20:18:26.789Z

Learnt from: devantler
Repo: devantler-tech/.github PR: 138
File: deploy/repositories/ascoachingogvaner.yaml:0-0
Timestamp: 2026-08-06T20:18:26.789Z
Learning: When reviewing comments in repository deployment manifests under deploy/repositories/*.yaml, ensure they describe the current state only. Do not add comments that narrate migrations, historical changes, or before/after states, in accordance with the repository's AGENTS.md guidance.

Applied to files:

• deploy/repositories/world-at-ruin.yaml

🔇 Additional comments (1)

deploy/repositories/world-at-ruin.yaml (1)

8-29: LGTM!

---

📝 Walkthrough

Walkthrough

The pull request rewrites the world-at-ruin Repository resource comment. It documents the provider-upjet-github and terraform-provider-github versions involved in rejected update PATCH requests, the resulting drift for allowMergeCommit and allowRebaseMerge, and the provider version required before enabling update management. No resource configuration changes.

Merge Risk: ⚪ Minimal · up to b2d6a

This change documents why the repository remains observe-only without changing its manifest or deployed behavior, so it introduces no current merge-readiness risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the comment-only change that records why world-at-ruin cannot leave Observe-only mode.
Description check	✅ Passed	The description directly explains the provider limitation, the reason promotion is unavailable, the unchanged deployed behavior, and the related issue.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Readiness evidence @ b2d6a450d46c3f8c7869f103488715c042655051

1. Programmatically tested — 13 checks, 0 failing, 0 pending. mergeStateStatus: CLEAN. 0 review threads (total and unresolved), 0 review-body findings (no review objects carry finding sections at this head).
2. Reviewed — CodeRabbit green at this head: its auto-generated summary was refreshed at 2026-09-08T11:37:24Z, postdating the authenticated request marker at 11:33:07Z, and names this exact head SHA. The head's CodeRabbit commit status corroborates with description: Review completed (11:37:26Z). The newest same-head command-invocation reply is the ordinary acknowledgement — no rate-limit or did-not-run marker. Recorded as cr@b2d6a450.
3. Evaluated — this change has no exercisable runtime surface, and that is proven rather than asserted: every changed line in the diff is a YAML comment or blank (22 added, 6 removed, all comment-only; a filter for any changed line that is neither comment nor blank returns nothing). YAML comments are not part of the parsed document, so the rendered Crossplane Repository spec is byte-identical before and after — the change cannot alter what the provider reconciles. What it changes is what the next reader concludes, and 🧪 Validate Manifests confirms the file still parses and renders.

The substance is the constraint it records: the two-stage flow's review precondition is now met (Synced=True, Ready=True, atProvider mirrored), so the old comment reads as an instruction to promote — and promoting would wedge the resource, because the shared kustomize patch sends webCommitSignoffRequired on every update PATCH and provider-upjet-github v0.19.1 is still the latest release. Recording the real blocker in the declaration is what stops a future reader acting on a precondition that has been met for the wrong reason.

Promoting and merging.