feat(rulesets): raise the probe's merge-queue timeout to 90 minutes and pin its id (#317)

Step 4 of the platform#3097 probe: change checkResponseTimeoutMinutes through
Update and confirm the admin bypass survives. Also pins the probe's
external-name, which the provider never wrote back without LateInitialize.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: devantler

deploy/repository-rulesets/README.md

@@ -24,5 +24,7 @@ observes.
 Most files here are Observe-first imports of a ruleset created out of band, so they carry a
 numeric `crossplane.io/external-name`. A **net-new** ruleset is the exception: it has no
 external-name and is managed (never `Delete`, except the disposable probe above), so Crossplane
-creates it on first reconcile.
+creates it on first reconcile. Keep `LateInitialize` on a net-new ruleset: without it the
+provider never writes the created id back as the external-name, so a provider restart would
+create a second copy. The disposable probe has no `LateInitialize`, so its id is pinned by hand.
 `../organization-rulesets/protect-release-tags.yaml` is the org-level precedent for that shape.

deploy/repository-rulesets/probe-bypass-roundtrip-on-platform-template.yaml

@@ -27,11 +27,19 @@
 #   3. The ruleset's `updated_at` does not move across several reconcile
 #      intervals (no re-apply loop from an actorId diff).
 #   4. A follow-up change to checkResponseTimeoutMinutes lands through Update
-#      and the bypass actor survives it.
+#      and the bypass actor survives it. (Step 4 is this file at 90 minutes.)
+#
+# The external-name is pinned to the id the first reconcile created. Without
+# LateInitialize the provider never wrote that id back onto the resource, so a
+# provider restart would have lost track of it and created a second probe. The
+# real promotion keeps its imported external-name, so pinning here also makes
+# the probe match it.
 apiVersion: repo.github.m.upbound.io/v1alpha1
 kind: RepositoryRuleset
 metadata:
   name: platform-template-probe-bypass-roundtrip
+  annotations:
+    crossplane.io/external-name: "24193850"
 spec:
   managementPolicies:
     - Observe
@@ -59,7 +67,7 @@ spec:
         update: false
         updateAllowsFetchAndMerge: false
         mergeQueue:
-          - checkResponseTimeoutMinutes: 60
+          - checkResponseTimeoutMinutes: 90
             groupingStrategy: ALLGREEN
             maxEntriesToBuild: 1
             maxEntriesToMerge: 1

tests/bypass-roundtrip-probe-ruleset.sh

@@ -46,7 +46,7 @@ assert_json() {
 assert_value "enforcement" "disabled" '.spec.forProvider.enforcement'
 assert_value "target repository" "platform-template" '.spec.forProvider.repository'
 assert_value "target" "branch" '.spec.forProvider.target'
-assert_value "external-name" "null" '.metadata.annotations."crossplane.io/external-name"'
+assert_value "external-name" "24193850" '.metadata.annotations."crossplane.io/external-name"'
 # Observe + Create + Update mirrors the planned promotion; Delete lets removing the
 # file clean the probe up. LateInitialize would copy observed values into spec and
 # hide exactly the round-trip this probe measures.
@@ -55,7 +55,7 @@ assert_json "management policy" '["Observe","Create","Update","Delete"]' '.spec.
 assert_json "bypass actors" '[{"actorType":"OrganizationAdmin","bypassMode":"always"}]' '.spec.forProvider.bypassActors'
 assert_json "target branch" '["~DEFAULT_BRANCH"]' '.spec.forProvider.conditions[0].refName[0].include'
 assert_value "rule count" "1" '.spec.forProvider.rules | length'
-assert_json "merge queue" '[{"checkResponseTimeoutMinutes":60,"groupingStrategy":"ALLGREEN","maxEntriesToBuild":1,"maxEntriesToMerge":1,"mergeMethod":"SQUASH","minEntriesToMerge":1,"minEntriesToMergeWaitMinutes":5}]' '.spec.forProvider.rules[0].mergeQueue'
+assert_json "merge queue" '[{"checkResponseTimeoutMinutes":90,"groupingStrategy":"ALLGREEN","maxEntriesToBuild":1,"maxEntriesToMerge":1,"mergeMethod":"SQUASH","minEntriesToMerge":1,"minEntriesToMergeWaitMinutes":5}]' '.spec.forProvider.rules[0].mergeQueue'
 
 # The probe must not be mistaken for the production gate's promotion.
 gate='select(.kind == "RepositoryRuleset" and .metadata.name == "platform-require-merge-queue")'