fix(deploy): pin webCommitSignoffRequired=true (org-enforced) + point skills/plugins MRs at renamed repos (#48)

The org enforces commit signoff and forbids disabling it per-repo, so the
provider's update PATCH was failing with 422 on the skills/plugins rename
(it sent web_commit_signoff_required=false). Pin webCommitSignoffRequired=true
in the shared patch so every repo's update is self-consistent (the other 12
already had it true via LateInitialize). Also point the skills/plugins MRs'
external-name at the now-renamed agent-skills/agent-plugins repos (k8s resource
names kept stable to avoid a prune/re-adopt).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: devantler

deploy/repositories/kustomization.yaml

@@ -24,10 +24,15 @@ resources:
   - ascoachingogvaner.yaml
   - wedding-app.yaml
   - fleet-gitops.yaml
-# Org-wide merge policy applied to EVERY Repository: squash-only (merge commits
-# and rebase disabled), auto-merge allowed, head branches auto-deleted, and
-# always-suggest-updating-PR-branches. Keeping it here (not per-file) makes it
-# the single source of truth and auto-applies to every future repo.
+# Org-wide repo settings applied to EVERY Repository, single source of truth
+# (auto-applies to every future repo):
+#  - squash-only merge policy (merge commits + rebase disabled; auto-merge,
+#    auto-delete head branches, always-suggest-updating-PR-branches enabled).
+#  - webCommitSignoffRequired: true — the org ENFORCES commit signoff and it
+#    can't be disabled per-repo, so the provider must always send true (else an
+#    update PATCH gets 422 "Commit signoff is enforced ... and cannot be
+#    disabled"). The 12 already-adopted repos had this true via LateInitialize;
+#    pinning it here makes every repo's update self-consistent and robust.
 patches:
   - target:
       group: repo.github.m.upbound.io
@@ -52,3 +57,6 @@ patches:
       - op: add
         path: /spec/forProvider/deleteBranchOnMerge
         value: true
+      - op: add
+        path: /spec/forProvider/webCommitSignoffRequired
+        value: true

deploy/repositories/plugins.yaml

@@ -1,16 +1,15 @@
 apiVersion: repo.github.m.upbound.io/v1alpha1
 kind: Repository
 metadata:
+  # NOTE: the k8s resource name stays "plugins" (historical) to avoid a
+  # prune/re-adopt cycle; it manages the renamed agent-plugins repo. external-name
+  # + forProvider.name are both agent-plugins now that the rename has reconciled.
   name: plugins
   annotations:
-    crossplane.io/external-name: plugins
+    crossplane.io/external-name: agent-plugins
 spec:
-  # RENAME plugins -> agent-plugins: forProvider.name is the new name while
-  # external-name stays the current repo ("plugins"), so Crossplane renames the
-  # repo IN PLACE (an Update, not a re-create) — GitHub keeps the old name as a
-  # redirect. external-name is updated to agent-plugins in a follow-up once the
-  # rename has reconciled. Squash-only merge policy still comes from the shared
-  # patch; everything else is adopted via LateInitialize.
+  # Manages the agent-plugins repo (renamed from plugins). Squash-only merge
+  # policy comes from the shared patch; everything else is adopted via LateInitialize.
   managementPolicies:
     - Observe
     - Create

deploy/repositories/skills.yaml

@@ -1,16 +1,15 @@
 apiVersion: repo.github.m.upbound.io/v1alpha1
 kind: Repository
 metadata:
+  # NOTE: the k8s resource name stays "skills" (historical) to avoid a
+  # prune/re-adopt cycle; it manages the renamed agent-skills repo. external-name
+  # + forProvider.name are both agent-skills now that the rename has reconciled.
   name: skills
   annotations:
-    crossplane.io/external-name: skills
+    crossplane.io/external-name: agent-skills
 spec:
-  # RENAME skills -> agent-skills: forProvider.name is the new name while
-  # external-name stays the current repo ("skills"), so Crossplane renames the
-  # repo IN PLACE (an Update, not a re-create) — GitHub keeps the old name as a
-  # redirect. external-name is updated to agent-skills in a follow-up once the
-  # rename has reconciled. Squash-only merge policy still comes from the shared
-  # patch; everything else is adopted via LateInitialize.
+  # Manages the agent-skills repo (renamed from skills). Squash-only merge policy
+  # comes from the shared patch; everything else is adopted via LateInitialize.
   managementPolicies:
     - Observe
     - Create