fix(github): keep new Pages bootstrap outside ongoing writes

[devantler]

🤖 Generated by the Agentic Engineer

Why

The newly created documentation site left repository settings stuck in a permission error because the managed GitHub App tried to update Pages. The matching bootstrap settings did not establish the observation needed for ongoing management.

What

Keep Pages as an explicit bootstrap setting and preserve normal updates to the repository. Continue checking the live Pages domain and build settings through the read-only drift audit, which rejects changed, missing, or ambiguous settings.

Fixes #614

[devantler]

🤖 Generated by the Agentic Engineer

The bootstrap-domain mutation first reproduced a false success in the audit. With this repair, matching initial Pages settings pass; a changed domain reports drift, an unreadable site fails closed, and declaring both ongoing and bootstrap-only Pages owners is rejected. The ordinary repository update-policy tests and ShellCheck pass.

Ran the actual read-only repository drift audit against the rendered change: all 27 declared repositories match live GitHub settings, including this Pages expectation. The provider CRD confirms that initProvider.pages is supported. This checks the desired settings, not successful controller adoption: after merge, a fresh managed-resource readback must show that the Pages PUT retries stop and normal repository synchronization succeeds.

The settings repair does not publish the documentation or activate its DNS tenant.

[github-code-quality]

Code coverage overview

Languages: Go, C#

Go / code-coverage/test

main 0516630	codex/khoist-pages-b... d07b16b	+/-
50%	50%	0%

C# / code-coverage/dotnet

main 0516630	codex/khoist-pages-b... d07b16b	+/-
100%	100%	0%

Go / code-coverage/go

main 0516630	codex/khoist-pages-b... d07b16b	+/-
50%	50%	0%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated October 16, 2026 08:57 UTC}

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 49 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: ebf024a4-b92e-42f7-871d-e1f214a3f363

📥 Commits

Reviewing files that changed from the base of the PR and between 0516630 and d07b16b.

📒 Files selected for processing: 6

• AGENTS.md
• deploy/repositories/data-product-controller.yaml
• khoist-pages-bootstrap.md
• scripts/check-repository-drift.sh
• tests/repository-drift.sh
• tests/repository-update-policy.sh

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T08:45:50.075423Z	d07b16b	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: d07b16badc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at d07b16badcf4e4878550e2d6cb0ca323e7ee5102:

• All 283 current-head checks have completed without failure; native mergeability is clean and the signed head is valid.
• Codex's current-head review reports no major issues. CodeRabbit explicitly reported an unavailable included allowance before Codex was requested. The complete review/thread inventories contain no open findings.
• The Pages-domain mutation reproduced a false audit success before the repair. Matching, changed, unreadable, and conflicting-owner cases now behave correctly; the repository update-policy suite and ShellCheck pass.
• User evaluation ran the actual read-only audit against the rendered change: all 27 repositories, including the Pages bootstrap expectation, match live GitHub settings. This configuration is consumed by the external Crossplane provider; the supported initial-setting contract and retained ordinary update ownership were traced, and the live CRD accepts that field. Successful reconciliation is a separate post-deployment readback, not claimed by the audit.

Ready to merge. The next verification is the repository resource's Synced/Ready state and absence of further Pages PUT errors.

[devantler]

🤖 Generated by the Agentic Engineer

Post-merge recovery confirmed: commit 3fef32e10ac83ed25f0e98a5c517a9e81480ac71 published as v7.12.1 through the successful deployment workflow. Flux fetched and verified that publication at its current source generation.

The managed repository is now generation 6, with Pages declared only as an initial setting and ordinary repository updates retained. Fresh readback reports Synced=True / ReconcileSuccess, Ready=True, and LastAsyncOperation=True / Success, transitioning at 2026-10-16 09:09:31 UTC. The prior Pages PUT failure has cleared. The live read-only audit had already verified all 27 declared repository expectations, including the Pages domain.

This completes the settings-owner repair. Documentation DNS and public HTTPS remain tracked in platform #4939.