[devantler]

🤖 Generated by the Agentic Engineer

Why

Marketplace publication needs release credentials restricted to reviewed source. The platform currently cannot reconcile the environment protections required for that boundary.

What

Enables the two required GitHub resource types for the existing configuration tenant while preserving its namespace isolation and resource-by-resource permissions.

Fixes #5427

⚠️ Merge order: this prerequisite must deploy before the shared release environment configuration can reconcile.

[devantler]

🤖 Generated by the Agentic Engineer

The authorization failures identified one missing approval ledger update. The follow-up changes exactly one entry: the namespaced github-config Role now includes the two GitHub environment resource kinds required by this proposal. Its namespace, verbs and all other resource permissions stay unchanged. The matching two managed-resource activation entries are included; no wildcard or cluster-wide permission is added. The frozen authorization history is untouched.

The focused authorization Go tests pass locally after this update. The branch also incorporates reviewed main through 18f24412ee545be1fa235102085cada9aef8fb56; hosted validation is running again at 7043cd4d92bc876ecd22ddc1a1b3f8c5a5a9e80f.

[devantler]

🤖 Generated by the Agentic Engineer

cr:no-gate@7043cd4 — current organization capacity is unavailable: CodeRabbit reported the included OSS limit with a 48-minute reset at 06:46 UTC on the shared prerequisite (comment 6435617235). No current-head review or finding exists on this pull request, and the no-gate guard admits this record. Continuing through the ordered review lanes.

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T18:22:07.586109Z	2489ffc	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 7043cd4d92

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Ready at 7043cd4d92bc876ecd22ddc1a1b3f8c5a5a9e80f: the complete hosted validation passed, all readable required gates are present, Codex reviewed this exact head without findings, and the review surfaces contain no unresolved threads or body findings. The code-quality analysis has no readable per-head verdict; GitHub reports this head CLEAN with that rule configured.

User evaluation: this is the declarative controller prerequisite consumed by GitOps. I rendered the actual local and production configurations and inspected the two scoped resource additions, then exercised the real authorization validator. It rejected the unapproved Role change and accepted the single updated approval entry. Native CI run 40462886386 independently passed complete Go regression, production authorization, repository guards and production manifest validation at this head. No standalone action runtime is added here. The protected merge queue still owns actual production deployment and its live health proof; this readiness record does not claim those later results or the downstream release environments already exist.

[devantler]

🤖 Generated by the Agentic Engineer

The first merge-queue deployment at candidate bc97c37ffc8cca2e8633ac62b4500b0444fec320 failed in CI run 40464763378, production job 122061246962. Its manifest publication, pull-credential verification and infrastructure reconciliation succeeded. The failure was the apps health gate: the existing private-mail StatefulSet remained failed. The reconciler explicitly classified this as a genuine failure with no control-plane restart and did not retry it.

Automatic recovery is running. This proposal and its downstream shared release change remain held until the mail dependency and recovery are verified; I have not requeued the unchanged candidate or bypassed the live health gate. The scoped controller/configuration checks and current-head review remain green but do not prove deployment.

[devantler]

🤖 Generated by the Agentic Engineer

The automatic main recovery job 122064229457 also failed the apps reconciliation health gate, with the same existing private-mail StatefulSet failure. Run 40464763378 is now complete/failed and this pull request is no longer in the merge queue. Recovery is not verified healthy.

I am returning this proposal to draft on that live blocker. No unchanged deployment retry or downstream release activation is authorized by these failed results. The active read-only mail diagnostic work in #5433 can provide further evidence; it does not yet establish service recovery.

[devantler]

🤖 Generated by the Agentic Engineer

Blocker: none

Cleared 2026-10-27: The prior apps-readiness deployment failure was recovered by completed protected run40539123683. Source and contract review establishes that this GitHub resource activation and scoped tenant Role change has no dependency on Email browser acceptance; that separate acceptance remains open on5412/5030 with its owner. Canonical health currently exits0. This clears the overbroad Email dependency only: current head2489ffc has a clean Codex review, while hosted CI40557000235 and all normal readiness/protected deployment gates remain required.

Previous record (historical):

> 🤖 Generated by the Agentic Engineer

<!-- pr-blocker-record -->

**Blocker:** devantler-tech/platform#5412 | upstream | last-verified 2026-10-27: The cancelled deployment is terminal and its remaining locks were recovered by protected run40539123683, which passed and merged PR5447 at2de82a12. The Email incident remains open; the latest acceptance observation still reports an administration-route upstream error. This PR remains draft until sustained service health and successful authenticated administration navigation are verified.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai full review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 12 minutes.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 12 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: devantler-tech/platform
• Branch: codex/release-environments-5427-99cb
• File: .coderabbit.yaml
• Commit: 2489ffc
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 836779c3-18a2-4b52-aab5-cd9f3f1131c9

Commits

Reviewing files that changed from the base of the PR and between e21105b and 2489ffc.

Files selected for processing: 3

• k8s/bases/apps/github-config/role.yaml
• k8s/providers/hetzner/infrastructure/crossplane/managed-resource-activation-policy.yaml
• scripts/validate-eks-ci-role-policy/approved-surface.txt

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

cr:no-gate@2489ffc — CodeRabbit refused the current head because its included review allowance is exhausted (response). At 18:09 UTC it reported the next included review in 12 minutes, approximately 18:22 UTC. The no-gate guard admits this record. Continuing through the ordered review lanes; the older head's review does not satisfy this commit.

[devantler]

🤖 Generated by the Agentic Engineer

@codex review for release environment provider activation and scoped tenant permissions against current main

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 2489ffc3a7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Current-head readiness at 2489ffc3a7a42b244463803e69e006fa682de35b: CI 40557000235 passed, and Codex completed its review without findings. The complete thread read has zero unresolved conversations and no pagination gap. No source changed after review. Body and closing-reference checks pass; all readable required gates pass. The configured Code Quality result remains unreadable through the API and is left for the ordinary protected merge enforcement; the native PR state is CLEAN.

The local authorization Go suite, thirteen-kind activation/Role parity, pinned-renderer authorization check and all eight manifest builds pass. The first local renderer mismatch was corrected by using the reviewed checksum-verified tool version, with no validator or rule change.

The previous Email acceptance dependency was overbroad after the real deployment failure recovered. It has been cleared through the canonical helper after reviewing the GitHub-only resource diff and coordinating with the active Email owner. Email acceptance remains open on #5412/#5030. This change will use the normal queue behind the existing candidates and retains all production deployment checks. After delivery, #5427 still needs established-definition and effective scoped-permission verification before the dependent configuration can proceed.