From bf4474af63432aea1974094a0ff1fd7ae7049451 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Tue, 27 Oct 2026 07:05:41 +0100 Subject: [PATCH 1/2] feat(github): enable protected release environments --- k8s/bases/apps/github-config/role.yaml | 2 ++ .../crossplane/managed-resource-activation-policy.yaml | 4 ++++ 2 files changed, 6 insertions(+) diff --git a/k8s/bases/apps/github-config/role.yaml b/k8s/bases/apps/github-config/role.yaml index 3ef7a6a2ca..39aada6726 100644 --- a/k8s/bases/apps/github-config/role.yaml +++ b/k8s/bases/apps/github-config/role.yaml @@ -44,6 +44,8 @@ rules: - repositoryrulesets - issuelabels - repositorycustomproperties + - environments + - environmentdeploymentpolicies verbs: - get - list diff --git a/k8s/providers/hetzner/infrastructure/crossplane/managed-resource-activation-policy.yaml b/k8s/providers/hetzner/infrastructure/crossplane/managed-resource-activation-policy.yaml index 45b67ac718..7d760aebd2 100644 --- a/k8s/providers/hetzner/infrastructure/crossplane/managed-resource-activation-policy.yaml +++ b/k8s/providers/hetzner/infrastructure/crossplane/managed-resource-activation-policy.yaml @@ -24,6 +24,10 @@ spec: # Explicit custom-property assignments owned by the github-config tenant # (devantler-tech/.github#773); organization schema remains a provider gap. - repositorycustomproperties.repo.github.m.upbound.io + # Protected Marketplace action releases are declared by the github-config + # tenant (devantler-tech/.github#779). Secret custody is a separate gate. + - environments.repo.github.m.upbound.io + - environmentdeploymentpolicies.repo.github.m.upbound.io # Org-level rulesets. Of the org's 20 org rules, the 10 provider-upjet-github # can express are adopted Observe-first in devantler-tech/.github # deploy/rulesets/ (+ a net-new tag-protection ruleset); the other 10 From 280f2856ffff5d3d53849b9d40c02e234f71959b Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Tue, 27 Oct 2026 07:30:00 +0100 Subject: [PATCH 2/2] fix(github): record the scoped environment authorization --- scripts/validate-eks-ci-role-policy/approved-surface.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/validate-eks-ci-role-policy/approved-surface.txt b/scripts/validate-eks-ci-role-policy/approved-surface.txt index affdfe74d3..abc74366cc 100644 --- a/scripts/validate-eks-ci-role-policy/approved-surface.txt +++ b/scripts/validate-eks-ci-role-policy/approved-surface.txt @@ -304,7 +304,7 @@ rbac.authorization.k8s.io/v1|Role|data-product-controller|data-product-readiness rbac.authorization.k8s.io/v1|Role|data-product-controller|khoist-documentation 35e63ab8f23f3de55976023d5c6144ac5a3cd7ed5c0947f1c451d74cf4167bef -rbac.authorization.k8s.io/v1|Role|github-config|github-config-managed-resources 07a7e586590a561fef323c6b988cb29850df5f0e58617d79e2250063c6a8fc2d +rbac.authorization.k8s.io/v1|Role|github-config|github-config-managed-resources f25e2b6e9407f0c330c23b428d3f467745fcdcdc1fa23153b4c8fcd7a286d8be rbac.authorization.k8s.io/v1|Role|kubelet-serving-cert-approver|leader-election:kubelet-serving-cert-approver b73fcea5da2f0aad8552ff6a168372a6d47e9f4fb967c7df741ba89708240c73