[devantler]

🤖 Generated by the Agentic Engineer

Why

Safe cleanup after upgrades needs deployment checks that examine the migration jobs as well as ordinary application resources.

What

Adds that validation for installation and upgrade, including the exact input Helm gives its renderer. This prepares the migration cleanup for a separate rollout.

Part of #5491

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai full review

[devantler]

🤖 Generated by the Agentic Engineer

Validation at d9603f11f4274298469572c3bb9b14dd9675af6f:

• New controls failed before the change. The complete post-renderer and disruption-budget suites now pass with 114 and 330 assertions, including invalid hook patches, unsupported strategies, and hooks that must never satisfy a workload budget. ShellCheck, workflow lint, and whitespace checks pass.
• User evaluation used the audited Helm 4.2.4 SDK renderer and the published Kyverno 3.9.2 chart. Capturing the actual input and applying the proposed lifecycle patch changed exactly the expected Job annotation among 80 rendered resources under Kubernetes YAML semantics. No other resource or field changed.
• The refreshed main branch was merged without changing the tested guard sources. This PR enables validation only; deployment cleanup and its production acceptance remain separate under Clean up successful Kyverno migration jobs after upgrades #5491.

[coderabbitai]

⚠️ Action not completed

Review rate limited.

---

Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 56 minutes.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 56 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: devantler-tech/platform
• Branch: codex/kyverno-migration-lifecycle-5491
• File: .coderabbit.yaml
• Commit: d9603f1
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: b71789f3-5787-4ed8-82b2-9a8141669894

Commits

Reviewing files that changed from the base of the PR and between 7b32a6c and d9603f1.

Files selected for processing: 7

• .github/workflows/ci.yaml
• AGENTS.md
• scripts/guard-helm-post-renderers.sh
• scripts/guard-pdb-selector-match.sh
• scripts/prepare-helm-render-input-capture.sh
• scripts/tests/test-guard-helm-post-renderers.sh
• scripts/tests/test-guard-pdb-selector-match.sh

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

cr:no-gate@d9603f1 — the included review was refused; the native guard confirms no completed review of this head.

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T10:59:50.030493Z	d9603f1	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: d9603f11f4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Ready for protected delivery at d9603f11f4274298469572c3bb9b14dd9675af6f: all 49 reported checks are settled without failures, every readable required gate passes, the branch is CLEAN, and there are no review threads or unresolved body findings. Codex's clean receipt 6467233791 binds this head. The real Helm user exercise and its limits are recorded above.

The configured code-quality rule has no readable per-head result, so the completeness helper reports it as UNVERIFIED; the normal protected merge API must decide that rule. This is not a complete-gate claim or an override. #5491 remains open for the separate lifecycle rollout and production acceptance.

[devantler]

🤖 Generated by the Agentic Engineer

The merge queue removed this PR for failed_checks at 16:16 UTC. Attempt 40722307528 failed before the application trial: public-image verification hit a GitHub API quota response and correctly refused to exceed its bounded recovery. The production deployment, final queue check and recovery jobs were all skipped.

The existing hosted fixture subsequently passed in job 122943582228, including the real controller and restricted public application step. Source head d9603f1 remains CLEAN, with its current-head Codex pass and no open review findings. No source, check, deadline or credential change is needed for this recovery. Performing one bounded requeue after that verified service recovery.