fix(deploy): adopt client repositories in coverage - #560

🤖 Generated by the Agentic Engineer

Validation at e2529d2e56a0b97211ae881afa11cc2707610c0f, based on reviewed fca583ac795d56928c5b542944b6e0963ea1e270:

• RED: the existing coverage checker reported two undeclared repositories against the complete captured organization census. The extended Admins inventory check also failed before adding the declarations.
• GREEN: the same coverage input now passes with all 26 active repositories declared. This exercises the coverage behavior against captured API evidence; it does not attest to the workflow's App-authenticated census.
• All fourteen maintenance baseline checks pass, including the repository coverage negative controls. Kustomize renders successfully and all ten new resources validate against the published provider-upjet-github v0.20.0 schemas.
• The actual release-title and base/head deletion guards pass. No managed resource is removed. GitHub reports the exact commit signature as verified and valid.
• Repository settings and labels remain Observe-only. Team grants are new declarations after the repository-scoped team census returned no existing grants; Actions permissions retain the existing shared policy.

The draft awaits settled CI and a substantive current-head review. Issue #556 remains open until the reviewed-main authenticated coverage check proves the repair. Publication and live adoption need separate receipts; this comment does not claim either.

Code Coverage Overview

Languages: Go, C#

Go / code-coverage/test

The overall line coverage in commit 1fc15f3 in the codex/repository-cov... branch remains at 50%, unchanged from commit c54800a in the main branch.

C# / code-coverage/dotnet

The overall line coverage in commit 1fc15f3 in the codex/repository-cov... branch remains at 100%, unchanged from commit c54800a in the main branch.

Go / code-coverage/go

The overall line coverage in commit 1fc15f3 in the codex/repository-cov... branch remains at 50%, unchanged from commit c54800a in the main branch.

_{Updated October 09, 2026 10:26 UTC}

🤖 Generated by the Agentic Engineer

Hosted CI at e2529d2e56a0b97211ae881afa11cc2707610c0f is blocked by the unchanged Go validation fixture's MegaLinter compiler mismatch, already being repaired in #558 under #559. The actual OSV job cannot load the fixture because it requires Go 1.26.8 while the container selects Go 1.26.3 with local-only toolchain selection. The scanner's package loading failure is not a clean security verdict.

The coverage declarations and their fourteen local baseline checks remain unchanged and passing. Keep this PR a draft until the compiler repair is delivered, current-head catalogue CI passes, and substantive review completes. No check is disabled or bypassed, and no workflow rerun is requested here.

🤖 Generated by the Agentic Engineer

Blocker: #559 | upstream | last-verified 2026-10-09: Current-head catalogue CI reproduces the unchanged MegaLinter Go compiler mismatch; the compiler repair is active in PR #558, and all fourteen local coverage baseline checks pass.

🤖 Generated by the Agentic Engineer

The compiler prerequisite #559 is delivered. I merged reviewed main at c54800ae638846697d08d2c97f3734df54ffdd1d into this draft without replacing its coverage commit.

The new head is 1fc15f3348ec2116333ee0faec3df94e520c3837. GitHub verifies its signature, and its parents are the original coverage head and the reviewed main revision. The earlier compiler blocker record is now historical; fresh catalogue CI is running at this head.

This remains a draft until current-head CI settles green and substantive review completes. Issue #556 still needs reviewed-main coverage, publication, and live adoption evidence. No production configuration was changed by this branch refresh.

🤖 Generated by the Agentic Engineer

@coderabbitai review

No actionable comments were generated in the recent review. 🎉

AGENTS.md — auto-discovered

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 1fc15

No actionable configuration issue is evident. Complete the pending CI and adoption checks before publishing the draft.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly and concisely describes adding the missing client repositories to deployment coverage.
Description check		The description explains why the repositories are missing, what the change adds, and how adoption is controlled. It is directly related to the changeset.

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

🤖 Generated by the Agentic Engineer

Readiness at 1fc15f3348ec2116333ee0faec3df94e520c3837:

• The same complete captured organization census fails against reviewed main with the two undeclared repositories and passes against this head with all 26 active repositories covered. This evaluates the coverage behavior using current forge evidence; it does not claim the workflow's installation-authenticated census passed.
• All fourteen maintenance baseline checks pass in this isolated worktree at the exact signed head. Hosted catalogue CI has settled with all 268 check runs successful, skipped, or neutral, and the required validation workflows passed.
• CodeRabbit's substantive review covers all sixteen changed files at this head and reports no actionable comments. The reviewed summary classifier returns GREEN, the provider status says Review completed, and the complete review/thread inventory has no findings or unresolved threads. CodeRabbit's auxiliary Checkov tool did not finish; this is not a claim that its Checkov scan passed.
• Repository settings and labels remain Observe-only. Publication, installation-authenticated reviewed-main coverage, and live adoption remain separate gates under Scheduled repository coverage check is failing on main #556.

GitHub's managed code-quality rule has no readable per-head verdict (setup=configured, UNVERIFIED). The normal merge API remains the authority for that protected rule; no bypass is requested. Promoting this validated draft and attempting the ordinary head-matched merge.

🤖 Generated by the Agentic Engineer

Delivered through the normal protected merge at 8d3327fe87f216d6e107941de4ce1ae019294cea.

• The reviewed-main coverage audit passed at this revision. Both the complete coverage comparison and its reporter succeeded; the reporter closed Scheduled repository coverage check is failing on main #556.
• Release v7.9.1 points to the same revision. The CD publication completed its staged signing, verification, and promotion step successfully.
• Independent Cosign verification accepted the exact pinned publisher identity. The signed artifact digest is sha256:6254738d05c89ca1d35ddff16178eafd99c1e1731a9a57ceeab77b32f3e8fc0d; its authenticated annotations bind this revision, version 7.9.1, and publication run 37919477709.

The full main CI run also completed successfully at the merged revision. Live adoption is not verified: the current Platform recovery remains unresolved. Publication and the restored coverage audit do not establish production readiness.