feat(helm): add operational labels to GithubOrganization

[onuryilmaz]

Summary

Adds four operational labels to every GithubOrganization CR rendered by the Helm chart, so Permission Manager can look up org CRs via label selectors and read config without parsing spec fields.

• repo-guard.cloudoperators.dev/github-instance — full hostname; PM uses as a label selector to find the org CR from a CCRN hostname
• repo-guard.cloudoperators.dev/github-instance-key — short key (defaults to first segment of the github field, e.g. enterprise from enterprise.github.com); overridable via githubInstanceKey in values
• repo-guard.cloudoperators.dev/default-ldap-provider — LDAP provider PM writes into spec.externalMemberProvider.ldap.provider on GithubTeam CRs it creates for this org
• repo-guard.cloudoperators.dev/admin-permission — "admin" or "admin-ondemand"; PM maps the ADMIN role to this value (defaults to "admin")

No CRD or Go changes required — these are purely ObjectMeta labels.

Closes #246

Test plan

• helm template renders all four labels with correct defaults (github-instance-key = first hostname segment, admin-permission = "admin", default-ldap-provider = "")
• Explicit overrides (githubInstanceKey, defaultLdapProvider, adminPermission) render correctly
• helm lint charts/repo-guard passes

[Copilot]

🟡 Changes recommended

Two moderate issues affect label lookup and Kubernetes validity; the public label documentation is also incomplete.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds four Permission Manager operational labels to Helm-rendered GithubOrganization resources and documents their configurable values.

Changes:

• Adds instance, instance-key, LDAP-provider, and admin-permission labels.
• Documents label overrides and defaults in values.yaml.

File summaries

File	Summary	Review findings
charts/repo-guard/values.yaml	Documents operational-label configuration values.	No findings.
charts/repo-guard/templates/githuborganization.yaml	Renders the four operational labels.	Moderate (3 votes): $org.github is a CR reference/resource key rather than necessarily the hostname, so hostname-based lookup can fail; derive labels from the matching instance URL or update the values contract. Moderate (1 vote): Full hostnames may exceed Kubernetes’s 63-character label-value limit and cause manifest rejection. Nit (1 vote): Add all four labels and defaults to docs/operations/labels.md.

Review details

Suppressed comments (3)

charts/repo-guard/templates/githuborganization.yaml:24

• The label advertises a key that Permission Manager uses to construct <instance-key>--... names, but the organization and team templates still build those names from $org.github. With github: enterprise.github.com, the label defaults to enterprise while rendered names remain enterprise.github.com--...; with githubInstanceKey overridden, the mismatch is guaranteed. Use the same naming prefix for the rendered resources or expose the actual prefix to Permission Manager before relying on this label.

    repo-guard.cloudoperators.dev/github-instance-key: "{{ $org.githubInstanceKey | default ($org.github | splitList "." | first) }}"

charts/repo-guard/templates/githuborganization.yaml:23

• A full hostname is not an unconstrained Kubernetes label value: label values are limited to 63 characters. Since $org.github can be a valid longer hostname/resource name, this can make the entire GithubOrganization manifest rejected by the API. Restrict the accepted hostname length or define a label-safe lookup representation while preserving the full hostname through another field.

    repo-guard.cloudoperators.dev/github-instance: "{{ $org.github }}"

charts/repo-guard/templates/githuborganization.yaml:26

• docs/operations/labels.md is the repository's reference table for GithubOrganization labels, but it does not document any of these four newly public labels or their defaults. Add entries for the lookup key, instance key, LDAP provider, and admin-permission labels so the chart/Permission Manager contract is discoverable and consistent with the existing label reference.

    repo-guard.cloudoperators.dev/github-instance: "{{ $org.github }}"
    repo-guard.cloudoperators.dev/github-instance-key: "{{ $org.githubInstanceKey | default ($org.github | splitList "." | first) }}"
    repo-guard.cloudoperators.dev/default-ldap-provider: "{{ $org.defaultLdapProvider | default "" }}"
    repo-guard.cloudoperators.dev/admin-permission: "{{ $org.adminPermission | default "admin" }}"

• Files reviewed: 2/2 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[onuryilmaz]

Addressed the Copilot review findings in the follow-up commit:

github-instance-key default corrected

The original default used splitList "." | first (e.g. enterprise from enterprise.github.com), but the Helm chart names GithubOrganization CRs as <github>--<org> — using the full $org.github value as the prefix. I confirmed this by checking the permission-manager source: PM is not yet consuming these labels (they are a prerequisite for upcoming PM issues), but when it does construct CR names in the <instance-key>--<org>--<slug> format, it will need the key to match the actual naming prefix. The default is now $org.github directly. An explicit githubInstanceKey override remains available for cases where a shorter alias is preferred.

63-char label value limit

The github-instance label uses $org.github as-is. In practice this is a GitHub hostname and will never approach 63 characters, but I've added a note about the constraint in docs/operations/labels.md so operators are aware.

Docs

Added all four operational labels to the GithubOrganization section of docs/operations/labels.md with descriptions, defaults, and the note about the Kubernetes label value length limit.

[Copilot]

🟡 Changes recommended

Label derivation and resource naming are inconsistent, and hostname-based labels lack length validation.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (5)

charts/repo-guard/templates/githuborganization.yaml:23

• $org.github is the Github resource key, not the GitHub hostname: the chart examples use github: com while the hostname is configured as githubs[].webURL (see charts/repo-guard/templates/github.yaml:8-10 and values.yaml:93-110). This label will therefore render com, so Permission Manager cannot select the org from a hostname such as enterprise.github.com; derive it from the associated Github object's webURL or introduce an explicit hostname value, and update the label documentation accordingly.

    repo-guard.cloudoperators.dev/github-instance: "{{ $org.github }}"

charts/repo-guard/templates/githuborganization.yaml:24

• This fallback emits the entire hostname rather than the required first segment: with github: enterprise.github.com, the label is enterprise.github.com instead of enterprise. Permission Manager will then use the wrong instance key when constructing CR names.

    repo-guard.cloudoperators.dev/github-instance-key: "{{ $org.githubInstanceKey | default $org.github }}"

charts/repo-guard/templates/githuborganization.yaml:23

• A full hostname can be longer than Kubernetes' 63-character label-value limit, but this template emits it without validation. A valid GitHub Enterprise hostname over that limit will render successfully in Helm and then be rejected by the Kubernetes API, preventing the release from installing. Fail early in the chart or use a label-safe identifier for lookup.

    repo-guard.cloudoperators.dev/github-instance: "{{ $org.github }}"

charts/repo-guard/values.yaml:136

• This chart comment documents the opposite default from the PR contract: githubInstanceKey is supposed to default to the first segment of a hostname, not the full github value. Update it together with the template so users do not configure Permission Manager with the wrong CR-name prefix.

#     # githubInstanceKey: defaults to the 'github' field value; used as the prefix in CR names (<instance-key>--<org>--<slug>)

docs/operations/labels.md:31

• The documented default here contradicts the PR requirement and the test plan: it says the full spec.github value, while the requested default is its first hostname segment (for example, enterprise from enterprise.github.com). Update this description and default after correcting the template.

| `repo-guard.cloudoperators.dev/github-instance-key` | Key PM uses to construct CR names matching the repo-guard convention (`<instance-key>--<org>--<team-slug>`). Defaults to the full `spec.github` value, which matches how the Helm chart names `GithubOrganization` CRs. Override via `githubInstanceKey` in Helm values. | `spec.github` value |

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

Unresolved naming, label-length validation, and admin-permission validation issues block approval.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (2)

charts/repo-guard/templates/githuborganization.yaml:24

• This default does not match the PR contract/test plan: for github: enterprise.github.com it renders enterprise.github.com, not the first segment enterprise. More importantly, the chart and controller currently use $org.github/spec.github for the GithubOrganization and GithubTeam names, so using a short key (or an override different from $org.github) makes Permission Manager's <instance-key>--... names diverge from the resources this chart creates. Please choose one canonical naming key and apply it consistently across the label, chart names, and controller/consumer contract, or keep the full hostname as the documented key.

    {{- if not $githubInstance -}}

charts/repo-guard/templates/githuborganization.yaml:23

• $org.github is the name of the referenced Github CR, not its hostname (GithubOrganization.spec.github is documented as a resource name; the host is in the Github object's spec.webURL). With the normal com / https://github.com setup this renders github-instance: "com", so a selector for github.com cannot find the organization. Resolve the referenced Github's hostname (or add an explicit hostname value) before writing this label.

    {{- $githubInstance := $org.githubInstanceHostname -}}

• Files reviewed: 3/3 changed files
• Comments generated: 2
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

The template has a critical missing-webURL failure path and a moderate resource-naming mismatch.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (3)

charts/repo-guard/templates/githuborganization.yaml:31

• The value derived from webURL is copied into a Kubernetes label without validating or normalizing it. A valid configured URL such as https://ghe.example.com/ or a hostname longer than 63 characters produces a value with / or an overlong label, so the rendered GithubOrganization is rejected by the API and Permission Manager cannot use the lookup. Validate the derived/override value against Kubernetes label-value constraints (or parse the URL to a hostname and fail clearly when it cannot fit).

    repo-guard.cloudoperators.dev/github-instance: "{{ $githubInstance }}"

charts/repo-guard/templates/githuborganization.yaml:33

• Both githubInstanceKey and defaultLdapProvider overrides are emitted verbatim as label values, but Kubernetes label values are limited to 63 characters and have character/start-end restrictions. A valid longer resource/provider name therefore makes Helm render a GithubOrganization that the API rejects. Add render-time validation for these label values and document the constraints; do not truncate them because Permission Manager needs the exact key/provider name.

    repo-guard.cloudoperators.dev/github-instance-key: "{{ $org.githubInstanceKey | default $org.github }}"
    repo-guard.cloudoperators.dev/default-ldap-provider: "{{ $org.defaultLdapProvider | default "" }}"

charts/repo-guard/templates/githuborganization.yaml:32

• githubInstanceKey only changes this label, but the chart still names GithubOrganization, GithubTeam, and GithubTeamRepository resources with $org.github. With an override such as githubInstanceKey: enterprise and github: enterprise.github.com, Permission Manager will construct enterprise--... names that Helm never rendered. Apply the effective key to the generated resource names (while retaining the original value in spec.github), or remove/limit this override so the label cannot diverge from the naming prefix.

    repo-guard.cloudoperators.dev/github-instance-key: "{{ $org.githubInstanceKey | default $org.github }}"

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Lite