Keep manually archived repositories archived; document renames

The deploy runs `pulumi up --refresh`, so a managed repository archived by
hand in GitHub would be refreshed to archived=true and then planned back to
false, un-archiving it. Ignore `archived` on the Repository resource so the
manual state sticks; archiving via this config (removing the entry, which
archiveOnDestroy turns into an archive) is unaffected.

Also document that adding `settings` to an existing repository does not
adopt it (import first), and that the `repository` key is the Pulumi
resource name, so renaming it in place archives the old repository.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kuh5eR5uDFfknR1vRPEkfn

Author: claude

README.md

@@ -57,7 +57,9 @@ The PR's `pulumi preview` comment shows the repository create. Once merged, the
 - Repository names are lowercase kebab-case (`ext-*` for extensions, `experimental-ext-*` while experimental).
 - At least one team or user must have `admin` permission (validated), so a managed repository is never ownerless.
 - Removing the entry **archives** the repository rather than deleting it; deletion stays a manual org-owner action.
-- Entries without `settings` are access-only: the repository pre-dates this config and Pulumi manages only its collaborators. Adopting an existing repository requires a `pulumi import` and is out of scope for the PR flow above.
+- Entries without `settings` are access-only: the repository pre-dates this config and Pulumi manages only its collaborators. Adding `settings` to such an entry does not adopt the repository — the deploy fails with a name-already-exists error. Adopt it with `pulumi import` first; that is out of scope for the PR flow above.
+- The `repository` key of a managed entry is also the Pulumi resource name. Renaming it in place archives the old repository and creates a new one: rename on GitHub first, then move the state (`pulumi state mv`) before changing the key.
+- A repository archived by hand in GitHub stays archived (`archived` is ignored on refresh); un-archiving is a manual org-owner action.
 
 ## Cloudflare Access (security-room)
 

src/config/repoAccess.ts

@@ -35,7 +35,13 @@ export interface RepositoryAccess {
   repository: string;
   /**
    * Declare to have Pulumi create and own the repository. Omit for repositories
-   * that pre-date this config (access-only).
+   * that pre-date this config (access-only). Adding `settings` to a repository
+   * that already exists does not adopt it: the deploy fails with a
+   * name-already-exists error. Adopt it with `pulumi import` first. The
+   * `repository` key of a managed entry is also the Pulumi resource name, so
+   * renaming it in place archives the old repository and creates a new one:
+   * rename on GitHub first, then move the state (`pulumi state mv`) before
+   * changing the key.
    */
   settings?: RepositorySettings;
   teams?: Array<{

src/github.ts

@@ -106,17 +106,27 @@ const repositories: Record<string, github.Repository> = {};
 REPOSITORY_ACCESS.forEach((repo) => {
   let repositoryName: pulumi.Input<string> = repo.repository;
   if (repo.settings) {
-    const repository = new github.Repository(`repository-${repo.repository}`, {
-      ...REPOSITORY_DEFAULTS,
-      name: repo.repository,
-      description: repo.settings.description,
-      visibility: repo.settings.visibility ?? 'public',
-      homepageUrl: repo.settings.homepage,
-      topics: repo.settings.topics ? [...repo.settings.topics] : undefined,
-      template: repo.settings.template
-        ? { owner: GITHUB_ORG, repository: repo.settings.template }
-        : undefined,
-    });
+    const repository = new github.Repository(
+      `repository-${repo.repository}`,
+      {
+        ...REPOSITORY_DEFAULTS,
+        name: repo.repository,
+        description: repo.settings.description,
+        visibility: repo.settings.visibility ?? 'public',
+        homepageUrl: repo.settings.homepage,
+        topics: repo.settings.topics ? [...repo.settings.topics] : undefined,
+        template: repo.settings.template
+          ? { owner: GITHUB_ORG, repository: repo.settings.template }
+          : undefined,
+      },
+      {
+        // A repository archived by hand in GitHub must stay archived: without
+        // this, the deploy's `pulumi up --refresh` would plan archived: true ->
+        // false and un-archive it. Archiving through this config still works
+        // (remove the entry; archiveOnDestroy archives instead of deleting).
+        ignoreChanges: ['archived'],
+      }
+    );
     repositories[repo.repository] = repository;
     repositoryName = repository.name;
   }