Nordix
diff --git a/‎.github/workflows/porch-e2e-ci-jobs.yaml‎
Lines changed: 16 additions & 9 deletions b/‎.github/workflows/porch-e2e-ci-jobs.yaml‎
Lines changed: 16 additions & 9 deletions
diff --git a/‎.github/workflows/sonarcloud.yml‎
Lines changed: 2 additions & 1 deletion b/‎.github/workflows/sonarcloud.yml‎
Lines changed: 2 additions & 1 deletion
diff --git a/‎.gitignore‎
Lines changed: 3 additions & 0 deletions b/‎.gitignore‎
Lines changed: 3 additions & 0 deletions
diff --git a/‎api/porchconfig/v1alpha1/config.porch.kpt.dev_repositories.yaml‎
Lines changed: 60 additions & 9 deletions b/‎api/porchconfig/v1alpha1/config.porch.kpt.dev_repositories.yaml‎
Lines changed: 60 additions & 9 deletions
diff --git a/‎api/porchconfig/v1alpha1/groupversion_info.go‎
Lines changed: 1 addition & 1 deletion b/‎api/porchconfig/v1alpha1/groupversion_info.go‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎api/porchconfig/v1alpha1/types.go‎
Lines changed: 32 additions & 3 deletions b/‎api/porchconfig/v1alpha1/types.go‎
Lines changed: 32 additions & 3 deletions
diff --git a/‎api/porchconfig/v1alpha1/zz_generated.deepcopy.go‎
Lines changed: 12 additions & 0 deletions b/‎api/porchconfig/v1alpha1/zz_generated.deepcopy.go‎
Lines changed: 12 additions & 0 deletions
diff --git a/‎controllers/main.go‎
Lines changed: 30 additions & 6 deletions b/‎controllers/main.go‎
Lines changed: 30 additions & 6 deletions
@@ -124,22 +124,22 @@ jobs:
             make_target: "run-in-kind"
             test_path: "${GITHUB_WORKSPACE}/test/e2e/api"
             test_env: "E2E=1"
-            log_name: "porch-e2e-server.log"
+            log_prefix: "porch-e2e"
           - name: "Porch E2E Tests (DB Cache)"
             make_target: "run-in-kind-db-cache"
             test_path: "${GITHUB_WORKSPACE}/test/e2e/api"
             test_env: "E2E=1 DB_CACHE=1"
-            log_name: "porch-e2e-dbcache-server.log"
+            log_prefix: "porch-e2e-dbcache"
           - name: "Porch CLI E2E Tests"
-            make_target: "run-in-kind-no-git"
+            make_target: "run-in-kind"
             test_path: "${GITHUB_WORKSPACE}/test/e2e/cli"
             test_env: "E2E=1"
-            log_name: "porch-cli-e2e-server.log"
+            log_prefix: "porch-cli-e2e"
           - name: "Porch CLI E2E Tests (DB Cache)"
-            make_target: "run-in-kind-db-cache-no-git"
+            make_target: "run-in-kind-db-cache"
             test_path: "${GITHUB_WORKSPACE}/test/e2e/cli"
             test_env: "E2E=1"
-            log_name: "porch-cli-e2e-dbcache-server.log"
+            log_prefix: "porch-cli-e2e-dbcache"
 
     steps:
       - name: Checkout Porch
@@ -178,13 +178,20 @@ jobs:
         if: always()
         run: |
           name=$(kubectl -n porch-system get pod -l app=porch-server -o custom-columns=NAME:.metadata.name --no-headers=true)
-          kubectl -n porch-system logs $name > ${{ matrix.log_name }}
+          kubectl -n porch-system logs $name > ${{ matrix.log_prefix }}-server.log
+      - name: Export porch controllers logs
+        if: always()
+        run: |
+          name=$(kubectl -n porch-system get pod -l k8s-app=porch-controllers -o custom-columns=NAME:.metadata.name --no-headers=true 2>/dev/null || true)
+          if [ -n "$name" ]; then
+            kubectl -n porch-system logs $name > ${{ matrix.log_prefix }}-controllers.log 2>/dev/null || true
+          fi
       - name: Archive logs
         if: always()
         uses: actions/upload-artifact@v4  
         with:
-          name: ${{ matrix.log_name }}
-          path: ${{ matrix.log_name }}
+          name: ${{ matrix.log_prefix }}-logs
+          path: "*.log"
           compression-level: 0
           retention-days: 2
 
 
@@ -83,6 +83,7 @@ jobs:
         workflow: CI test report
         run_id: ${{ github.event.workflow_run.id }}
         name: coverage-report
+        use_unzip: true
 
     - name: Fix Go module paths in coverage
       run: |
@@ -111,4 +112,4 @@ jobs:
         args:
           -Dsonar.projectKey=nephio-project_porch
           -Dsonar.organization=nephio-project
-          -Dproject.settings=sonar-project.properties
+          -Dproject.settings=sonar-project.properties
@@ -50,5 +50,8 @@ docs/go.sum
 # Temporary lock file while building
 /.hugo_build.lock
 
+# Test binaries
+testbin/
+
 # gosec artifacts
 *.sarif
@@ -24,6 +24,8 @@ spec:
     kind: Repository
     listKind: RepositoryList
     plural: repositories
+    shortNames:
+    - repo
     singular: repository
   scope: Namespaced
   versions:
@@ -46,6 +48,12 @@ spec:
     - jsonPath: .spec['git','oci']['repo','registry']
       name: Address
       type: string
+    - jsonPath: .spec.git.branch
+      name: Branch
+      type: string
+    - jsonPath: .metadata.creationTimestamp
+      name: Age
+      type: date
     name: v1alpha1
     schema:
       openAPIV3Schema:
@@ -101,19 +109,19 @@ spec:
                     type: string
                   branch:
                     default: main
-                    description: Name of the branch containing the packages. Finalized
-                      packages will be committed to this branch (if the repository
-                      allows write access). If unspecified, defaults to "main".
+                    description: |-
+                      Name of the branch containing the packages. Finalized packages will be committed to this branch (if the repository allows write access). If unspecified, defaults to "main".
+                      This field is immutable after creation.
                     minLength: 1
                     type: string
                   createBranch:
                     description: CreateBranch specifies if Porch should create the
                       package branch if it doesn't exist.
                     type: boolean
                   directory:
-                    description: Directory within the Git repository where the packages
-                      are stored. A subdirectory of this directory containing a Kptfile
-                      is considered a package. If unspecified, defaults to root directory.
+                    description: |-
+                      Directory within the Git repository where the packages are stored. A subdirectory of this directory containing a Kptfile is considered a package. If unspecified, defaults to root directory.
+                      This field is immutable after creation.
                     type: string
                   email:
                     description: Email to use for commits
@@ -162,9 +170,8 @@ spec:
                 description: Repository sync/reconcile details
                 properties:
                   runOnceAt:
-                    description: Value in metav1.Time format to indicate when the
-                      repository should be synced once outside the periodic cron based
-                      reconcile loop.
+                    description: Value in metav1.Time format to trigger a one-time
+                      cache sync outside the periodic schedule.
                     format: date-time
                     type: string
                   schedule:
@@ -238,13 +245,57 @@ spec:
                   - type
                   type: object
                 type: array
+              gitCommitHash:
+                description: |-
+                  GitCommitHash is the commit hash of the configured branch for git repositories.
+                  Empty for OCI repositories.
+                type: string
+              lastFullSyncTime:
+                description: LastFullSyncTime is the timestamp of the last successful
+                  full repository sync.
+                format: date-time
+                type: string
+              nextFullSyncTime:
+                description: NextFullSyncTime is the timestamp when the next full
+                  sync is scheduled to occur.
+                format: date-time
+                type: string
+              observedGeneration:
+                description: ObservedGeneration is the generation of the Repository
+                  spec that was last reconciled.
+                format: int64
+                type: integer
+              observedRunOnceAt:
+                description: |-
+                  ObservedRunOnceAt tracks the last observed value of spec.sync.runOnceAt.
+                  Used to detect when runOnceAt is set, updated, or cleared to prevent redundant syncs.
+                format: date-time
+                type: string
+              packageCount:
+                description: PackageCount is the number of package revisions discovered
+                  in the repository.
+                type: integer
             type: object
         type: object
         x-kubernetes-validations:
         - message: metadata.name must conform to the RFC1123 DNS label standard
           rule: self.metadata.name.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?$')
         - message: metadata.name must be no more than 63 characters
           rule: size(self.metadata.name) <= 63
+        - message: spec.type is immutable
+          rule: '!has(oldSelf.spec.type) || self.spec.type == oldSelf.spec.type'
+        - message: spec.git.repo is immutable
+          rule: '!has(oldSelf.spec.git) || !has(oldSelf.spec.git.repo) || self.spec.git.repo
+            == oldSelf.spec.git.repo'
+        - message: spec.git.branch is immutable
+          rule: '!has(oldSelf.spec.git) || !has(oldSelf.spec.git.branch) || self.spec.git.branch
+            == oldSelf.spec.git.branch'
+        - message: spec.git.directory is immutable
+          rule: '!has(oldSelf.spec.git) || !has(oldSelf.spec.git.directory) || self.spec.git.directory
+            == oldSelf.spec.git.directory'
+        - message: spec.oci.registry is immutable
+          rule: '!has(oldSelf.spec.oci) || !has(oldSelf.spec.oci.registry) || self.spec.oci.registry
+            == oldSelf.spec.oci.registry'
     served: true
     storage: true
     subresources:
 
@@ -1,4 +1,4 @@
-// Copyright 2022,2026 The kpt and Nephio Authors
+// Copyright 2022-2026 The kpt and Nephio Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
 
@@ -1,4 +1,4 @@
-// Copyright 2022-2025 The kpt and Nephio Authors
+// Copyright 2022-2026 The kpt and Nephio Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -20,15 +20,22 @@ import (
 
 //+kubebuilder:object:root=true
 //+kubebuilder:subresource:status
-//+kubebuilder:resource:path=repositories,singular=repository
+//+kubebuilder:resource:path=repositories,singular=repository,shortName=repo
 //+kubebuilder:printcolumn:name="Type",type=string,JSONPath=`.spec.type`
 //+kubebuilder:printcolumn:name="Content",type=string,JSONPath=`.spec.content`
 // +kubebuilder:printcolumn:name="Sync schedule",type=string,JSONPath=`.spec.sync.schedule`
 //+kubebuilder:printcolumn:name="Deployment",type=boolean,JSONPath=`.spec.deployment`
 //+kubebuilder:printcolumn:name="Ready",type=string,JSONPath=`.status.conditions[?(@.type=='Ready')].status`
 //+kubebuilder:printcolumn:name="Address",type=string,JSONPath=`.spec['git','oci']['repo','registry']`
+//+kubebuilder:printcolumn:name="Branch",type=string,JSONPath=`.spec.git.branch`
+//+kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
 // +kubebuilder:validation:XValidation:rule="self.metadata.name.matches('^[a-z0-9]([-a-z0-9]*[a-z0-9])?$')",message="metadata.name must conform to the RFC1123 DNS label standard"
 // +kubebuilder:validation:XValidation:rule="size(self.metadata.name) <= 63",message="metadata.name must be no more than 63 characters"
+// +kubebuilder:validation:XValidation:rule="!has(oldSelf.spec.type) || self.spec.type == oldSelf.spec.type",message="spec.type is immutable"
+// +kubebuilder:validation:XValidation:rule="!has(oldSelf.spec.git) || !has(oldSelf.spec.git.repo) || self.spec.git.repo == oldSelf.spec.git.repo",message="spec.git.repo is immutable"
+// +kubebuilder:validation:XValidation:rule="!has(oldSelf.spec.git) || !has(oldSelf.spec.git.branch) || self.spec.git.branch == oldSelf.spec.git.branch",message="spec.git.branch is immutable"
+// +kubebuilder:validation:XValidation:rule="!has(oldSelf.spec.git) || !has(oldSelf.spec.git.directory) || self.spec.git.directory == oldSelf.spec.git.directory",message="spec.git.directory is immutable"
+// +kubebuilder:validation:XValidation:rule="!has(oldSelf.spec.oci) || !has(oldSelf.spec.oci.registry) || self.spec.oci.registry == oldSelf.spec.oci.registry",message="spec.oci.registry is immutable"
 
 // Repository
 type Repository struct {
@@ -77,7 +84,7 @@ type RepositorySpec struct {
 }
 
 type RepositorySync struct {
-	// Value in metav1.Time format to indicate when the repository should be synced once outside the periodic cron based reconcile loop.
+	// Value in metav1.Time format to trigger a one-time cache sync outside the periodic schedule.
 	RunOnceAt *metav1.Time `json:"runOnceAt,omitempty"`
 	// Cron value to indicate when the repository should be synced periodically. Example: `*/10 * * * *` to sync every 10 minutes.
 	Schedule string `json:"schedule,omitempty"`
@@ -92,10 +99,12 @@ type GitRepository struct {
 	// +kubebuilder:default=main
 	// +kubebuilder:validation:MinLength=1
 	// Name of the branch containing the packages. Finalized packages will be committed to this branch (if the repository allows write access). If unspecified, defaults to "main".
+	// This field is immutable after creation.
 	Branch string `json:"branch,omitempty"`
 	// CreateBranch specifies if Porch should create the package branch if it doesn't exist.
 	CreateBranch bool `json:"createBranch,omitempty"`
 	// Directory within the Git repository where the packages are stored. A subdirectory of this directory containing a Kptfile is considered a package. If unspecified, defaults to root directory.
+	// This field is immutable after creation.
 	Directory string `json:"directory,omitempty"`
 	// Reference to secret containing authentication credentials.
 	SecretRef SecretRef `json:"secretRef,omitempty"`
@@ -160,6 +169,26 @@ const (
 type RepositoryStatus struct {
 	// Conditions describes the reconciliation state of the object.
 	Conditions []metav1.Condition `json:"conditions,omitempty"`
+	// LastFullSyncTime is the timestamp of the last successful full repository sync.
+	// +optional
+	LastFullSyncTime *metav1.Time `json:"lastFullSyncTime,omitempty"`
+	// ObservedGeneration is the generation of the Repository spec that was last reconciled.
+	// +optional
+	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
+	// ObservedRunOnceAt tracks the last observed value of spec.sync.runOnceAt.
+	// Used to detect when runOnceAt is set, updated, or cleared to prevent redundant syncs.
+	// +optional
+	ObservedRunOnceAt *metav1.Time `json:"observedRunOnceAt,omitempty"`
+	// PackageCount is the number of package revisions discovered in the repository.
+	// +optional
+	PackageCount int `json:"packageCount,omitempty"`
+	// GitCommitHash is the commit hash of the configured branch for git repositories.
+	// Empty for OCI repositories.
+	// +optional
+	GitCommitHash string `json:"gitCommitHash,omitempty"`
+	// NextFullSyncTime is the timestamp when the next full sync is scheduled to occur.
+	// +optional
+	NextFullSyncTime *metav1.Time `json:"nextFullSyncTime,omitempty"`
 }
 
 //+kubebuilder:object:root=true
 
@@ -1,4 +1,4 @@
-// Copyright 2022,2026 The kpt and Nephio Authors
+// Copyright 2022-2026 The kpt and Nephio Authors
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -38,9 +38,9 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/webhook"
 
-	porchapi "github.com/nephio-project/porch/api/porch/v1alpha1"
 	"github.com/nephio-project/porch/controllers/packagevariants/pkg/controllers/packagevariant"
 	"github.com/nephio-project/porch/controllers/packagevariantsets/pkg/controllers/packagevariantset"
+	"github.com/nephio-project/porch/controllers/repositories/pkg/controllers/repository"
 	porchotel "github.com/nephio-project/porch/internal/otel"
 	"github.com/nephio-project/porch/pkg/controllerrestmapper"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -49,13 +49,20 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
 	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+
+	porchapi "github.com/nephio-project/porch/api/porch/v1alpha1"
+	configapi "github.com/nephio-project/porch/api/porchconfig/v1alpha1"
+	porchinternal "github.com/nephio-project/porch/internal/api/porchinternal/v1alpha1"
 	//+kubebuilder:scaffold:imports
 )
 
+const errInitScheme = "error initializing scheme: %w"
+
 var (
 	reconcilers = map[string]Reconciler{
 		"packagevariants":    &packagevariant.PackageVariantReconciler{},
 		"packagevariantsets": &packagevariantset.PackageVariantSetReconciler{},
+		"repositories":       &repository.RepositoryReconciler{},
 	}
 )
 
@@ -71,6 +78,9 @@ type Reconciler interface {
 
 	// SetupWithManager registers the reconciler to run under the specified manager
 	SetupWithManager(ctrl.Manager) error
+
+	// SetLogger sets the logger for the reconciler
+	SetLogger(name string)
 }
 
 // We include our lease / events permissions in the main RBAC role
@@ -117,11 +127,19 @@ func run(ctx context.Context) error {
 
 	scheme := runtime.NewScheme()
 	if err := clientgoscheme.AddToScheme(scheme); err != nil {
-		return fmt.Errorf("error initializing scheme: %w", err)
+		return fmt.Errorf(errInitScheme, err)
 	}
 
 	if err := porchapi.AddToScheme(scheme); err != nil {
-		return fmt.Errorf("error initializing scheme: %w", err)
+		return fmt.Errorf(errInitScheme, err)
+	}
+
+	if err := configapi.AddToScheme(scheme); err != nil {
+		return fmt.Errorf(errInitScheme, err)
+	}
+
+	if err := porchinternal.AddToScheme(scheme); err != nil {
+		return fmt.Errorf(errInitScheme, err)
 	}
 
 	managerOptions := ctrl.Options{
@@ -174,6 +192,8 @@ func run(ctx context.Context) error {
 		if !reconcilerIsEnabled(enabledReconcilers, name) {
 			continue
 		}
+		reconciler.SetLogger(name)
+		ctrl.Log.WithName(name).Info("setting up controller")
 		if err = reconciler.SetupWithManager(mgr); err != nil {
 			return fmt.Errorf("error creating %s reconciler: %w", name, err)
 		}
@@ -212,8 +232,12 @@ func reconcilerIsEnabled(reconcilers []string, reconciler string) bool {
 	if slices.Contains(reconcilers, reconciler) {
 		return true
 	}
-	if _, found := os.LookupEnv(fmt.Sprintf("ENABLE_%s", strings.ToUpper(reconciler))); found {
-		return true
+	// Check env var value (not just existence)
+	envVar := fmt.Sprintf("ENABLE_%s", strings.ToUpper(reconciler))
+	if val := os.Getenv(envVar); val != "" {
+		// Parse as boolean: "true", "1", "yes" = enabled
+		valLower := strings.ToLower(val)
+		return valLower == "true" || val == "1" || valLower == "yes"
 	}
 	return false
 }
Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-// Copyright 2022,2026 The kpt and Nephio Authors`
	`1`	`+// Copyright 2022-2026 The kpt and Nephio Authors`
`2`	`2`	`//`
`3`	`3`	`// Licensed under the Apache License, Version 2.0 (the "License");`
`4`	`4`	`// you may not use this file except in compliance with the License.`