Preserve Release Please lifecycle labels under declarative sync

[devantler]

🤖 Generated by the Agentic Engineer.

Impact

The Actions v12.0.2 release PR was created correctly, but the declarative repository controller removed Release Please’s autorelease: pending label before merge. The next Release Please run could not recognize the merged release PR, scanned 863 historical commits, skipped v12.0.2, and generated/published v13.0.0.

Exact evidence

• PR chore(main): release 12.0.2 #892 received autorelease: pending from botantler-1[bot] at 2026-08-03T02:28:00Z.
• provider-upjet-github[bot] removed that label at 2026-08-03T02:28:20Z, before the PR merged.
• The post-merge Release Please log reported No latest release pull request found, considered 863 commits, and opened chore(main): release 13.0.0 #893 as v13.0.0.
• chore(main): release 13.0.0 #893 then merged through the programmed bot path and published v13.0.0.

Expected behavior

Declarative label reconciliation must preserve the Release Please lifecycle labels used by the release workflow, and the release path should fail closed instead of generating a new release PR when a just-merged release PR is missing its lifecycle marker.

Acceptance criteria

• Add the Release Please lifecycle labels to the declarative label set for devantler-tech/actions.
• Add a regression test proving the controller-owned label set retains both autorelease: pending and autorelease: tagged.
• Add or document a fail-closed check that prevents historical re-scan/version escalation when the lifecycle marker is missing.
• Validate the next patch release is recognized and tagged without generating an unintended major.

[coderabbitai]

🔗 Related PRs

#412 - ci: skip the suite on the release-commit push to dodge the self-pin tag race [merged]
#418 - feat!: remove the sync-github-labels composite action (superseded by declarative IssueLabels) [merged]
#427 - fix: resolve first-party self-references at the same commit [merged]
#612 - fix(release): disable issue notification hooks [merged]
#811 - fix(auto-merge): close residual event-order gaps [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[devantler]

🤖 Generated by the Agentic Engineer.

Verification update:

• Root cause repaired in fix(deploy): preserve Actions release labels .github#133 and merged as signed commit 06aa9d092fa6e7e99d0c5dbd981d0f002b8a5b44.
• Release tag v1.21.6 points exactly at that commit; exact-head CodeQL and Release runs passed.
• CD run 30780537833 published and signed ghcr.io/devantler-tech/github-config/manifests@sha256:f60b8effb9ccce449c261ea7f324b28e8ea32a20796d7bd45c484fe74d306587; local Cosign verification passed, including the transparency-log and certificate checks.
• The live devantler-tech/actions label set now contains both autorelease: pending and autorelease: tagged with the declared ededed color, proving downstream reconciliation applied the repaired manifest.
• Regression coverage includes both lifecycle labels plus a negative-control test proving a partial yq output cannot mask a read failure.

Keeping this issue open in Verifying. Two acceptance items remain: add or document the release-path fail-closed guard for a missing lifecycle marker, and validate the next genuine patch release is recognized/tagged without another version escalation.