Fix deployment: remove stale 'core' team references and add validation

PR #17 removed the 'core' group but left references in repoAccess.ts,
causing deployments to fail since Nov 25th.

Changes:
- Remove 'core' team references from 6 repositories in repoAccess.ts
- Replace with 'core-maintainers' to maintain equivalent permissions
- Add scripts/validate-config.ts to validate all team references
- Add pre-commit hook to run validation on config changes
- Add npm run validate script

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.pre-commit-config.yaml

@@ -15,3 +15,10 @@ repos:
         language: system
         pass_filenames: false
         files: \.(ts|tsx)$
+
+      - id: validate-config
+        name: Validate team references
+        entry: npm run validate
+        language: system
+        pass_filenames: false
+        files: ^src/config/

package.json

@@ -4,7 +4,8 @@
   "description": "Infrastructure as Code for MCP access management",
   "main": "src/index.ts",
   "scripts": {
-    "build": "tsc"
+    "build": "tsc",
+    "validate": "npx ts-node scripts/validate-config.ts"
   },
   "license": "MIT",
   "dependencies": {

scripts/validate-config.ts

@@ -0,0 +1,82 @@
+#!/usr/bin/env npx ts-node
+
+/**
+ * Validates that all team references in repoAccess.ts exist in groups.ts
+ * Run with: npx ts-node scripts/validate-config.ts
+ */
+
+import { GROUPS } from '../src/config/groups';
+import { REPOSITORY_ACCESS } from '../src/config/repoAccess';
+import { MEMBERS } from '../src/config/users';
+import type { Group, Member } from '../src/config/utils';
+
+// Get all GitHub team names (groups not limited to google-only platforms)
+const githubTeamNames = new Set<string>();
+// Get all group names (for member validation - members can be in any group)
+const allGroupNames = new Set<string>();
+
+for (const g of GROUPS) {
+  const group = g as Group;
+  allGroupNames.add(group.name);
+
+  const platforms = group.onlyOnPlatforms;
+  if (!platforms || platforms.includes('github')) {
+    githubTeamNames.add(group.name);
+  }
+}
+
+let hasErrors = false;
+
+// Validate team references in REPOSITORY_ACCESS
+console.log('Validating team references in repoAccess.ts...');
+for (const repo of REPOSITORY_ACCESS) {
+  if (!repo.teams) continue;
+
+  for (const teamRef of repo.teams) {
+    if (!githubTeamNames.has(teamRef.team)) {
+      console.error(
+        `ERROR: Repository "${repo.repository}" references team "${teamRef.team}" which does not exist in groups.ts`
+      );
+      hasErrors = true;
+    }
+  }
+}
+
+// Validate team references in MEMBERS (memberOf)
+// Members can be in any group (GitHub or Google-only)
+console.log('Validating team references in users.ts...');
+for (const m of MEMBERS) {
+  const member = m as Member;
+  for (const teamKey of member.memberOf) {
+    if (!allGroupNames.has(teamKey)) {
+      console.error(
+        `ERROR: Member "${member.github || member.email}" references team "${teamKey}" which does not exist in groups.ts`
+      );
+      hasErrors = true;
+    }
+  }
+}
+
+// Validate parent team references (memberOf in groups)
+console.log('Validating parent team references in groups.ts...');
+for (const g of GROUPS) {
+  const group = g as Group;
+  if (!group.memberOf) continue;
+
+  for (const parentTeam of group.memberOf) {
+    if (!allGroupNames.has(parentTeam)) {
+      console.error(
+        `ERROR: Group "${group.name}" has parent "${parentTeam}" which does not exist in groups.ts`
+      );
+      hasErrors = true;
+    }
+  }
+}
+
+if (hasErrors) {
+  console.error('\nValidation failed! Please fix the errors above.');
+  process.exit(1);
+} else {
+  console.log('\nAll team references are valid.');
+  process.exit(0);
+}

src/config/repoAccess.ts

@@ -21,8 +21,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
     ],
     teams: [
       { team: 'auth-wg', permission: 'push' },
-      { team: 'core', permission: 'maintain' },
-      { team: 'core-maintainers', permission: 'push' },
+      { team: 'core-maintainers', permission: 'maintain' },
       { team: 'csharp-sdk', permission: 'push' },
       { team: 'docs-maintaners', permission: 'push' },
       { team: 'go-sdk', permission: 'push' },
@@ -54,8 +53,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
     ],
     teams: [
       { team: 'auth-wg', permission: 'triage' },
-      { team: 'core', permission: 'maintain' },
-      { team: 'core-maintainers', permission: 'push' },
+      { team: 'core-maintainers', permission: 'maintain' },
       { team: 'csharp-sdk', permission: 'triage' },
       { team: 'docs-maintaners', permission: 'triage' },
       { team: 'go-sdk', permission: 'triage' },
@@ -91,8 +89,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
     teams: [
       { team: 'inspector-maintainers', permission: 'push' },
       { team: 'auth-wg', permission: 'push' },
-      { team: 'core', permission: 'maintain' },
-      { team: 'core-maintainers', permission: 'push' },
+      { team: 'core-maintainers', permission: 'maintain' },
       { team: 'csharp-sdk', permission: 'push' },
       { team: 'docs-maintaners', permission: 'push' },
       { team: 'go-sdk', permission: 'push' },
@@ -124,8 +121,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
     ],
     teams: [
       { team: 'auth-wg', permission: 'push' },
-      { team: 'core', permission: 'maintain' },
-      { team: 'core-maintainers', permission: 'push' },
+      { team: 'core-maintainers', permission: 'maintain' },
       { team: 'csharp-sdk', permission: 'triage' },
       { team: 'docs-maintaners', permission: 'push' },
       { team: 'go-sdk', permission: 'triage' },
@@ -158,8 +154,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
     ],
     teams: [
       { team: 'auth-wg', permission: 'push' },
-      { team: 'core', permission: 'maintain' },
-      { team: 'core-maintainers', permission: 'push' },
+      { team: 'core-maintainers', permission: 'maintain' },
       { team: 'csharp-sdk', permission: 'push' },
       { team: 'docs-maintaners', permission: 'push' },
       { team: 'go-sdk', permission: 'push' },
@@ -192,8 +187,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
     ],
     teams: [
       { team: 'auth-wg', permission: 'push' },
-      { team: 'core', permission: 'admin' },
-      { team: 'core-maintainers', permission: 'push' },
+      { team: 'core-maintainers', permission: 'admin' },
       { team: 'csharp-sdk', permission: 'push' },
       { team: 'docs-maintaners', permission: 'push' },
       { team: 'go-sdk', permission: 'push' },