Migrate GitHub teams to infrastructure-as-code (#5)
* Migrate GitHub teams to infrastructure-as-code - Add 25 teams with proper hierarchy (steering-committee, SDK teams, working groups, interest groups) - Add 67 team members with their assignments - Add repository access configuration for all 21 repositories - Refactor github.ts to use config-driven approach with repoAccess.ts - Mark all MCP teams as GitHub-only with onlyOnPlatforms - Use RepositoryCollaborators for authoritative access management Note: GitHub Projects V2 permissions are not yet supported by Pulumi and must be managed manually. See https://github.com/pulumi/pulumi-github/issues/1006 * Add individual user collaborators to repository access Preserves direct collaborator access for users who have explicit permissions outside of team membership, including: - jspahrsummers: admin on multiple core repos - Go SDK collaborators (neild, rsc, rolandshoemaker, h9jiang) - C# SDK collaborators (jeffhandley, MackinnonBuck, jozkee, localden, PederHP) - Rust SDK collaborators (jamadeo, jokemanfire, 4t145) - Inspector collaborators (richardkmichael, olaservo, an-dustin, ashwin-ant) - Financial services IG collaborators (aniabot, imfing, sambhav, KengoA, nitsanh) - And others Without this, RepositoryCollaborators (authoritative mode) would remove all individual user access.
This commit is contained in:
adam jones
Adam Jones
parent
5b2b01db21
commit
7883dbc5e3
1 changed files with 772 additions and 10 deletions
329
src/config/repoAccess.ts
Normal file
329
src/config/repoAccess.ts
Normal file
|
|
@ -0,0 +1,329 @@
|
|||
// Repository access configuration
|
||||
// Each repository lists all teams and users that should have access and their permission level
|
||||
|
||||
export interface RepositoryAccess {
|
||||
repository: string;
|
||||
teams?: Array<{
|
||||
team: string; // Team slug
|
||||
permission: 'pull' | 'triage' | 'push' | 'maintain' | 'admin';
|
||||
}>;
|
||||
users?: Array<{
|
||||
username: string; // GitHub username
|
||||
permission: 'pull' | 'triage' | 'push' | 'maintain' | 'admin';
|
||||
}>;
|
||||
}
|
||||
|
||||
export const REPOSITORY_ACCESS: RepositoryAccess[] = [
|
||||
{
|
||||
repository: 'docs',
|
||||
users: [
|
||||
{ username: 'jspahrsummers', permission: 'admin' },
|
||||
],
|
||||
teams: [
|
||||
{ team: 'auth-wg', permission: 'push' },
|
||||
{ team: 'core', permission: 'maintain' },
|
||||
{ team: 'core-maintainers', permission: 'push' },
|
||||
{ team: 'csharp-sdk', permission: 'push' },
|
||||
{ team: 'docs-maintaners', permission: 'push' },
|
||||
{ team: 'go-sdk', permission: 'push' },
|
||||
{ team: 'ig-financial-services', permission: 'push' },
|
||||
{ team: 'interest-groups', permission: 'push' },
|
||||
{ team: 'java-sdk', permission: 'push' },
|
||||
{ team: 'kotlin-sdk', permission: 'push' },
|
||||
{ team: 'moderators', permission: 'push' },
|
||||
{ team: 'php-sdk', permission: 'push' },
|
||||
{ team: 'python-sdk', permission: 'push' },
|
||||
{ team: 'python-sdk-auth', permission: 'push' },
|
||||
{ team: 'registry-wg', permission: 'push' },
|
||||
{ team: 'ruby-sdk', permission: 'push' },
|
||||
{ team: 'rust-sdk', permission: 'push' },
|
||||
{ team: 'sdk-maintainers', permission: 'push' },
|
||||
{ team: 'security-wg', permission: 'admin' },
|
||||
{ team: 'steering-committee', permission: 'push' },
|
||||
{ team: 'swift-sdk', permission: 'push' },
|
||||
{ team: 'transport-wg', permission: 'push' },
|
||||
{ team: 'typescript-sdk', permission: 'push' },
|
||||
{ team: 'typescript-sdk-auth', permission: 'push' },
|
||||
{ team: 'working-groups', permission: 'push' },
|
||||
],
|
||||
},
|
||||
{
|
||||
repository: '.github',
|
||||
users: [
|
||||
{ username: 'jspahrsummers', permission: 'admin' },
|
||||
],
|
||||
teams: [
|
||||
{ team: 'auth-wg', permission: 'triage' },
|
||||
{ team: 'core', permission: 'maintain' },
|
||||
{ team: 'core-maintainers', permission: 'push' },
|
||||
{ team: 'csharp-sdk', permission: 'triage' },
|
||||
{ team: 'docs-maintaners', permission: 'triage' },
|
||||
{ team: 'go-sdk', permission: 'triage' },
|
||||
{ team: 'ig-financial-services', permission: 'triage' },
|
||||
{ team: 'interest-groups', permission: 'triage' },
|
||||
{ team: 'java-sdk', permission: 'triage' },
|
||||
{ team: 'kotlin-sdk', permission: 'triage' },
|
||||
{ team: 'moderators', permission: 'push' },
|
||||
{ team: 'php-sdk', permission: 'triage' },
|
||||
{ team: 'python-sdk', permission: 'triage' },
|
||||
{ team: 'python-sdk-auth', permission: 'triage' },
|
||||
{ team: 'registry-wg', permission: 'triage' },
|
||||
{ team: 'ruby-sdk', permission: 'triage' },
|
||||
{ team: 'rust-sdk', permission: 'triage' },
|
||||
{ team: 'sdk-maintainers', permission: 'triage' },
|
||||
{ team: 'security-wg', permission: 'admin' },
|
||||
{ team: 'steering-committee', permission: 'triage' },
|
||||
{ team: 'swift-sdk', permission: 'triage' },
|
||||
{ team: 'transport-wg', permission: 'triage' },
|
||||
{ team: 'typescript-sdk', permission: 'triage' },
|
||||
{ team: 'typescript-sdk-auth', permission: 'triage' },
|
||||
{ team: 'working-groups', permission: 'triage' },
|
||||
],
|
||||
},
|
||||
{
|
||||
repository: 'inspector',
|
||||
users: [
|
||||
{ username: 'richardkmichael', permission: 'triage' },
|
||||
{ username: 'jspahrsummers', permission: 'admin' },
|
||||
{ username: 'olaservo', permission: 'push' },
|
||||
{ username: 'an-dustin', permission: 'admin' },
|
||||
{ username: 'ashwin-ant', permission: 'admin' },
|
||||
],
|
||||
teams: [
|
||||
{ team: 'auth-wg', permission: 'push' },
|
||||
{ team: 'core', permission: 'maintain' },
|
||||
{ team: 'core-maintainers', permission: 'push' },
|
||||
{ team: 'csharp-sdk', permission: 'push' },
|
||||
{ team: 'docs-maintaners', permission: 'push' },
|
||||
{ team: 'go-sdk', permission: 'push' },
|
||||
{ team: 'ig-financial-services', permission: 'push' },
|
||||
{ team: 'interest-groups', permission: 'push' },
|
||||
{ team: 'java-sdk', permission: 'push' },
|
||||
{ team: 'kotlin-sdk', permission: 'push' },
|
||||
{ team: 'moderators', permission: 'push' },
|
||||
{ team: 'php-sdk', permission: 'push' },
|
||||
{ team: 'python-sdk', permission: 'push' },
|
||||
{ team: 'python-sdk-auth', permission: 'push' },
|
||||
{ team: 'registry-wg', permission: 'push' },
|
||||
{ team: 'ruby-sdk', permission: 'push' },
|
||||
{ team: 'rust-sdk', permission: 'push' },
|
||||
{ team: 'sdk-maintainers', permission: 'push' },
|
||||
{ team: 'security-wg', permission: 'admin' },
|
||||
{ team: 'steering-committee', permission: 'push' },
|
||||
{ team: 'swift-sdk', permission: 'push' },
|
||||
{ team: 'transport-wg', permission: 'push' },
|
||||
{ team: 'typescript-sdk', permission: 'push' },
|
||||
{ team: 'typescript-sdk-auth', permission: 'push' },
|
||||
{ team: 'working-groups', permission: 'push' },
|
||||
],
|
||||
},
|
||||
{
|
||||
repository: 'modelcontextprotocol',
|
||||
users: [
|
||||
{ username: 'jspahrsummers', permission: 'admin' },
|
||||
],
|
||||
teams: [
|
||||
{ team: 'auth-wg', permission: 'push' },
|
||||
{ team: 'core', permission: 'maintain' },
|
||||
{ team: 'core-maintainers', permission: 'push' },
|
||||
{ team: 'csharp-sdk', permission: 'triage' },
|
||||
{ team: 'docs-maintaners', permission: 'push' },
|
||||
{ team: 'go-sdk', permission: 'triage' },
|
||||
{ team: 'ig-financial-services', permission: 'triage' },
|
||||
{ team: 'interest-groups', permission: 'triage' },
|
||||
{ team: 'java-sdk', permission: 'triage' },
|
||||
{ team: 'kotlin-sdk', permission: 'triage' },
|
||||
{ team: 'moderators', permission: 'triage' },
|
||||
{ team: 'php-sdk', permission: 'triage' },
|
||||
{ team: 'python-sdk', permission: 'triage' },
|
||||
{ team: 'python-sdk-auth', permission: 'triage' },
|
||||
{ team: 'registry-wg', permission: 'triage' },
|
||||
{ team: 'ruby-sdk', permission: 'triage' },
|
||||
{ team: 'rust-sdk', permission: 'triage' },
|
||||
{ team: 'sdk-maintainers', permission: 'triage' },
|
||||
{ team: 'security-wg', permission: 'admin' },
|
||||
{ team: 'steering-committee', permission: 'triage' },
|
||||
{ team: 'swift-sdk', permission: 'triage' },
|
||||
{ team: 'transport-wg', permission: 'triage' },
|
||||
{ team: 'typescript-sdk', permission: 'triage' },
|
||||
{ team: 'typescript-sdk-auth', permission: 'triage' },
|
||||
{ team: 'working-groups', permission: 'triage' },
|
||||
],
|
||||
},
|
||||
{
|
||||
repository: 'quickstart-resources',
|
||||
users: [
|
||||
{ username: 'jspahrsummers', permission: 'admin' },
|
||||
],
|
||||
teams: [
|
||||
{ team: 'auth-wg', permission: 'push' },
|
||||
{ team: 'core', permission: 'maintain' },
|
||||
{ team: 'core-maintainers', permission: 'push' },
|
||||
{ team: 'csharp-sdk', permission: 'push' },
|
||||
{ team: 'docs-maintaners', permission: 'push' },
|
||||
{ team: 'go-sdk', permission: 'push' },
|
||||
{ team: 'ig-financial-services', permission: 'push' },
|
||||
{ team: 'interest-groups', permission: 'push' },
|
||||
{ team: 'java-sdk', permission: 'push' },
|
||||
{ team: 'kotlin-sdk', permission: 'push' },
|
||||
{ team: 'moderators', permission: 'push' },
|
||||
{ team: 'php-sdk', permission: 'push' },
|
||||
{ team: 'python-sdk', permission: 'push' },
|
||||
{ team: 'python-sdk-auth', permission: 'push' },
|
||||
{ team: 'registry-wg', permission: 'push' },
|
||||
{ team: 'ruby-sdk', permission: 'push' },
|
||||
{ team: 'rust-sdk', permission: 'push' },
|
||||
{ team: 'sdk-maintainers', permission: 'push' },
|
||||
{ team: 'security-wg', permission: 'admin' },
|
||||
{ team: 'steering-committee', permission: 'push' },
|
||||
{ team: 'swift-sdk', permission: 'push' },
|
||||
{ team: 'transport-wg', permission: 'push' },
|
||||
{ team: 'typescript-sdk', permission: 'push' },
|
||||
{ team: 'typescript-sdk-auth', permission: 'push' },
|
||||
{ team: 'working-groups', permission: 'push' },
|
||||
],
|
||||
},
|
||||
{
|
||||
repository: 'servers',
|
||||
users: [
|
||||
{ username: 'jspahrsummers', permission: 'admin' },
|
||||
{ username: 'slimslenderslacks', permission: 'push' },
|
||||
],
|
||||
teams: [
|
||||
{ team: 'auth-wg', permission: 'push' },
|
||||
{ team: 'core', permission: 'admin' },
|
||||
{ team: 'core-maintainers', permission: 'push' },
|
||||
{ team: 'csharp-sdk', permission: 'push' },
|
||||
{ team: 'docs-maintaners', permission: 'push' },
|
||||
{ team: 'go-sdk', permission: 'push' },
|
||||
{ team: 'ig-financial-services', permission: 'push' },
|
||||
{ team: 'interest-groups', permission: 'push' },
|
||||
{ team: 'java-sdk', permission: 'push' },
|
||||
{ team: 'kotlin-sdk', permission: 'push' },
|
||||
{ team: 'moderators', permission: 'push' },
|
||||
{ team: 'php-sdk', permission: 'push' },
|
||||
{ team: 'python-sdk', permission: 'push' },
|
||||
{ team: 'python-sdk-auth', permission: 'push' },
|
||||
{ team: 'registry-wg', permission: 'push' },
|
||||
{ team: 'ruby-sdk', permission: 'push' },
|
||||
{ team: 'rust-sdk', permission: 'push' },
|
||||
{ team: 'sdk-maintainers', permission: 'push' },
|
||||
{ team: 'security-wg', permission: 'admin' },
|
||||
{ team: 'steering-committee', permission: 'push' },
|
||||
{ team: 'swift-sdk', permission: 'push' },
|
||||
{ team: 'transport-wg', permission: 'push' },
|
||||
{ team: 'typescript-sdk', permission: 'push' },
|
||||
{ team: 'typescript-sdk-auth', permission: 'push' },
|
||||
{ team: 'working-groups', permission: 'push' },
|
||||
],
|
||||
},
|
||||
{
|
||||
repository: 'csharp-sdk',
|
||||
teams: [{ team: 'csharp-sdk', permission: 'admin' }],
|
||||
users: [
|
||||
{ username: 'jeffhandley', permission: 'admin' },
|
||||
{ username: 'MackinnonBuck', permission: 'admin' },
|
||||
{ username: 'jozkee', permission: 'admin' },
|
||||
{ username: 'localden', permission: 'admin' },
|
||||
{ username: 'PederHP', permission: 'triage' },
|
||||
],
|
||||
},
|
||||
{
|
||||
repository: 'go-sdk',
|
||||
teams: [{ team: 'go-sdk', permission: 'admin' }],
|
||||
users: [
|
||||
{ username: 'neild', permission: 'push' },
|
||||
{ username: 'rsc', permission: 'push' },
|
||||
{ username: 'rolandshoemaker', permission: 'push' },
|
||||
{ username: 'h9jiang', permission: 'maintain' },
|
||||
],
|
||||
},
|
||||
{
|
||||
repository: 'java-sdk',
|
||||
teams: [{ team: 'java-sdk', permission: 'admin' }],
|
||||
},
|
||||
{
|
||||
repository: 'kotlin-sdk',
|
||||
teams: [{ team: 'kotlin-sdk', permission: 'admin' }],
|
||||
},
|
||||
{
|
||||
repository: 'php-sdk',
|
||||
teams: [{ team: 'php-sdk', permission: 'admin' }],
|
||||
},
|
||||
{
|
||||
repository: 'python-sdk',
|
||||
teams: [
|
||||
{ team: 'python-sdk', permission: 'admin' },
|
||||
{ team: 'python-sdk-auth', permission: 'admin' },
|
||||
],
|
||||
users: [
|
||||
{ username: 'jspahrsummers', permission: 'admin' },
|
||||
],
|
||||
},
|
||||
{
|
||||
repository: 'ruby-sdk',
|
||||
teams: [{ team: 'ruby-sdk', permission: 'admin' }],
|
||||
},
|
||||
{
|
||||
repository: 'rust-sdk',
|
||||
teams: [{ team: 'rust-sdk', permission: 'admin' }],
|
||||
users: [
|
||||
{ username: 'jamadeo', permission: 'admin' },
|
||||
{ username: 'jokemanfire', permission: 'push' },
|
||||
{ username: '4t145', permission: 'push' },
|
||||
],
|
||||
},
|
||||
{
|
||||
repository: 'swift-sdk',
|
||||
teams: [{ team: 'swift-sdk', permission: 'admin' }],
|
||||
},
|
||||
{
|
||||
repository: 'typescript-sdk',
|
||||
teams: [
|
||||
{ team: 'typescript-sdk', permission: 'admin' },
|
||||
{ team: 'typescript-sdk-auth', permission: 'admin' },
|
||||
],
|
||||
users: [
|
||||
{ username: 'jspahrsummers', permission: 'admin' },
|
||||
],
|
||||
},
|
||||
{
|
||||
repository: 'create-python-server',
|
||||
teams: [
|
||||
{ team: 'python-sdk', permission: 'admin' },
|
||||
{ team: 'python-sdk-auth', permission: 'admin' },
|
||||
],
|
||||
},
|
||||
{
|
||||
repository: 'create-typescript-server',
|
||||
teams: [
|
||||
{ team: 'typescript-sdk', permission: 'admin' },
|
||||
{ team: 'typescript-sdk-auth', permission: 'admin' },
|
||||
],
|
||||
},
|
||||
{
|
||||
repository: 'registry',
|
||||
teams: [{ team: 'registry-wg', permission: 'admin' }],
|
||||
users: [
|
||||
{ username: 'rdimitrov', permission: 'admin' },
|
||||
],
|
||||
},
|
||||
{
|
||||
repository: 'static',
|
||||
teams: [{ team: 'registry-wg', permission: 'push' }],
|
||||
},
|
||||
{
|
||||
repository: 'financial-services-interest-group',
|
||||
teams: [{ team: 'ig-financial-services', permission: 'admin' }],
|
||||
users: [
|
||||
{ username: 'aniabot', permission: 'pull' },
|
||||
{ username: 'imfing', permission: 'triage' },
|
||||
{ username: 'sambhav', permission: 'admin' },
|
||||
{ username: 'KengoA', permission: 'triage' },
|
||||
{ username: 'nitsanh', permission: 'pull' },
|
||||
],
|
||||
},
|
||||
];
|
||||
|
||||
// GitHub Projects V2 permissions are NOT managed by Pulumi - no support yet
|
||||
// See: https://github.com/pulumi/pulumi-github/issues/1006
|
||||
Loading…
Reference in a new issue