modelcontextprotocol/access
Watch
1
0
Fork
You've already forked access
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Ignore org-role teams in RepositoryCollaborators to unblock deploys (#179)

Browse source 
GitHub's list-repository-teams API now also returns teams whose access
comes from an organization role (orgRoles.ts: lead-maintainers and
core-maintainers hold all_repo_admin, security-managers holds
security_manager). During `pulumi up --refresh` the provider reads these
teams as direct collaborators on every repository, then tries to DELETE
the direct team-repo association where repoAccess.ts does not grant it —
and GitHub 404s because no direct association exists. This broke every
deploy starting with run #253 (first failure on experimental-ext-skills,
where refresh picked up lead-maintainers).

The pinned @pulumi/github 6.12.1 provider predates the upstream fix that
skips non-direct teams (integrations/terraform-provider-github#3571), so
work around it by passing ignoreTeams for the org-role-holding teams on
each RepositoryCollaborators resource — except teams the repository's
repoAccess.ts entry grants directly (e.g. lead-maintainers on
maintainer-docs), which must stay managed by Pulumi.

Remove this workaround once a @pulumi/github release including the
upstream fix is adopted.


Claude-Session: https://claude.ai/code/session_01H4JKj5FVkmj6bRzgh1GPrY

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
claude[bot] 2026-09-12 20:46:27 -07:00 • committed by GitHub
commit e53fad28a9
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 18 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

18
src/github.ts
View file

@ -86,10 +86,28 @@ ORG_ROLE_ASSIGNMENTS.forEach((assignment) => {
});
});
// Teams that hold organization-level roles (ORG_ROLE_ASSIGNMENTS above). GitHub's
// list-repository-teams API now also returns teams whose access comes from an org
// role, so a refresh reads them as direct collaborators on every repository and the
// provider then fails trying to delete the non-existent direct association (404).
// The pinned @pulumi/github 6.12.1 provider predates the upstream fix that skips
// non-direct teams (https://github.com/integrations/terraform-provider-github/pull/3571),
// so we tell the provider to ignore these teams on every repository that does not
// grant them directly in repoAccess.ts. Remove this workaround once we upgrade to a
// @pulumi/github release that includes that fix.
const orgRoleTeamNames = [...new Set(ORG_ROLE_ASSIGNMENTS.map((a) => a.team))];
// Configure repository access
REPOSITORY_ACCESS.forEach((repo) => {
const grantedTeams = new Set(repo.teams?.map((t) => t.team));
new github.RepositoryCollaborators(`repo-${repo.repository}`, {
repository: repo.repository,
// Ignore org-role teams, except where repoAccess.ts grants them directly on
// this repository (e.g. lead-maintainers on maintainer-docs) — those grants
// must stay managed by Pulumi.
ignoreTeams: orgRoleTeamNames
.filter((team) => !grantedTeams.has(team))
.map((team) => ({ teamId: teams[team].slug })),
teams: repo.teams?.map((t) => ({
teamId: teams[t.team]?.id,
permission: t.permission,