modelcontextprotocol/access
Watch
1
0
Fork
You've already forked access
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add Discord role sync with role-centric architecture (#22)

Browse source 
* Add Discord role sync with role-centric architecture

This refactors the access management to use a role-centric model where
each role explicitly defines which platforms it exists on (GitHub,
Discord, Google).

Key changes:
- Add Discord role sync via Pulumi Dynamic Provider
- Replace groups.ts with roleIds.ts + roles.ts for type-safe role definitions
- Use ROLE_IDS constants to prevent typos in memberOf references
- Each role has platform-specific config (github/discord/google keys)
- Discord-only roles (e.g., administrators) and GitHub-only roles
  (e.g., typescript-sdk-auth) are now explicitly modeled
- Add PR preview workflow to show Pulumi changes before merge
- Add test-config.ts for config structure validation
- Fix typo: docs-maintaners -> docs-maintainers

Discord roles will match existing server roles:
- administrators, lead maintainers, core maintainers
- sdk maintainers, working groups, interest groups
- etc.

Requires new GitHub secrets:
- DISCORD_BOT_TOKEN
- DISCORD_GUILD_ID

* Fix GitHub team ordering and make Discord integration optional

- Add topological sort for GitHub teams to ensure parent teams are
  created before child teams, fixing the registry-wg parentTeamId issue
- Make Discord integration optional by using config.get() instead of
  config.require(), allowing CI preview to succeed without Discord secrets
- Add sortRolesByGitHubDependency() utility function in config/utils.ts

Claude-Generated-By: Claude Code (cli/claude-opus-4-5=20%)
Claude-Steers: 2
Claude-Permission-Prompts: 1
Claude-Escapes: 0

* Reconcile Discord roles for listed users

Replace per-role-membership approach with per-user role sync that:
- Adds missing roles users should have
- Removes managed roles users shouldn't have
- Only touches roles defined in config (won't affect admin roles, etc.)

Users not in config remain untouched.

Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%)
Claude-Steers: 4
Claude-Permission-Prompts: 1
Claude-Escapes: 0

* Fix descriptions to match existing resources

* Cache Pulumi plugins and fix GITHUB_TOKEN for pulumi install

* Remove accidentally committed state backup

* Use github.token for pulumi install

* Fix formatting

Fix deploy: add pulumi login before config set

Fix deploy: set PULUMI_CONFIG_PASSPHRASE_FILE for config commands

Import existing docs-maintainers team (remove after deploy)

Remove docs-maintainers import workaround

Add docs-maintainers cleanup to state cleanup

Add pulumi refresh before up to sync state with reality

Rename Discord roles to add (synced) suffix

Cleanup Makefile and add lead-maintainers GitHub team
This commit is contained in:
David Soria Parra 2026-01-13 22:03:59 +00:00 • committed by David Soria Parra
commit f960494174
No known key found for this signature in database
1 changed files with 1354 additions and 414 deletions
Download patch file Download diff file Expand all files Collapse all files

22
Makefile
View file

@ -1,4 +1,4 @@
.PHONY: help login preview up
.PHONY: help login preview refresh up
# Default target
help: ## Show this help message
@ -12,20 +12,8 @@ login: ## Login to Pulumi backend (GCS)
preview: login ## Preview infrastructure changes
PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi preview --stack prod
cleanup-state: login ## Remove orphaned resources from state
@echo "Cleaning up orphaned state entries..."
-PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::dsp-ant-core' --yes 2>/dev/null
-PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::maxisbey-core' --yes 2>/dev/null
-PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::bhosmer-ant-core' --yes 2>/dev/null
-PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::crondinini-ant-core' --yes 2>/dev/null
-PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::ochafik-core' --yes 2>/dev/null
-PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::ihrpr-core' --yes 2>/dev/null
-PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::jerome3o-anthropic-core' --yes 2>/dev/null
-PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::felixweinberger-core' --yes 2>/dev/null
-PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::maheshmurag-core' --yes 2>/dev/null
-PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/teamMembership:TeamMembership::domdomegg-core' --yes 2>/dev/null
-PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi state delete --stack prod 'urn:pulumi:prod::mcp-access::github:index/team:Team::core' --yes 2>/dev/null
@echo "State cleanup complete"
refresh: login ## Refresh state to match reality
PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi refresh --yes --stack prod
up: login cleanup-state ## Deploy infrastructure
PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi up --yes --stack prod
up: login refresh ## Deploy infrastructure
PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt pulumi up --yes --stack prod