Add Discord role sync with role-centric architecture (#22)
* Add Discord role sync with role-centric architecture This refactors the access management to use a role-centric model where each role explicitly defines which platforms it exists on (GitHub, Discord, Google). Key changes: - Add Discord role sync via Pulumi Dynamic Provider - Replace groups.ts with roleIds.ts + roles.ts for type-safe role definitions - Use ROLE_IDS constants to prevent typos in memberOf references - Each role has platform-specific config (github/discord/google keys) - Discord-only roles (e.g., administrators) and GitHub-only roles (e.g., typescript-sdk-auth) are now explicitly modeled - Add PR preview workflow to show Pulumi changes before merge - Add test-config.ts for config structure validation - Fix typo: docs-maintaners -> docs-maintainers Discord roles will match existing server roles: - administrators, lead maintainers, core maintainers - sdk maintainers, working groups, interest groups - etc. Requires new GitHub secrets: - DISCORD_BOT_TOKEN - DISCORD_GUILD_ID * Fix GitHub team ordering and make Discord integration optional - Add topological sort for GitHub teams to ensure parent teams are created before child teams, fixing the registry-wg parentTeamId issue - Make Discord integration optional by using config.get() instead of config.require(), allowing CI preview to succeed without Discord secrets - Add sortRolesByGitHubDependency() utility function in config/utils.ts Claude-Generated-By: Claude Code (cli/claude-opus-4-5=20%) Claude-Steers: 2 Claude-Permission-Prompts: 1 Claude-Escapes: 0 * Reconcile Discord roles for listed users Replace per-role-membership approach with per-user role sync that: - Adds missing roles users should have - Removes managed roles users shouldn't have - Only touches roles defined in config (won't affect admin roles, etc.) Users not in config remain untouched. Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 4 Claude-Permission-Prompts: 1 Claude-Escapes: 0 * Fix descriptions to match existing resources * Cache Pulumi plugins and fix GITHUB_TOKEN for pulumi install * Remove accidentally committed state backup * Use github.token for pulumi install * Fix formatting Fix deploy: add pulumi login before config set Fix deploy: set PULUMI_CONFIG_PASSPHRASE_FILE for config commands Import existing docs-maintainers team (remove after deploy) Remove docs-maintainers import workaround Add docs-maintainers cleanup to state cleanup Add pulumi refresh before up to sync state with reality Rename Discord roles to add (synced) suffix Cleanup Makefile and add lead-maintainers GitHub team
This commit is contained in:
David Soria Parra
David Soria Parra
parent
f0336a9991
commit
f960494174
2 changed files with 1354 additions and 414 deletions
87
scripts/test-config.ts
Normal file
87
scripts/test-config.ts
Normal file
|
|
@ -0,0 +1,87 @@
|
|||
#!/usr/bin/env npx ts-node
|
||||
|
||||
/**
|
||||
* Tests the configuration structure without needing Pulumi credentials.
|
||||
* Run with: npx ts-node scripts/test-config.ts
|
||||
*/
|
||||
|
||||
import { ROLES, buildRoleLookup, getRolesForPlatform } from '../src/config/roles';
|
||||
import { ROLE_IDS, isValidRoleId } from '../src/config/roleIds';
|
||||
import { MEMBERS } from '../src/config/users';
|
||||
|
||||
let passed = 0;
|
||||
let failed = 0;
|
||||
|
||||
function test(name: string, fn: () => boolean) {
|
||||
try {
|
||||
if (fn()) {
|
||||
console.log(`✓ ${name}`);
|
||||
passed++;
|
||||
} else {
|
||||
console.log(`✗ ${name}`);
|
||||
failed++;
|
||||
}
|
||||
} catch (e) {
|
||||
console.log(`✗ ${name}: ${e}`);
|
||||
failed++;
|
||||
}
|
||||
}
|
||||
|
||||
console.log('Testing role configuration...\n');
|
||||
|
||||
// Test ROLE_IDS
|
||||
test('ROLE_IDS has entries', () => Object.keys(ROLE_IDS).length > 0);
|
||||
test('All ROLE_IDS values are valid', () =>
|
||||
Object.values(ROLE_IDS).every((id) => isValidRoleId(id)));
|
||||
|
||||
// Test ROLES
|
||||
test('ROLES array is not empty', () => ROLES.length > 0);
|
||||
test('All roles have id and description', () => ROLES.every((r) => r.id && r.description));
|
||||
test('All role IDs are unique', () => {
|
||||
const ids = ROLES.map((r) => r.id);
|
||||
return ids.length === new Set(ids).size;
|
||||
});
|
||||
|
||||
// Test platform configs
|
||||
const githubRoles = getRolesForPlatform('github');
|
||||
const discordRoles = getRolesForPlatform('discord');
|
||||
const googleRoles = getRolesForPlatform('google');
|
||||
|
||||
test('Has GitHub roles', () => githubRoles.length > 0);
|
||||
test('Has Discord roles', () => discordRoles.length > 0);
|
||||
test('Has Google roles', () => googleRoles.length > 0);
|
||||
|
||||
test('GitHub roles have team names', () => githubRoles.every((r) => r.github?.team));
|
||||
test('Discord roles have role names', () => discordRoles.every((r) => r.discord?.role));
|
||||
test('Google roles have group names', () => googleRoles.every((r) => r.google?.group));
|
||||
|
||||
// Test parent relationships
|
||||
const roleLookup = buildRoleLookup();
|
||||
test('All GitHub parent references are valid', () =>
|
||||
githubRoles.every((r) => {
|
||||
if (!r.github?.parent) return true;
|
||||
const parent = roleLookup.get(r.github.parent);
|
||||
return parent && parent.github;
|
||||
}));
|
||||
|
||||
// Test members
|
||||
test('MEMBERS array is not empty', () => MEMBERS.length > 0);
|
||||
test('All members have at least one identifier', () =>
|
||||
MEMBERS.every((m) => m.github || m.email || m.discord));
|
||||
test('All member role references are valid', () =>
|
||||
MEMBERS.every((m) => m.memberOf.every((id) => roleLookup.has(id))));
|
||||
|
||||
// Test specific roles exist
|
||||
test('CORE_MAINTAINERS role exists', () => !!roleLookup.get(ROLE_IDS.CORE_MAINTAINERS));
|
||||
test('ADMINISTRATORS role exists (Discord-only)', () => {
|
||||
const role = roleLookup.get(ROLE_IDS.ADMINISTRATORS);
|
||||
return role !== undefined && role.discord !== undefined && role.github === undefined;
|
||||
});
|
||||
test('TYPESCRIPT_SDK_AUTH role exists (GitHub-only)', () => {
|
||||
const role = roleLookup.get(ROLE_IDS.TYPESCRIPT_SDK_AUTH);
|
||||
return role !== undefined && role.github !== undefined && role.discord === undefined;
|
||||
});
|
||||
|
||||
// Summary
|
||||
console.log(`\n${passed} passed, ${failed} failed`);
|
||||
process.exit(failed > 0 ? 1 : 0);
|
||||
|
|
@ -1,27 +1,27 @@
|
|||
#!/usr/bin/env npx ts-node
|
||||
|
||||
/**
|
||||
* Validates that all team references in repoAccess.ts exist in groups.ts
|
||||
* Validates that all references in the config are valid.
|
||||
* Run with: npx ts-node scripts/validate-config.ts
|
||||
*/
|
||||
|
||||
import { GROUPS } from '../src/config/groups';
|
||||
import { ROLES, buildRoleLookup } from '../src/config/roles';
|
||||
import { REPOSITORY_ACCESS } from '../src/config/repoAccess';
|
||||
import { MEMBERS } from '../src/config/users';
|
||||
import type { Group, Member } from '../src/config/utils';
|
||||
import type { RoleId } from '../src/config/roleIds';
|
||||
|
||||
// Get all GitHub team names (groups not limited to google-only platforms)
|
||||
const roleLookup = buildRoleLookup();
|
||||
|
||||
// Get all GitHub team names (roles that have GitHub config)
|
||||
const githubTeamNames = new Set<string>();
|
||||
// Get all group names (for member validation - members can be in any group)
|
||||
const allGroupNames = new Set<string>();
|
||||
// Get all role IDs (for member validation)
|
||||
const allRoleIds = new Set<RoleId>();
|
||||
|
||||
for (const g of GROUPS) {
|
||||
const group = g as Group;
|
||||
allGroupNames.add(group.name);
|
||||
for (const role of ROLES) {
|
||||
allRoleIds.add(role.id);
|
||||
|
||||
const platforms = group.onlyOnPlatforms;
|
||||
if (!platforms || platforms.includes('github')) {
|
||||
githubTeamNames.add(group.name);
|
||||
if (role.github) {
|
||||
githubTeamNames.add(role.github.team);
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -35,41 +35,42 @@ for (const repo of REPOSITORY_ACCESS) {
|
|||
for (const teamRef of repo.teams) {
|
||||
if (!githubTeamNames.has(teamRef.team)) {
|
||||
console.error(
|
||||
`ERROR: Repository "${repo.repository}" references team "${teamRef.team}" which does not exist in groups.ts`
|
||||
`ERROR: Repository "${repo.repository}" references team "${teamRef.team}" which does not exist in roles.ts`
|
||||
);
|
||||
hasErrors = true;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Validate team references in MEMBERS (memberOf)
|
||||
// Members can be in any group (GitHub or Google-only)
|
||||
console.log('Validating team references in users.ts...');
|
||||
for (const m of MEMBERS) {
|
||||
const member = m as Member;
|
||||
for (const teamKey of member.memberOf) {
|
||||
if (!allGroupNames.has(teamKey)) {
|
||||
// Validate role references in MEMBERS (memberOf)
|
||||
console.log('Validating role references in users.ts...');
|
||||
for (const member of MEMBERS) {
|
||||
for (const roleId of member.memberOf) {
|
||||
if (!allRoleIds.has(roleId)) {
|
||||
console.error(
|
||||
`ERROR: Member "${member.github || member.email}" references team "${teamKey}" which does not exist in groups.ts`
|
||||
`ERROR: Member "${member.github || member.email}" references role "${roleId}" which does not exist in roles.ts`
|
||||
);
|
||||
hasErrors = true;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Validate parent team references (memberOf in groups)
|
||||
console.log('Validating parent team references in groups.ts...');
|
||||
for (const g of GROUPS) {
|
||||
const group = g as Group;
|
||||
if (!group.memberOf) continue;
|
||||
// Validate parent role references in roles.ts
|
||||
console.log('Validating parent role references in roles.ts...');
|
||||
for (const role of ROLES) {
|
||||
if (!role.github?.parent) continue;
|
||||
|
||||
for (const parentTeam of group.memberOf) {
|
||||
if (!allGroupNames.has(parentTeam)) {
|
||||
console.error(
|
||||
`ERROR: Group "${group.name}" has parent "${parentTeam}" which does not exist in groups.ts`
|
||||
);
|
||||
hasErrors = true;
|
||||
}
|
||||
const parentRole = roleLookup.get(role.github.parent);
|
||||
if (!parentRole) {
|
||||
console.error(
|
||||
`ERROR: Role "${role.id}" has parent "${role.github.parent}" which does not exist in roles.ts`
|
||||
);
|
||||
hasErrors = true;
|
||||
} else if (!parentRole.github) {
|
||||
console.error(
|
||||
`ERROR: Role "${role.id}" has parent "${role.github.parent}" which does not have GitHub config`
|
||||
);
|
||||
hasErrors = true;
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -77,6 +78,6 @@ if (hasErrors) {
|
|||
console.error('\nValidation failed! Please fix the errors above.');
|
||||
process.exit(1);
|
||||
} else {
|
||||
console.log('\nAll team references are valid.');
|
||||
console.log('\nAll references are valid.');
|
||||
process.exit(0);
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue