Add the enterprise-managed-authorization IG, the two active auth
sub-WGs (tool scopes and fine-grained authorization), an agents WG
Discord role, and auth IG memberships from the charter. Convert
skills-over-mcp from IG to WG and security from WG to IG per their
charters, updating team names and all references. Add ochafik to the
MCP Apps WG and pcarleton to the security IG. Remove the
server-identity-wg and agents-ig roles, whose Discord channels are
archived or gone. Fix the README link to src/config/roles.ts.
Claude-Session: https://claude.ai/code/session_01VRxNJh9HqnkTYdpALP5Vhf
Co-authored-by: Claude <noreply@anthropic.com>
* Add npm/PyPI package publishing access management (config + drift detection)
Declare expected npm org membership, per-package maintainers and trusted
publishers, and PyPI project rosters in src/config/packageAccess.ts, with
npm/pypi identity fields on members in users.ts.
Deliberately outside the Pulumi resource graph: npm governance writes
require an interactive 2FA challenge since August 2026 (read endpoints
still work with a granular access token), and PyPI has no management API
at all. Drift against the live npm registry is detected read-only by
scripts/check-package-drift.ts (weekly via package-drift.yml, no-op when
the NPM_READ_TOKEN secret is absent), which emits a remediation plan of
npm CLI commands for a maintainer to run in one 2FA-approved session.
PyPI procedures are documented as a manual runbook in the README.
* Encode all slashes when escaping package names in registry URLs
Fixes the CodeQL finding: String.replace with a string pattern only
replaces the first occurrence. Use a shared helper with a global regex,
following the npm CLI convention (keep '@' literal, encode every '/').
---------
Co-authored-by: Claude <noreply@anthropic.com>
GWS user accounts were only created for members whose direct roles had
google.provisionUser (lead/core maintainers, moderators, maintainers,
registry-wg). SDK maintainers and working-group members who opted in by
adding firstName/lastName/googleEmailPrefix (e.g. #148, #150, #152)
silently got no account.
- Move provisionUser from GoogleConfig to the Role level, and add it to
the implicit-maintainer containers (sdk-maintainers, working-groups)
plus the standalone maintainer roles (docs, inspector, mcpb,
reference-servers, use-mcp, server-identity-wg, wg/ig facilitators).
- Eligibility now walks github.parent chains (hasProvisionUserRole),
matching GitHub team-nesting semantics, so e.g. python-sdk members
qualify via sdk-maintainers.
- validate-config now errors when a googleEmailPrefix would be a silent
no-op (no eligible role and not an existing GWS user), so opt-in PRs
like #150 fail CI instead of quietly doing nothing.
Newly provisioned on next apply: marcelo@, alexhancock@, liad@.
ochafik is now eligible but already has an account (existingGWSUser).
Adds a google config with provisionUser to the MAINTAINERS role. Runtime
provisioning already gates on firstName/lastName/googleEmailPrefix, so
maintainers opt in by sending a PR adding those fields to their entry in
users.ts. Missing fields means no account is created.
Relaxes the validator and tests to treat missing GWS fields as implicit
opt-out rather than a hard error, so existing maintainers do not need
skipGoogleUserProvisioning set up front.
Also documents the opt-in flow in the README.
- Add prettier with consistent formatting config
- Add format and format:check npm scripts
- Add prettier pre-commit hook
- Add validation and formatting checks to CI workflow
- Reformat all TypeScript and JSON files
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
