* Add npm/PyPI package publishing access management (config + drift detection)
Declare expected npm org membership, per-package maintainers and trusted
publishers, and PyPI project rosters in src/config/packageAccess.ts, with
npm/pypi identity fields on members in users.ts.
Deliberately outside the Pulumi resource graph: npm governance writes
require an interactive 2FA challenge since August 2026 (read endpoints
still work with a granular access token), and PyPI has no management API
at all. Drift against the live npm registry is detected read-only by
scripts/check-package-drift.ts (weekly via package-drift.yml, no-op when
the NPM_READ_TOKEN secret is absent), which emits a remediation plan of
npm CLI commands for a maintainer to run in one 2FA-approved session.
PyPI procedures are documented as a manual runbook in the README.
* Encode all slashes when escaping package names in registry URLs
Fixes the CodeQL finding: String.replace with a string pattern only
replaces the first occurrence. Use a shared helper with a global regex,
following the npm CLI convention (keep '@' literal, encode every '/').
---------
Co-authored-by: Claude <noreply@anthropic.com>
GWS user accounts were only created for members whose direct roles had
google.provisionUser (lead/core maintainers, moderators, maintainers,
registry-wg). SDK maintainers and working-group members who opted in by
adding firstName/lastName/googleEmailPrefix (e.g. #148, #150, #152)
silently got no account.
- Move provisionUser from GoogleConfig to the Role level, and add it to
the implicit-maintainer containers (sdk-maintainers, working-groups)
plus the standalone maintainer roles (docs, inspector, mcpb,
reference-servers, use-mcp, server-identity-wg, wg/ig facilitators).
- Eligibility now walks github.parent chains (hasProvisionUserRole),
matching GitHub team-nesting semantics, so e.g. python-sdk members
qualify via sdk-maintainers.
- validate-config now errors when a googleEmailPrefix would be a silent
no-op (no eligible role and not an existing GWS user), so opt-in PRs
like #150 fail CI instead of quietly doing nothing.
Newly provisioned on next apply: marcelo@, alexhancock@, liad@.
ochafik is now eligible but already has an account (existingGWSUser).
Adds a google config with provisionUser to the MAINTAINERS role. Runtime
provisioning already gates on firstName/lastName/googleEmailPrefix, so
maintainers opt in by sending a PR adding those fields to their entry in
users.ts. Missing fields means no account is created.
Relaxes the validator and tests to treat missing GWS fields as implicit
opt-out rather than a hard error, so existing maintainers do not need
skipGoogleUserProvisioning set up front.
Also documents the opt-in flow in the README.
* Add Google Workspace user account provisioning
* Fix validation: remove stale skipGoogleUserProvisioning from a-akimov, add it for BobDickinson
- a-akimov: had skipGoogleUserProvisioning but is not in a provisionUser role (DOCS_MAINTAINERS)
- BobDickinson: is in REGISTRY_MAINTAINERS (provisionUser role) but missing Google user fields
* Add Discord role sync with role-centric architecture
This refactors the access management to use a role-centric model where
each role explicitly defines which platforms it exists on (GitHub,
Discord, Google).
Key changes:
- Add Discord role sync via Pulumi Dynamic Provider
- Replace groups.ts with roleIds.ts + roles.ts for type-safe role definitions
- Use ROLE_IDS constants to prevent typos in memberOf references
- Each role has platform-specific config (github/discord/google keys)
- Discord-only roles (e.g., administrators) and GitHub-only roles
(e.g., typescript-sdk-auth) are now explicitly modeled
- Add PR preview workflow to show Pulumi changes before merge
- Add test-config.ts for config structure validation
- Fix typo: docs-maintaners -> docs-maintainers
Discord roles will match existing server roles:
- administrators, lead maintainers, core maintainers
- sdk maintainers, working groups, interest groups
- etc.
Requires new GitHub secrets:
- DISCORD_BOT_TOKEN
- DISCORD_GUILD_ID
* Fix GitHub team ordering and make Discord integration optional
- Add topological sort for GitHub teams to ensure parent teams are
created before child teams, fixing the registry-wg parentTeamId issue
- Make Discord integration optional by using config.get() instead of
config.require(), allowing CI preview to succeed without Discord secrets
- Add sortRolesByGitHubDependency() utility function in config/utils.ts
Claude-Generated-By: Claude Code (cli/claude-opus-4-5=20%)
Claude-Steers: 2
Claude-Permission-Prompts: 1
Claude-Escapes: 0
* Reconcile Discord roles for listed users
Replace per-role-membership approach with per-user role sync that:
- Adds missing roles users should have
- Removes managed roles users shouldn't have
- Only touches roles defined in config (won't affect admin roles, etc.)
Users not in config remain untouched.
Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%)
Claude-Steers: 4
Claude-Permission-Prompts: 1
Claude-Escapes: 0
* Fix descriptions to match existing resources
* Cache Pulumi plugins and fix GITHUB_TOKEN for pulumi install
* Remove accidentally committed state backup
* Use github.token for pulumi install
* Fix formatting
Fix deploy: add pulumi login before config set
Fix deploy: set PULUMI_CONFIG_PASSPHRASE_FILE for config commands
Import existing docs-maintainers team (remove after deploy)
Remove docs-maintainers import workaround
Add docs-maintainers cleanup to state cleanup
Add pulumi refresh before up to sync state with reality
Rename Discord roles to add (synced) suffix
Cleanup Makefile and add lead-maintainers GitHub team
