The hashicorp/googleworkspace provider has a known eventual-consistency
bug (issue #387): after creating a user, it polls for 4 consecutive
identical API etags before marking the resource created. Google's API
frequently flip-flops etags, so the check never passes and the 300s
default timeout trips — even though the user was actually created.
This caused cliff@ creation to timeout, leaving the user in GWS but not
in Pulumi state; subsequent runs fail with 409 Entity already exists.
Two changes:
- Mark cliff as existingGWSUser so Pulumi stops trying to create him
(matches the pattern used for other stranded users).
- Switch to the SamuZad/googleworkspace fork (v0.11.1), which lowers
numConsistent from 4 to 2, preventing the timeout for future user
creations. The upstream provider has been unmaintained for 2+ years.
* Add evalstate and cliffhall to docs-maintaners team
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Add org email details for Ola Hungerford and Luca Chang
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: David Soria Parra <167242713+dsp-ant@users.noreply.github.com>
Adds a google config with provisionUser to the MAINTAINERS role. Runtime
provisioning already gates on firstName/lastName/googleEmailPrefix, so
maintainers opt in by sending a PR adding those fields to their entry in
users.ts. Missing fields means no account is created.
Relaxes the validator and tests to treat missing GWS fields as implicit
opt-out rather than a hard error, so existing maintainers do not need
skipGoogleUserProvisioning set up front.
Also documents the opt-in flow in the README.
The GWS provider validates email types during import, but GWS itself
returns empty types for primary/alias emails. This causes unrecoverable
validation errors on every new user import. Instead, skip managing
existing users entirely and let group memberships be created directly.
Also marks den as existingGWSUser.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
After creation/import we only care that the user exists and is in the
right groups. All profile settings (name, recovery info, password,
org unit, etc.) are left to users and admins to manage directly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The orgUnitPath '/Model Context Protocol' was hardcoded but the OU
didn't exist in Pulumi state, causing INVALID_OU_ID errors for all
user creates/updates. Create it as a Pulumi resource and wire up
dependsOn so users are provisioned after the OU exists.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The googleworkspace provider requests ~14 default OAuth scopes, but only
3 are authorized in the domain-wide delegation for the service account.
The token exchange rejects requests with unauthorized scopes, causing
401 errors. Explicitly set oauthScopes to the 3 delegated scopes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The service account was impersonating david@ which only had Groups Admin
privileges. User management requires elevated Directory API permissions
that admin-david@ has.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Add Google Workspace user account provisioning
* Fix validation: remove stale skipGoogleUserProvisioning from a-akimov, add it for BobDickinson
- a-akimov: had skipGoogleUserProvisioning but is not in a provisionUser role (DOCS_MAINTAINERS)
- BobDickinson: is in REGISTRY_MAINTAINERS (provisionUser role) but missing Google user fields
* Add evalstate and cliffhall to docs-maintaners team
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Add BobDickinson to SKILLS_OVER_MCP_IG role
Closes#62
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix alphabetical sorting of BobDickinson entry
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Move bolinfest and jokemanfire from direct repo collaborators to the
rust-sdk team in users.ts. Remove 4t145 entirely. The rust-sdk repo
now has no direct collaborators.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove richardkmichael and ashwin-ant from inspector, and
slimslenderslacks from servers.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove jspahrsummers (org admin) from all direct repo access. Remove
redundant direct access for users who already have equal or higher
permissions via team membership: localden (csharp-sdk), an-dustin
(inspector via security-wg), jamadeo and alexhancock (rust-sdk),
mattt/movetz/stallent (swift-sdk), rdimitrov (registry via registry-wg),
sambhav (financial-services-ig), and liady/idosal/antonpk1 (ext-apps
via mcp-apps-sdk). Upgrade swift-sdk team permission from push to admin.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Add primitive-grouping-ig interest group
Create the primitive-grouping-ig interest group team under interest-groups
and grant it push access to the experimental-ext-grouping repository.
Members: cliffhall, chughtapan, SamMorrowDrums.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Fix formatting
* Give core-maintainers and moderators access to experimental-ext-grouping
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Add Tapan Chugh as facilitator for Primitive Grouping Interest Group. Also npm audit fix to remove 14 high vulnerabilities.
* In package-lock.json
- npm audit fix.
- 0 vulnerabilities now
* In roles.ts
- add PRIMITIVE_GROUPING_IG
* In roles.ts
- add block for ROLE_IDS.PRIMITIVE_GROUPING_IG
- **NOTE**: the github team and discord role are forward-looking and still need to be created
* In users.ts
- add block for Tapan with role ids for
- INTEREST_GROUPS
- PRIMITIVE_GROUPING_IG
- WG_IG_FACILITATORS
* In users.ts
- add ROLE_IDS.MAINTAINERS to Tapan's entry as per DSP
* Add Skills Over MCP Interest Group and experimental-ext-skills repo
- Add SKILLS_OVER_MCP_IG role under interest-groups (GitHub team only)
- Add repo access for experimental-ext-skills per SEP-2133 governance:
- core-maintainers: admin (oversight)
- moderators: triage
- skills-over-mcp-ig: admin (day-to-day governance)
- Add IG membership for: cliffhall, erain, JAORMX, kaxil, keithagroves,
olaservo, pederhp, SamMorrowDrums, TeamSparkAI
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Add SKILLS_OVER_MCP_IG role to user membership
* Fix alphabetical sorting of users
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* Import auth-maintainers team into Pulumi state with correct ID
The auth-wg -> auth-maintainers rename (PR #50) caused the team to be
lost from Pulumi state. A previous import attempt used the wrong team
ID (14435880). The actual GitHub team ID is 16083315.
Every deploy since has failed with:
422 Validation Failed: Name must be unique for this org
This adds a one-time import step to reconcile state. The import line
should be removed after the next successful deploy.
* Remove one-time auth-maintainers import from deploy workflow
The import in the previous commit successfully reconciled the
auth-maintainers team (ID 16083315) into Pulumi state. This
removes the one-time import line now that state is consistent.
The auth-wg -> auth-maintainers rename (PR #50) caused the team to be
lost from Pulumi state. A previous import attempt used the wrong team
ID (14435880). The actual GitHub team ID is 16083315.
Every deploy since has failed with:
422 Validation Failed: Name must be unique for this org
This adds a one-time import step to reconcile state. The import line
should be removed after the next successful deploy.
