* Add Discord role sync with role-centric architecture
This refactors the access management to use a role-centric model where
each role explicitly defines which platforms it exists on (GitHub,
Discord, Google).
Key changes:
- Add Discord role sync via Pulumi Dynamic Provider
- Replace groups.ts with roleIds.ts + roles.ts for type-safe role definitions
- Use ROLE_IDS constants to prevent typos in memberOf references
- Each role has platform-specific config (github/discord/google keys)
- Discord-only roles (e.g., administrators) and GitHub-only roles
(e.g., typescript-sdk-auth) are now explicitly modeled
- Add PR preview workflow to show Pulumi changes before merge
- Add test-config.ts for config structure validation
- Fix typo: docs-maintaners -> docs-maintainers
Discord roles will match existing server roles:
- administrators, lead maintainers, core maintainers
- sdk maintainers, working groups, interest groups
- etc.
Requires new GitHub secrets:
- DISCORD_BOT_TOKEN
- DISCORD_GUILD_ID
* Fix GitHub team ordering and make Discord integration optional
- Add topological sort for GitHub teams to ensure parent teams are
created before child teams, fixing the registry-wg parentTeamId issue
- Make Discord integration optional by using config.get() instead of
config.require(), allowing CI preview to succeed without Discord secrets
- Add sortRolesByGitHubDependency() utility function in config/utils.ts
Claude-Generated-By: Claude Code (cli/claude-opus-4-5=20%)
Claude-Steers: 2
Claude-Permission-Prompts: 1
Claude-Escapes: 0
* Reconcile Discord roles for listed users
Replace per-role-membership approach with per-user role sync that:
- Adds missing roles users should have
- Removes managed roles users shouldn't have
- Only touches roles defined in config (won't affect admin roles, etc.)
Users not in config remain untouched.
Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%)
Claude-Steers: 4
Claude-Permission-Prompts: 1
Claude-Escapes: 0
* Fix descriptions to match existing resources
* Cache Pulumi plugins and fix GITHUB_TOKEN for pulumi install
* Remove accidentally committed state backup
* Use github.token for pulumi install
* Fix formatting
Fix deploy: add pulumi login before config set
Fix deploy: set PULUMI_CONFIG_PASSPHRASE_FILE for config commands
Import existing docs-maintainers team (remove after deploy)
Remove docs-maintainers import workaround
Add docs-maintainers cleanup to state cleanup
Add pulumi refresh before up to sync state with reality
Rename Discord roles to add (synced) suffix
Cleanup Makefile and add lead-maintainers GitHub team
* Add movetz and stallent as Swift SDK maintainers
Adding Maksym Mova (MacPaw) and Stephen Tallent (Mercury.io) as new
maintainers for the Swift SDK, as discussed in the SDK working group.
* Set up tiered access: admins + contributor team
- movetz and stallent get admin access directly
- swift-sdk team grants push access (for future contributors)
This follows the pattern used by go-sdk and rust-sdk.
* Preserve mattt as admin
* Add evalstate and cliffhall to docs-maintaners team
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Add a-akimov to docs-maintaners team, tighten inspector/servers permissions
- Add a-akimov to docs-maintaners team (replaces direct repo access)
- Remove a-akimov direct push from quickstart-resources (now via team)
- Remove interest groups from inspector push access (ig-financial-services, interest-groups)
- Remove working-groups umbrella from inspector push access
- Remove docs-maintaners from inspector push access
- Remove interest groups from servers push access (ig-financial-services, interest-groups)
- Remove working-groups umbrella from servers push access
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
bolinfest should have push access to rust-sdk, not admin. Direct
access is already configured in repoAccess.ts.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The 'core' team was deleted from GitHub but still exists in Pulumi
state. Add cleanup-state target that runs before deploy to remove
these orphaned resources.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Pass the token via GITHUB_TOKEN environment variable which the Pulumi
GitHub provider reads automatically. Remove the one-time migration
workflow since state cleanup already succeeded.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add migrate-state.yml workflow (manual trigger) that:
- Sets github:token in Pulumi config from PULUMI_GITHUB_TOKEN secret
- Cleans up orphaned 'core' team memberships from state
- Commits the updated Pulumi.prod.yaml back to repo
- Revert deploy.yml to use encrypted token from Pulumi config
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Move GitHub token from Pulumi encrypted config to GitHub Actions secret
(PULUMI_GITHUB_TOKEN) for better secret management. The token is passed
via GITHUB_TOKEN env var which the Pulumi GitHub provider reads automatically.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add prettier with consistent formatting config
- Add format and format:check npm scripts
- Add prettier pre-commit hook
- Add validation and formatting checks to CI workflow
- Reformat all TypeScript and JSON files
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
PR #17 removed the 'core' group but left references in repoAccess.ts,
causing deployments to fail since Nov 25th.
Changes:
- Remove 'core' team references from 6 repositories in repoAccess.ts
- Replace with 'core-maintainers' to maintain equivalent permissions
- Add scripts/validate-config.ts to validate all team references
- Add pre-commit hook to run validation on config changes
- Add npm run validate script
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Adds Felix (felixreiseberg) and Sam (marshallofsound) as maintainers for the Model Context Protocol Bundle (MCPB) project.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
Creates a new mcpb-maintainers team under the steering committee with Joan Xie (joan-anthropic), Adam Jones (domdomegg), and Alex Sklar (asklar) as initial maintainers.
* give akimov triage on quickstart-resources
* Add pre-commit hooks for code quality
Includes standard checks (trailing whitespace, EOF, YAML, merge conflicts) and TypeScript type checking. Expensive checks like Pulumi preview are intentionally excluded for CI instead.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Migrate GitHub teams to infrastructure-as-code
- Add 25 teams with proper hierarchy (steering-committee, SDK teams, working groups, interest groups)
- Add 67 team members with their assignments
- Add repository access configuration for all 21 repositories
- Refactor github.ts to use config-driven approach with repoAccess.ts
- Mark all MCP teams as GitHub-only with onlyOnPlatforms
- Use RepositoryCollaborators for authoritative access management
Note: GitHub Projects V2 permissions are not yet supported by Pulumi and must be managed manually. See https://github.com/pulumi/pulumi-github/issues/1006
* Add individual user collaborators to repository access
Preserves direct collaborator access for users who have explicit permissions outside of team membership, including:
- jspahrsummers: admin on multiple core repos
- Go SDK collaborators (neild, rsc, rolandshoemaker, h9jiang)
- C# SDK collaborators (jeffhandley, MackinnonBuck, jozkee, localden, PederHP)
- Rust SDK collaborators (jamadeo, jokemanfire, 4t145)
- Inspector collaborators (richardkmichael, olaservo, an-dustin, ashwin-ant)
- Financial services IG collaborators (aniabot, imfing, sambhav, KengoA, nitsanh)
- And others
Without this, RepositoryCollaborators (authoritative mode) would remove all individual user access.
Addresses security concern where secrets were directly interpolated in
run commands. Following GitHub's security best practices, the secret is
now passed through an intermediate environment variable before being
written to the file.
This maintains compatibility with the existing Makefile workflow while
reducing the risk of accidental secret disclosure.
- Add catch-all email group with admin-adam@modelcontextprotocol.io
- Add onlyOnPlatforms configuration to restrict groups to specific platforms
- Set antitrust and catch-all groups to Google only
- Groups default to all platforms when onlyOnPlatforms is not specified
