Remove richardkmichael and ashwin-ant from inspector, and
slimslenderslacks from servers.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove jspahrsummers (org admin) from all direct repo access. Remove
redundant direct access for users who already have equal or higher
permissions via team membership: localden (csharp-sdk), an-dustin
(inspector via security-wg), jamadeo and alexhancock (rust-sdk),
mattt/movetz/stallent (swift-sdk), rdimitrov (registry via registry-wg),
sambhav (financial-services-ig), and liady/idosal/antonpk1 (ext-apps
via mcp-apps-sdk). Upgrade swift-sdk team permission from push to admin.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Add primitive-grouping-ig interest group
Create the primitive-grouping-ig interest group team under interest-groups
and grant it push access to the experimental-ext-grouping repository.
Members: cliffhall, chughtapan, SamMorrowDrums.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Fix formatting
* Give core-maintainers and moderators access to experimental-ext-grouping
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Add Skills Over MCP Interest Group and experimental-ext-skills repo
- Add SKILLS_OVER_MCP_IG role under interest-groups (GitHub team only)
- Add repo access for experimental-ext-skills per SEP-2133 governance:
- core-maintainers: admin (oversight)
- moderators: triage
- skills-over-mcp-ig: admin (day-to-day governance)
- Add IG membership for: cliffhall, erain, JAORMX, kaxil, keithagroves,
olaservo, pederhp, SamMorrowDrums, TeamSparkAI
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Add SKILLS_OVER_MCP_IG role to user membership
* Fix alphabetical sorting of users
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
- Add tarekgh to csharp-sdk with push permission
- Add ext-apps with mcp-apps-wg, mcp-apps-sdk teams and outside collaborators
- Add use-mcp with core-maintainers, moderators and geelen
- Add example-remote-client with core-maintainers, moderators and outside collaborators
This brings these previously unmanaged repos under centralized access control.
* Add Discord role sync with role-centric architecture
This refactors the access management to use a role-centric model where
each role explicitly defines which platforms it exists on (GitHub,
Discord, Google).
Key changes:
- Add Discord role sync via Pulumi Dynamic Provider
- Replace groups.ts with roleIds.ts + roles.ts for type-safe role definitions
- Use ROLE_IDS constants to prevent typos in memberOf references
- Each role has platform-specific config (github/discord/google keys)
- Discord-only roles (e.g., administrators) and GitHub-only roles
(e.g., typescript-sdk-auth) are now explicitly modeled
- Add PR preview workflow to show Pulumi changes before merge
- Add test-config.ts for config structure validation
- Fix typo: docs-maintaners -> docs-maintainers
Discord roles will match existing server roles:
- administrators, lead maintainers, core maintainers
- sdk maintainers, working groups, interest groups
- etc.
Requires new GitHub secrets:
- DISCORD_BOT_TOKEN
- DISCORD_GUILD_ID
* Fix GitHub team ordering and make Discord integration optional
- Add topological sort for GitHub teams to ensure parent teams are
created before child teams, fixing the registry-wg parentTeamId issue
- Make Discord integration optional by using config.get() instead of
config.require(), allowing CI preview to succeed without Discord secrets
- Add sortRolesByGitHubDependency() utility function in config/utils.ts
Claude-Generated-By: Claude Code (cli/claude-opus-4-5=20%)
Claude-Steers: 2
Claude-Permission-Prompts: 1
Claude-Escapes: 0
* Reconcile Discord roles for listed users
Replace per-role-membership approach with per-user role sync that:
- Adds missing roles users should have
- Removes managed roles users shouldn't have
- Only touches roles defined in config (won't affect admin roles, etc.)
Users not in config remain untouched.
Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%)
Claude-Steers: 4
Claude-Permission-Prompts: 1
Claude-Escapes: 0
* Fix descriptions to match existing resources
* Cache Pulumi plugins and fix GITHUB_TOKEN for pulumi install
* Remove accidentally committed state backup
* Use github.token for pulumi install
* Fix formatting
Fix deploy: add pulumi login before config set
Fix deploy: set PULUMI_CONFIG_PASSPHRASE_FILE for config commands
Import existing docs-maintainers team (remove after deploy)
Remove docs-maintainers import workaround
Add docs-maintainers cleanup to state cleanup
Add pulumi refresh before up to sync state with reality
Rename Discord roles to add (synced) suffix
Cleanup Makefile and add lead-maintainers GitHub team
* Add movetz and stallent as Swift SDK maintainers
Adding Maksym Mova (MacPaw) and Stephen Tallent (Mercury.io) as new
maintainers for the Swift SDK, as discussed in the SDK working group.
* Set up tiered access: admins + contributor team
- movetz and stallent get admin access directly
- swift-sdk team grants push access (for future contributors)
This follows the pattern used by go-sdk and rust-sdk.
* Preserve mattt as admin
* Add evalstate and cliffhall to docs-maintaners team
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Add a-akimov to docs-maintaners team, tighten inspector/servers permissions
- Add a-akimov to docs-maintaners team (replaces direct repo access)
- Remove a-akimov direct push from quickstart-resources (now via team)
- Remove interest groups from inspector push access (ig-financial-services, interest-groups)
- Remove working-groups umbrella from inspector push access
- Remove docs-maintaners from inspector push access
- Remove interest groups from servers push access (ig-financial-services, interest-groups)
- Remove working-groups umbrella from servers push access
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
- Add prettier with consistent formatting config
- Add format and format:check npm scripts
- Add prettier pre-commit hook
- Add validation and formatting checks to CI workflow
- Reformat all TypeScript and JSON files
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
PR #17 removed the 'core' group but left references in repoAccess.ts,
causing deployments to fail since Nov 25th.
Changes:
- Remove 'core' team references from 6 repositories in repoAccess.ts
- Replace with 'core-maintainers' to maintain equivalent permissions
- Add scripts/validate-config.ts to validate all team references
- Add pre-commit hook to run validation on config changes
- Add npm run validate script
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Migrate GitHub teams to infrastructure-as-code
- Add 25 teams with proper hierarchy (steering-committee, SDK teams, working groups, interest groups)
- Add 67 team members with their assignments
- Add repository access configuration for all 21 repositories
- Refactor github.ts to use config-driven approach with repoAccess.ts
- Mark all MCP teams as GitHub-only with onlyOnPlatforms
- Use RepositoryCollaborators for authoritative access management
Note: GitHub Projects V2 permissions are not yet supported by Pulumi and must be managed manually. See https://github.com/pulumi/pulumi-github/issues/1006
* Add individual user collaborators to repository access
Preserves direct collaborator access for users who have explicit permissions outside of team membership, including:
- jspahrsummers: admin on multiple core repos
- Go SDK collaborators (neild, rsc, rolandshoemaker, h9jiang)
- C# SDK collaborators (jeffhandley, MackinnonBuck, jozkee, localden, PederHP)
- Rust SDK collaborators (jamadeo, jokemanfire, 4t145)
- Inspector collaborators (richardkmichael, olaservo, an-dustin, ashwin-ant)
- Financial services IG collaborators (aniabot, imfing, sambhav, KengoA, nitsanh)
- And others
Without this, RepositoryCollaborators (authoritative mode) would remove all individual user access.
