The orgUnitPath '/Model Context Protocol' was hardcoded but the OU
didn't exist in Pulumi state, causing INVALID_OU_ID errors for all
user creates/updates. Create it as a Pulumi resource and wire up
dependsOn so users are provisioned after the OU exists.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The googleworkspace provider requests ~14 default OAuth scopes, but only
3 are authorized in the domain-wide delegation for the service account.
The token exchange rejects requests with unauthorized scopes, causing
401 errors. Explicitly set oauthScopes to the 3 delegated scopes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The service account was impersonating david@ which only had Groups Admin
privileges. User management requires elevated Directory API permissions
that admin-david@ has.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Add Google Workspace user account provisioning
* Fix validation: remove stale skipGoogleUserProvisioning from a-akimov, add it for BobDickinson
- a-akimov: had skipGoogleUserProvisioning but is not in a provisionUser role (DOCS_MAINTAINERS)
- BobDickinson: is in REGISTRY_MAINTAINERS (provisionUser role) but missing Google user fields
* Add evalstate and cliffhall to docs-maintaners team
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Add BobDickinson to SKILLS_OVER_MCP_IG role
Closes#62
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix alphabetical sorting of BobDickinson entry
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Move bolinfest and jokemanfire from direct repo collaborators to the
rust-sdk team in users.ts. Remove 4t145 entirely. The rust-sdk repo
now has no direct collaborators.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove richardkmichael and ashwin-ant from inspector, and
slimslenderslacks from servers.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Remove jspahrsummers (org admin) from all direct repo access. Remove
redundant direct access for users who already have equal or higher
permissions via team membership: localden (csharp-sdk), an-dustin
(inspector via security-wg), jamadeo and alexhancock (rust-sdk),
mattt/movetz/stallent (swift-sdk), rdimitrov (registry via registry-wg),
sambhav (financial-services-ig), and liady/idosal/antonpk1 (ext-apps
via mcp-apps-sdk). Upgrade swift-sdk team permission from push to admin.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Add primitive-grouping-ig interest group
Create the primitive-grouping-ig interest group team under interest-groups
and grant it push access to the experimental-ext-grouping repository.
Members: cliffhall, chughtapan, SamMorrowDrums.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Fix formatting
* Give core-maintainers and moderators access to experimental-ext-grouping
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Add Tapan Chugh as facilitator for Primitive Grouping Interest Group. Also npm audit fix to remove 14 high vulnerabilities.
* In package-lock.json
- npm audit fix.
- 0 vulnerabilities now
* In roles.ts
- add PRIMITIVE_GROUPING_IG
* In roles.ts
- add block for ROLE_IDS.PRIMITIVE_GROUPING_IG
- **NOTE**: the github team and discord role are forward-looking and still need to be created
* In users.ts
- add block for Tapan with role ids for
- INTEREST_GROUPS
- PRIMITIVE_GROUPING_IG
- WG_IG_FACILITATORS
* In users.ts
- add ROLE_IDS.MAINTAINERS to Tapan's entry as per DSP
* Add Skills Over MCP Interest Group and experimental-ext-skills repo
- Add SKILLS_OVER_MCP_IG role under interest-groups (GitHub team only)
- Add repo access for experimental-ext-skills per SEP-2133 governance:
- core-maintainers: admin (oversight)
- moderators: triage
- skills-over-mcp-ig: admin (day-to-day governance)
- Add IG membership for: cliffhall, erain, JAORMX, kaxil, keithagroves,
olaservo, pederhp, SamMorrowDrums, TeamSparkAI
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* Add SKILLS_OVER_MCP_IG role to user membership
* Fix alphabetical sorting of users
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com>
* Import auth-maintainers team into Pulumi state with correct ID
The auth-wg -> auth-maintainers rename (PR #50) caused the team to be
lost from Pulumi state. A previous import attempt used the wrong team
ID (14435880). The actual GitHub team ID is 16083315.
Every deploy since has failed with:
422 Validation Failed: Name must be unique for this org
This adds a one-time import step to reconcile state. The import line
should be removed after the next successful deploy.
* Remove one-time auth-maintainers import from deploy workflow
The import in the previous commit successfully reconciled the
auth-maintainers team (ID 16083315) into Pulumi state. This
removes the one-time import line now that state is consistent.
The auth-wg -> auth-maintainers rename (PR #50) caused the team to be
lost from Pulumi state. A previous import attempt used the wrong team
ID (14435880). The actual GitHub team ID is 16083315.
Every deploy since has failed with:
422 Validation Failed: Name must be unique for this org
This adds a one-time import step to reconcile state. The import line
should be removed after the next successful deploy.
The team was accidentally deleted when both auth-wg and auth-maintainers
existed in state pointing to the same GitHub team. Need to clear stale
state so Pulumi can create fresh resources.
* Add herczyn to Go SDK team.
Kuba is another lead from the new team at Google that took over the Go SDK maintenance.
* Add discord for herczyn
* Clean up inactive maintainers of Go SDK
---------
Co-authored-by: David Soria Parra <167242713+dsp-ant@users.noreply.github.com>
* Add evalstate and cliffhall to docs-maintaners team
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Add maintainers, reference-servers, and working-groups roles to olaservo
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Add WG/IG facilitators role for calendar access
Add a new Discord-only role for Working Group and Interest Group
facilitators who need access to manage meetings on meet.modelcontextprotocol.io.
Initial members:
- Emily Lauber (@EmLauber) - Auth IG OAuth Mixup sub-working group
- Nate Barbettini (@nbarbettini)
* Fix member ordering - sort alphabetically
