* Manage GitHub org settings and org-role assignments via Pulumi
Brings two click-ops org-level configs under IaC and tightens defaults:
- OrganizationSettings: default_repository_permission read -> none so
private repos are not implicitly readable by every member; repo
creation restricted to admins; billingEmail from Pulumi secret;
security new-repo defaults pinned so the provider does not reset them.
- Org-role assignments: codify lead/core-maintainers -> all_repo_admin.
moderators -> all_repo_triage and anthropic -> all_repo_write are
intentionally omitted (being removed).
* Fix config namespace: use project namespace for githubBillingEmail
The github: namespace is reserved for the @pulumi/github provider's own
config keys, so github:billingEmail was rejected as an unknown provider
option. Use the project default namespace instead. preview.yml uses the
same --config flag pattern as the existing Discord secrets.
* Import auth-maintainers team into Pulumi state with correct ID
The auth-wg -> auth-maintainers rename (PR #50) caused the team to be
lost from Pulumi state. A previous import attempt used the wrong team
ID (14435880). The actual GitHub team ID is 16083315.
Every deploy since has failed with:
422 Validation Failed: Name must be unique for this org
This adds a one-time import step to reconcile state. The import line
should be removed after the next successful deploy.
* Remove one-time auth-maintainers import from deploy workflow
The import in the previous commit successfully reconciled the
auth-maintainers team (ID 16083315) into Pulumi state. This
removes the one-time import line now that state is consistent.
The auth-wg -> auth-maintainers rename (PR #50) caused the team to be
lost from Pulumi state. A previous import attempt used the wrong team
ID (14435880). The actual GitHub team ID is 16083315.
Every deploy since has failed with:
422 Validation Failed: Name must be unique for this org
This adds a one-time import step to reconcile state. The import line
should be removed after the next successful deploy.
The team was accidentally deleted when both auth-wg and auth-maintainers
existed in state pointing to the same GitHub team. Need to clear stale
state so Pulumi can create fresh resources.
Fork PRs don't have access to repository secrets, causing the GCP
auth and PR comment steps to fail. Instead of failing, skip the
preview job entirely for fork PRs. The job will show as 'skipped'
rather than 'failed', allowing fork PRs to be merged based on
the CI check alone.
Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%)
Claude-Steers: 2
Claude-Permission-Prompts: 1
Claude-Escapes: 0
* Add Discord role sync with role-centric architecture
This refactors the access management to use a role-centric model where
each role explicitly defines which platforms it exists on (GitHub,
Discord, Google).
Key changes:
- Add Discord role sync via Pulumi Dynamic Provider
- Replace groups.ts with roleIds.ts + roles.ts for type-safe role definitions
- Use ROLE_IDS constants to prevent typos in memberOf references
- Each role has platform-specific config (github/discord/google keys)
- Discord-only roles (e.g., administrators) and GitHub-only roles
(e.g., typescript-sdk-auth) are now explicitly modeled
- Add PR preview workflow to show Pulumi changes before merge
- Add test-config.ts for config structure validation
- Fix typo: docs-maintaners -> docs-maintainers
Discord roles will match existing server roles:
- administrators, lead maintainers, core maintainers
- sdk maintainers, working groups, interest groups
- etc.
Requires new GitHub secrets:
- DISCORD_BOT_TOKEN
- DISCORD_GUILD_ID
* Fix GitHub team ordering and make Discord integration optional
- Add topological sort for GitHub teams to ensure parent teams are
created before child teams, fixing the registry-wg parentTeamId issue
- Make Discord integration optional by using config.get() instead of
config.require(), allowing CI preview to succeed without Discord secrets
- Add sortRolesByGitHubDependency() utility function in config/utils.ts
Claude-Generated-By: Claude Code (cli/claude-opus-4-5=20%)
Claude-Steers: 2
Claude-Permission-Prompts: 1
Claude-Escapes: 0
* Reconcile Discord roles for listed users
Replace per-role-membership approach with per-user role sync that:
- Adds missing roles users should have
- Removes managed roles users shouldn't have
- Only touches roles defined in config (won't affect admin roles, etc.)
Users not in config remain untouched.
Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%)
Claude-Steers: 4
Claude-Permission-Prompts: 1
Claude-Escapes: 0
* Fix descriptions to match existing resources
* Cache Pulumi plugins and fix GITHUB_TOKEN for pulumi install
* Remove accidentally committed state backup
* Use github.token for pulumi install
* Fix formatting
Fix deploy: add pulumi login before config set
Fix deploy: set PULUMI_CONFIG_PASSPHRASE_FILE for config commands
Import existing docs-maintainers team (remove after deploy)
Remove docs-maintainers import workaround
Add docs-maintainers cleanup to state cleanup
Add pulumi refresh before up to sync state with reality
Rename Discord roles to add (synced) suffix
Cleanup Makefile and add lead-maintainers GitHub team
Pass the token via GITHUB_TOKEN environment variable which the Pulumi
GitHub provider reads automatically. Remove the one-time migration
workflow since state cleanup already succeeded.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add migrate-state.yml workflow (manual trigger) that:
- Sets github:token in Pulumi config from PULUMI_GITHUB_TOKEN secret
- Cleans up orphaned 'core' team memberships from state
- Commits the updated Pulumi.prod.yaml back to repo
- Revert deploy.yml to use encrypted token from Pulumi config
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Move GitHub token from Pulumi encrypted config to GitHub Actions secret
(PULUMI_GITHUB_TOKEN) for better secret management. The token is passed
via GITHUB_TOKEN env var which the Pulumi GitHub provider reads automatically.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add prettier with consistent formatting config
- Add format and format:check npm scripts
- Add prettier pre-commit hook
- Add validation and formatting checks to CI workflow
- Reformat all TypeScript and JSON files
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Addresses security concern where secrets were directly interpolated in
run commands. Following GitHub's security best practices, the secret is
now passed through an intermediate environment variable before being
written to the file.
This maintains compatibility with the existing Makefile workflow while
reducing the risk of accidental secret disclosure.
