* Manage GitHub org settings and org-role assignments via Pulumi
Brings two click-ops org-level configs under IaC and tightens defaults:
- OrganizationSettings: default_repository_permission read -> none so
private repos are not implicitly readable by every member; repo
creation restricted to admins; billingEmail from Pulumi secret;
security new-repo defaults pinned so the provider does not reset them.
- Org-role assignments: codify lead/core-maintainers -> all_repo_admin.
moderators -> all_repo_triage and anthropic -> all_repo_write are
intentionally omitted (being removed).
* Fix config namespace: use project namespace for githubBillingEmail
The github: namespace is reserved for the @pulumi/github provider's own
config keys, so github:billingEmail was rejected as an unknown provider
option. Use the project default namespace instead. preview.yml uses the
same --config flag pattern as the existing Discord secrets.
Creates the agents-wg role and corresponding GitHub team under working-groups,
adds Caitie, David, Luca, and Peter Alexander as members, and grants the team
admin access to the experimental-ext-tasks repository.
Creates the file-uploads-wg GitHub team (under working-groups) and the
matching Discord role. Initial members: localden (Lead), nickcoai,
ochafik. See charter PR modelcontextprotocol#2635.
🏠 Remote-Dev: homespace
* Add INTERCEPTORS_WG role ID
* Add Interceptors Working Group role configuration
* Add repository access configuration for interceptors
* Add user to INTERCEPTORS_WG role
When a member wasn't in the guild at create() time (or drifted afterwards),
read() only reported the drift. Pulumi would not trigger update() because
the inputs hadn't changed, so the member stayed permanently out of sync.
Call syncMemberRoles() directly from read() when drift is detected so roles
are applied on the next refresh without needing an input change.
Add firstName, lastName, and googleEmailPrefix fields to provision
sam@modelcontextprotocol.io Google Workspace account.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Adds SERVER_CARD_WG working group with GitHub team and Discord role.
Adds Sam to MAINTAINERS and SERVER_CARD_WG, and adds tadasant and dsp-ant
to SERVER_CARD_WG.
- New GitHub team typescript-sdk-collaborators (child of typescript-sdk)
- Grant push permission on modelcontextprotocol/typescript-sdk
- Add poteat as initial member
🏠 Remote-Dev: homespace
- Expand REFERENCE_SERVERS_MAINTAINERS role (previously Discord-only) to
create a GitHub team
- Grant the team admin permission on modelcontextprotocol/servers
- Add tobinsouth as a new member
Existing members cliffhall and olaservo will also be added to the new
GitHub team.
🏠 Remote-Dev: homespace
Cloudflare edge errors (5xx, edge-level 429s) return plain-text bodies
like "upstream connect error..." or "error code: 1015" that crash a
naive response.json() call. Add a tryParseJson helper and use it for
all error paths so we surface the actual HTTP status/body instead of a
JSON parse exception.
Also add exponential backoff retry for 5xx responses, matching the
existing 429 retry behavior.
🏠 Remote-Dev: homespace
The csharp-sdk team only had push permission, which was insufficient for
members to push to protected branches, edit/assign issues, or have their
PR approvals count toward merge requirements. Upgrading to maintain grants
these capabilities without admin access.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Den Delimarsky <53200638+localden@users.noreply.github.com>
The 250ms jitter was too narrow for ~68 parallel refresh reads — all
retries clustered after the same retry_after and collided again. Scale
jitter linearly with attempt number so the herd progressively spreads
out across attempts.
Split `make up` into two phases: a plain `pulumi up` first, then
`pulumi up --refresh`. Dynamic providers serialize their implementation
into state at create/update time. During refresh, the serialized `read()`
runs — so any provider-code change (like the Discord 429 retry logic)
doesn't take effect until a successful update writes the new `__provider`
to state. Running refresh first used the stale serialized code from the
last successful deploy, which had no rate-limit handling, failing on
parallel Discord member lookups.
Also bump discordFetch maxRetries from 5 to 10 for headroom against ~68
parallel refresh reads.
- Handle 429 responses from Discord API with automatic retry based on
retry_after, preventing transient failures during role sync
- Surface underlying error details in role and member role read failures
to make debugging easier
- Bump @pulumi/github to ^6.11.0 (resolves 6.12.1)
🏠 Remote-Dev: homespace
* Add nickcoai Google info
As above
* Update src/config/users.ts
---------
Co-authored-by: David Soria Parra <167242713+dsp-ant@users.noreply.github.com>
* Add evalstate and cliffhall to docs-maintaners team
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Add Tool Annotations Interest Group and enable Discord sync
Add rreichel3, mattzcarey, and SamMorrowDrums as facilitators
for the new Tool Annotations IG. Create GitHub team and Discord
role sync. Add Discord IDs for rreichel3 and mattzcarey.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* Add experimental-ext-tool-annotations repo for Tool Annotations IG
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Moderators need maintain permission to create, edit, and delete GitHub
Discussion categories. Previously they had push or triage, which only
allows managing individual discussions but not categories.
- Add sunishsheth2009 as a new member of the skills-over-mcp-ig group
- Enable Discord role sync for the Skills over MCP Interest Group
- Add Discord IDs for erain, JAORMX, kaxil, and keithagroves
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Grants Paul Carleton moderator (GitHub + Discord), Discord administrator,
and docs-maintainers access alongside his existing core-maintainers role.
🏠 Remote-Dev: homespace
* Add csharp-sdk-admin team and split csharp-sdk repo permissions
Introduce a csharp-sdk-admin team for admin access to the csharp-sdk repo,
while the existing csharp-sdk team is changed to push (write) access. This
separates admin privileges from general write access.
- Add CSHARP_SDK_ADMIN role to roleIds.ts and roles.ts
- Update repoAccess.ts: csharp-sdk-admin (admin), csharp-sdk (push), PederHP (triage)
- Add jeffhandley, ericstj, jozkee, tarekgh as new members in users.ts
- Move dend/localden from csharp-sdk to csharp-sdk-admin team
- Add csharp-sdk-admin membership for halter73, mikekistler, stephentoub
- Remove MackinnonBuck (admin) direct access per request
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix alphabetical ordering of new users in users.ts
Move ericstj after erain and jeffhandley before jenn-newton to satisfy
the case-insensitive alphabetical sort check in validate-config.ts.
🏠 Remote-Dev: homespace
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Den Delimarsky <den@anthropic.com>
The hashicorp/googleworkspace provider has a known eventual-consistency
bug (issue #387): after creating a user, it polls for 4 consecutive
identical API etags before marking the resource created. Google's API
frequently flip-flops etags, so the check never passes and the 300s
default timeout trips — even though the user was actually created.
This caused cliff@ creation to timeout, leaving the user in GWS but not
in Pulumi state; subsequent runs fail with 409 Entity already exists.
Two changes:
- Mark cliff as existingGWSUser so Pulumi stops trying to create him
(matches the pattern used for other stranded users).
- Switch to the SamuZad/googleworkspace fork (v0.11.1), which lowers
numConsistent from 4 to 2, preventing the timeout for future user
creations. The upstream provider has been unmaintained for 2+ years.
* Add evalstate and cliffhall to docs-maintaners team
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Add org email details for Ola Hungerford and Luca Chang
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: David Soria Parra <167242713+dsp-ant@users.noreply.github.com>
Adds a google config with provisionUser to the MAINTAINERS role. Runtime
provisioning already gates on firstName/lastName/googleEmailPrefix, so
maintainers opt in by sending a PR adding those fields to their entry in
users.ts. Missing fields means no account is created.
Relaxes the validator and tests to treat missing GWS fields as implicit
opt-out rather than a hard error, so existing maintainers do not need
skipGoogleUserProvisioning set up front.
Also documents the opt-in flow in the README.
