* Add Discord role sync with role-centric architecture
This refactors the access management to use a role-centric model where
each role explicitly defines which platforms it exists on (GitHub,
Discord, Google).
Key changes:
- Add Discord role sync via Pulumi Dynamic Provider
- Replace groups.ts with roleIds.ts + roles.ts for type-safe role definitions
- Use ROLE_IDS constants to prevent typos in memberOf references
- Each role has platform-specific config (github/discord/google keys)
- Discord-only roles (e.g., administrators) and GitHub-only roles
(e.g., typescript-sdk-auth) are now explicitly modeled
- Add PR preview workflow to show Pulumi changes before merge
- Add test-config.ts for config structure validation
- Fix typo: docs-maintaners -> docs-maintainers
Discord roles will match existing server roles:
- administrators, lead maintainers, core maintainers
- sdk maintainers, working groups, interest groups
- etc.
Requires new GitHub secrets:
- DISCORD_BOT_TOKEN
- DISCORD_GUILD_ID
* Fix GitHub team ordering and make Discord integration optional
- Add topological sort for GitHub teams to ensure parent teams are
created before child teams, fixing the registry-wg parentTeamId issue
- Make Discord integration optional by using config.get() instead of
config.require(), allowing CI preview to succeed without Discord secrets
- Add sortRolesByGitHubDependency() utility function in config/utils.ts
Claude-Generated-By: Claude Code (cli/claude-opus-4-5=20%)
Claude-Steers: 2
Claude-Permission-Prompts: 1
Claude-Escapes: 0
* Reconcile Discord roles for listed users
Replace per-role-membership approach with per-user role sync that:
- Adds missing roles users should have
- Removes managed roles users shouldn't have
- Only touches roles defined in config (won't affect admin roles, etc.)
Users not in config remain untouched.
Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%)
Claude-Steers: 4
Claude-Permission-Prompts: 1
Claude-Escapes: 0
* Fix descriptions to match existing resources
* Cache Pulumi plugins and fix GITHUB_TOKEN for pulumi install
* Remove accidentally committed state backup
* Use github.token for pulumi install
* Fix formatting
Fix deploy: add pulumi login before config set
Fix deploy: set PULUMI_CONFIG_PASSPHRASE_FILE for config commands
Import existing docs-maintainers team (remove after deploy)
Remove docs-maintainers import workaround
Add docs-maintainers cleanup to state cleanup
Add pulumi refresh before up to sync state with reality
Rename Discord roles to add (synced) suffix
Cleanup Makefile and add lead-maintainers GitHub team
* Migrate GitHub teams to infrastructure-as-code
- Add 25 teams with proper hierarchy (steering-committee, SDK teams, working groups, interest groups)
- Add 67 team members with their assignments
- Add repository access configuration for all 21 repositories
- Refactor github.ts to use config-driven approach with repoAccess.ts
- Mark all MCP teams as GitHub-only with onlyOnPlatforms
- Use RepositoryCollaborators for authoritative access management
Note: GitHub Projects V2 permissions are not yet supported by Pulumi and must be managed manually. See https://github.com/pulumi/pulumi-github/issues/1006
* Add individual user collaborators to repository access
Preserves direct collaborator access for users who have explicit permissions outside of team membership, including:
- jspahrsummers: admin on multiple core repos
- Go SDK collaborators (neild, rsc, rolandshoemaker, h9jiang)
- C# SDK collaborators (jeffhandley, MackinnonBuck, jozkee, localden, PederHP)
- Rust SDK collaborators (jamadeo, jokemanfire, 4t145)
- Inspector collaborators (richardkmichael, olaservo, an-dustin, ashwin-ant)
- Financial services IG collaborators (aniabot, imfing, sambhav, KengoA, nitsanh)
- And others
Without this, RepositoryCollaborators (authoritative mode) would remove all individual user access.
- Add catch-all email group with admin-adam@modelcontextprotocol.io
- Add onlyOnPlatforms configuration to restrict groups to specific platforms
- Set antitrust and catch-all groups to Google only
- Groups default to all platforms when onlyOnPlatforms is not specified
