bolinfest should have push access to rust-sdk, not admin. Direct
access is already configured in repoAccess.ts.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The 'core' team was deleted from GitHub but still exists in Pulumi
state. Add cleanup-state target that runs before deploy to remove
these orphaned resources.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Pass the token via GITHUB_TOKEN environment variable which the Pulumi
GitHub provider reads automatically. Remove the one-time migration
workflow since state cleanup already succeeded.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add migrate-state.yml workflow (manual trigger) that:
- Sets github:token in Pulumi config from PULUMI_GITHUB_TOKEN secret
- Cleans up orphaned 'core' team memberships from state
- Commits the updated Pulumi.prod.yaml back to repo
- Revert deploy.yml to use encrypted token from Pulumi config
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Move GitHub token from Pulumi encrypted config to GitHub Actions secret
(PULUMI_GITHUB_TOKEN) for better secret management. The token is passed
via GITHUB_TOKEN env var which the Pulumi GitHub provider reads automatically.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add prettier with consistent formatting config
- Add format and format:check npm scripts
- Add prettier pre-commit hook
- Add validation and formatting checks to CI workflow
- Reformat all TypeScript and JSON files
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
PR #17 removed the 'core' group but left references in repoAccess.ts,
causing deployments to fail since Nov 25th.
Changes:
- Remove 'core' team references from 6 repositories in repoAccess.ts
- Replace with 'core-maintainers' to maintain equivalent permissions
- Add scripts/validate-config.ts to validate all team references
- Add pre-commit hook to run validation on config changes
- Add npm run validate script
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Adds Felix (felixreiseberg) and Sam (marshallofsound) as maintainers for the Model Context Protocol Bundle (MCPB) project.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
Creates a new mcpb-maintainers team under the steering committee with Joan Xie (joan-anthropic), Adam Jones (domdomegg), and Alex Sklar (asklar) as initial maintainers.
* give akimov triage on quickstart-resources
* Add pre-commit hooks for code quality
Includes standard checks (trailing whitespace, EOF, YAML, merge conflicts) and TypeScript type checking. Expensive checks like Pulumi preview are intentionally excluded for CI instead.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* Migrate GitHub teams to infrastructure-as-code
- Add 25 teams with proper hierarchy (steering-committee, SDK teams, working groups, interest groups)
- Add 67 team members with their assignments
- Add repository access configuration for all 21 repositories
- Refactor github.ts to use config-driven approach with repoAccess.ts
- Mark all MCP teams as GitHub-only with onlyOnPlatforms
- Use RepositoryCollaborators for authoritative access management
Note: GitHub Projects V2 permissions are not yet supported by Pulumi and must be managed manually. See https://github.com/pulumi/pulumi-github/issues/1006
* Add individual user collaborators to repository access
Preserves direct collaborator access for users who have explicit permissions outside of team membership, including:
- jspahrsummers: admin on multiple core repos
- Go SDK collaborators (neild, rsc, rolandshoemaker, h9jiang)
- C# SDK collaborators (jeffhandley, MackinnonBuck, jozkee, localden, PederHP)
- Rust SDK collaborators (jamadeo, jokemanfire, 4t145)
- Inspector collaborators (richardkmichael, olaservo, an-dustin, ashwin-ant)
- Financial services IG collaborators (aniabot, imfing, sambhav, KengoA, nitsanh)
- And others
Without this, RepositoryCollaborators (authoritative mode) would remove all individual user access.
Addresses security concern where secrets were directly interpolated in
run commands. Following GitHub's security best practices, the secret is
now passed through an intermediate environment variable before being
written to the file.
This maintains compatibility with the existing Makefile workflow while
reducing the risk of accidental secret disclosure.
- Add catch-all email group with admin-adam@modelcontextprotocol.io
- Add onlyOnPlatforms configuration to restrict groups to specific platforms
- Set antitrust and catch-all groups to Google only
- Groups default to all platforms when onlyOnPlatforms is not specified
