Ignore org-role teams in RepositoryCollaborators to unblock deploys - #179
Open
claude[bot] wants to merge 1 commit into
Open
Ignore org-role teams in RepositoryCollaborators to unblock deploys#179claude[bot] wants to merge 1 commit into
claude[bot] wants to merge 1 commit into
Conversation
GitHub's list-repository-teams API now also returns teams whose access comes from an organization role (orgRoles.ts: lead-maintainers and core-maintainers hold all_repo_admin, security-managers holds security_manager). During `pulumi up --refresh` the provider reads these teams as direct collaborators on every repository, then tries to DELETE the direct team-repo association where repoAccess.ts does not grant it — and GitHub 404s because no direct association exists. This broke every deploy starting with run #253 (first failure on experimental-ext-skills, where refresh picked up lead-maintainers). The pinned @pulumi/github 6.12.1 provider predates the upstream fix that skips non-direct teams (integrations/terraform-provider-github#3571), so work around it by passing ignoreTeams for the org-role-holding teams on each RepositoryCollaborators resource — except teams the repository's repoAccess.ts entry grants directly (e.g. lead-maintainers on maintainer-docs), which must stay managed by Pulumi. Remove this workaround once a @pulumi/github release including the upstream fix is adopted. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4JKj5FVkmj6bRzgh1GPrY
Pulumi PreviewClick to expand preview output |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Den Delimarsky · Slack thread
Before: Every deploy on
mainfails, starting with run #253. GitHub's list-repository-teams API now also returns teams whose access comes from an organization role, sopulumi up --refreshreads the org-role teams fromorgRoles.ts(lead-maintainersandcore-maintainersholdall_repo_admin,security-managersholdssecurity_manager) as direct collaborators on repositories that never granted them inrepoAccess.ts. The provider then tries toDELETEthe direct team-repo association — e.g.lead-maintainersonexperimental-ext-skills— and GitHub returns 404 because no direct association exists, aborting the deploy. The pinned @pulumi/github 6.12.1 provider predates the upstream fix that skips non-direct teams.After: Deploys converge again. Each
RepositoryCollaboratorsresource passesignoreTeamsfor the org-role-holding teams, so the provider skipslead-maintainers,core-maintainers, andsecurity-managers— except on repositories whoserepoAccess.tsentry grants them directly (e.g.lead-maintainersandcore-maintainersonmaintainer-docs), where the deliberate grants remain fully managed by Pulumi, unchanged.This is a workaround to remove once a @pulumi/github release includes the upstream fix integrations/terraform-provider-github#3571.
How:
src/github.tsderives the org-role team list directly fromORG_ROLE_ASSIGNMENTS(so it cannot drift fromorgRoles.ts), and for each repository computesignoreTeamsas that list minus the teams the repo's config entry explicitly grants, referencing each team'sslugoutput (the 6.12.1ignoreTeams.teamIdinput accepts an id or slug). No grants were changed; the only diff to each resource is the addedignoreTeamsinput, sopulumi previewshould show onlyRepositoryCollaboratorsupdates.🤖 Generated with Claude Code
https://claude.ai/code/session_01H4JKj5FVkmj6bRzgh1GPrY
Generated by Claude Code