From 0029f1e0adb9a8eaf6c970f9897c4d1e05eb5eff Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 7 Sep 2026 07:43:32 +0000
Subject: [PATCH] Ignore org-role teams in RepositoryCollaborators to unblock
 deploys
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

GitHub's list-repository-teams API now also returns teams whose access
comes from an organization role (orgRoles.ts: lead-maintainers and
core-maintainers hold all_repo_admin, security-managers holds
security_manager). During `pulumi up --refresh` the provider reads these
teams as direct collaborators on every repository, then tries to DELETE
the direct team-repo association where repoAccess.ts does not grant it —
and GitHub 404s because no direct association exists. This broke every
deploy starting with run #253 (first failure on experimental-ext-skills,
where refresh picked up lead-maintainers).

The pinned @pulumi/github 6.12.1 provider predates the upstream fix that
skips non-direct teams (integrations/terraform-provider-github#3571), so
work around it by passing ignoreTeams for the org-role-holding teams on
each RepositoryCollaborators resource — except teams the repository's
repoAccess.ts entry grants directly (e.g. lead-maintainers on
maintainer-docs), which must stay managed by Pulumi.

Remove this workaround once a @pulumi/github release including the
upstream fix is adopted.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H4JKj5FVkmj6bRzgh1GPrY
---
 src/github.ts | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/src/github.ts b/src/github.ts
index 7076caa5..b7100eaf 100644
--- a/src/github.ts
+++ b/src/github.ts
@@ -86,10 +86,28 @@ ORG_ROLE_ASSIGNMENTS.forEach((assignment) => {
   });
 });
 
+// Teams that hold organization-level roles (ORG_ROLE_ASSIGNMENTS above). GitHub's
+// list-repository-teams API now also returns teams whose access comes from an org
+// role, so a refresh reads them as direct collaborators on every repository and the
+// provider then fails trying to delete the non-existent direct association (404).
+// The pinned @pulumi/github 6.12.1 provider predates the upstream fix that skips
+// non-direct teams (https://github.com/integrations/terraform-provider-github/pull/3571),
+// so we tell the provider to ignore these teams on every repository that does not
+// grant them directly in repoAccess.ts. Remove this workaround once we upgrade to a
+// @pulumi/github release that includes that fix.
+const orgRoleTeamNames = [...new Set(ORG_ROLE_ASSIGNMENTS.map((a) => a.team))];
+
 // Configure repository access
 REPOSITORY_ACCESS.forEach((repo) => {
+  const grantedTeams = new Set(repo.teams?.map((t) => t.team));
   new github.RepositoryCollaborators(`repo-${repo.repository}`, {
     repository: repo.repository,
+    // Ignore org-role teams, except where repoAccess.ts grants them directly on
+    // this repository (e.g. lead-maintainers on maintainer-docs) — those grants
+    // must stay managed by Pulumi.
+    ignoreTeams: orgRoleTeamNames
+      .filter((team) => !grantedTeams.has(team))
+      .map((team) => ({ teamId: teams[team].slug })),
     teams: repo.teams?.map((t) => ({
       teamId: teams[t.team]?.id,
       permission: t.permission,