feat: manage ycst-org-uk and its admins team

CLAUDE.md

@@ -12,7 +12,9 @@ files.
 
 ## Repository layout
 
-- `data/<org>/*.yaml` — one file per managed repo (the source of truth)
+- `data/<org>/*.yaml` — one file per managed repo (the source of truth);
+  `data/<org>/_teams.yaml` is optional per-org metadata, and leading-underscore
+  filenames are reserved for it rather than read as repos
 - `modules/github-repo/` — the reusable repo module; `variables.tf` lists
   every supported field and its default
 - `modules/org/` — iterates an org's `data/` files
@@ -45,6 +47,14 @@ files.
 - **Private repos on the free-tier personal org:** rulesets and secret
   scanning are paywalled — omit them. Keep `vulnerability_alerts` and
   `dependabot_security_updates`.
+- **Teams are optional and per-org.** `data/<org>/_teams.yaml` is a map keyed
+  by team slug, each with `description`, `members`, and an optional `privacy`
+  (default `closed`). The key is used verbatim as the team name, and GitHub
+  derives the slug from it, so keys must be lowercase and hyphenated for the
+  two to agree. Membership is authoritative — a member added in the UI is
+  removed on the next apply. A repo grants to a team with
+  `collaborators.teams: [{permission: admin, slug: admins}]`; a slug with no
+  team in the same org's `_teams.yaml` fails the plan.
 
 ## Applying changes
 
@@ -73,6 +83,11 @@ task plan    # terraform plan -out tfplan        (read-only)
 task apply   # terraform apply tfplan            (only after reviewing the plan)
 ```
 
+`task plan ORG=<org>` scopes the plan to one org
+(`-target=module.org_<org>`, hyphens become underscores). Targeting skips the
+excluded org's `check "unmanaged_repos"` and its filename/`name:` validation,
+so it is for scoping a known change; unscoped `task plan` stays the default.
+
 Inspect state with `task state:list` (all instance addresses) and
 `task state:show REPO=<name>` (one repo's instances). Always review the plan
 before applying; plan files can contain sensitive values and are gitignored.

Taskfile.yaml

@@ -49,17 +49,33 @@ tasks:
           fi
         fi
 
+  # An unmatched -target is only a soft warning, and the resulting empty plan
+  # reads like "nothing to do". A data directory doesn't prove module.org_<org>
+  # exists, but it's a cheap proxy that catches a plain typo in ORG before
+  # terraform silently no-ops.
+  org-guard:
+    internal: true
+    silent: true
+    cmds:
+      - |
+        if [ -n "{{.ORG}}" ] && [ ! -d "data/{{.ORG}}" ]; then
+          echo "ERROR: no data/{{.ORG}} directory; ORG must name a managed org." >&2
+          exit 1
+        fi
+
   init:
     desc: Initialise terraform against the Stategraph HTTP backend
     deps: [preflight]
     cmds:
       - terraform init
 
   plan:
-    desc: Generate a plan file via `terraform plan -out {{.PLAN_FILE}}` (read-only)
-    deps: [preflight]
+    desc: Generate a plan file via `terraform plan` (ORG=<org> scopes it to one org)
+    deps: [preflight, org-guard]
+    vars:
+      TARGET: '{{if .ORG}}-target=module.org_{{.ORG | replace "-" "_"}}{{end}}'
     cmds:
-      - terraform plan -out={{.PLAN_FILE}}
+      - terraform plan -out={{.PLAN_FILE}} {{.TARGET}}
 
   apply:
     desc: Apply the previously generated plan file

data/ycst-org-uk/_teams.yaml

@@ -0,0 +1,6 @@
+---
+admins:
+  description: Administrators for York City Supporters Trust repositories
+  members:
+    - robinbowes
+    - PlanetSeth