Add MCP_APPS_SDK role for antonpk1 (ext-apps access) - #5
Open
filforopen-source wants to merge 59 commits into
Open
Add MCP_APPS_SDK role for antonpk1 (ext-apps access)#5filforopen-source wants to merge 59 commits into
filforopen-source wants to merge 59 commits into
Conversation
Addresses security concern where secrets were directly interpolated in run commands. Following GitHub's security best practices, the secret is now passed through an intermediate environment variable before being written to the file. This maintains compatibility with the existing Makefile workflow while reducing the risk of accidental secret disclosure.
* Migrate GitHub teams to infrastructure-as-code - Add 25 teams with proper hierarchy (steering-committee, SDK teams, working groups, interest groups) - Add 67 team members with their assignments - Add repository access configuration for all 21 repositories - Refactor github.ts to use config-driven approach with repoAccess.ts - Mark all MCP teams as GitHub-only with onlyOnPlatforms - Use RepositoryCollaborators for authoritative access management Note: GitHub Projects V2 permissions are not yet supported by Pulumi and must be managed manually. See pulumi/pulumi-github#1006 * Add individual user collaborators to repository access Preserves direct collaborator access for users who have explicit permissions outside of team membership, including: - jspahrsummers: admin on multiple core repos - Go SDK collaborators (neild, rsc, rolandshoemaker, h9jiang) - C# SDK collaborators (jeffhandley, MackinnonBuck, jozkee, localden, PederHP) - Rust SDK collaborators (jamadeo, jokemanfire, 4t145) - Inspector collaborators (richardkmichael, olaservo, an-dustin, ashwin-ant) - Financial services IG collaborators (aniabot, imfing, sambhav, KengoA, nitsanh) - And others Without this, RepositoryCollaborators (authoritative mode) would remove all individual user access.
…uality (#6) * give akimov triage on quickstart-resources * Add pre-commit hooks for code quality Includes standard checks (trailing whitespace, EOF, YAML, merge conflicts) and TypeScript type checking. Expensive checks like Pulumi preview are intentionally excluded for CI instead. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude <noreply@anthropic.com>
* grant auth-wg admin on ext-auth * add pcarleton to auth-wg
Creates a new mcpb-maintainers team under the steering committee with Joan Xie (joan-anthropic), Adam Jones (domdomegg), and Alex Sklar (asklar) as initial maintainers.
Adds Felix (felixreiseberg) and Sam (marshallofsound) as maintainers for the Model Context Protocol Bundle (MCPB) project. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude <noreply@anthropic.com>
PR #17 removed the 'core' group but left references in repoAccess.ts, causing deployments to fail since Nov 25th. Changes: - Remove 'core' team references from 6 repositories in repoAccess.ts - Replace with 'core-maintainers' to maintain equivalent permissions - Add scripts/validate-config.ts to validate all team references - Add pre-commit hook to run validation on config changes - Add npm run validate script 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add prettier with consistent formatting config - Add format and format:check npm scripts - Add prettier pre-commit hook - Add validation and formatting checks to CI workflow - Reformat all TypeScript and JSON files 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Move GitHub token from Pulumi encrypted config to GitHub Actions secret (PULUMI_GITHUB_TOKEN) for better secret management. The token is passed via GITHUB_TOKEN env var which the Pulumi GitHub provider reads automatically. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add migrate-state.yml workflow (manual trigger) that: - Sets github:token in Pulumi config from PULUMI_GITHUB_TOKEN secret - Cleans up orphaned 'core' team memberships from state - Commits the updated Pulumi.prod.yaml back to repo - Revert deploy.yml to use encrypted token from Pulumi config 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Pass the token via GITHUB_TOKEN environment variable which the Pulumi GitHub provider reads automatically. Remove the one-time migration workflow since state cleanup already succeeded. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The 'core' team was deleted from GitHub but still exists in Pulumi state. Add cleanup-state target that runs before deploy to remove these orphaned resources. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
bolinfest should have push access to rust-sdk, not admin. Direct access is already configured in repoAccess.ts. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…s (#19) * Add evalstate and cliffhall to docs-maintaners team 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * Add a-akimov to docs-maintaners team, tighten inspector/servers permissions - Add a-akimov to docs-maintaners team (replaces direct repo access) - Remove a-akimov direct push from quickstart-resources (now via team) - Remove interest groups from inspector push access (ig-financial-services, interest-groups) - Remove working-groups umbrella from inspector push access - Remove docs-maintaners from inspector push access - Remove interest groups from servers push access (ig-financial-services, interest-groups) - Remove working-groups umbrella from servers push access 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
* Add movetz and stallent as Swift SDK maintainers Adding Maksym Mova (MacPaw) and Stephen Tallent (Mercury.io) as new maintainers for the Swift SDK, as discussed in the SDK working group. * Set up tiered access: admins + contributor team - movetz and stallent get admin access directly - swift-sdk team grants push access (for future contributors) This follows the pattern used by go-sdk and rust-sdk. * Preserve mattt as admin
* Add Discord role sync with role-centric architecture This refactors the access management to use a role-centric model where each role explicitly defines which platforms it exists on (GitHub, Discord, Google). Key changes: - Add Discord role sync via Pulumi Dynamic Provider - Replace groups.ts with roleIds.ts + roles.ts for type-safe role definitions - Use ROLE_IDS constants to prevent typos in memberOf references - Each role has platform-specific config (github/discord/google keys) - Discord-only roles (e.g., administrators) and GitHub-only roles (e.g., typescript-sdk-auth) are now explicitly modeled - Add PR preview workflow to show Pulumi changes before merge - Add test-config.ts for config structure validation - Fix typo: docs-maintaners -> docs-maintainers Discord roles will match existing server roles: - administrators, lead maintainers, core maintainers - sdk maintainers, working groups, interest groups - etc. Requires new GitHub secrets: - DISCORD_BOT_TOKEN - DISCORD_GUILD_ID * Fix GitHub team ordering and make Discord integration optional - Add topological sort for GitHub teams to ensure parent teams are created before child teams, fixing the registry-wg parentTeamId issue - Make Discord integration optional by using config.get() instead of config.require(), allowing CI preview to succeed without Discord secrets - Add sortRolesByGitHubDependency() utility function in config/utils.ts Claude-Generated-By: Claude Code (cli/claude-opus-4-5=20%) Claude-Steers: 2 Claude-Permission-Prompts: 1 Claude-Escapes: 0 * Reconcile Discord roles for listed users Replace per-role-membership approach with per-user role sync that: - Adds missing roles users should have - Removes managed roles users shouldn't have - Only touches roles defined in config (won't affect admin roles, etc.) Users not in config remain untouched. Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 4 Claude-Permission-Prompts: 1 Claude-Escapes: 0 * Fix descriptions to match existing resources * Cache Pulumi plugins and fix GITHUB_TOKEN for pulumi install * Remove accidentally committed state backup * Use github.token for pulumi install * Fix formatting Fix deploy: add pulumi login before config set Fix deploy: set PULUMI_CONFIG_PASSPHRASE_FILE for config commands Import existing docs-maintainers team (remove after deploy) Remove docs-maintainers import workaround Add docs-maintainers cleanup to state cleanup Add pulumi refresh before up to sync state with reality Rename Discord roles to add (synced) suffix Cleanup Makefile and add lead-maintainers GitHub team
* Add user caitiem20 * removing duplicate caitie * ran prettier
Fork PRs don't have access to repository secrets, causing the GCP auth and PR comment steps to fail. Instead of failing, skip the preview job entirely for fork PRs. The job will show as 'skipped' rather than 'failed', allowing fork PRs to be merged based on the CI check alone. Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 2 Claude-Permission-Prompts: 1 Claude-Escapes: 0
* Update discord & email for chr-hertel * Update src/config/users.ts --------- Co-authored-by: David Soria Parra <167242713+dsp-ant@users.noreply.github.com>
* Add Discord ID to user configuration for Rado * Update src/config/users.ts --------- Co-authored-by: David Soria Parra <167242713+dsp-ant@users.noreply.github.com>
Refresh before every deploy adds latency without much benefit since infrastructure is fully managed via code. The refresh target remains available for manual use when drift is suspected. Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 2 Claude-Permission-Prompts: 0 Claude-Escapes: 0
* Updated user Cliff Hall - Add email address - Add discord user id - Add missing role.REFERENCE_SERVERS_MAINTAINERS * Updated user Cliff Hall - Add missing role MAINTAINERS * Updated user Cliff Hall - Add missing role WORKING_GROUPS * Prettier
* chore: add discord identifier for myself * Update src/config/users.ts --------- Co-authored-by: David Soria Parra <167242713+dsp-ant@users.noreply.github.com>
* Add Discord user IDs * Update users.ts * Update member roles and remove 'dend' from users config Removed the user 'dend' from the MEMBERS list. Updated roles for 'ihrpr', 'localden', and 'nickcoai' to reflect new responsibilities and group memberships. * Update formatting based on prettier --------- Co-authored-by: Den Delimarsky <53200638+localden@users.noreply.github.com> Co-authored-by: Den Delimarsky <den@anthropic.com>
The Discord ID 1086709448816468038 is not a member of the MCP Discord server, causing deploy failures with 'Unknown Member (code: 10007)' Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 1 Claude-Permission-Prompts: 2 Claude-Escapes: 0
When a user with a Discord ID leaves the server (or the ID is invalid), the sync now logs a warning and continues instead of failing the entire deploy. This prevents deploys from breaking when someone leaves Discord. The memberNotFound flag is tracked in Pulumi state so we can identify stale Discord IDs. Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 0 Claude-Permission-Prompts: 0 Claude-Escapes: 0
* Add * Missing comma * Add Discord ID * Prettier
* chore: add apps-wg and discord/github for liad * Update src/config/roles.ts Co-authored-by: David Soria Parra <167242713+dsp-ant@users.noreply.github.com> * fix: PR comments * minor: comment --------- Co-authored-by: David Soria Parra <167242713+dsp-ant@users.noreply.github.com>
Automated matching found 18 users by username/display name: - CodeWithKyrian, Kehrlann, Kludex, Nyholm, asklar, baxen - carlpeaslee, evalstate, felixweinberger, jba, jerome3o-anthropic - joan-anthropic, jonathanhefner, ochafik, olaservo, stallent - tadasant, topherbullock Manually provided IDs for 12 users: - D-McAdams, a-akimov, aaronpk, atesgoral, domdomegg, findleyr - koic, mikekistler, pederhp, sambhav, toby, tzolov Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 2 Claude-Permission-Prompts: 7 Claude-Escapes: 0
- Add discordImplies field to Role interface for Discord-specific role hierarchy - Add expandDiscordRoles() function to traverse both GitHub parent chain and discordImplies relationships when syncing Discord roles - SDK_MAINTAINERS now implies MAINTAINERS for Discord This ensures that users with SDK roles (GO_SDK, PYTHON_SDK, etc.) automatically get the 'maintainers (synced)' Discord role through: GO_SDK -> SDK_MAINTAINERS (via GitHub parent) -> MAINTAINERS (via discordImplies) Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 5 Claude-Permission-Prompts: 1 Claude-Escapes: 0
Since SDK_MAINTAINERS now implies MAINTAINERS via discordImplies, users with SDK roles no longer need explicit MAINTAINERS membership. Removed redundant MAINTAINERS from: - alexhancock (has RUST_SDK) - chr-hertel (has PHP_SDK) - ihrpr (has PYTHON_SDK, TYPESCRIPT_SDK) - liady (has MCP_APPS_SDK)
* Add maciej to go-sdk maintainers; discord ID for findleyr Maciej is joining the project from Google. Add him as a go-sdk maintainer. Also, add a discord ID for myself. * Update src/config/users.ts Co-authored-by: Maciej Kisiel <macio92@gmail.com> --------- Co-authored-by: David Soria Parra <167242713+dsp-ant@users.noreply.github.com> Co-authored-by: Maciej Kisiel <macio92@gmail.com>
- Add tarekgh to csharp-sdk with push permission - Add ext-apps with mcp-apps-wg, mcp-apps-sdk teams and outside collaborators - Add use-mcp with core-maintainers, moderators and geelen - Add example-remote-client with core-maintainers, moderators and outside collaborators This brings these previously unmanaged repos under centralized access control.
filforopen-source
changed the base branch from
au-farm-land
to
adamj/secure-passphrase-handling
July 3, 2026 18:37
Replaced discord IDs with a placeholder for all members.
…atch-2 Update user config to remove discord IDs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.