Deaf - #9
Open
filforopen-source wants to merge 200 commits into
Open
Conversation
* grant auth-wg admin on ext-auth * add pcarleton to auth-wg
Creates a new mcpb-maintainers team under the steering committee with Joan Xie (joan-anthropic), Adam Jones (domdomegg), and Alex Sklar (asklar) as initial maintainers.
Adds Felix (felixreiseberg) and Sam (marshallofsound) as maintainers for the Model Context Protocol Bundle (MCPB) project. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude <noreply@anthropic.com>
PR #17 removed the 'core' group but left references in repoAccess.ts, causing deployments to fail since Nov 25th. Changes: - Remove 'core' team references from 6 repositories in repoAccess.ts - Replace with 'core-maintainers' to maintain equivalent permissions - Add scripts/validate-config.ts to validate all team references - Add pre-commit hook to run validation on config changes - Add npm run validate script 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add prettier with consistent formatting config - Add format and format:check npm scripts - Add prettier pre-commit hook - Add validation and formatting checks to CI workflow - Reformat all TypeScript and JSON files 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Move GitHub token from Pulumi encrypted config to GitHub Actions secret (PULUMI_GITHUB_TOKEN) for better secret management. The token is passed via GITHUB_TOKEN env var which the Pulumi GitHub provider reads automatically. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Add migrate-state.yml workflow (manual trigger) that: - Sets github:token in Pulumi config from PULUMI_GITHUB_TOKEN secret - Cleans up orphaned 'core' team memberships from state - Commits the updated Pulumi.prod.yaml back to repo - Revert deploy.yml to use encrypted token from Pulumi config 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Pass the token via GITHUB_TOKEN environment variable which the Pulumi GitHub provider reads automatically. Remove the one-time migration workflow since state cleanup already succeeded. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The 'core' team was deleted from GitHub but still exists in Pulumi state. Add cleanup-state target that runs before deploy to remove these orphaned resources. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
bolinfest should have push access to rust-sdk, not admin. Direct access is already configured in repoAccess.ts. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…s (#19) * Add evalstate and cliffhall to docs-maintaners team 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * Add a-akimov to docs-maintaners team, tighten inspector/servers permissions - Add a-akimov to docs-maintaners team (replaces direct repo access) - Remove a-akimov direct push from quickstart-resources (now via team) - Remove interest groups from inspector push access (ig-financial-services, interest-groups) - Remove working-groups umbrella from inspector push access - Remove docs-maintaners from inspector push access - Remove interest groups from servers push access (ig-financial-services, interest-groups) - Remove working-groups umbrella from servers push access 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com>
* Add movetz and stallent as Swift SDK maintainers Adding Maksym Mova (MacPaw) and Stephen Tallent (Mercury.io) as new maintainers for the Swift SDK, as discussed in the SDK working group. * Set up tiered access: admins + contributor team - movetz and stallent get admin access directly - swift-sdk team grants push access (for future contributors) This follows the pattern used by go-sdk and rust-sdk. * Preserve mattt as admin
* Add Discord role sync with role-centric architecture This refactors the access management to use a role-centric model where each role explicitly defines which platforms it exists on (GitHub, Discord, Google). Key changes: - Add Discord role sync via Pulumi Dynamic Provider - Replace groups.ts with roleIds.ts + roles.ts for type-safe role definitions - Use ROLE_IDS constants to prevent typos in memberOf references - Each role has platform-specific config (github/discord/google keys) - Discord-only roles (e.g., administrators) and GitHub-only roles (e.g., typescript-sdk-auth) are now explicitly modeled - Add PR preview workflow to show Pulumi changes before merge - Add test-config.ts for config structure validation - Fix typo: docs-maintaners -> docs-maintainers Discord roles will match existing server roles: - administrators, lead maintainers, core maintainers - sdk maintainers, working groups, interest groups - etc. Requires new GitHub secrets: - DISCORD_BOT_TOKEN - DISCORD_GUILD_ID * Fix GitHub team ordering and make Discord integration optional - Add topological sort for GitHub teams to ensure parent teams are created before child teams, fixing the registry-wg parentTeamId issue - Make Discord integration optional by using config.get() instead of config.require(), allowing CI preview to succeed without Discord secrets - Add sortRolesByGitHubDependency() utility function in config/utils.ts Claude-Generated-By: Claude Code (cli/claude-opus-4-5=20%) Claude-Steers: 2 Claude-Permission-Prompts: 1 Claude-Escapes: 0 * Reconcile Discord roles for listed users Replace per-role-membership approach with per-user role sync that: - Adds missing roles users should have - Removes managed roles users shouldn't have - Only touches roles defined in config (won't affect admin roles, etc.) Users not in config remain untouched. Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%) Claude-Steers: 4 Claude-Permission-Prompts: 1 Claude-Escapes: 0 * Fix descriptions to match existing resources * Cache Pulumi plugins and fix GITHUB_TOKEN for pulumi install * Remove accidentally committed state backup * Use github.token for pulumi install * Fix formatting Fix deploy: add pulumi login before config set Fix deploy: set PULUMI_CONFIG_PASSPHRASE_FILE for config commands Import existing docs-maintainers team (remove after deploy) Remove docs-maintainers import workaround Add docs-maintainers cleanup to state cleanup Add pulumi refresh before up to sync state with reality Rename Discord roles to add (synced) suffix Cleanup Makefile and add lead-maintainers GitHub team
* chore: align registry roster with WG charter Aligns GitHub teams / Discord roles / Google groups with the Registry Working Group charter (https://modelcontextprotocol.io/community/registry/charter): - Add REGISTRY_WG_COLLABORATORS role + registry-wg-collaborators GitHub team with push (not admin) on the registry repo, mirroring the typescript-sdk-collaborators model. No google config => no @modelcontextprotocol.io account (charter: Maintainer? No). - Add Preeti (Pree) Dewani (@pree-dew) as a registry collaborator. - Remove Adam Jones (@domdomegg) from REGISTRY_MAINTAINERS (he remains an active MCPB maintainer). His @modelcontextprotocol.io account is unaffected (existingGWSUser, not managed by this IaC). - Remove Toby Padilla (@toby) entirely; registry was his only maintainership. His @modelcontextprotocol.io account is likewise unaffected by this change (existingGWSUser). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore: drop discord config and inline comments from collaborators role Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore: annotate registry collaborators role id as GitHub only Matches the typescript-sdk-collaborators convention in roleIds.ts. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore: keep Toby as registry emeritus with empty role membership Instead of removing Toby Padilla's access entry entirely, retain it with an empty memberOf and a comment noting he is an emeritus maintainer of the Registry. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore: rename registry collaborators team to registry-collaborators Drops the '-wg' infix for consistency: GitHub team slug 'registry-wg-collaborators' -> 'registry-collaborators' and the role id constant REGISTRY_WG_COLLABORATORS -> REGISTRY_COLLABORATORS, keeping the constant and slug mirrored as with typescript-sdk-collaborators. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Tadas Antanavicius <tadas@modelcontextprotocol.io> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
example-remote-server was missing from the repository access config, so with the org default repository permission set to 'none', no team had write access to it. Add it alongside its sibling example-remote-client, mirroring the team grants used for ext-apps (the apps surface these example servers belong to): core-maintainers push, moderators maintain, mcp-apps-wg push, mcp-apps-sdk admin.
* Add sambhav to skills IG * Format memberOf array for better readability * Fix formatting in users.ts for ROLE_IDS
- GroupSettings: ignoreChanges on isArchived (upstream hashicorp/terraform-provider-googleworkspace#398) - OrgUnit: drop the stale import option; it was only needed for the initial adopt and now triggers a re-compare on every preview
* Add evalstate and cliffhall to docs-maintaners team 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> * feat(users): add olaservo to interceptors-wg Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Den Delimarsky <53200638+localden@users.noreply.github.com>
The repo was renamed to ext-tasks in #125, but Pulumi state still holds the old RepositoryCollaborators resource. The first 'pulumi up' (which runs before refresh) tries to delete it and 404s, blocking all deploys. Drop it from state explicitly before 'make up'. Idempotent via '|| true'; remove this line after one successful deploy.
Update .gitignore
Adds appeals@modelcontextprotocol.io as an email Google Group so banned or external users have an out-of-band channel to appeal Code of Conduct actions even after an org-level GitHub block. Mirrors the existing antitrust@/catch-all@ email-group setup (isEmailGroup, no new GoogleConfig fields). Membership is curated explicitly (like the antitrust@ members) to the current moderators and active lead maintainers, rather than derived from the MODERATORS/LEAD_MAINTAINERS roles, since those roles include emeritus and former members who should not receive appeals. Co-authored-by: Tadas Antanavicius <tadas@modelcontextprotocol.io> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> Co-authored-by: David Soria Parra <167242713+dsp-ant@users.noreply.github.com>
Update deploy.yml workflow file
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.