Merge branch 'main' into declare-org-website

Author: localden

.github/workflows/deploy.yml

@@ -70,9 +70,6 @@ jobs:
           echo "$PULUMI_PASSPHRASE" > passphrase.prod.txt
           export PULUMI_CONFIG_PASSPHRASE_FILE=passphrase.prod.txt
           pulumi login gs://mcp-access-prod-pulumi-state
-          # TEMP: drop stale state for renamed repo (experimental-ext-tasks -> ext-tasks, #125).
-          # Delete-on-up 404s because the old repo name is gone. Remove after one successful deploy.
-          pulumi state delete 'urn:pulumi:prod::mcp-access::github:index/repositoryCollaborators:RepositoryCollaborators::repo-experimental-ext-tasks' --stack prod --yes || true
           pulumi config set discord:guildId "$DISCORD_GUILD_ID" --stack prod
           pulumi config set discord:botToken "$DISCORD_BOT_TOKEN" --secret --stack prod
           pulumi config set githubBillingEmail "$ORG_BILLING_EMAIL" --secret --stack prod

Pulumi.yaml

@@ -7,4 +7,4 @@ packages:
     version: 0.14.0
     parameters:
       - SamuZad/googleworkspace
-      - 0.11.1
+      - 0.11.2

scripts/validate-config.ts

@@ -8,6 +8,7 @@
 import { ROLES, buildRoleLookup } from '../src/config/roles';
 import { REPOSITORY_ACCESS } from '../src/config/repoAccess';
 import { MEMBERS } from '../src/config/users';
+import { resolveGoogleMemberEmail } from '../src/config/utils';
 import type { RoleId } from '../src/config/roleIds';
 
 const roleLookup = buildRoleLookup();
@@ -157,6 +158,30 @@ console.log('Validating Google Workspace user provisioning fields...');
   }
 }
 
+// Validate that external group members are explicitly permitted.
+// allowExternalMembers is an explicit per-role opt-in (see GoogleConfig in
+// roles.ts): if a group's membership resolves to any non-@modelcontextprotocol.io
+// email but the role does not opt in, `pulumi up` would set the group's
+// ALLOW_EXTERNAL_MEMBERS setting to false and Google would silently purge the
+// external members ~1-2 days later (#133 incident). Fail loudly instead.
+console.log('Validating external group members are explicitly permitted...');
+for (const member of MEMBERS) {
+  const memberEmail = resolveGoogleMemberEmail(member);
+  if (!memberEmail || memberEmail.endsWith('@modelcontextprotocol.io')) continue;
+
+  for (const roleId of member.memberOf) {
+    const role = roleLookup.get(roleId);
+    if (!role?.google || role.google.allowExternalMembers === true) continue;
+
+    console.error(
+      `ERROR: Google group "${role.google.group}" has external member "${memberEmail}" ` +
+        `but its role does not permit external members. If this member is intentional, ` +
+        `add allowExternalMembers: true to the '${role.id}' role's google config in src/config/roles.ts`
+    );
+    hasErrors = true;
+  }
+}
+
 // Validate parent role references in roles.ts
 console.log('Validating parent role references in roles.ts...');
 for (const role of ROLES) {

src/config/roles.ts

@@ -28,6 +28,13 @@ export interface GoogleConfig {
   isEmailGroup?: boolean;
   /** If true, members of this role get a Google Workspace user account */
   provisionUser?: boolean;
+  /**
+   * Opt-in for groups that intentionally include non-@modelcontextprotocol.io
+   * members. Defaults to false. Must stay declared on the GroupSettings
+   * resource: the provider resets an omitted field to false on every apply,
+   * after which Google silently purges external members (#133 incident).
+   */
+  allowExternalMembers?: boolean;
 }
 
 /**
@@ -105,7 +112,7 @@ export const ROLES: readonly Role[] = [
     discord: { role: 'maintainers (synced)' },
     // GWS user accounts are opt-in: maintainers add firstName/lastName/googleEmailPrefix
     // to their entry in users.ts via PR to get an @modelcontextprotocol.io account
-    google: { group: 'maintainers', provisionUser: true },
+    google: { group: 'maintainers', provisionUser: true, allowExternalMembers: true },
   },
   {
     id: ROLE_IDS.DOCS_MAINTAINERS,
@@ -136,7 +143,7 @@ export const ROLES: readonly Role[] = [
     description: 'Official registry builders and maintainers',
     github: { team: 'registry-wg', parent: ROLE_IDS.WORKING_GROUPS },
     discord: { role: 'registry maintainers (synced)' },
-    google: { group: 'registry-wg', provisionUser: true },
+    google: { group: 'registry-wg', provisionUser: true, allowExternalMembers: true },
   },
   {
     id: ROLE_IDS.REGISTRY_COLLABORATORS,
@@ -394,7 +401,7 @@ export const ROLES: readonly Role[] = [
   {
     id: ROLE_IDS.ANTITRUST,
     description: 'Antitrust compliance contacts',
-    google: { group: 'antitrust', isEmailGroup: true },
+    google: { group: 'antitrust', isEmailGroup: true, allowExternalMembers: true },
     // Google only
   },
   {
@@ -406,7 +413,7 @@ export const ROLES: readonly Role[] = [
   {
     id: ROLE_IDS.CATCH_ALL,
     description: 'Catch-all email group',
-    google: { group: 'catch-all', isEmailGroup: true },
+    google: { group: 'catch-all', isEmailGroup: true, allowExternalMembers: true },
     // Google only
   },
 ] as const;

src/config/users.ts

@@ -20,6 +20,14 @@ export const MEMBERS: readonly Member[] = [
     discord: '324624369428987905',
     memberOf: [ROLE_IDS.AUTH_MAINTAINERS, ROLE_IDS.MAINTAINERS],
   },
+  {
+    github: 'ajribeiro',
+    firstName: 'AJ',
+    lastName: 'Ribeiro',
+    googleEmailPrefix: 'ajr',
+    existingGWSUser: true,
+    memberOf: [],
+  },
   {
     github: 'alexhancock',
     discord: '1325885093343924316',
@@ -566,6 +574,10 @@ export const MEMBERS: readonly Member[] = [
   {
     github: 'ochafik',
     discord: '1004897332069925024',
+    firstName: 'Olivier',
+    lastName: 'Chafik',
+    googleEmailPrefix: 'ochafik',
+    existingGWSUser: true,
     memberOf: [
       ROLE_IDS.FILE_UPLOADS_WG,
       ROLE_IDS.MCP_APPS_SDK,

src/config/utils.ts

@@ -27,6 +27,19 @@ export interface Member {
   skipGoogleUserProvisioning?: boolean;
 }
 
+/**
+ * Resolve the email a member joins Google groups with.
+ * Prefers the provisioned GWS email over the personal email. This is the
+ * single source of truth for group-membership emails — src/google.ts uses it
+ * to create memberships, and scripts/validate-config.ts uses it to check that
+ * external members only appear in roles that opt into allowExternalMembers.
+ */
+export function resolveGoogleMemberEmail(member: Member): string | undefined {
+  return member.googleEmailPrefix
+    ? `${member.googleEmailPrefix}@modelcontextprotocol.io`
+    : member.email;
+}
+
 /**
  * Sort roles by GitHub parent dependency (topological sort).
  * Ensures parent teams are created before child teams.

src/google.ts

@@ -5,6 +5,7 @@ import * as random from '@pulumi/random';
 import { ROLES, type Role, buildRoleLookup } from './config/roles';
 import { MEMBERS } from './config/users';
 import type { RoleId } from './config/roleIds';
+import { resolveGoogleMemberEmail } from './config/utils';
 
 const roleLookup = buildRoleLookup();
 // Groups keyed by Google group name
@@ -25,6 +26,15 @@ ROLES.forEach((role: Role) => {
     {
       email: groups[role.google.group].email,
 
+      // Permit external (non-workspace) members only on groups whose role
+      // explicitly opts in via allowExternalMembers in config/roles.ts.
+      // Who is actually a member is still governed entirely by config/users.ts;
+      // validate-config enforces that every external member's role opts in.
+      // This field must stay DECLARED: when omitted, the provider defaults it
+      // to false on every `pulumi up`, and Google then silently purges
+      // external-email members ~1-2 days later (#133 incident).
+      allowExternalMembers: role.google.allowExternalMembers ?? false,
+
       // Maximise visibility of group. It's visible in GitHub anyway
       whoCanViewMembership: 'ALL_IN_DOMAIN_CAN_VIEW',
 
@@ -154,12 +164,11 @@ MEMBERS.forEach((member) => {
 // Create group memberships for users
 MEMBERS.forEach((member) => {
   // Prefer the provisioned GWS email over the personal email for group memberships
-  const gwsEmail = member.googleEmailPrefix
-    ? `${member.googleEmailPrefix}@modelcontextprotocol.io`
-    : undefined;
-  const memberEmail = gwsEmail || member.email;
+  const memberEmail = resolveGoogleMemberEmail(member);
   if (!memberEmail) return;
-  const provisionedUser = gwsEmail ? provisionedUsersByEmail[gwsEmail] : undefined;
+  const provisionedUser = member.googleEmailPrefix
+    ? provisionedUsersByEmail[memberEmail]
+    : undefined;
 
   member.memberOf.forEach((roleId: RoleId) => {
     const role = roleLookup.get(roleId);