diff --git a/deploy/README.md b/deploy/README.md index bfa9433..cf942c9 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -14,7 +14,10 @@ reconcile the live GitHub org to match these manifests — including reverting out-of-band changes made in the GitHub UI. - `repositories/` — one `Repository` per managed repo. -- `teams/` — the `maintainers` team, its membership, and team → repo access. +- `teams/` — one `Team` per file (the `maintainers` team, Observe-adopted). +- `team-memberships/` — one `TeamMembership` per file (`add--to-.yaml`). +- `team-repositories/` — one `TeamRepository` per file (`grant--on-.yaml`), + each granting a team a permission on a repo. - `labels/` — one `IssueLabels` per managed repo. The canonical org label taxonomy lives once in `labels/kustomization.yaml` (a shared patch appended to every repo); each `.yaml` adds only that repo's Dependabot/Renovate diff --git a/deploy/kustomization.yaml b/deploy/kustomization.yaml index f5511ca..3414c14 100644 --- a/deploy/kustomization.yaml +++ b/deploy/kustomization.yaml @@ -17,4 +17,6 @@ resources: - provider-config.yaml - repositories/ - teams/ + - team-memberships/ + - team-repositories/ - labels/ diff --git a/deploy/team-memberships/add-devantler-to-maintainers.yaml b/deploy/team-memberships/add-devantler-to-maintainers.yaml new file mode 100644 index 0000000..fa34971 --- /dev/null +++ b/deploy/team-memberships/add-devantler-to-maintainers.yaml @@ -0,0 +1,16 @@ +# The maintainer. A team CODEOWNERS with no members would request no reviewer, so +# the team is given its member here. New desired state (team had no members) → Create. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamMembership +metadata: + name: maintainers-devantler +spec: + managementPolicies: ["Observe", "Create", "Update", "LateInitialize"] + forProvider: + teamIdRef: + name: maintainers + username: devantler + role: maintainer + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/team-memberships/kustomization.yaml b/deploy/team-memberships/kustomization.yaml new file mode 100644 index 0000000..cb76b56 --- /dev/null +++ b/deploy/team-memberships/kustomization.yaml @@ -0,0 +1,7 @@ +# `TeamMembership` resources — one per file, named `add--to-.yaml`. A team +# used as a CODEOWNERS owner needs at least one member, or it requests no reviewer. See +# ../README.md and the platform repo's docs/github-management.md. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - add-devantler-to-maintainers.yaml diff --git a/deploy/team-repositories/grant-maintainers-on-actions.yaml b/deploy/team-repositories/grant-maintainers-on-actions.yaml new file mode 100644 index 0000000..35cb057 --- /dev/null +++ b/deploy/team-repositories/grant-maintainers-on-actions.yaml @@ -0,0 +1,18 @@ +# Team → repository access, adopted Observe-first (read-only). +# external-name = `:`. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-actions + annotations: + crossplane.io/external-name: "17046606:actions" +spec: + managementPolicies: ["Observe"] + forProvider: + teamIdRef: + name: maintainers + repository: actions + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/team-repositories/grant-maintainers-on-dotnet-template.yaml b/deploy/team-repositories/grant-maintainers-on-dotnet-template.yaml new file mode 100644 index 0000000..af00748 --- /dev/null +++ b/deploy/team-repositories/grant-maintainers-on-dotnet-template.yaml @@ -0,0 +1,18 @@ +# Team → repository access, adopted Observe-first (read-only). +# external-name = `:`. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-dotnet-template + annotations: + crossplane.io/external-name: "17046606:dotnet-template" +spec: + managementPolicies: ["Observe"] + forProvider: + teamIdRef: + name: maintainers + repository: dotnet-template + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/team-repositories/grant-maintainers-on-gitops-tenant-template.yaml b/deploy/team-repositories/grant-maintainers-on-gitops-tenant-template.yaml new file mode 100644 index 0000000..8d06b7a --- /dev/null +++ b/deploy/team-repositories/grant-maintainers-on-gitops-tenant-template.yaml @@ -0,0 +1,16 @@ +# Team → repository access. No external-name: this grant did not exist yet, so it is +# Created (full management except Delete) rather than adopted. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-gitops-tenant-template +spec: + managementPolicies: ["Observe", "Create", "Update", "LateInitialize"] + forProvider: + teamIdRef: + name: maintainers + repository: gitops-tenant-template + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/team-repositories/grant-maintainers-on-go-template.yaml b/deploy/team-repositories/grant-maintainers-on-go-template.yaml new file mode 100644 index 0000000..9383b1b --- /dev/null +++ b/deploy/team-repositories/grant-maintainers-on-go-template.yaml @@ -0,0 +1,18 @@ +# Team → repository access, adopted Observe-first (read-only). +# external-name = `:`. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-go-template + annotations: + crossplane.io/external-name: "17046606:go-template" +spec: + managementPolicies: ["Observe"] + forProvider: + teamIdRef: + name: maintainers + repository: go-template + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/team-repositories/grant-maintainers-on-homebrew-tap.yaml b/deploy/team-repositories/grant-maintainers-on-homebrew-tap.yaml new file mode 100644 index 0000000..d8a969c --- /dev/null +++ b/deploy/team-repositories/grant-maintainers-on-homebrew-tap.yaml @@ -0,0 +1,16 @@ +# Team → repository access. No external-name: this grant did not exist yet, so it is +# Created (full management except Delete) rather than adopted. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-homebrew-tap +spec: + managementPolicies: ["Observe", "Create", "Update", "LateInitialize"] + forProvider: + teamIdRef: + name: maintainers + repository: homebrew-tap + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/team-repositories/grant-maintainers-on-ksail.yaml b/deploy/team-repositories/grant-maintainers-on-ksail.yaml new file mode 100644 index 0000000..0d013b6 --- /dev/null +++ b/deploy/team-repositories/grant-maintainers-on-ksail.yaml @@ -0,0 +1,18 @@ +# Team → repository access, adopted Observe-first (read-only). +# external-name = `:`. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-ksail + annotations: + crossplane.io/external-name: "17046606:ksail" +spec: + managementPolicies: ["Observe"] + forProvider: + teamIdRef: + name: maintainers + repository: ksail + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/team-repositories/grant-maintainers-on-monorepo.yaml b/deploy/team-repositories/grant-maintainers-on-monorepo.yaml new file mode 100644 index 0000000..18da786 --- /dev/null +++ b/deploy/team-repositories/grant-maintainers-on-monorepo.yaml @@ -0,0 +1,18 @@ +# Team → repository access, adopted Observe-first (read-only). +# external-name = `:`. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-monorepo + annotations: + crossplane.io/external-name: "17046606:monorepo" +spec: + managementPolicies: ["Observe"] + forProvider: + teamIdRef: + name: maintainers + repository: monorepo + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/team-repositories/grant-maintainers-on-platform-template.yaml b/deploy/team-repositories/grant-maintainers-on-platform-template.yaml new file mode 100644 index 0000000..2ee345c --- /dev/null +++ b/deploy/team-repositories/grant-maintainers-on-platform-template.yaml @@ -0,0 +1,16 @@ +# Team → repository access. No external-name: this grant did not exist yet, so it is +# Created (full management except Delete) rather than adopted. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-platform-template +spec: + managementPolicies: ["Observe", "Create", "Update", "LateInitialize"] + forProvider: + teamIdRef: + name: maintainers + repository: platform-template + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/team-repositories/grant-maintainers-on-platform.yaml b/deploy/team-repositories/grant-maintainers-on-platform.yaml new file mode 100644 index 0000000..af525dd --- /dev/null +++ b/deploy/team-repositories/grant-maintainers-on-platform.yaml @@ -0,0 +1,18 @@ +# Team → repository access, adopted Observe-first (read-only). +# external-name = `:`. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-platform + annotations: + crossplane.io/external-name: "17046606:platform" +spec: + managementPolicies: ["Observe"] + forProvider: + teamIdRef: + name: maintainers + repository: platform + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/team-repositories/grant-maintainers-on-reusable-workflows.yaml b/deploy/team-repositories/grant-maintainers-on-reusable-workflows.yaml new file mode 100644 index 0000000..9eefbaa --- /dev/null +++ b/deploy/team-repositories/grant-maintainers-on-reusable-workflows.yaml @@ -0,0 +1,18 @@ +# Team → repository access, adopted Observe-first (read-only). +# external-name = `:`. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-reusable-workflows + annotations: + crossplane.io/external-name: "17046606:reusable-workflows" +spec: + managementPolicies: ["Observe"] + forProvider: + teamIdRef: + name: maintainers + repository: reusable-workflows + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/team-repositories/grant-maintainers-on-unifi.yaml b/deploy/team-repositories/grant-maintainers-on-unifi.yaml new file mode 100644 index 0000000..b882046 --- /dev/null +++ b/deploy/team-repositories/grant-maintainers-on-unifi.yaml @@ -0,0 +1,16 @@ +# Team → repository access. No external-name: this grant did not exist yet, so it is +# Created (full management except Delete) rather than adopted. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-unifi +spec: + managementPolicies: ["Observe", "Create", "Update", "LateInitialize"] + forProvider: + teamIdRef: + name: maintainers + repository: unifi + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/team-repositories/kustomization.yaml b/deploy/team-repositories/kustomization.yaml new file mode 100644 index 0000000..af5617d --- /dev/null +++ b/deploy/team-repositories/kustomization.yaml @@ -0,0 +1,21 @@ +# `TeamRepository` resources — one per file, named `grant--on-.yaml`, each +# granting a team a permission on a repository. Existing access is adopted Observe-first; +# access the team did not yet hold is Created at `maintain`. Grant a new repo by dropping +# a `grant-maintainers-on-.yaml` here and listing it below. See ../README.md and +# the platform repo's docs/github-management.md. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + # Observe-adopted (access already existed). + - grant-maintainers-on-actions.yaml + - grant-maintainers-on-dotnet-template.yaml + - grant-maintainers-on-go-template.yaml + - grant-maintainers-on-ksail.yaml + - grant-maintainers-on-monorepo.yaml + - grant-maintainers-on-platform.yaml + - grant-maintainers-on-reusable-workflows.yaml + # Created (grant did not exist yet). + - grant-maintainers-on-gitops-tenant-template.yaml + - grant-maintainers-on-platform-template.yaml + - grant-maintainers-on-unifi.yaml + - grant-maintainers-on-homebrew-tap.yaml diff --git a/deploy/teams/kustomization.yaml b/deploy/teams/kustomization.yaml index 10254ad..f41045b 100644 --- a/deploy/teams/kustomization.yaml +++ b/deploy/teams/kustomization.yaml @@ -1,5 +1,7 @@ -# One file per managed team: the Team (Observe-adopted), its memberships, and its -# team -> repository access. See ../README.md and the platform repo's +# The `maintainers` team — the canonical CODEOWNERS owner across the devantler-tech +# suite (the "teams over individuals" convention), Observe-adopted by numeric id. One +# `Team` per file. Its membership lives in ../team-memberships/ and its team → repository +# access in ../team-repositories/. See ../README.md and the platform repo's # docs/github-management.md for the Observe-first adoption flow. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization diff --git a/deploy/teams/maintainers.yaml b/deploy/teams/maintainers.yaml index cfffcd7..973b72c 100644 --- a/deploy/teams/maintainers.yaml +++ b/deploy/teams/maintainers.yaml @@ -1,9 +1,7 @@ # The `maintainers` team — the canonical CODEOWNERS owner across the devantler-tech -# suite (the "teams over individuals" convention). Its membership and repo access -# are declared here so team ownership is GitOps-managed, never granted out-of-band -# via the GitHub UI/API. Existing access is adopted Observe-first; access the team -# did not yet hold is Created at `maintain`. Extend the per-repo list as more repos -# adopt the team CODEOWNERS. +# suite (the "teams over individuals" convention), adopted Observe-first (read-only). +# Its membership lives one-per-file in ../team-memberships/ and its team → repository +# access in ../team-repositories/. apiVersion: team.github.m.upbound.io/v1alpha1 kind: Team metadata: @@ -21,199 +19,3 @@ spec: providerConfigRef: kind: ProviderConfig name: default ---- -# The maintainer. A team CODEOWNERS with no members would request no reviewer, so -# the team is given its member here. New desired state (team had no members) → Create. -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamMembership -metadata: - name: maintainers-devantler -spec: - managementPolicies: ["Observe", "Create", "Update", "LateInitialize"] - forProvider: - teamIdRef: - name: maintainers - username: devantler - role: maintainer - providerConfigRef: - kind: ProviderConfig - name: default ---- -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamRepository -metadata: - name: maintainers-actions - annotations: - crossplane.io/external-name: "17046606:actions" -spec: - managementPolicies: ["Observe"] - forProvider: - teamIdRef: - name: maintainers - repository: actions - permission: maintain - providerConfigRef: - kind: ProviderConfig - name: default ---- -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamRepository -metadata: - name: maintainers-dotnet-template - annotations: - crossplane.io/external-name: "17046606:dotnet-template" -spec: - managementPolicies: ["Observe"] - forProvider: - teamIdRef: - name: maintainers - repository: dotnet-template - permission: maintain - providerConfigRef: - kind: ProviderConfig - name: default ---- -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamRepository -metadata: - name: maintainers-go-template - annotations: - crossplane.io/external-name: "17046606:go-template" -spec: - managementPolicies: ["Observe"] - forProvider: - teamIdRef: - name: maintainers - repository: go-template - permission: maintain - providerConfigRef: - kind: ProviderConfig - name: default ---- -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamRepository -metadata: - name: maintainers-ksail - annotations: - crossplane.io/external-name: "17046606:ksail" -spec: - managementPolicies: ["Observe"] - forProvider: - teamIdRef: - name: maintainers - repository: ksail - permission: maintain - providerConfigRef: - kind: ProviderConfig - name: default ---- -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamRepository -metadata: - name: maintainers-monorepo - annotations: - crossplane.io/external-name: "17046606:monorepo" -spec: - managementPolicies: ["Observe"] - forProvider: - teamIdRef: - name: maintainers - repository: monorepo - permission: maintain - providerConfigRef: - kind: ProviderConfig - name: default ---- -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamRepository -metadata: - name: maintainers-platform - annotations: - crossplane.io/external-name: "17046606:platform" -spec: - managementPolicies: ["Observe"] - forProvider: - teamIdRef: - name: maintainers - repository: platform - permission: maintain - providerConfigRef: - kind: ProviderConfig - name: default ---- -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamRepository -metadata: - name: maintainers-reusable-workflows - annotations: - crossplane.io/external-name: "17046606:reusable-workflows" -spec: - managementPolicies: ["Observe"] - forProvider: - teamIdRef: - name: maintainers - repository: reusable-workflows - permission: maintain - providerConfigRef: - kind: ProviderConfig - name: default ---- -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamRepository -metadata: - name: maintainers-gitops-tenant-template -spec: - managementPolicies: ["Observe", "Create", "Update", "LateInitialize"] - forProvider: - teamIdRef: - name: maintainers - repository: gitops-tenant-template - permission: maintain - providerConfigRef: - kind: ProviderConfig - name: default ---- -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamRepository -metadata: - name: maintainers-platform-template -spec: - managementPolicies: ["Observe", "Create", "Update", "LateInitialize"] - forProvider: - teamIdRef: - name: maintainers - repository: platform-template - permission: maintain - providerConfigRef: - kind: ProviderConfig - name: default ---- -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamRepository -metadata: - name: maintainers-unifi -spec: - managementPolicies: ["Observe", "Create", "Update", "LateInitialize"] - forProvider: - teamIdRef: - name: maintainers - repository: unifi - permission: maintain - providerConfigRef: - kind: ProviderConfig - name: default ---- -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamRepository -metadata: - name: maintainers-homebrew-tap -spec: - managementPolicies: ["Observe", "Create", "Update", "LateInitialize"] - forProvider: - teamIdRef: - name: maintainers - repository: homebrew-tap - permission: maintain - providerConfigRef: - kind: ProviderConfig - name: default