From 986467921e67600831f4c95e030aefc80dac5565 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Thu, 25 Jun 2026 20:01:59 +0200 Subject: [PATCH 1/2] refactor(github): one team resource per file in deploy/teams/ Per the maintainer's one-resource-per-file preference: split the 13-resource deploy/teams/maintainers.yaml (Team + TeamMembership + 11 TeamRepository) into one file per resource (filename = resource name, matching ../repositories/). The directory-level explanation moves to teams/kustomization.yaml. Behaviour-preserving: the rendered set of 13 team resources is byte-identical before/after the split (verified via kustomize build diff). Co-Authored-By: Claude Opus 4.8 --- deploy/teams/kustomization.yaml | 24 ++- deploy/teams/maintainers-actions.yaml | 18 ++ deploy/teams/maintainers-devantler.yaml | 16 ++ deploy/teams/maintainers-dotnet-template.yaml | 18 ++ .../maintainers-gitops-tenant-template.yaml | 16 ++ deploy/teams/maintainers-go-template.yaml | 18 ++ deploy/teams/maintainers-homebrew-tap.yaml | 16 ++ deploy/teams/maintainers-ksail.yaml | 18 ++ deploy/teams/maintainers-monorepo.yaml | 18 ++ .../teams/maintainers-platform-template.yaml | 16 ++ deploy/teams/maintainers-platform.yaml | 18 ++ .../teams/maintainers-reusable-workflows.yaml | 18 ++ deploy/teams/maintainers-unifi.yaml | 16 ++ deploy/teams/maintainers.yaml | 204 +----------------- 14 files changed, 230 insertions(+), 204 deletions(-) create mode 100644 deploy/teams/maintainers-actions.yaml create mode 100644 deploy/teams/maintainers-devantler.yaml create mode 100644 deploy/teams/maintainers-dotnet-template.yaml create mode 100644 deploy/teams/maintainers-gitops-tenant-template.yaml create mode 100644 deploy/teams/maintainers-go-template.yaml create mode 100644 deploy/teams/maintainers-homebrew-tap.yaml create mode 100644 deploy/teams/maintainers-ksail.yaml create mode 100644 deploy/teams/maintainers-monorepo.yaml create mode 100644 deploy/teams/maintainers-platform-template.yaml create mode 100644 deploy/teams/maintainers-platform.yaml create mode 100644 deploy/teams/maintainers-reusable-workflows.yaml create mode 100644 deploy/teams/maintainers-unifi.yaml diff --git a/deploy/teams/kustomization.yaml b/deploy/teams/kustomization.yaml index 10254ad..455f828 100644 --- a/deploy/teams/kustomization.yaml +++ b/deploy/teams/kustomization.yaml @@ -1,7 +1,25 @@ -# One file per managed team: the Team (Observe-adopted), its memberships, and its -# team -> repository access. See ../README.md and the platform repo's -# docs/github-management.md for the Observe-first adoption flow. +# The `maintainers` team — the canonical CODEOWNERS owner across the devantler-tech +# suite (the "teams over individuals" convention). One resource per file: the Team +# (Observe-adopted by numeric id), its membership, and its team → repository access +# grants. Existing access is adopted Observe-first; access the team did not yet hold is +# Created at `maintain`. See ../README.md and the platform repo's docs/github-management.md +# for the Observe-first adoption flow. Grant a new repo by dropping a +# maintainers-.yaml here and listing it below. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - maintainers.yaml + - maintainers-devantler.yaml + # Team → repository access (Observe-adopted). + - maintainers-actions.yaml + - maintainers-dotnet-template.yaml + - maintainers-go-template.yaml + - maintainers-ksail.yaml + - maintainers-monorepo.yaml + - maintainers-platform.yaml + - maintainers-reusable-workflows.yaml + # Team → repository access (Created — grant did not exist yet). + - maintainers-gitops-tenant-template.yaml + - maintainers-platform-template.yaml + - maintainers-unifi.yaml + - maintainers-homebrew-tap.yaml diff --git a/deploy/teams/maintainers-actions.yaml b/deploy/teams/maintainers-actions.yaml new file mode 100644 index 0000000..35cb057 --- /dev/null +++ b/deploy/teams/maintainers-actions.yaml @@ -0,0 +1,18 @@ +# Team → repository access, adopted Observe-first (read-only). +# external-name = `:`. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-actions + annotations: + crossplane.io/external-name: "17046606:actions" +spec: + managementPolicies: ["Observe"] + forProvider: + teamIdRef: + name: maintainers + repository: actions + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/teams/maintainers-devantler.yaml b/deploy/teams/maintainers-devantler.yaml new file mode 100644 index 0000000..fa34971 --- /dev/null +++ b/deploy/teams/maintainers-devantler.yaml @@ -0,0 +1,16 @@ +# The maintainer. A team CODEOWNERS with no members would request no reviewer, so +# the team is given its member here. New desired state (team had no members) → Create. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamMembership +metadata: + name: maintainers-devantler +spec: + managementPolicies: ["Observe", "Create", "Update", "LateInitialize"] + forProvider: + teamIdRef: + name: maintainers + username: devantler + role: maintainer + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/teams/maintainers-dotnet-template.yaml b/deploy/teams/maintainers-dotnet-template.yaml new file mode 100644 index 0000000..af00748 --- /dev/null +++ b/deploy/teams/maintainers-dotnet-template.yaml @@ -0,0 +1,18 @@ +# Team → repository access, adopted Observe-first (read-only). +# external-name = `:`. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-dotnet-template + annotations: + crossplane.io/external-name: "17046606:dotnet-template" +spec: + managementPolicies: ["Observe"] + forProvider: + teamIdRef: + name: maintainers + repository: dotnet-template + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/teams/maintainers-gitops-tenant-template.yaml b/deploy/teams/maintainers-gitops-tenant-template.yaml new file mode 100644 index 0000000..8d06b7a --- /dev/null +++ b/deploy/teams/maintainers-gitops-tenant-template.yaml @@ -0,0 +1,16 @@ +# Team → repository access. No external-name: this grant did not exist yet, so it is +# Created (full management except Delete) rather than adopted. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-gitops-tenant-template +spec: + managementPolicies: ["Observe", "Create", "Update", "LateInitialize"] + forProvider: + teamIdRef: + name: maintainers + repository: gitops-tenant-template + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/teams/maintainers-go-template.yaml b/deploy/teams/maintainers-go-template.yaml new file mode 100644 index 0000000..9383b1b --- /dev/null +++ b/deploy/teams/maintainers-go-template.yaml @@ -0,0 +1,18 @@ +# Team → repository access, adopted Observe-first (read-only). +# external-name = `:`. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-go-template + annotations: + crossplane.io/external-name: "17046606:go-template" +spec: + managementPolicies: ["Observe"] + forProvider: + teamIdRef: + name: maintainers + repository: go-template + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/teams/maintainers-homebrew-tap.yaml b/deploy/teams/maintainers-homebrew-tap.yaml new file mode 100644 index 0000000..d8a969c --- /dev/null +++ b/deploy/teams/maintainers-homebrew-tap.yaml @@ -0,0 +1,16 @@ +# Team → repository access. No external-name: this grant did not exist yet, so it is +# Created (full management except Delete) rather than adopted. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-homebrew-tap +spec: + managementPolicies: ["Observe", "Create", "Update", "LateInitialize"] + forProvider: + teamIdRef: + name: maintainers + repository: homebrew-tap + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/teams/maintainers-ksail.yaml b/deploy/teams/maintainers-ksail.yaml new file mode 100644 index 0000000..0d013b6 --- /dev/null +++ b/deploy/teams/maintainers-ksail.yaml @@ -0,0 +1,18 @@ +# Team → repository access, adopted Observe-first (read-only). +# external-name = `:`. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-ksail + annotations: + crossplane.io/external-name: "17046606:ksail" +spec: + managementPolicies: ["Observe"] + forProvider: + teamIdRef: + name: maintainers + repository: ksail + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/teams/maintainers-monorepo.yaml b/deploy/teams/maintainers-monorepo.yaml new file mode 100644 index 0000000..18da786 --- /dev/null +++ b/deploy/teams/maintainers-monorepo.yaml @@ -0,0 +1,18 @@ +# Team → repository access, adopted Observe-first (read-only). +# external-name = `:`. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-monorepo + annotations: + crossplane.io/external-name: "17046606:monorepo" +spec: + managementPolicies: ["Observe"] + forProvider: + teamIdRef: + name: maintainers + repository: monorepo + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/teams/maintainers-platform-template.yaml b/deploy/teams/maintainers-platform-template.yaml new file mode 100644 index 0000000..2ee345c --- /dev/null +++ b/deploy/teams/maintainers-platform-template.yaml @@ -0,0 +1,16 @@ +# Team → repository access. No external-name: this grant did not exist yet, so it is +# Created (full management except Delete) rather than adopted. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-platform-template +spec: + managementPolicies: ["Observe", "Create", "Update", "LateInitialize"] + forProvider: + teamIdRef: + name: maintainers + repository: platform-template + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/teams/maintainers-platform.yaml b/deploy/teams/maintainers-platform.yaml new file mode 100644 index 0000000..af525dd --- /dev/null +++ b/deploy/teams/maintainers-platform.yaml @@ -0,0 +1,18 @@ +# Team → repository access, adopted Observe-first (read-only). +# external-name = `:`. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-platform + annotations: + crossplane.io/external-name: "17046606:platform" +spec: + managementPolicies: ["Observe"] + forProvider: + teamIdRef: + name: maintainers + repository: platform + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/teams/maintainers-reusable-workflows.yaml b/deploy/teams/maintainers-reusable-workflows.yaml new file mode 100644 index 0000000..9eefbaa --- /dev/null +++ b/deploy/teams/maintainers-reusable-workflows.yaml @@ -0,0 +1,18 @@ +# Team → repository access, adopted Observe-first (read-only). +# external-name = `:`. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-reusable-workflows + annotations: + crossplane.io/external-name: "17046606:reusable-workflows" +spec: + managementPolicies: ["Observe"] + forProvider: + teamIdRef: + name: maintainers + repository: reusable-workflows + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/teams/maintainers-unifi.yaml b/deploy/teams/maintainers-unifi.yaml new file mode 100644 index 0000000..b882046 --- /dev/null +++ b/deploy/teams/maintainers-unifi.yaml @@ -0,0 +1,16 @@ +# Team → repository access. No external-name: this grant did not exist yet, so it is +# Created (full management except Delete) rather than adopted. +apiVersion: team.github.m.upbound.io/v1alpha1 +kind: TeamRepository +metadata: + name: maintainers-unifi +spec: + managementPolicies: ["Observe", "Create", "Update", "LateInitialize"] + forProvider: + teamIdRef: + name: maintainers + repository: unifi + permission: maintain + providerConfigRef: + kind: ProviderConfig + name: default diff --git a/deploy/teams/maintainers.yaml b/deploy/teams/maintainers.yaml index cfffcd7..1663649 100644 --- a/deploy/teams/maintainers.yaml +++ b/deploy/teams/maintainers.yaml @@ -1,9 +1,7 @@ # The `maintainers` team — the canonical CODEOWNERS owner across the devantler-tech -# suite (the "teams over individuals" convention). Its membership and repo access -# are declared here so team ownership is GitOps-managed, never granted out-of-band -# via the GitHub UI/API. Existing access is adopted Observe-first; access the team -# did not yet hold is Created at `maintain`. Extend the per-repo list as more repos -# adopt the team CODEOWNERS. +# suite (the "teams over individuals" convention), adopted Observe-first (read-only). +# Its membership and team → repository access live one-per-file in the sibling +# maintainers-*.yaml files. apiVersion: team.github.m.upbound.io/v1alpha1 kind: Team metadata: @@ -21,199 +19,3 @@ spec: providerConfigRef: kind: ProviderConfig name: default ---- -# The maintainer. A team CODEOWNERS with no members would request no reviewer, so -# the team is given its member here. New desired state (team had no members) → Create. -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamMembership -metadata: - name: maintainers-devantler -spec: - managementPolicies: ["Observe", "Create", "Update", "LateInitialize"] - forProvider: - teamIdRef: - name: maintainers - username: devantler - role: maintainer - providerConfigRef: - kind: ProviderConfig - name: default ---- -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamRepository -metadata: - name: maintainers-actions - annotations: - crossplane.io/external-name: "17046606:actions" -spec: - managementPolicies: ["Observe"] - forProvider: - teamIdRef: - name: maintainers - repository: actions - permission: maintain - providerConfigRef: - kind: ProviderConfig - name: default ---- -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamRepository -metadata: - name: maintainers-dotnet-template - annotations: - crossplane.io/external-name: "17046606:dotnet-template" -spec: - managementPolicies: ["Observe"] - forProvider: - teamIdRef: - name: maintainers - repository: dotnet-template - permission: maintain - providerConfigRef: - kind: ProviderConfig - name: default ---- -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamRepository -metadata: - name: maintainers-go-template - annotations: - crossplane.io/external-name: "17046606:go-template" -spec: - managementPolicies: ["Observe"] - forProvider: - teamIdRef: - name: maintainers - repository: go-template - permission: maintain - providerConfigRef: - kind: ProviderConfig - name: default ---- -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamRepository -metadata: - name: maintainers-ksail - annotations: - crossplane.io/external-name: "17046606:ksail" -spec: - managementPolicies: ["Observe"] - forProvider: - teamIdRef: - name: maintainers - repository: ksail - permission: maintain - providerConfigRef: - kind: ProviderConfig - name: default ---- -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamRepository -metadata: - name: maintainers-monorepo - annotations: - crossplane.io/external-name: "17046606:monorepo" -spec: - managementPolicies: ["Observe"] - forProvider: - teamIdRef: - name: maintainers - repository: monorepo - permission: maintain - providerConfigRef: - kind: ProviderConfig - name: default ---- -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamRepository -metadata: - name: maintainers-platform - annotations: - crossplane.io/external-name: "17046606:platform" -spec: - managementPolicies: ["Observe"] - forProvider: - teamIdRef: - name: maintainers - repository: platform - permission: maintain - providerConfigRef: - kind: ProviderConfig - name: default ---- -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamRepository -metadata: - name: maintainers-reusable-workflows - annotations: - crossplane.io/external-name: "17046606:reusable-workflows" -spec: - managementPolicies: ["Observe"] - forProvider: - teamIdRef: - name: maintainers - repository: reusable-workflows - permission: maintain - providerConfigRef: - kind: ProviderConfig - name: default ---- -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamRepository -metadata: - name: maintainers-gitops-tenant-template -spec: - managementPolicies: ["Observe", "Create", "Update", "LateInitialize"] - forProvider: - teamIdRef: - name: maintainers - repository: gitops-tenant-template - permission: maintain - providerConfigRef: - kind: ProviderConfig - name: default ---- -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamRepository -metadata: - name: maintainers-platform-template -spec: - managementPolicies: ["Observe", "Create", "Update", "LateInitialize"] - forProvider: - teamIdRef: - name: maintainers - repository: platform-template - permission: maintain - providerConfigRef: - kind: ProviderConfig - name: default ---- -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamRepository -metadata: - name: maintainers-unifi -spec: - managementPolicies: ["Observe", "Create", "Update", "LateInitialize"] - forProvider: - teamIdRef: - name: maintainers - repository: unifi - permission: maintain - providerConfigRef: - kind: ProviderConfig - name: default ---- -apiVersion: team.github.m.upbound.io/v1alpha1 -kind: TeamRepository -metadata: - name: maintainers-homebrew-tap -spec: - managementPolicies: ["Observe", "Create", "Update", "LateInitialize"] - forProvider: - teamIdRef: - name: maintainers - repository: homebrew-tap - permission: maintain - providerConfigRef: - kind: ProviderConfig - name: default From 6c227a0d2f528bba89368084606a018d99d4012a Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Thu, 25 Jun 2026 20:18:57 +0200 Subject: [PATCH 2/2] refactor(github): one subfolder per team CR kind with active-verb filenames MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit deploy/teams/ mixed three kinds (Team, TeamMembership, TeamRepository) under ambiguous maintainers- names. Split into one subfolder per CR kind, each with an active-verb filename pattern so a file's purpose is clear and files in a folder share one convention: - teams/ — Team (maintainers.yaml) - team-memberships/ — TeamMembership (add--to-.yaml) - team-repositories/— TeamRepository (grant--on-.yaml) Pure rename + kustomization re-wiring; resource bodies (incl. metadata.name and crossplane.io/external-name) are unchanged, so there is no Crossplane resource churn. `kubectl kustomize deploy/` validated (1 Team, 1 TeamMembership, 11 TeamRepository). Co-Authored-By: Claude Opus 4.8 --- deploy/README.md | 5 +++- deploy/kustomization.yaml | 2 ++ .../add-devantler-to-maintainers.yaml} | 0 deploy/team-memberships/kustomization.yaml | 7 ++++++ .../grant-maintainers-on-actions.yaml} | 0 ...grant-maintainers-on-dotnet-template.yaml} | 0 ...aintainers-on-gitops-tenant-template.yaml} | 0 .../grant-maintainers-on-go-template.yaml} | 0 .../grant-maintainers-on-homebrew-tap.yaml} | 0 .../grant-maintainers-on-ksail.yaml} | 0 .../grant-maintainers-on-monorepo.yaml} | 0 ...ant-maintainers-on-platform-template.yaml} | 0 .../grant-maintainers-on-platform.yaml} | 0 ...nt-maintainers-on-reusable-workflows.yaml} | 0 .../grant-maintainers-on-unifi.yaml} | 0 deploy/team-repositories/kustomization.yaml | 21 ++++++++++++++++ deploy/teams/kustomization.yaml | 24 ++++--------------- deploy/teams/maintainers.yaml | 4 ++-- 18 files changed, 40 insertions(+), 23 deletions(-) rename deploy/{teams/maintainers-devantler.yaml => team-memberships/add-devantler-to-maintainers.yaml} (100%) create mode 100644 deploy/team-memberships/kustomization.yaml rename deploy/{teams/maintainers-actions.yaml => team-repositories/grant-maintainers-on-actions.yaml} (100%) rename deploy/{teams/maintainers-dotnet-template.yaml => team-repositories/grant-maintainers-on-dotnet-template.yaml} (100%) rename deploy/{teams/maintainers-gitops-tenant-template.yaml => team-repositories/grant-maintainers-on-gitops-tenant-template.yaml} (100%) rename deploy/{teams/maintainers-go-template.yaml => team-repositories/grant-maintainers-on-go-template.yaml} (100%) rename deploy/{teams/maintainers-homebrew-tap.yaml => team-repositories/grant-maintainers-on-homebrew-tap.yaml} (100%) rename deploy/{teams/maintainers-ksail.yaml => team-repositories/grant-maintainers-on-ksail.yaml} (100%) rename deploy/{teams/maintainers-monorepo.yaml => team-repositories/grant-maintainers-on-monorepo.yaml} (100%) rename deploy/{teams/maintainers-platform-template.yaml => team-repositories/grant-maintainers-on-platform-template.yaml} (100%) rename deploy/{teams/maintainers-platform.yaml => team-repositories/grant-maintainers-on-platform.yaml} (100%) rename deploy/{teams/maintainers-reusable-workflows.yaml => team-repositories/grant-maintainers-on-reusable-workflows.yaml} (100%) rename deploy/{teams/maintainers-unifi.yaml => team-repositories/grant-maintainers-on-unifi.yaml} (100%) create mode 100644 deploy/team-repositories/kustomization.yaml diff --git a/deploy/README.md b/deploy/README.md index bfa9433..cf942c9 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -14,7 +14,10 @@ reconcile the live GitHub org to match these manifests — including reverting out-of-band changes made in the GitHub UI. - `repositories/` — one `Repository` per managed repo. -- `teams/` — the `maintainers` team, its membership, and team → repo access. +- `teams/` — one `Team` per file (the `maintainers` team, Observe-adopted). +- `team-memberships/` — one `TeamMembership` per file (`add--to-.yaml`). +- `team-repositories/` — one `TeamRepository` per file (`grant--on-.yaml`), + each granting a team a permission on a repo. - `labels/` — one `IssueLabels` per managed repo. The canonical org label taxonomy lives once in `labels/kustomization.yaml` (a shared patch appended to every repo); each `.yaml` adds only that repo's Dependabot/Renovate diff --git a/deploy/kustomization.yaml b/deploy/kustomization.yaml index f5511ca..3414c14 100644 --- a/deploy/kustomization.yaml +++ b/deploy/kustomization.yaml @@ -17,4 +17,6 @@ resources: - provider-config.yaml - repositories/ - teams/ + - team-memberships/ + - team-repositories/ - labels/ diff --git a/deploy/teams/maintainers-devantler.yaml b/deploy/team-memberships/add-devantler-to-maintainers.yaml similarity index 100% rename from deploy/teams/maintainers-devantler.yaml rename to deploy/team-memberships/add-devantler-to-maintainers.yaml diff --git a/deploy/team-memberships/kustomization.yaml b/deploy/team-memberships/kustomization.yaml new file mode 100644 index 0000000..cb76b56 --- /dev/null +++ b/deploy/team-memberships/kustomization.yaml @@ -0,0 +1,7 @@ +# `TeamMembership` resources — one per file, named `add--to-.yaml`. A team +# used as a CODEOWNERS owner needs at least one member, or it requests no reviewer. See +# ../README.md and the platform repo's docs/github-management.md. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - add-devantler-to-maintainers.yaml diff --git a/deploy/teams/maintainers-actions.yaml b/deploy/team-repositories/grant-maintainers-on-actions.yaml similarity index 100% rename from deploy/teams/maintainers-actions.yaml rename to deploy/team-repositories/grant-maintainers-on-actions.yaml diff --git a/deploy/teams/maintainers-dotnet-template.yaml b/deploy/team-repositories/grant-maintainers-on-dotnet-template.yaml similarity index 100% rename from deploy/teams/maintainers-dotnet-template.yaml rename to deploy/team-repositories/grant-maintainers-on-dotnet-template.yaml diff --git a/deploy/teams/maintainers-gitops-tenant-template.yaml b/deploy/team-repositories/grant-maintainers-on-gitops-tenant-template.yaml similarity index 100% rename from deploy/teams/maintainers-gitops-tenant-template.yaml rename to deploy/team-repositories/grant-maintainers-on-gitops-tenant-template.yaml diff --git a/deploy/teams/maintainers-go-template.yaml b/deploy/team-repositories/grant-maintainers-on-go-template.yaml similarity index 100% rename from deploy/teams/maintainers-go-template.yaml rename to deploy/team-repositories/grant-maintainers-on-go-template.yaml diff --git a/deploy/teams/maintainers-homebrew-tap.yaml b/deploy/team-repositories/grant-maintainers-on-homebrew-tap.yaml similarity index 100% rename from deploy/teams/maintainers-homebrew-tap.yaml rename to deploy/team-repositories/grant-maintainers-on-homebrew-tap.yaml diff --git a/deploy/teams/maintainers-ksail.yaml b/deploy/team-repositories/grant-maintainers-on-ksail.yaml similarity index 100% rename from deploy/teams/maintainers-ksail.yaml rename to deploy/team-repositories/grant-maintainers-on-ksail.yaml diff --git a/deploy/teams/maintainers-monorepo.yaml b/deploy/team-repositories/grant-maintainers-on-monorepo.yaml similarity index 100% rename from deploy/teams/maintainers-monorepo.yaml rename to deploy/team-repositories/grant-maintainers-on-monorepo.yaml diff --git a/deploy/teams/maintainers-platform-template.yaml b/deploy/team-repositories/grant-maintainers-on-platform-template.yaml similarity index 100% rename from deploy/teams/maintainers-platform-template.yaml rename to deploy/team-repositories/grant-maintainers-on-platform-template.yaml diff --git a/deploy/teams/maintainers-platform.yaml b/deploy/team-repositories/grant-maintainers-on-platform.yaml similarity index 100% rename from deploy/teams/maintainers-platform.yaml rename to deploy/team-repositories/grant-maintainers-on-platform.yaml diff --git a/deploy/teams/maintainers-reusable-workflows.yaml b/deploy/team-repositories/grant-maintainers-on-reusable-workflows.yaml similarity index 100% rename from deploy/teams/maintainers-reusable-workflows.yaml rename to deploy/team-repositories/grant-maintainers-on-reusable-workflows.yaml diff --git a/deploy/teams/maintainers-unifi.yaml b/deploy/team-repositories/grant-maintainers-on-unifi.yaml similarity index 100% rename from deploy/teams/maintainers-unifi.yaml rename to deploy/team-repositories/grant-maintainers-on-unifi.yaml diff --git a/deploy/team-repositories/kustomization.yaml b/deploy/team-repositories/kustomization.yaml new file mode 100644 index 0000000..af5617d --- /dev/null +++ b/deploy/team-repositories/kustomization.yaml @@ -0,0 +1,21 @@ +# `TeamRepository` resources — one per file, named `grant--on-.yaml`, each +# granting a team a permission on a repository. Existing access is adopted Observe-first; +# access the team did not yet hold is Created at `maintain`. Grant a new repo by dropping +# a `grant-maintainers-on-.yaml` here and listing it below. See ../README.md and +# the platform repo's docs/github-management.md. +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + # Observe-adopted (access already existed). + - grant-maintainers-on-actions.yaml + - grant-maintainers-on-dotnet-template.yaml + - grant-maintainers-on-go-template.yaml + - grant-maintainers-on-ksail.yaml + - grant-maintainers-on-monorepo.yaml + - grant-maintainers-on-platform.yaml + - grant-maintainers-on-reusable-workflows.yaml + # Created (grant did not exist yet). + - grant-maintainers-on-gitops-tenant-template.yaml + - grant-maintainers-on-platform-template.yaml + - grant-maintainers-on-unifi.yaml + - grant-maintainers-on-homebrew-tap.yaml diff --git a/deploy/teams/kustomization.yaml b/deploy/teams/kustomization.yaml index 455f828..f41045b 100644 --- a/deploy/teams/kustomization.yaml +++ b/deploy/teams/kustomization.yaml @@ -1,25 +1,9 @@ # The `maintainers` team — the canonical CODEOWNERS owner across the devantler-tech -# suite (the "teams over individuals" convention). One resource per file: the Team -# (Observe-adopted by numeric id), its membership, and its team → repository access -# grants. Existing access is adopted Observe-first; access the team did not yet hold is -# Created at `maintain`. See ../README.md and the platform repo's docs/github-management.md -# for the Observe-first adoption flow. Grant a new repo by dropping a -# maintainers-.yaml here and listing it below. +# suite (the "teams over individuals" convention), Observe-adopted by numeric id. One +# `Team` per file. Its membership lives in ../team-memberships/ and its team → repository +# access in ../team-repositories/. See ../README.md and the platform repo's +# docs/github-management.md for the Observe-first adoption flow. apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - maintainers.yaml - - maintainers-devantler.yaml - # Team → repository access (Observe-adopted). - - maintainers-actions.yaml - - maintainers-dotnet-template.yaml - - maintainers-go-template.yaml - - maintainers-ksail.yaml - - maintainers-monorepo.yaml - - maintainers-platform.yaml - - maintainers-reusable-workflows.yaml - # Team → repository access (Created — grant did not exist yet). - - maintainers-gitops-tenant-template.yaml - - maintainers-platform-template.yaml - - maintainers-unifi.yaml - - maintainers-homebrew-tap.yaml diff --git a/deploy/teams/maintainers.yaml b/deploy/teams/maintainers.yaml index 1663649..973b72c 100644 --- a/deploy/teams/maintainers.yaml +++ b/deploy/teams/maintainers.yaml @@ -1,7 +1,7 @@ # The `maintainers` team — the canonical CODEOWNERS owner across the devantler-tech # suite (the "teams over individuals" convention), adopted Observe-first (read-only). -# Its membership and team → repository access live one-per-file in the sibling -# maintainers-*.yaml files. +# Its membership lives one-per-file in ../team-memberships/ and its team → repository +# access in ../team-repositories/. apiVersion: team.github.m.upbound.io/v1alpha1 kind: Team metadata: