refactor(github): one team resource per file in deploy/teams/

deploy/README.md

@@ -14,7 +14,10 @@ reconcile the live GitHub org to match these manifests — including reverting
 out-of-band changes made in the GitHub UI.
 
 - `repositories/` — one `Repository` per managed repo.
-- `teams/` — the `maintainers` team, its membership, and team → repo access.
+- `teams/` — one `Team` per file (the `maintainers` team, Observe-adopted).
+- `team-memberships/` — one `TeamMembership` per file (`add-<user>-to-<team>.yaml`).
+- `team-repositories/` — one `TeamRepository` per file (`grant-<team>-on-<repo>.yaml`),
+  each granting a team a permission on a repo.
 - `labels/` — one `IssueLabels` per managed repo. The canonical org label
   taxonomy lives once in `labels/kustomization.yaml` (a shared patch appended to
   every repo); each `<repo>.yaml` adds only that repo's Dependabot/Renovate

deploy/kustomization.yaml

@@ -17,4 +17,6 @@ resources:
   - provider-config.yaml
   - repositories/
   - teams/
+  - team-memberships/
+  - team-repositories/
   - labels/

deploy/team-memberships/add-devantler-to-maintainers.yaml

@@ -0,0 +1,16 @@
+# The maintainer. A team CODEOWNERS with no members would request no reviewer, so
+# the team is given its member here. New desired state (team had no members) → Create.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamMembership
+metadata:
+  name: maintainers-devantler
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: maintainers
+    username: devantler
+    role: maintainer
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-memberships/kustomization.yaml

@@ -0,0 +1,7 @@
+# `TeamMembership` resources — one per file, named `add-<user>-to-<team>.yaml`. A team
+# used as a CODEOWNERS owner needs at least one member, or it requests no reviewer. See
+# ../README.md and the platform repo's docs/github-management.md.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - add-devantler-to-maintainers.yaml

deploy/team-repositories/grant-maintainers-on-actions.yaml

@@ -0,0 +1,18 @@
+# Team → repository access, adopted Observe-first (read-only).
+# external-name = `<team_id>:<repository>`.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: maintainers-actions
+  annotations:
+    crossplane.io/external-name: "17046606:actions"
+spec:
+  managementPolicies: ["Observe"]
+  forProvider:
+    teamIdRef:
+      name: maintainers
+    repository: actions
+    permission: maintain
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-maintainers-on-dotnet-template.yaml

@@ -0,0 +1,18 @@
+# Team → repository access, adopted Observe-first (read-only).
+# external-name = `<team_id>:<repository>`.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: maintainers-dotnet-template
+  annotations:
+    crossplane.io/external-name: "17046606:dotnet-template"
+spec:
+  managementPolicies: ["Observe"]
+  forProvider:
+    teamIdRef:
+      name: maintainers
+    repository: dotnet-template
+    permission: maintain
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-maintainers-on-gitops-tenant-template.yaml

@@ -0,0 +1,16 @@
+# Team → repository access. No external-name: this grant did not exist yet, so it is
+# Created (full management except Delete) rather than adopted.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: maintainers-gitops-tenant-template
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: maintainers
+    repository: gitops-tenant-template
+    permission: maintain
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-maintainers-on-go-template.yaml

@@ -0,0 +1,18 @@
+# Team → repository access, adopted Observe-first (read-only).
+# external-name = `<team_id>:<repository>`.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: maintainers-go-template
+  annotations:
+    crossplane.io/external-name: "17046606:go-template"
+spec:
+  managementPolicies: ["Observe"]
+  forProvider:
+    teamIdRef:
+      name: maintainers
+    repository: go-template
+    permission: maintain
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-maintainers-on-homebrew-tap.yaml

@@ -0,0 +1,16 @@
+# Team → repository access. No external-name: this grant did not exist yet, so it is
+# Created (full management except Delete) rather than adopted.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: maintainers-homebrew-tap
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: maintainers
+    repository: homebrew-tap
+    permission: maintain
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-maintainers-on-ksail.yaml

@@ -0,0 +1,18 @@
+# Team → repository access, adopted Observe-first (read-only).
+# external-name = `<team_id>:<repository>`.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: maintainers-ksail
+  annotations:
+    crossplane.io/external-name: "17046606:ksail"
+spec:
+  managementPolicies: ["Observe"]
+  forProvider:
+    teamIdRef:
+      name: maintainers
+    repository: ksail
+    permission: maintain
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-maintainers-on-monorepo.yaml

@@ -0,0 +1,18 @@
+# Team → repository access, adopted Observe-first (read-only).
+# external-name = `<team_id>:<repository>`.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: maintainers-monorepo
+  annotations:
+    crossplane.io/external-name: "17046606:monorepo"
+spec:
+  managementPolicies: ["Observe"]
+  forProvider:
+    teamIdRef:
+      name: maintainers
+    repository: monorepo
+    permission: maintain
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-maintainers-on-platform-template.yaml

@@ -0,0 +1,16 @@
+# Team → repository access. No external-name: this grant did not exist yet, so it is
+# Created (full management except Delete) rather than adopted.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: maintainers-platform-template
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: maintainers
+    repository: platform-template
+    permission: maintain
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-maintainers-on-platform.yaml

@@ -0,0 +1,18 @@
+# Team → repository access, adopted Observe-first (read-only).
+# external-name = `<team_id>:<repository>`.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: maintainers-platform
+  annotations:
+    crossplane.io/external-name: "17046606:platform"
+spec:
+  managementPolicies: ["Observe"]
+  forProvider:
+    teamIdRef:
+      name: maintainers
+    repository: platform
+    permission: maintain
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-maintainers-on-reusable-workflows.yaml

@@ -0,0 +1,18 @@
+# Team → repository access, adopted Observe-first (read-only).
+# external-name = `<team_id>:<repository>`.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: maintainers-reusable-workflows
+  annotations:
+    crossplane.io/external-name: "17046606:reusable-workflows"
+spec:
+  managementPolicies: ["Observe"]
+  forProvider:
+    teamIdRef:
+      name: maintainers
+    repository: reusable-workflows
+    permission: maintain
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/grant-maintainers-on-unifi.yaml

@@ -0,0 +1,16 @@
+# Team → repository access. No external-name: this grant did not exist yet, so it is
+# Created (full management except Delete) rather than adopted.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: maintainers-unifi
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: maintainers
+    repository: unifi
+    permission: maintain
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default

deploy/team-repositories/kustomization.yaml

@@ -0,0 +1,21 @@
+# `TeamRepository` resources — one per file, named `grant-<team>-on-<repo>.yaml`, each
+# granting a team a permission on a repository. Existing access is adopted Observe-first;
+# access the team did not yet hold is Created at `maintain`. Grant a new repo by dropping
+# a `grant-maintainers-on-<repo>.yaml` here and listing it below. See ../README.md and
+# the platform repo's docs/github-management.md.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # Observe-adopted (access already existed).
+  - grant-maintainers-on-actions.yaml
+  - grant-maintainers-on-dotnet-template.yaml
+  - grant-maintainers-on-go-template.yaml
+  - grant-maintainers-on-ksail.yaml
+  - grant-maintainers-on-monorepo.yaml
+  - grant-maintainers-on-platform.yaml
+  - grant-maintainers-on-reusable-workflows.yaml
+  # Created (grant did not exist yet).
+  - grant-maintainers-on-gitops-tenant-template.yaml
+  - grant-maintainers-on-platform-template.yaml
+  - grant-maintainers-on-unifi.yaml
+  - grant-maintainers-on-homebrew-tap.yaml

deploy/teams/kustomization.yaml

@@ -1,5 +1,7 @@
-# One file per managed team: the Team (Observe-adopted), its memberships, and its
-# team -> repository access. See ../README.md and the platform repo's
+# The `maintainers` team — the canonical CODEOWNERS owner across the devantler-tech
+# suite (the "teams over individuals" convention), Observe-adopted by numeric id. One
+# `Team` per file. Its membership lives in ../team-memberships/ and its team → repository
+# access in ../team-repositories/. See ../README.md and the platform repo's
 # docs/github-management.md for the Observe-first adoption flow.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization