From adf72ef843cf039bbc743b8f8ead0be437e28894 Mon Sep 17 00:00:00 2001 From: Elior Erez Date: Fri, 16 Oct 2026 15:12:18 -0400 Subject: [PATCH 1/3] NO-ISSUE: Reorganize teams around the OSAC engineering roster Build GitHub teams from the SVGN engineering roster and give access by role instead of through the fulfillment-wg catch-all and a wg-infra team that mixed managers, the infra working group and force-merge helpers. Teams: - One team per working group (wg-bmaas, wg-caas, wg-vmaas, wg-maas, wg-enclave, wg-connectivity, wg-core, wg-metering, wg-ui, wg-e2e, wg-soln-eng, wg-qe, wg-architecture, plus the existing wg-infra and wg-osac-storage). Product managers are not added. - Role teams: managers, architects, wg-leads. - ci-duty for CI duty and merge assistance. - contributors for fulfillment-wg members outside the working groups. - fulfillment-wg and infrastructure are removed. Access: - Teams flagged contributor in teams.csv get the push access that fulfillment-wg had (new contributor_teams module input). - managers takes over wg-infra's admin, ruleset bypass, push allowances and the runner-manager org role. - ci-duty takes over infrastructure's push and bypass on osac and osac-test-infra and the CI/CD admin org role. - wg-infra becomes a regular working group, plus push on osac-ci for its CODEOWNERS entry. Repositories reference the new teams through github_team.all, so the teams are created before any repository grants them access. Assisted-by: Claude Code (Claude Opus 5.5) Signed-off-by: Elior Erez --- .github/workflows/apply.yaml | 2 +- README.md | 19 +- modules/common_repository/main.tf | 16 +- modules/common_repository/variables.tf | 6 + organization.tf | 12 +- repositories.tf | 284 ++++++++++--------------- team-members/architects.csv | 12 ++ team-members/ci-duty.csv | 10 + team-members/contributors.csv | 19 ++ team-members/fulfillment-wg.csv | 95 --------- team-members/infrastructure.csv | 2 - team-members/managers.csv | 11 + team-members/wg-architecture.csv | 12 ++ team-members/wg-bmaas.csv | 11 + team-members/wg-caas.csv | 11 + team-members/wg-connectivity.csv | 9 + team-members/wg-core.csv | 9 + team-members/wg-e2e.csv | 6 + team-members/wg-enclave.csv | 7 + team-members/wg-infra.csv | 12 +- team-members/wg-leads.csv | 12 ++ team-members/wg-maas.csv | 3 + team-members/wg-metering.csv | 7 + team-members/wg-osac-storage.csv | 2 +- team-members/wg-qe.csv | 8 + team-members/wg-soln-eng.csv | 3 + team-members/wg-ui.csv | 5 + team-members/wg-vmaas.csv | 9 + teams.csv | 34 ++- 29 files changed, 343 insertions(+), 305 deletions(-) create mode 100644 team-members/architects.csv create mode 100644 team-members/ci-duty.csv create mode 100644 team-members/contributors.csv delete mode 100644 team-members/fulfillment-wg.csv delete mode 100644 team-members/infrastructure.csv create mode 100644 team-members/managers.csv create mode 100644 team-members/wg-architecture.csv create mode 100644 team-members/wg-bmaas.csv create mode 100644 team-members/wg-caas.csv create mode 100644 team-members/wg-connectivity.csv create mode 100644 team-members/wg-core.csv create mode 100644 team-members/wg-e2e.csv create mode 100644 team-members/wg-enclave.csv create mode 100644 team-members/wg-leads.csv create mode 100644 team-members/wg-maas.csv create mode 100644 team-members/wg-metering.csv create mode 100644 team-members/wg-qe.csv create mode 100644 team-members/wg-soln-eng.csv create mode 100644 team-members/wg-ui.csv create mode 100644 team-members/wg-vmaas.csv diff --git a/.github/workflows/apply.yaml b/.github/workflows/apply.yaml index e1b5be9..703f7cb 100644 --- a/.github/workflows/apply.yaml +++ b/.github/workflows/apply.yaml @@ -130,7 +130,7 @@ jobs: # # A permanent per-module `-target` loop was considered and rejected: # several modules share cross-module resources (e.g. - # github_team.all["wg-infra"], referenced by ruleset_bypass_team_ids + # github_team.all["managers"], referenced by ruleset_bypass_team_ids # in multiple repo modules), so looping per module would re-plan/ # re-apply those shared resources on every iteration that references # them -- wasteful, and it gives up Terraform's normal whole-graph diff --git a/README.md b/README.md index 5643eb9..2254b73 100644 --- a/README.md +++ b/README.md @@ -20,16 +20,26 @@ When a commit is pushed to the `main` branch (e.g., when a pull request merges), ### Add a new team? 1. Open `teams.csv` -1. Add a new row of the form `,,`, where `` can be either `closed` (visible to all members of the organization) or `secret` (visible to organization owners and members of this team) +1. Add a new row of the form `,,,`, where `` can be either `closed` (visible to all members of the organization) or `secret` (visible to organization owners and members of this team). + Set `` to `true` to give the team push access on every repository that uses `local.contributor_teams` in `repositories.tf` (the working group teams), or `false` otherwise. ### Add an organization member to a team? 1. Open `team-members/.csv` 1. Add a new line of the form `,`, where `` should be `member`. +Which team? Teams follow the OSAC engineering roster: + +- `wg-*`: one team per working group (for example `wg-core`, `wg-bmaas`, `wg-infra`). + Working group teams have push access to the OSAC repositories. +- `contributors`: people who contribute but aren't in a working group. Same push access. +- `managers`, `architects`, `wg-leads`: role teams across all working groups. `managers` + also has admin on the main repositories and ruleset bypass (see below). +- `ci-duty`: CI duty and merge assistance (see below). + ### Give someone runner management or merge-queue bypass without making them an org owner? -Add them to the `infrastructure` team (`team-members/infrastructure.csv`). That team: +Add them to the `ci-duty` team (`team-members/ci-duty.csv`). That team: - Holds GitHub's predefined **CI/CD admin** organization role, granting management of org self-hosted runners and runner groups (plus Actions policies, secrets, variables, @@ -38,9 +48,8 @@ Add them to the `infrastructure` team (`team-members/infrastructure.csv`). That the merge queue and required status checks on those repos. See `ruleset_bypass_team_ids` in `repositories.tf`. -The broader `wg-infra` working group keeps the narrower `runner-manager` role and the same -bypass; `infrastructure` is a smaller team for people who need this without the rest of the -working-group context. +The `managers` team holds the narrower `runner-manager` role, admin on the main +repositories, and ruleset bypass on every repository with required status checks. ### Add a new repository? diff --git a/modules/common_repository/main.tf b/modules/common_repository/main.tf index 4409d85..b4b8f5c 100644 --- a/modules/common_repository/main.tf +++ b/modules/common_repository/main.tf @@ -294,15 +294,17 @@ resource "github_repository_collaborators" "repo_collaborators" { permission = var.all_members_permission } - # Generate team blocks from the value of the "teams" input variable. + # Generate team blocks from the "contributor_teams" (push) and "teams" + # input variables. An explicit "teams" entry overrides the contributor + # push permission for the same team. dynamic "team" { - for_each = { - for team in var.teams : - team.team_id => team - } + for_each = merge( + { for team_id in var.contributor_teams : team_id => "push" }, + { for team in var.teams : team.team_id => team.permission }, + ) content { - team_id = team.value.team_id - permission = team.value.permission + team_id = team.key + permission = team.value } } diff --git a/modules/common_repository/variables.tf b/modules/common_repository/variables.tf index a6f6f80..ddb7f3b 100644 --- a/modules/common_repository/variables.tf +++ b/modules/common_repository/variables.tf @@ -94,6 +94,12 @@ variable "teams" { } } +variable "contributor_teams" { + description = "Teams granted push access to this repository. An entry in \"teams\" for the same team overrides this permission." + type = list(string) + default = [] +} + variable "users" { description = "Users with access to this repository" type = list(object({ diff --git a/organization.tf b/organization.tf index 473e62c..77eb314 100644 --- a/organization.tf +++ b/organization.tf @@ -10,7 +10,7 @@ resource "github_organization_settings" "osac-project" { members_can_create_repositories = false } -# Lets wg-infra manage self-hosted runners/runner groups at the org level +# Lets managers manage self-hosted runners/runner groups at the org level # (register/remove runners, create runner groups, control repo access to # them) without granting full org-owner access. base_role defaults to # "none", so this role carries only the permission listed below. @@ -23,12 +23,12 @@ resource "github_organization_role" "runner_manager" { ] } -resource "github_organization_role_team" "runner_manager_wg_infra" { +resource "github_organization_role_team" "runner_manager_managers" { role_id = github_organization_role.runner_manager.role_id - team_slug = github_team.all["wg-infra"].slug + team_slug = github_team.all["managers"].slug } -# Assign GitHub's predefined "CI/CD admin" organization role to the infrastructure +# Assign GitHub's predefined "CI/CD admin" organization role to the ci-duty # team. It grants admin access to Actions policies, runners, runner groups, hosted # compute network configs, secrets, variables, and usage metrics for the org -- a # superset of the runner-manager role above -- without granting org-owner access. @@ -49,7 +49,7 @@ locals { ]) } -resource "github_organization_role_team" "cicd_admin_infrastructure" { +resource "github_organization_role_team" "cicd_admin_ci_duty" { role_id = local.cicd_admin_role_id - team_slug = github_team.all["infrastructure"].slug + team_slug = github_team.all["ci-duty"].slug } diff --git a/repositories.tf b/repositories.tf index 805301e..5bc1704 100644 --- a/repositories.tf +++ b/repositories.tf @@ -1,3 +1,14 @@ +locals { + # Teams flagged "contributor" in teams.csv get push access on every + # repository that uses this list. Iterating github_team.all (rather than + # the CSV) makes the repositories wait for the teams to exist. + contributor_teams = [ + for name, team in github_team.all : team.name + if local.teams_csv[name].contributor == "true" + ] + teams_csv = { for team in csvdecode(file("teams.csv")) : team.name => team } +} + module "repo_issues" { source = "./modules/common_repository" name = "issues" @@ -42,15 +53,12 @@ module "repo_github_config" { required_status_checks = [ { context = "pre-commit", integration_id = 15368 }, ] - ruleset_bypass_team_ids = [github_team.all["wg-infra"].id] + ruleset_bypass_team_ids = [github_team.all["managers"].id] + contributor_teams = local.contributor_teams teams = [ { - team_id = "fulfillment-wg" - permission = "push" - }, - { - team_id = "wg-infra" + team_id = github_team.all["managers"].name permission = "admin" } ] @@ -78,25 +86,15 @@ module "repo_managed_cluster_config" { name = "managed-cluster-config" use_public_template = false description = "Configuration for OpenShift cluster running ACM w/ Hosted Control Planes" - teams = [ - { - team_id = "fulfillment-wg" - permission = "push" - } - ] + contributor_teams = local.contributor_teams } module "repo_managed_cluster_apps" { - source = "./modules/common_repository" - visibility = "public" - name = "managed-cluster-apps" - description = "Argocd apps to deploy resources on the innabox cluster" - teams = [ - { - team_id = "fulfillment-wg" - permission = "push" - } - ] + source = "./modules/common_repository" + visibility = "public" + name = "managed-cluster-apps" + description = "Argocd apps to deploy resources on the innabox cluster" + contributor_teams = local.contributor_teams } module "repo_fulfillment_service" { @@ -105,15 +103,12 @@ module "repo_fulfillment_service" { name = "fulfillment-service" description = "Cloud-in-a-box fulfillment service" # Merged into osac mono-repo (OSAC-1732/OSAC-1733); archived (OSAC-1737). - archived = true - lock_branch = true + archived = true + lock_branch = true + contributor_teams = local.contributor_teams teams = [ { - team_id = "fulfillment-wg" - permission = "push" - }, - { - team_id = "wg-infra" + team_id = github_team.all["managers"].name permission = "admin" } ] @@ -121,8 +116,8 @@ module "repo_fulfillment_service" { required_status_checks = [ { context = "e2e-vmaas-full-install / e2e", integration_id = 15368 }, ] - ruleset_bypass_team_ids = [github_team.all["wg-infra"].id] - push_allowances = ["/openshift-merge-robot", "osac-project/wg-infra", "osac-project/org-admins"] + ruleset_bypass_team_ids = [github_team.all["managers"].id] + push_allowances = ["/openshift-merge-robot", "osac-project/${github_team.all["managers"].name}", "osac-project/org-admins"] environments = [{ name = "e2e-test" }] pages = { build_type = "workflow" @@ -141,17 +136,14 @@ module "repo_osac" { # Always show "Update branch" (merge or rebase). The merge queue does not # require up-to-date branches, so GitHub otherwise hides the button. allow_update_branch = true + contributor_teams = local.contributor_teams teams = [ { - team_id = "fulfillment-wg" - permission = "push" - }, - { - team_id = "wg-infra" + team_id = github_team.all["managers"].name permission = "admin" }, { - team_id = "infrastructure" + team_id = github_team.all["ci-duty"].name permission = "push" }, { @@ -198,8 +190,8 @@ module "repo_osac" { { context = "Run unit tests (bare-metal-fulfillment-operator)", integration_id = 15368 }, ] ruleset_bypass_team_ids = [ - github_team.all["wg-infra"].id, - github_team.all["infrastructure"].id, + github_team.all["managers"].id, + github_team.all["ci-duty"].id, ] # osac-release/* tags trigger a Konflux staging release (see @@ -232,15 +224,12 @@ module "repo_cloudkit_operator" { name = "osac-operator" description = "OSAC kubernetes operator" # Merged into osac mono-repo (OSAC-1732/OSAC-1733); archived (OSAC-1737). - archived = true - lock_branch = true + archived = true + lock_branch = true + contributor_teams = local.contributor_teams teams = [ { - team_id = "fulfillment-wg" - permission = "push" - }, - { - team_id = "wg-infra" + team_id = github_team.all["managers"].name permission = "admin" } ] @@ -248,8 +237,8 @@ module "repo_cloudkit_operator" { required_status_checks = [ { context = "e2e-vmaas-full-install / e2e", integration_id = 15368 }, ] - ruleset_bypass_team_ids = [github_team.all["wg-infra"].id] - push_allowances = ["/openshift-merge-robot", "osac-project/wg-infra", "osac-project/org-admins"] + ruleset_bypass_team_ids = [github_team.all["managers"].id] + push_allowances = ["/openshift-merge-robot", "osac-project/${github_team.all["managers"].name}", "osac-project/org-admins"] environments = [{ name = "e2e-test" }] } @@ -259,15 +248,12 @@ module "repo_cloudkit_aap" { name = "osac-aap" description = "OSAC AAP configuration and playbooks" # Merged into osac mono-repo (OSAC-1732/OSAC-1733); archived (OSAC-1737). - archived = true - lock_branch = true + archived = true + lock_branch = true + contributor_teams = local.contributor_teams teams = [ { - team_id = "fulfillment-wg" - permission = "push" - }, - { - team_id = "wg-infra" + team_id = github_team.all["managers"].name permission = "admin" } ] @@ -275,35 +261,25 @@ module "repo_cloudkit_aap" { required_status_checks = [ { context = "e2e-vmaas-full-install / e2e", integration_id = 15368 }, ] - ruleset_bypass_team_ids = [github_team.all["wg-infra"].id] - push_allowances = ["/openshift-merge-robot", "osac-project/wg-infra", "osac-project/org-admins"] + ruleset_bypass_team_ids = [github_team.all["managers"].id] + push_allowances = ["/openshift-merge-robot", "osac-project/${github_team.all["managers"].name}", "osac-project/org-admins"] environments = [{ name = "e2e-test" }] } module "repo_cloudkit_aap_ee" { - source = "./modules/common_repository" - visibility = "public" - name = "osac-aap-ee" - description = "OSAC execution environment for AAP" - teams = [ - { - team_id = "fulfillment-wg" - permission = "push" - } - ] + source = "./modules/common_repository" + visibility = "public" + name = "osac-aap-ee" + description = "OSAC execution environment for AAP" + contributor_teams = local.contributor_teams } module "repo_cloudkit_operator_config" { - source = "./modules/common_repository" - visibility = "public" - name = "osac-operator-config" - description = "Configuration for our deployment of the OSAC operator" - teams = [ - { - team_id = "fulfillment-wg" - permission = "push" - } - ] + source = "./modules/common_repository" + visibility = "public" + name = "osac-operator-config" + description = "Configuration for our deployment of the OSAC operator" + contributor_teams = local.contributor_teams } module "repo_osac_installer" { @@ -312,15 +288,12 @@ module "repo_osac_installer" { name = "osac-installer" description = "Integration repository for installing all OSAC components" # Merged into osac mono-repo (OSAC-1732/OSAC-1733); archived (OSAC-1737). - archived = true - lock_branch = true + archived = true + lock_branch = true + contributor_teams = local.contributor_teams teams = [ { - team_id = "fulfillment-wg" - permission = "push" - }, - { - team_id = "wg-infra" + team_id = github_team.all["managers"].name permission = "admin" } ] @@ -330,8 +303,8 @@ module "repo_osac_installer" { ] required_approvals = null - ruleset_bypass_team_ids = [github_team.all["wg-infra"].id] - push_allowances = ["/openshift-merge-robot", "osac-project/wg-infra", "osac-project/org-admins"] + ruleset_bypass_team_ids = [github_team.all["managers"].id] + push_allowances = ["/openshift-merge-robot", "osac-project/${github_team.all["managers"].name}", "osac-project/org-admins"] environments = [{ name = "e2e-test" }] } @@ -353,7 +326,7 @@ module "repo_enhancement_proposals" { # Job id in enhancement-proposals/.github/workflows/pre-commit.yaml. { context = "pre-commit", integration_id = 15368 }, ] - ruleset_bypass_team_ids = [github_team.all["wg-infra"].id] + ruleset_bypass_team_ids = [github_team.all["managers"].id] teams = [ { team_id = "wg-osac-storage" @@ -363,21 +336,18 @@ module "repo_enhancement_proposals" { } module "repo_osac_test_infra" { - source = "./modules/common_repository" - visibility = "public" - name = "osac-test-infra" - description = "Ansible-based test infrastructure for OSAC end-to-end testing" + source = "./modules/common_repository" + visibility = "public" + name = "osac-test-infra" + description = "Ansible-based test infrastructure for OSAC end-to-end testing" + contributor_teams = local.contributor_teams teams = [ { - team_id = "fulfillment-wg" - permission = "push" - }, - { - team_id = "wg-infra" + team_id = github_team.all["managers"].name permission = "admin" }, { - team_id = "infrastructure" + team_id = github_team.all["ci-duty"].name permission = "push" }, { @@ -397,8 +367,8 @@ module "repo_osac_test_infra" { { context = "pre-commit", integration_id = 15368 }, ] ruleset_bypass_team_ids = [ - github_team.all["wg-infra"].id, - github_team.all["infrastructure"].id, + github_team.all["managers"].id, + github_team.all["ci-duty"].id, ] environments = [{ name = "e2e-test" }] @@ -425,8 +395,12 @@ module "repo_osac_ci" { allow_update_branch = true teams = [ { - team_id = "wg-infra" + team_id = github_team.all["managers"].name permission = "admin" + }, + { + team_id = "wg-infra" + permission = "push" } ] # The planner can eventually decide what merges in other repositories, so @@ -441,20 +415,15 @@ module "repo_osac_ci" { { context = "unit-tests", integration_id = 15368 }, { context = "legacy-differential", integration_id = 15368 }, ] - ruleset_bypass_team_ids = [github_team.all["wg-infra"].id] + ruleset_bypass_team_ids = [github_team.all["managers"].id] } module "repo_massopencloud_templates" { - source = "./modules/common_repository" - visibility = "public" - name = "osac-massopencloud-templates" - description = "OSAC MOC-specific templates" - teams = [ - { - team_id = "fulfillment-wg" - permission = "push" - } - ] + source = "./modules/common_repository" + visibility = "public" + name = "osac-massopencloud-templates" + description = "OSAC MOC-specific templates" + contributor_teams = local.contributor_teams } module "repo_osac_ui" { @@ -463,13 +432,10 @@ module "repo_osac_ui" { name = "osac-ui" description = "OSAC UI Web Console" # Merged into osac mono-repo, with full commit history preserved; archived. - archived = true - lock_branch = true + archived = true + lock_branch = true + contributor_teams = local.contributor_teams teams = [ - { - team_id = "fulfillment-wg" - permission = "push" - }, { team_id = "wg-osac-storage" permission = "push" @@ -478,16 +444,11 @@ module "repo_osac_ui" { } module "repo_osac_ux" { - source = "./modules/common_repository" - visibility = "public" - name = "osac-ux" - description = "OSAC UX Roadmap Console" - teams = [ - { - team_id = "fulfillment-wg" - permission = "push" - } - ] + source = "./modules/common_repository" + visibility = "public" + name = "osac-ux" + description = "OSAC UX Roadmap Console" + contributor_teams = local.contributor_teams users = [ { username = "liatb-rh" @@ -509,14 +470,9 @@ module "repo_host_management_openstack" { name = "host-management-openstack" description = "[Archived] OSAC Host Management Operator for OpenStack" # archived (OSAC-3445) - archived = true - lock_branch = true - teams = [ - { - team_id = "fulfillment-wg" - permission = "push" - } - ] + archived = true + lock_branch = true + contributor_teams = local.contributor_teams } module "repo_bare_metal_operator" { @@ -525,32 +481,24 @@ module "repo_bare_metal_operator" { name = "bare-metal-fulfillment-operator" description = "OSAC Operator for Bare Metal Fulfillment" # Merged into osac mono-repo (OSAC-1732/OSAC-3395); archived (OSAC-1737). - archived = true - lock_branch = true + archived = true + lock_branch = true + contributor_teams = local.contributor_teams teams = [ { - team_id = "fulfillment-wg" - permission = "push" - }, - { - team_id = "wg-infra" + team_id = github_team.all["managers"].name permission = "admin" } ] - push_allowances = ["/openshift-merge-robot", "osac-project/wg-infra", "osac-project/org-admins"] + push_allowances = ["/openshift-merge-robot", "osac-project/${github_team.all["managers"].name}", "osac-project/org-admins"] } module "repo_osac_workspace" { - source = "./modules/common_repository" - visibility = "public" - name = "osac-workspace" - description = "Workspace for operating on OSAC repositories with AI tooling" - teams = [ - { - team_id = "fulfillment-wg" - permission = "push" - } - ] + source = "./modules/common_repository" + visibility = "public" + name = "osac-workspace" + description = "Workspace for operating on OSAC repositories with AI tooling" + contributor_teams = local.contributor_teams pages = { build_type = "workflow" source = { @@ -561,21 +509,18 @@ module "repo_osac_workspace" { } module "repo_cluster_tool" { - source = "./modules/common_repository" - visibility = "public" - name = "cluster-tool" - description = "Instant OpenShift SNO clusters from snapshots, distributed as OCI images" + source = "./modules/common_repository" + visibility = "public" + name = "cluster-tool" + description = "Instant OpenShift SNO clusters from snapshots, distributed as OCI images" + contributor_teams = local.contributor_teams teams = [ { - team_id = "fulfillment-wg" - permission = "push" - }, - { - team_id = "wg-infra" + team_id = github_team.all["managers"].name permission = "admin" } ] - push_allowances = ["/openshift-merge-robot", "osac-project/wg-infra", "osac-project/org-admins"] + push_allowances = ["/openshift-merge-robot", "osac-project/${github_team.all["managers"].name}", "osac-project/org-admins"] } module "repo_osac_csi_driver" { @@ -584,19 +529,16 @@ module "repo_osac_csi_driver" { name = "osac-csi-driver" description = "OSAC CSI driver for persistent storage" # Merged into osac mono-repo (OSAC-1732/OSAC-3530); archived (OSAC-1737). - archived = true - lock_branch = true + archived = true + lock_branch = true + contributor_teams = local.contributor_teams teams = [ { - team_id = "fulfillment-wg" - permission = "push" - }, - { - team_id = "wg-infra" + team_id = github_team.all["managers"].name permission = "admin" } ] required_approvals = null - push_allowances = ["/openshift-merge-robot", "osac-project/wg-infra", "osac-project/org-admins"] + push_allowances = ["/openshift-merge-robot", "osac-project/${github_team.all["managers"].name}", "osac-project/org-admins"] environments = [{ name = "e2e-test" }] } diff --git a/team-members/architects.csv b/team-members/architects.csv new file mode 100644 index 0000000..d025c93 --- /dev/null +++ b/team-members/architects.csv @@ -0,0 +1,12 @@ +username,role +mhrivnak,member +avishayt,member +carbonin,member +vladikr,member +ygalblum,member +mpaulgreen,member +maorfr,member +jhernand,member +eliorerz,member +masayag,member +rgolangh,member diff --git a/team-members/ci-duty.csv b/team-members/ci-duty.csv new file mode 100644 index 0000000..541dad0 --- /dev/null +++ b/team-members/ci-duty.csv @@ -0,0 +1,10 @@ +username,role +rccrdpccl,member +akshaynadkarni,member +rgolangh,member +CrystalChun,member +ItzikEzra-rh,member +sk-ilya,member +omer-vishlitzky,member +minmzzhang,member +eliorerz,member diff --git a/team-members/contributors.csv b/team-members/contributors.csv new file mode 100644 index 0000000..e0d6046 --- /dev/null +++ b/team-members/contributors.csv @@ -0,0 +1,19 @@ +username,role +bkopilov,member +dekulkar-web,member +dmurugap,member +dshekhte,member +giladravid16,member +ibengal,member +jenniferubah,member +LiorSoffer,member +lshilin-r,member +mlorenzofr,member +mor-rh,member +orli-nagar,member +schmaustech,member +sprizend-rh,member +talhil-rh,member +openshift-ci-robot,member +openshift-merge-robot,member +osac-dev-bot,member diff --git a/team-members/fulfillment-wg.csv b/team-members/fulfillment-wg.csv deleted file mode 100644 index 673c133..0000000 --- a/team-members/fulfillment-wg.csv +++ /dev/null @@ -1,95 +0,0 @@ -username,role -tzumainn,maintainer -mhrivnak,member -AlonaKaplan,maintainer -jhernand,member -oourfali,maintainer -skanthed,member -adriengentil,member -tssala23,member -computate,member -schwesig,member -trewest,member -maorfr,member -mlorenzofr,member -DanNiESh,member -karmab,member -eliorerz,maintainer -romfreiman,member -schmaustech,member -tzvatot,member -avishayt,member -eranco74,maintainer -akshaynadkarni,member -zszabo-rh,member -javipolo,member -openshift-ci-robot,member -openshift-merge-robot,member -CrystalChun,member -danmanor,member -bkopilov,member -omer-vishlitzky,member -obochan-rh,member -amej,member -sk-ilya,member -DakCrowder,member -SiddarthR56,member -wgordon17,member -ori-amizur,member -achuzhoy,member -ybettan,member -mennyaboush,member -carbonin,member -gamli75,member -eurijon,member -rccrdpccl,member -rporres,member -giladravid16,member -osac-dev-bot,member -ElayAharoni,member -tchughesiv,member -ygalblum,member -liatb-rh,member -souvdas-coder,member -sruiz-rh,member -geizenbe,member -aalfanda,member -batzionb,member -rawagner,member -alosadagrande,member -empovit,member -ronniel1,member -htayrie-rh,member -danielerez,member -minmzzhang,member -clobrano,member -Tzif-Morgen,member -slintes,member -udis,member -rgolangh,member -mpaulgreen,member -ItzikEzra-rh,member -sprizend-rh,member -vladikr,member -dmurugap,member -amito,member -jvalimak,member -srasanen,member -mvaskima,member -sank-ak,member -dekulkar-web,member -dshekhte,member -ibengal,member -mor-rh,member -osac-ci-bot,member -pastequo,member -talhil-rh,member -lalon4,member -MarkBramnik,member -LiorSoffer,member -shirelbar80,member -masayag,member -lshilin-r,member -prabinovRedhat,member -orli-nagar,member -jenniferubah,member diff --git a/team-members/infrastructure.csv b/team-members/infrastructure.csv deleted file mode 100644 index a441ce0..0000000 --- a/team-members/infrastructure.csv +++ /dev/null @@ -1,2 +0,0 @@ -username,role -minmzzhang,member diff --git a/team-members/managers.csv b/team-members/managers.csv new file mode 100644 index 0000000..8a21ed6 --- /dev/null +++ b/team-members/managers.csv @@ -0,0 +1,11 @@ +username,role +AlonaKaplan,member +udis,member +swati-kale,member +gamli75,member +oourfali,member +ronniel1,member +liatb-rh,member +aalfanda,member +romfreiman,member +chenyosef,member diff --git a/team-members/wg-architecture.csv b/team-members/wg-architecture.csv new file mode 100644 index 0000000..8d8244e --- /dev/null +++ b/team-members/wg-architecture.csv @@ -0,0 +1,12 @@ +username,role +mhrivnak,member +avishayt,member +carbonin,member +vladikr,member +jhernand,member +maorfr,member +eliorerz,member +masayag,member +rgolangh,member +ygalblum,member +mpaulgreen,member diff --git a/team-members/wg-bmaas.csv b/team-members/wg-bmaas.csv new file mode 100644 index 0000000..ca036df --- /dev/null +++ b/team-members/wg-bmaas.csv @@ -0,0 +1,11 @@ +username,role +AlonaKaplan,maintainer +adriengentil,maintainer +carbonin,member +tzumainn,member +ybettan,member +skanthed,member +DanNiESh,member +ajamias,member +pastequo,member +mennyaboush,member diff --git a/team-members/wg-caas.csv b/team-members/wg-caas.csv new file mode 100644 index 0000000..4a1a9b3 --- /dev/null +++ b/team-members/wg-caas.csv @@ -0,0 +1,11 @@ +username,role +AlonaKaplan,maintainer +rccrdpccl,maintainer +avishayt,member +vladikr,member +larsks,member +tzvatot,member +trewest,member +alosadagrande,member +empovit,member +sk-ilya,member diff --git a/team-members/wg-connectivity.csv b/team-members/wg-connectivity.csv new file mode 100644 index 0000000..1992509 --- /dev/null +++ b/team-members/wg-connectivity.csv @@ -0,0 +1,9 @@ +username,role +AlonaKaplan,maintainer +danmanor,maintainer +vladikr,member +eranco74,member +SiddarthR56,member +ori-amizur,member +tchughesiv,member +tssala23,member diff --git a/team-members/wg-core.csv b/team-members/wg-core.csv new file mode 100644 index 0000000..ac65914 --- /dev/null +++ b/team-members/wg-core.csv @@ -0,0 +1,9 @@ +username,role +oourfali,maintainer +CrystalChun,maintainer +jhernand,member +obochan-rh,member +rccrdpccl,member +htayrie-rh,member +danielerez,member +shirelbar80,member diff --git a/team-members/wg-e2e.csv b/team-members/wg-e2e.csv new file mode 100644 index 0000000..ba63998 --- /dev/null +++ b/team-members/wg-e2e.csv @@ -0,0 +1,6 @@ +username,role +aalfanda,maintainer +geizenbe,maintainer +souvdas-coder,member +sruiz-rh,member +sank-ak,member diff --git a/team-members/wg-enclave.csv b/team-members/wg-enclave.csv new file mode 100644 index 0000000..7c48d9a --- /dev/null +++ b/team-members/wg-enclave.csv @@ -0,0 +1,7 @@ +username,role +gamli75,maintainer +maorfr,maintainer +carbonin,member +eurijon,member +javipolo,member +rporres,member diff --git a/team-members/wg-infra.csv b/team-members/wg-infra.csv index 24d17c9..e5e28a9 100644 --- a/team-members/wg-infra.csv +++ b/team-members/wg-infra.csv @@ -1,10 +1,6 @@ username,role +gamli75,maintainer eliorerz,maintainer -omer-vishlitzky,member -oourfali,maintainer -ronniel1,member -gamli75,member -chenyosef,member -rccrdpccl,member -akshaynadkarni,member -rgolangh,member +minmzzhang,member +amej,member +osac-ci-bot,member diff --git a/team-members/wg-leads.csv b/team-members/wg-leads.csv new file mode 100644 index 0000000..cd9defa --- /dev/null +++ b/team-members/wg-leads.csv @@ -0,0 +1,12 @@ +username,role +adriengentil,member +rccrdpccl,member +ygalblum,member +maorfr,member +danmanor,member +CrystalChun,member +eliorerz,member +masayag,member +akshaynadkarni,member +rawagner,member +geizenbe,member diff --git a/team-members/wg-maas.csv b/team-members/wg-maas.csv new file mode 100644 index 0000000..a82ac6e --- /dev/null +++ b/team-members/wg-maas.csv @@ -0,0 +1,3 @@ +username,role +swati-kale,maintainer +mpaulgreen,member diff --git a/team-members/wg-metering.csv b/team-members/wg-metering.csv new file mode 100644 index 0000000..24ba124 --- /dev/null +++ b/team-members/wg-metering.csv @@ -0,0 +1,7 @@ +username,role +ronniel1,maintainer +masayag,maintainer +amito,member +schwesig,member +computate,member +omer-vishlitzky,member diff --git a/team-members/wg-osac-storage.csv b/team-members/wg-osac-storage.csv index 1d9b06f..1be439d 100644 --- a/team-members/wg-osac-storage.csv +++ b/team-members/wg-osac-storage.csv @@ -4,7 +4,7 @@ avishayt,member DanNiESh,member ElayAharoni,member rgolangh,member -ronniel1,member +ronniel1,maintainer wgordon17,member zszabo-rh,member MarkBramnik,member diff --git a/team-members/wg-qe.csv b/team-members/wg-qe.csv new file mode 100644 index 0000000..4f8dc0d --- /dev/null +++ b/team-members/wg-qe.csv @@ -0,0 +1,8 @@ +username,role +jvalimak,maintainer +lalon4,maintainer +achuzhoy,member +ItzikEzra-rh,member +trewest,member +mvaskima,member +srasanen,member diff --git a/team-members/wg-soln-eng.csv b/team-members/wg-soln-eng.csv new file mode 100644 index 0000000..f4080b0 --- /dev/null +++ b/team-members/wg-soln-eng.csv @@ -0,0 +1,3 @@ +username,role +karmab,member +dcritch,member diff --git a/team-members/wg-ui.csv b/team-members/wg-ui.csv new file mode 100644 index 0000000..d7722cf --- /dev/null +++ b/team-members/wg-ui.csv @@ -0,0 +1,5 @@ +username,role +liatb-rh,maintainer +rawagner,maintainer +ElayAharoni,member +batzionb,member diff --git a/team-members/wg-vmaas.csv b/team-members/wg-vmaas.csv new file mode 100644 index 0000000..7d20463 --- /dev/null +++ b/team-members/wg-vmaas.csv @@ -0,0 +1,9 @@ +username,role +udis,maintainer +ygalblum,maintainer +avishayt,member +DakCrowder,member +slintes,member +Tzif-Morgen,member +clobrano,member +prabinovRedhat,member diff --git a/teams.csv b/teams.csv index 83f0e57..564ae52 100644 --- a/teams.csv +++ b/teams.csv @@ -1,9 +1,25 @@ -name,description,privacy -org-admins,Organization Administrators,secret -fulfillment-wg,Fulfillment working group,secret -observability-wg,observability working group,secret -personas-wg,Personas working group,secret -documentation-wg,Documentation working group,secret -wg-infra,OSAC Infrastructure working group,closed -wg-osac-storage,OSAC Storage working group,closed -infrastructure,Infrastructure & CI/CD operations - runners and merge-queue bypass,closed +name,description,privacy,contributor +org-admins,Organization Administrators,secret,false +observability-wg,observability working group,secret,false +personas-wg,Personas working group,secret,false +documentation-wg,Documentation working group,secret,false +wg-infra,OSAC Infrastructure working group,closed,true +wg-osac-storage,OSAC Storage working group,closed,true +managers,OSAC working group managers,closed,true +architects,Architects across all OSAC working groups,closed,true +wg-leads,Leads of the OSAC working groups,closed,true +ci-duty,CI duty and merge assistance - bypass on osac and osac-test-infra and CI/CD admin,closed,false +contributors,OSAC contributors outside the working groups,closed,true +wg-architecture,OSAC Architecture working group,closed,true +wg-bmaas,OSAC BMaaS working group,closed,true +wg-caas,OSAC CaaS working group,closed,true +wg-vmaas,OSAC VMaaS working group,closed,true +wg-maas,OSAC MaaS working group,closed,true +wg-enclave,OSAC Enclave working group,closed,true +wg-connectivity,OSAC Connectivity & Fabric working group,closed,true +wg-core,OSAC Core working group,closed,true +wg-metering,OSAC Metering working group,closed,true +wg-ui,OSAC UI working group,closed,true +wg-e2e,OSAC E2E working group,closed,true +wg-soln-eng,OSAC Solution Engineering working group,closed,true +wg-qe,OSAC QE working group,closed,true From b9542e8799b9b70e92d678774b4b873821cb0b56 Mon Sep 17 00:00:00 2001 From: Elior Erez Date: Fri, 16 Oct 2026 15:21:50 -0400 Subject: [PATCH 2/3] NO-ISSUE: Rename wg-osac-storage to wg-storage Align the storage working group team with the other wg- teams. The team is recreated as wg-storage with the same members. Its explicit push entries on osac, osac-test-infra, osac-ui and enhancement-proposals are dropped: contributor push covers the first three, and every org member already has push on enhancement-proposals. Assisted-by: Claude Code (Claude Opus 5.5) Signed-off-by: Elior Erez --- README.md | 2 +- repositories.tf | 20 ------------------- .../{wg-osac-storage.csv => wg-storage.csv} | 0 teams.csv | 2 +- 4 files changed, 2 insertions(+), 22 deletions(-) rename team-members/{wg-osac-storage.csv => wg-storage.csv} (100%) diff --git a/README.md b/README.md index 2254b73..eb90958 100644 --- a/README.md +++ b/README.md @@ -30,7 +30,7 @@ When a commit is pushed to the `main` branch (e.g., when a pull request merges), Which team? Teams follow the OSAC engineering roster: -- `wg-*`: one team per working group (for example `wg-core`, `wg-bmaas`, `wg-infra`). +- `wg-*`: one team per working group (for example `wg-core`, `wg-storage`, `wg-infra`). Working group teams have push access to the OSAC repositories. - `contributors`: people who contribute but aren't in a working group. Same push access. - `managers`, `architects`, `wg-leads`: role teams across all working groups. `managers` diff --git a/repositories.tf b/repositories.tf index 5bc1704..bd58317 100644 --- a/repositories.tf +++ b/repositories.tf @@ -145,10 +145,6 @@ module "repo_osac" { { team_id = github_team.all["ci-duty"].name permission = "push" - }, - { - team_id = "wg-osac-storage" - permission = "push" } ] # Prow plugins handle approval via OWNERS (lgtm/approved labels), not native @@ -327,12 +323,6 @@ module "repo_enhancement_proposals" { { context = "pre-commit", integration_id = 15368 }, ] ruleset_bypass_team_ids = [github_team.all["managers"].id] - teams = [ - { - team_id = "wg-osac-storage" - permission = "push" - } - ] } module "repo_osac_test_infra" { @@ -349,10 +339,6 @@ module "repo_osac_test_infra" { { team_id = github_team.all["ci-duty"].name permission = "push" - }, - { - team_id = "wg-osac-storage" - permission = "push" } ] required_approvals = null @@ -435,12 +421,6 @@ module "repo_osac_ui" { archived = true lock_branch = true contributor_teams = local.contributor_teams - teams = [ - { - team_id = "wg-osac-storage" - permission = "push" - } - ] } module "repo_osac_ux" { diff --git a/team-members/wg-osac-storage.csv b/team-members/wg-storage.csv similarity index 100% rename from team-members/wg-osac-storage.csv rename to team-members/wg-storage.csv diff --git a/teams.csv b/teams.csv index 564ae52..dd0fa3e 100644 --- a/teams.csv +++ b/teams.csv @@ -4,7 +4,7 @@ observability-wg,observability working group,secret,false personas-wg,Personas working group,secret,false documentation-wg,Documentation working group,secret,false wg-infra,OSAC Infrastructure working group,closed,true -wg-osac-storage,OSAC Storage working group,closed,true +wg-storage,OSAC Storage working group,closed,true managers,OSAC working group managers,closed,true architects,Architects across all OSAC working groups,closed,true wg-leads,Leads of the OSAC working groups,closed,true From 84e89cf7733253c05398eb3d6f025ef6c5da8ae7 Mon Sep 17 00:00:00 2001 From: Elior Erez Date: Fri, 16 Oct 2026 23:41:31 -0400 Subject: [PATCH 3/3] NO-ISSUE: Keep fulfillment-wg as a team without repository access The hypershift1 cluster (osac-project/managed-cluster-config) restricts its GitHub OAuth login to osac-project/fulfillment-wg and maps the team to cluster RBAC, ArgoCD admin and a Vault policy. Deleting the team would lock everyone out of that cluster. Keep the team and its members, but mark it contributor=false so it no longer grants repository access; the roster teams cover that now. Assisted-by: Claude Code (Claude Opus 5.5) Signed-off-by: Elior Erez --- README.md | 3 ++ team-members/fulfillment-wg.csv | 95 +++++++++++++++++++++++++++++++++ teams.csv | 1 + 3 files changed, 99 insertions(+) create mode 100644 team-members/fulfillment-wg.csv diff --git a/README.md b/README.md index eb90958..cac61ad 100644 --- a/README.md +++ b/README.md @@ -36,6 +36,9 @@ Which team? Teams follow the OSAC engineering roster: - `managers`, `architects`, `wg-leads`: role teams across all working groups. `managers` also has admin on the main repositories and ruleset bypass (see below). - `ci-duty`: CI duty and merge assistance (see below). +- `fulfillment-wg`: legacy team with no repository access. It is kept only because the + hypershift1 cluster (`osac-project/managed-cluster-config`) uses it for OAuth login, + RBAC, ArgoCD and Vault. Don't add people to it for repository access. ### Give someone runner management or merge-queue bypass without making them an org owner? diff --git a/team-members/fulfillment-wg.csv b/team-members/fulfillment-wg.csv new file mode 100644 index 0000000..673c133 --- /dev/null +++ b/team-members/fulfillment-wg.csv @@ -0,0 +1,95 @@ +username,role +tzumainn,maintainer +mhrivnak,member +AlonaKaplan,maintainer +jhernand,member +oourfali,maintainer +skanthed,member +adriengentil,member +tssala23,member +computate,member +schwesig,member +trewest,member +maorfr,member +mlorenzofr,member +DanNiESh,member +karmab,member +eliorerz,maintainer +romfreiman,member +schmaustech,member +tzvatot,member +avishayt,member +eranco74,maintainer +akshaynadkarni,member +zszabo-rh,member +javipolo,member +openshift-ci-robot,member +openshift-merge-robot,member +CrystalChun,member +danmanor,member +bkopilov,member +omer-vishlitzky,member +obochan-rh,member +amej,member +sk-ilya,member +DakCrowder,member +SiddarthR56,member +wgordon17,member +ori-amizur,member +achuzhoy,member +ybettan,member +mennyaboush,member +carbonin,member +gamli75,member +eurijon,member +rccrdpccl,member +rporres,member +giladravid16,member +osac-dev-bot,member +ElayAharoni,member +tchughesiv,member +ygalblum,member +liatb-rh,member +souvdas-coder,member +sruiz-rh,member +geizenbe,member +aalfanda,member +batzionb,member +rawagner,member +alosadagrande,member +empovit,member +ronniel1,member +htayrie-rh,member +danielerez,member +minmzzhang,member +clobrano,member +Tzif-Morgen,member +slintes,member +udis,member +rgolangh,member +mpaulgreen,member +ItzikEzra-rh,member +sprizend-rh,member +vladikr,member +dmurugap,member +amito,member +jvalimak,member +srasanen,member +mvaskima,member +sank-ak,member +dekulkar-web,member +dshekhte,member +ibengal,member +mor-rh,member +osac-ci-bot,member +pastequo,member +talhil-rh,member +lalon4,member +MarkBramnik,member +LiorSoffer,member +shirelbar80,member +masayag,member +lshilin-r,member +prabinovRedhat,member +orli-nagar,member +jenniferubah,member diff --git a/teams.csv b/teams.csv index dd0fa3e..a25f0f8 100644 --- a/teams.csv +++ b/teams.csv @@ -1,5 +1,6 @@ name,description,privacy,contributor org-admins,Organization Administrators,secret,false +fulfillment-wg,Fulfillment working group,secret,false observability-wg,observability working group,secret,false personas-wg,Personas working group,secret,false documentation-wg,Documentation working group,secret,false