NO-ISSUE: Reorganize teams around the OSAC engineering roster

.github/workflows/apply.yaml

@@ -130,7 +130,7 @@ jobs:
       #
       # A permanent per-module `-target` loop was considered and rejected:
       # several modules share cross-module resources (e.g.
-      # github_team.all["wg-infra"], referenced by ruleset_bypass_team_ids
+      # github_team.all["managers"], referenced by ruleset_bypass_team_ids
       # in multiple repo modules), so looping per module would re-plan/
       # re-apply those shared resources on every iteration that references
       # them -- wasteful, and it gives up Terraform's normal whole-graph

README.md

@@ -20,16 +20,29 @@ When a commit is pushed to the `main` branch (e.g., when a pull request merges),
 ### Add a new team?
 
 1. Open `teams.csv`
-1. Add a new row of the form `<team_name>,<description>,<privacy>`, where `<privacy>` can be either `closed` (visible to all members of the organization) or `secret` (visible to organization owners and members of this team)
+1. Add a new row of the form `<team_name>,<description>,<privacy>,<contributor>`, where `<privacy>` can be either `closed` (visible to all members of the organization) or `secret` (visible to organization owners and members of this team).
+   Set `<contributor>` to `true` to give the team push access on every repository that uses `local.contributor_teams` in `repositories.tf` (the working group teams), or `false` otherwise.
 
 ### Add an organization member to a team?
 
 1. Open `team-members/<team>.csv`
 1. Add a new line of the form `<username>,<role>`, where `<role>` should be `member`.
 
+Which team? Teams follow the OSAC engineering roster:
+
+- `wg-*`: one team per working group (for example `wg-core`, `wg-storage`, `wg-infra`).
+  Working group teams have push access to the OSAC repositories.
+- `contributors`: people who contribute but aren't in a working group. Same push access.
+- `managers`, `architects`, `wg-leads`: role teams across all working groups. `managers`
+  also has admin on the main repositories and ruleset bypass (see below).
+- `ci-duty`: CI duty and merge assistance (see below).
+- `fulfillment-wg`: legacy team with no repository access. It is kept only because the
+  hypershift1 cluster (`osac-project/managed-cluster-config`) uses it for OAuth login,
+  RBAC, ArgoCD and Vault. Don't add people to it for repository access.
+
 ### Give someone runner management or merge-queue bypass without making them an org owner?
 
-Add them to the `infrastructure` team (`team-members/infrastructure.csv`). That team:
+Add them to the `ci-duty` team (`team-members/ci-duty.csv`). That team:
 
 - Holds GitHub's predefined **CI/CD admin** organization role, granting management of
   org self-hosted runners and runner groups (plus Actions policies, secrets, variables,
@@ -38,9 +51,8 @@ Add them to the `infrastructure` team (`team-members/infrastructure.csv`). That
   the merge queue and required status checks on those repos. See `ruleset_bypass_team_ids`
   in `repositories.tf`.
 
-The broader `wg-infra` working group keeps the narrower `runner-manager` role and the same
-bypass; `infrastructure` is a smaller team for people who need this without the rest of the
-working-group context.
+The `managers` team holds the narrower `runner-manager` role, admin on the main
+repositories, and ruleset bypass on every repository with required status checks.
 
 ### Add a new repository?
 

modules/common_repository/main.tf

@@ -294,15 +294,17 @@ resource "github_repository_collaborators" "repo_collaborators" {
     permission = var.all_members_permission
   }
 
-  # Generate team blocks from the value of the "teams" input variable.
+  # Generate team blocks from the "contributor_teams" (push) and "teams"
+  # input variables. An explicit "teams" entry overrides the contributor
+  # push permission for the same team.
   dynamic "team" {
-    for_each = {
-      for team in var.teams :
-      team.team_id => team
-    }
+    for_each = merge(
+      { for team_id in var.contributor_teams : team_id => "push" },
+      { for team in var.teams : team.team_id => team.permission },
+    )
     content {
-      team_id    = team.value.team_id
-      permission = team.value.permission
+      team_id    = team.key
+      permission = team.value
     }
   }
 

modules/common_repository/variables.tf

@@ -94,6 +94,12 @@ variable "teams" {
   }
 }
 
+variable "contributor_teams" {
+  description = "Teams granted push access to this repository. An entry in \"teams\" for the same team overrides this permission."
+  type        = list(string)
+  default     = []
+}
+
 variable "users" {
   description = "Users with access to this repository"
   type = list(object({

organization.tf

@@ -10,7 +10,7 @@ resource "github_organization_settings" "osac-project" {
   members_can_create_repositories         = false
 }
 
-# Lets wg-infra manage self-hosted runners/runner groups at the org level
+# Lets managers manage self-hosted runners/runner groups at the org level
 # (register/remove runners, create runner groups, control repo access to
 # them) without granting full org-owner access. base_role defaults to
 # "none", so this role carries only the permission listed below.
@@ -23,12 +23,12 @@ resource "github_organization_role" "runner_manager" {
   ]
 }
 
-resource "github_organization_role_team" "runner_manager_wg_infra" {
+resource "github_organization_role_team" "runner_manager_managers" {
   role_id   = github_organization_role.runner_manager.role_id
-  team_slug = github_team.all["wg-infra"].slug
+  team_slug = github_team.all["managers"].slug
 }
 
-# Assign GitHub's predefined "CI/CD admin" organization role to the infrastructure
+# Assign GitHub's predefined "CI/CD admin" organization role to the ci-duty
 # team. It grants admin access to Actions policies, runners, runner groups, hosted
 # compute network configs, secrets, variables, and usage metrics for the org -- a
 # superset of the runner-manager role above -- without granting org-owner access.
@@ -49,7 +49,7 @@ locals {
   ])
 }
 
-resource "github_organization_role_team" "cicd_admin_infrastructure" {
+resource "github_organization_role_team" "cicd_admin_ci_duty" {
   role_id   = local.cicd_admin_role_id
-  team_slug = github_team.all["infrastructure"].slug
+  team_slug = github_team.all["ci-duty"].slug
 }