Repository navigation
fix(teams): ignore teams that hold an All-repository organization role - #1113
Open
rudycelekli wants to merge 1 commit into
Open
rudycelekli wants to merge 1 commit into
rudycelekli wants to merge 1 commit into
Conversation
Teams granted an organization-wide role such as "All-repository read" show up in every repo's team list. Because they are not declared in the safe-settings config, the Teams plugin reported (and in apply mode performed) a removal for each of them on every repository. Treat the All-repository read/triage/write/maintain/admin roles like the security manager role: discover their teams and leave them untouched. Fixes github-community-projects#1112 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #1112
Root cause
A team with an organization role such as "All-repository read" is returned by
repos.listTeamsfor every repository. It is not declared in the safe-settings config, so the Teams plugin treats it as an extra team and reports (and, when applying, performs) a removal on each repo. The plugin already skips teams holding thesecurity_managerrole; the All-repository roles were not covered.Change
lib/plugins/teams.js: the org-role discovery now covers thesecurity_managerrole and the All-repository read/triage/write/maintain/admin roles, collects the teams of every matching role, and leaves those teams untouched (same handling as security manager teams, including the add/update/remove no-ops and the discovery-failure deletion protection).Verification
npx jest test/unit/lib/plugins/teams.test.js: 46 passed.npm run test:unit: 1005 passed, 12 skipped.standardandeslintclean on the two changed files.Not run
listTeamsreturns role-holding teams is taken from the issue report).eslint .were not run (the latter already reports errors in unrelated files).Note: draft PR #1043 also touches the security manager handling in this plugin; this change may need a rebase depending on which lands first.
🤖 Generated with Claude Code