Managing the list of TeamRepository resources

[mattwynne]

Suppose I have:

• A repository, "awesome"
• Two teams, "commiters" and "core"

const repo = new GitHub.Repository("awesome", { name: "awesome" })
const coreTeam = new github.Team(
  "core",
  {
    description: "Core team",
    name: "core",
    privacy: "closed",
  },
);
const committersTeam = new github.Team(
  "committers",
  {
    description: "All contributors,
    name: "committers",
    privacy: "closed",
  },
);

Now suppose I give the core team maintain access to the respository, using Pulumi. Something like this:

const coreTeamAccessToAwesome = new github.TeamRepository("core-awesome", {
  repository: "awesome",
  teamId: coreTeam.id,
  "maintain",
});

I can run pulumi up and the "Manage access" tab shows the right thing. 👌🏼

Suppose, however, someone then goes to that tab and manually adds the "committers" team to the repo too. Is there any way to detect this, and fix (i.e. remove that access) it using my Pulumi program?

I'm new to Pulimi / Terraform, so I might be missing something obvious, but I don't see a way, based on the API, to declare the list of TeamRepositories, only declare individual ones.

[mattwynne]

Seems like this is related, and if I understand correctly it explains that my use-case isn't currently possible: integrations/terraform-provider-github#395

[mattwynne]

It looks as though there's some progress on the problem upstream: integrations/terraform-provider-github#975

[guineveresaenger]

Hi @mattwynne - I'm actually working on something similar right now.

My recommendation for a workaround by maintaining a list of TeamRepositories yourself. If a team that is under Pulumi management manually receives a TeamRepository they shouldn't have, a pulumi up will absolutely remove their access. This does have the drawback of needing to manage a permission config. It depends on your use case if this is helpful to you.

Please stay tuned for a blog post on precisely this topic coming out soon!

[guineveresaenger]

@mattwynne here's a use case that may be relevant to you: https://www.pulumi.com/blog/managing-github-with-pulumi/

I realize this issue is ancient so I'm going to close it for now - please feel free to reopen if this remains a concern!