diff --git a/.github/workflows/access-report.yml b/.github/workflows/access-report.yml
new file mode 100644
index 0000000..ce30866
--- /dev/null
+++ b/.github/workflows/access-report.yml
@@ -0,0 +1,63 @@
+name: Access Report
+
+on:
+ workflow_dispatch:
+ inputs:
+ organization:
+ description: Organization config to report on
+ required: true
+
+defaults:
+ run:
+ shell: bash
+
+jobs:
+ report:
+ permissions:
+ contents: read
+ name: Access report
+ runs-on: ubuntu-latest
+ environment: read
+ env:
+ TF_IN_AUTOMATION: 1
+ TF_INPUT: 0
+ TF_WORKSPACE: ${{ inputs.organization }}
+ AWS_ACCESS_KEY_ID: ${{ secrets.RO_AWS_ACCESS_KEY_ID }}
+ AWS_SECRET_ACCESS_KEY: ${{ secrets.RO_AWS_SECRET_ACCESS_KEY }}
+ steps:
+ - name: Checkout
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ - name: Setup terraform
+ uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
+ with:
+ terraform_version: 1.12.0
+ terraform_wrapper: false
+ - name: Initialize terraform
+ run: terraform init
+ working-directory: terraform
+ - name: Install pnpm
+ uses: pnpm/action-setup@91ab88e2619ed1f46221f0ba42d1492c02baf788 # v6.0.6
+ with:
+ version: 10
+ - name: Use Node.js lts/*
+ uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+ with:
+ node-version: lts/*
+ cache: ''
+ - name: Initialize scripts
+ run: pnpm install --frozen-lockfile && pnpm run build
+ working-directory: scripts
+ - name: Generate access report
+ run: node --input-type=module --eval "import {runDescribeAccessChanges} from './lib/actions/shared/describe-access-changes.js'; await runDescribeAccessChanges();"
+ working-directory: scripts
+ env:
+ ACCESS_REPORT_PATH: ../ACCESS_REPORT.md
+ - name: Publish access report summary
+ run: cat ACCESS_REPORT.md >> "$GITHUB_STEP_SUMMARY"
+ - name: Upload access report
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+ with:
+ name: access-report-${{ env.TF_WORKSPACE }}
+ path: ACCESS_REPORT.md
+ if-no-files-found: error
+ retention-days: 14
diff --git a/.github/workflows/apply.yml b/.github/workflows/apply.yml
index 6dcaca9..7087b02 100644
--- a/.github/workflows/apply.yml
+++ b/.github/workflows/apply.yml
@@ -47,19 +47,65 @@ jobs:
GITHUB_APP_PEM_FILE: ${{ secrets.RO_GITHUB_APP_PEM_FILE }}
run: node lib/actions/find-sha-for-plan.js
working-directory: scripts
- apply:
+ classify:
needs: [prepare]
if: needs.prepare.outputs.sha != '' && needs.prepare.outputs.workspaces != ''
+ permissions:
+ contents: read
+ name: Classify
+ runs-on: ubuntu-latest
+ environment: read
+ outputs:
+ matrix: ${{ steps.classify.outputs.matrix }}
+ env:
+ TF_IN_AUTOMATION: 1
+ TF_INPUT: 0
+ AWS_ACCESS_KEY_ID: ${{ secrets.RO_AWS_ACCESS_KEY_ID }}
+ AWS_SECRET_ACCESS_KEY: ${{ secrets.RO_AWS_SECRET_ACCESS_KEY }}
+ WORKSPACES: ${{ needs.prepare.outputs.workspaces }}
+ defaults:
+ run:
+ shell: bash
+ steps:
+ - name: Checkout
+ uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+ - name: Setup terraform
+ uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
+ with:
+ terraform_version: 1.12.0
+ terraform_wrapper: false
+ - name: Initialize terraform
+ run: terraform init
+ working-directory: terraform
+ - name: Install pnpm
+ uses: pnpm/action-setup@91ab88e2619ed1f46221f0ba42d1492c02baf788 # v6.0.6
+ with:
+ version: 10
+ - name: Use Node.js lts/*
+ uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+ with:
+ node-version: lts/*
+ cache: ''
+ - run: pnpm install --frozen-lockfile && pnpm run build
+ working-directory: scripts
+ - name: Classify workspaces
+ id: classify
+ env:
+ MODE: write
+ run: node lib/actions/classify-allow-destroy.js
+ working-directory: scripts
+ apply:
+ needs: [prepare, classify]
+ if: needs.prepare.outputs.sha != '' && needs.prepare.outputs.workspaces != ''
permissions:
actions: read
contents: read
strategy:
fail-fast: false
- matrix:
- workspace: ${{ fromJson(needs.prepare.outputs.workspaces) }}
+ matrix: ${{ fromJson(needs.classify.outputs.matrix) }}
name: Apply
runs-on: ubuntu-latest
- environment: write
+ environment: ${{ matrix.environment }}
env:
TF_IN_AUTOMATION: 1
TF_INPUT: 0
@@ -84,19 +130,83 @@ jobs:
terraform_wrapper: false
- name: Initialize terraform
run: terraform init
+ - name: Allow destroy in guarded environment
+ if: matrix.environment == 'write-allow-destroy'
+ env:
+ ALLOW_DESTROY: ${{ vars.ALLOW_DESTROY }}
+ run: |
+ if [[ "${ALLOW_DESTROY}" != "true" ]]; then
+ echo "The write-allow-destroy environment must define ALLOW_DESTROY=true."
+ exit 1
+ fi
+ cp allow_destroy_override.tf.disabled allow_destroy_override.tf
+ - name: Summarize apply target
+ env:
+ REVIEWED_SHA: ${{ needs.prepare.outputs.sha }}
+ ENVIRONMENT_REASONS: ${{ toJson(matrix.environmentReasons) }}
+ run: |
+ {
+ echo '## Apply target'
+ echo ''
+ echo "- Reviewed SHA: \`${REVIEWED_SHA}\`"
+ echo "- Workspace: \`${TF_WORKSPACE}\`"
+ echo "- Environment: \`${{ matrix.environment }}\`"
+ if [[ "$(jq 'length' <<< "${ENVIRONMENT_REASONS}")" == '0' ]]; then
+ echo "- Environment reason: no allow-destroy changes detected"
+ else
+ echo "- Environment reason:"
+ jq -r '.[] | " - " + .' <<< "${ENVIRONMENT_REASONS}"
+ fi
+ echo "- Reviewed plan artifact: \`${TF_WORKSPACE}_${REVIEWED_SHA}.tfplan\`"
+ } >> "$GITHUB_STEP_SUMMARY"
- name: Download reviewed terraform plan
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
SHA: ${{ needs.prepare.outputs.sha }}
run: gh run download -n "${TF_WORKSPACE}_${SHA}.tfplan" --repo "${GITHUB_REPOSITORY}"
+ - name: Show reviewed terraform plan
+ run: |
+ terraform show -no-color "${TF_WORKSPACE}.tfplan" > "${TF_WORKSPACE}.reviewed.txt"
+ {
+ echo '## Reviewed Terraform plan'
+ echo ''
+ echo "${TF_WORKSPACE}.tfplan
"
+ echo ''
+ echo '~~~~terraform'
+ sed 's/^~~~~/~~~~ /' "${TF_WORKSPACE}.reviewed.txt"
+ echo '~~~~'
+ echo ''
+ echo '${TF_WORKSPACE}.merged.tfplan
"
+ echo ''
+ echo '~~~~terraform'
+ sed 's/^~~~~/~~~~ /' "${TF_WORKSPACE}.merged.txt"
+ echo '~~~~'
+ echo ''
+ echo 'Config diff
'
+ echo
+ echo '```diff'
+ git diff -- "github/${ORGANIZATION}.yml" | sed 's/^```/``` /'
+ echo '```'
+ echo
+ echo 'Access Changes<\/summary>/)
+ assert.doesNotMatch(comment, /Potential no members/)
+ assert.doesNotMatch(comment, /Any other members/)
+ })
+
+ it('falls back to workflow output when access change comments are too long', () => {
+ const state = new State(
+ JSON.stringify({values: {root_module: {resources: []}}})
+ )
+ const config = new Config(`
+members:
+ member:
+ - alice
+`)
+
+ const comment = describeAccessChangesComment(
+ state,
+ config,
+ 10,
+ 'https://github.example/runs/1'
+ )
+
+ assert.equal(
+ comment,
+ 'Access changes are too long to post as a comment. Please inspect [the Fix workflow summary or access report artifact](https://github.example/runs/1) instead.'
+ )
+ })
+
+ it('writes the full access report as a side effect of the action helper', async () => {
+ const dir = mkdtempSync(join(tmpdir(), 'access-report-'))
+ const reportPath = join(dir, 'ACCESS_REPORT.md')
+ const originalPath = process.env.ACCESS_REPORT_PATH
+
+ try {
+ process.env.ACCESS_REPORT_PATH = reportPath
+ const comment = await runDescribeAccessChanges()
+ const report = readFileSync(reportPath, 'utf8')
+
+ assert.match(comment, /Access Changes<\/summary>/)
+ assert.doesNotMatch(comment, /Potential no members/)
+ assert.match(
+ report,
+ /Post-change potential no members<\/summary>/
+ )
+ } finally {
+ if (originalPath === undefined) {
+ delete process.env.ACCESS_REPORT_PATH
+ } else {
+ process.env.ACCESS_REPORT_PATH = originalPath
+ }
+ rmSync(dir, {recursive: true, force: true})
+ }
+ })
+})
diff --git a/scripts/__tests__/actions/classify-allow-destroy.test.ts b/scripts/__tests__/actions/classify-allow-destroy.test.ts
new file mode 100644
index 0000000..67969af
--- /dev/null
+++ b/scripts/__tests__/actions/classify-allow-destroy.test.ts
@@ -0,0 +1,347 @@
+import 'reflect-metadata'
+
+import {describe, it} from 'node:test'
+import assert from 'node:assert'
+import {
+ describeWorkspaceClassification,
+ getEnvironment,
+ getAllowDestroyReasons,
+ hasAllowDestroyChange,
+ validateRemovedMembersHaveNoDanglingAccess
+} from '../../src/actions/classify-allow-destroy.js'
+import {Config} from '../../src/yaml/config.js'
+import {State} from '../../src/terraform/state.js'
+import {Locals} from '../../src/terraform/locals.js'
+
+function setManagedResourceTypes(resourceTypes: string[]): void {
+ Locals.locals = {
+ resource_types: resourceTypes,
+ ignore: {
+ repositories: [],
+ teams: [],
+ users: []
+ }
+ }
+}
+
+function state(source: object): State {
+ return new State(JSON.stringify(source))
+}
+
+describe('allow destroy classification', () => {
+ it('routes repository deletes to allow-destroy environments', async () => {
+ setManagedResourceTypes(['github_repository', 'github_membership'])
+
+ const allowDestroy = await hasAllowDestroyChange(
+ new Config(`
+repositories:
+ kept: {}
+`),
+ state({
+ values: {
+ root_module: {
+ resources: [
+ {
+ mode: 'managed',
+ type: 'github_repository',
+ values: {name: 'kept'}
+ },
+ {
+ mode: 'managed',
+ type: 'github_repository',
+ values: {name: 'removed'}
+ }
+ ]
+ }
+ }
+ })
+ )
+
+ assert.equal(allowDestroy, true)
+ assert.equal(getEnvironment('read', allowDestroy), 'read-allow-destroy')
+ assert.equal(getEnvironment('write', allowDestroy), 'write-allow-destroy')
+ })
+
+ it('routes membership deletes to allow-destroy environments', async () => {
+ setManagedResourceTypes(['github_repository', 'github_membership'])
+
+ const allowDestroy = await hasAllowDestroyChange(
+ new Config(`
+members:
+ admin:
+ - kept
+`),
+ state({
+ values: {
+ root_module: {
+ resources: [
+ {
+ mode: 'managed',
+ type: 'github_membership',
+ values: {username: 'kept', role: 'admin'}
+ },
+ {
+ mode: 'managed',
+ type: 'github_membership',
+ values: {username: 'removed', role: 'admin'}
+ }
+ ]
+ }
+ }
+ })
+ )
+
+ assert.equal(allowDestroy, true)
+ })
+
+ it('describes why allow-destroy environments are selected', async () => {
+ setManagedResourceTypes(['github_repository', 'github_membership'])
+
+ const reasons = await getAllowDestroyReasons(
+ new Config(`
+members:
+ admin:
+ - kept
+repositories:
+ kept: {}
+`),
+ state({
+ values: {
+ root_module: {
+ resources: [
+ {
+ mode: 'managed',
+ type: 'github_membership',
+ values: {username: 'kept', role: 'admin'}
+ },
+ {
+ mode: 'managed',
+ type: 'github_membership',
+ values: {username: 'removed', role: 'admin'}
+ },
+ {
+ mode: 'managed',
+ type: 'github_repository',
+ values: {name: 'kept'}
+ },
+ {
+ mode: 'managed',
+ type: 'github_repository',
+ values: {name: 'removed'}
+ }
+ ]
+ }
+ }
+ })
+ )
+ const summary = describeWorkspaceClassification({
+ include: [
+ {
+ workspace: 'default',
+ environment: 'read-allow-destroy',
+ environmentReasons: reasons
+ }
+ ]
+ })
+
+ assert.deepEqual(reasons, [
+ 'removes organization member removed',
+ 'removes repository removed'
+ ])
+ assert.match(summary, /Workspace classification/)
+ assert.match(summary, /read-allow-destroy/)
+ assert.match(summary, /removes organization member removed/)
+ assert.match(summary, /removes repository removed/)
+ })
+
+ it('keeps repository and membership updates in normal environments', async () => {
+ setManagedResourceTypes(['github_repository', 'github_membership'])
+
+ const allowDestroy = await hasAllowDestroyChange(
+ new Config(`
+members:
+ member:
+ - octocat
+repositories:
+ github:
+ description: updated
+`),
+ state({
+ values: {
+ root_module: {
+ resources: [
+ {
+ mode: 'managed',
+ type: 'github_repository',
+ values: {name: 'github', description: 'old'}
+ },
+ {
+ mode: 'managed',
+ type: 'github_membership',
+ values: {username: 'octocat', role: 'member'}
+ }
+ ]
+ }
+ }
+ })
+ )
+
+ assert.equal(allowDestroy, false)
+ assert.equal(getEnvironment('read', allowDestroy), 'read')
+ assert.equal(getEnvironment('write', allowDestroy), 'write')
+ })
+
+ it('ignores deletes for other resource types', async () => {
+ setManagedResourceTypes(['github_team'])
+
+ const allowDestroy = await hasAllowDestroyChange(
+ new Config('{}'),
+ state({
+ values: {
+ root_module: {
+ resources: [
+ {
+ mode: 'managed',
+ type: 'github_team',
+ values: {name: 'removed'}
+ }
+ ]
+ }
+ }
+ })
+ )
+
+ assert.equal(allowDestroy, false)
+ })
+
+ it('ignores repository and membership types that are not managed', async () => {
+ setManagedResourceTypes([])
+
+ const allowDestroy = await hasAllowDestroyChange(
+ new Config('{}'),
+ state({
+ values: {
+ root_module: {
+ resources: [
+ {
+ mode: 'managed',
+ type: 'github_repository',
+ values: {name: 'removed'}
+ },
+ {
+ mode: 'managed',
+ type: 'github_membership',
+ values: {username: 'removed', role: 'member'}
+ }
+ ]
+ }
+ }
+ })
+ )
+
+ assert.equal(allowDestroy, false)
+ })
+
+ it('fails when removing a member who remains in a team', async () => {
+ setManagedResourceTypes(['github_membership'])
+
+ await assert.rejects(
+ validateRemovedMembersHaveNoDanglingAccess(
+ new Config(`
+teams:
+ maintainers:
+ members:
+ member:
+ - removed
+`),
+ state({
+ values: {
+ root_module: {
+ resources: [
+ {
+ mode: 'managed',
+ type: 'github_membership',
+ values: {username: 'removed', role: 'member'}
+ }
+ ]
+ }
+ }
+ })
+ ),
+ /removed is still a member of team maintainers/
+ )
+ })
+
+ it('fails when removing a member who keeps direct private repository access', async () => {
+ setManagedResourceTypes(['github_membership'])
+
+ await assert.rejects(
+ validateRemovedMembersHaveNoDanglingAccess(
+ new Config(`
+repositories:
+ private-repo:
+ collaborators:
+ pull:
+ - removed
+ visibility: private
+`),
+ state({
+ values: {
+ root_module: {
+ resources: [
+ {
+ mode: 'managed',
+ type: 'github_membership',
+ values: {username: 'removed', role: 'member'}
+ }
+ ]
+ }
+ }
+ })
+ ),
+ /removed still has direct access to private repository private-repo/
+ )
+ })
+
+ it('allows member removal when team and private direct access are removed too', async () => {
+ setManagedResourceTypes(['github_membership'])
+
+ await validateRemovedMembersHaveNoDanglingAccess(
+ new Config(`
+repositories:
+ public-repo:
+ collaborators:
+ pull:
+ - removed
+ visibility: public
+`),
+ state({
+ values: {
+ root_module: {
+ resources: [
+ {
+ mode: 'managed',
+ type: 'github_membership',
+ values: {username: 'removed', role: 'member'}
+ },
+ {
+ mode: 'managed',
+ type: 'github_repository',
+ values: {name: 'private-repo', visibility: 'private'}
+ },
+ {
+ mode: 'managed',
+ type: 'github_repository_collaborator',
+ values: {
+ username: 'removed',
+ repository: 'private-repo',
+ permission: 'pull'
+ }
+ }
+ ]
+ }
+ }
+ })
+ )
+ })
+})
diff --git a/scripts/__tests__/actions/update-members.test.ts b/scripts/__tests__/actions/update-members.test.ts
new file mode 100644
index 0000000..b115ef7
--- /dev/null
+++ b/scripts/__tests__/actions/update-members.test.ts
@@ -0,0 +1,183 @@
+import 'reflect-metadata'
+
+import assert from 'node:assert'
+import {describe, it} from 'node:test'
+import {Config} from '../../src/yaml/config.js'
+import {
+ parseCutoffDate,
+ parseLimit,
+ parseOrganizationMembership,
+ selectMembersForUpdate,
+ updateMembersConfig
+} from '../../src/actions/update-members.js'
+import {Member} from '../../src/resources/member.js'
+import {TeamMember} from '../../src/resources/team-member.js'
+import {RepositoryCollaborator} from '../../src/resources/repository-collaborator.js'
+
+describe('update members', () => {
+ it('requires cutoff date or only list', () => {
+ const config = new Config('members:\n member:\n - alice\n')
+
+ assert.throws(() =>
+ selectMembersForUpdate(config, [], {
+ ignore: [],
+ only: [],
+ publicRepoAccess: 'retain',
+ organizationMembership: 'keep'
+ })
+ )
+ })
+
+ it('validates workflow inputs', () => {
+ assert.equal(
+ parseCutoffDate('2025-01-02')?.toISOString(),
+ '2025-01-02T00:00:00.000Z'
+ )
+ assert.equal(parseLimit('2'), 2)
+ assert.equal(parseOrganizationMembership('keep'), 'keep')
+ assert.equal(parseOrganizationMembership('remove'), 'remove')
+ assert.throws(() => parseCutoffDate('01-02-2025'))
+ assert.throws(() => parseLimit('0'))
+ assert.throws(() => parseOrganizationMembership('invalid'))
+ })
+
+ it('selects inactive members with only, ignore, limit, and KEEP handling', () => {
+ const config = new Config(`
+members:
+ member:
+ - active
+ - ignored
+ - kept # KEEP: manual exception
+ - manual
+ - never-active
+ - old
+`)
+
+ const selected = selectMembersForUpdate(
+ config,
+ [
+ {username: 'active', latestActivity: new Date('2025-01-01T00:00:00Z')},
+ {username: 'old', latestActivity: new Date('2023-01-01T00:00:00Z')}
+ ],
+ {
+ cutoffDate: new Date('2024-01-01T00:00:00Z'),
+ limit: 2,
+ ignore: ['ignored'],
+ only: ['active', 'ignored', 'kept', 'manual', 'never-active', 'old'],
+ publicRepoAccess: 'retain',
+ organizationMembership: 'keep'
+ }
+ )
+
+ assert.deepEqual(selected, ['manual', 'never-active'])
+ })
+
+ it('retains effective public repository access when configured', () => {
+ const config = new Config(`
+members:
+ member:
+ - alice
+repositories:
+ private-repo:
+ collaborators:
+ pull:
+ - alice
+ teams:
+ admin:
+ - maintainers
+ visibility: private
+ public-repo:
+ collaborators:
+ pull:
+ - alice
+ teams:
+ push:
+ - maintainers
+ visibility: public
+teams:
+ maintainers:
+ members:
+ member:
+ - alice
+`)
+
+ updateMembersConfig(config, ['alice'], 'retain', 'keep')
+
+ assert.equal(
+ config
+ .getResources(TeamMember)
+ .some(teamMember => teamMember.username === 'alice'),
+ false
+ )
+ assert.equal(
+ config
+ .getResources(RepositoryCollaborator)
+ .some(
+ collaborator =>
+ collaborator.username === 'alice' &&
+ collaborator.repository === 'private-repo'
+ ),
+ false
+ )
+
+ const publicCollaborator = config
+ .getResources(RepositoryCollaborator)
+ .find(
+ collaborator =>
+ collaborator.username === 'alice' &&
+ collaborator.repository === 'public-repo'
+ )
+
+ assert.equal(publicCollaborator?.permission, 'push')
+ })
+
+ it('removes public repository access when configured', () => {
+ const config = new Config(`
+members:
+ member:
+ - alice
+repositories:
+ public-repo:
+ collaborators:
+ pull:
+ - alice
+ teams:
+ push:
+ - maintainers
+ visibility: public
+teams:
+ maintainers:
+ members:
+ member:
+ - alice
+`)
+
+ updateMembersConfig(config, ['alice'], 'remove', 'keep')
+
+ assert.equal(
+ config
+ .getResources(RepositoryCollaborator)
+ .some(collaborator => collaborator.username === 'alice'),
+ false
+ )
+ })
+
+ it('removes organization membership when configured', () => {
+ const config = new Config(`
+members:
+ member:
+ - alice
+ - bob
+repositories:
+ public-repo:
+ visibility: public
+`)
+
+ updateMembersConfig(config, ['alice'], 'remove', 'remove')
+
+ assert.deepEqual(
+ config.getResources(Member).map(member => member.username),
+ ['bob']
+ )
+ })
+})
diff --git a/scripts/__tests__/workflows.test.ts b/scripts/__tests__/workflows.test.ts
new file mode 100644
index 0000000..1894acc
--- /dev/null
+++ b/scripts/__tests__/workflows.test.ts
@@ -0,0 +1,290 @@
+import assert from 'node:assert'
+import {existsSync, readFileSync} from 'node:fs'
+import {describe, it} from 'node:test'
+import * as YAML from 'yaml'
+
+type WorkflowStep = {
+ name?: string
+ if?: string
+ uses?: string
+ run?: string
+ env?: Record
+ with?: Record
+}
+
+type Workflow = {
+ on: {
+ workflow_dispatch?: unknown
+ }
+ jobs: Record<
+ string,
+ {
+ permissions?: Record
+ environment?: string
+ steps: WorkflowStep[]
+ }
+ >
+}
+
+function workflow(path: string): Workflow {
+ return YAML.parse(readFileSync(`../.github/workflows/${path}`, 'utf8'))
+}
+
+describe('workflows', () => {
+ it('guards allow-destroy override steps with an environment variable', () => {
+ const plan = workflow('plan.yml')
+ const apply = workflow('apply.yml')
+ const planStep = plan.jobs.plan.steps.find(
+ step => step.name === 'Allow destroy in guarded environment'
+ )
+ const applyStep = apply.jobs.apply.steps.find(
+ step => step.name === 'Allow destroy in guarded environment'
+ )
+
+ assert.ok(planStep)
+ assert.ok(applyStep)
+ assert.equal(planStep.env?.ALLOW_DESTROY, '${{ vars.ALLOW_DESTROY }}')
+ assert.match(planStep.run ?? '', /ALLOW_DESTROY.*true/)
+ assert.match(planStep.run ?? '', /allow_destroy_override\.tf\.disabled/)
+ assert.equal(applyStep.env?.ALLOW_DESTROY, '${{ vars.ALLOW_DESTROY }}')
+ assert.match(applyStep.run ?? '', /ALLOW_DESTROY.*true/)
+ assert.match(applyStep.run ?? '', /allow_destroy_override\.tf\.disabled/)
+ })
+
+ it('provides a manual access report workflow through the shared formatter helper', () => {
+ assert.equal(existsSync('../.github/workflows/access-report.yml'), true)
+
+ const accessReport = workflow('access-report.yml')
+ const reportJob = accessReport.jobs.report
+ const steps = reportJob.steps
+ const generateStep = steps.find(
+ step => step.name === 'Generate access report'
+ )
+ const publishStep = steps.find(
+ step => step.name === 'Publish access report summary'
+ )
+ const uploadStep = steps.find(step => step.name === 'Upload access report')
+
+ assert.ok(accessReport.on.workflow_dispatch)
+ assert.equal(reportJob.environment, 'read')
+ assert.ok(generateStep)
+ assert.equal(generateStep.env?.ACCESS_REPORT_PATH, '../ACCESS_REPORT.md')
+ assert.match(generateStep.run ?? '', /runDescribeAccessChanges/)
+ assert.doesNotMatch(generateStep.run ?? '', /access-report\.js/)
+ assert.ok(publishStep)
+ assert.equal(
+ publishStep.run,
+ 'cat ACCESS_REPORT.md >> "$GITHUB_STEP_SUMMARY"'
+ )
+ assert.ok(uploadStep)
+ assert.equal(uploadStep.with?.name, 'access-report-${{ env.TF_WORKSPACE }}')
+ assert.equal(uploadStep.with?.path, 'ACCESS_REPORT.md')
+ })
+
+ it('publishes the full access report from the fix workflow', () => {
+ const fix = workflow('fix.yml')
+ const steps = fix.jobs.fix.steps.map(step => step.name)
+
+ assert.ok(steps.includes('Publish access report summary'))
+ assert.ok(steps.includes('Upload access report'))
+ })
+
+ it('downloads only fixed YAML config artifacts before pushing fix changes', () => {
+ const fix = workflow('fix.yml')
+ const fixSteps = fix.jobs.fix.steps
+ const pushSteps = fix.jobs.push.steps
+ const uploadYamlStep = fixSteps.find(
+ step => step.name === 'Upload YAML config'
+ )
+ const downloadYamlStep = pushSteps.find(
+ step => step.name === 'Download YAML configs'
+ )
+ const copyYamlStep = pushSteps.find(
+ step => step.name === 'Copy YAML configs'
+ )
+
+ assert.ok(uploadYamlStep)
+ assert.ok(downloadYamlStep)
+ assert.ok(copyYamlStep)
+ assert.equal(
+ uploadYamlStep.with?.name,
+ 'fixed-config-${{ env.TF_WORKSPACE }}'
+ )
+ assert.equal(downloadYamlStep.with?.pattern, 'fixed-config-*')
+ assert.equal(downloadYamlStep.with?.['merge-multiple'], true)
+ assert.equal(copyYamlStep.run, 'cp artifacts/*.yml head/github')
+ })
+
+ it('publishes planned terraform targets and rendered plan summaries', () => {
+ const plan = workflow('plan.yml')
+ const planSteps = plan.jobs.plan.steps
+ const commentSteps = plan.jobs.comment.steps
+ const targetStep = planSteps.find(
+ step => step.name === 'Summarize plan target'
+ )
+ const publishStep = commentSteps.find(
+ step => step.name === 'Publish terraform plans summary'
+ )
+ const uploadStep = commentSteps.find(
+ step => step.name === 'Upload terraform plans summary'
+ )
+
+ assert.ok(targetStep)
+ assert.equal(
+ targetStep.env?.ENVIRONMENT_REASONS,
+ '${{ toJson(matrix.environmentReasons) }}'
+ )
+ assert.match(targetStep.run ?? '', /## Plan target/)
+ assert.match(targetStep.run ?? '', /Pull request/)
+ assert.match(targetStep.run ?? '', /Source SHA/)
+ assert.match(targetStep.run ?? '', /Environment reason/)
+ assert.match(targetStep.run ?? '', /Terraform plan artifact/)
+ assert.ok(publishStep)
+ assert.equal(
+ publishStep.run,
+ 'cat TERRAFORM_PLANS.md >> "$GITHUB_STEP_SUMMARY"'
+ )
+ assert.ok(uploadStep)
+ assert.equal(
+ uploadStep.with?.name,
+ 'terraform-plans-${{ github.event.pull_request.head.sha || github.sha }}'
+ )
+ assert.equal(uploadStep.with?.path, 'terraform/TERRAFORM_PLANS.md')
+ })
+
+ it('publishes apply targets and reviewed plan summaries', () => {
+ const apply = workflow('apply.yml')
+ const steps = apply.jobs.apply.steps
+ const targetStep = steps.find(
+ step => step.name === 'Summarize apply target'
+ )
+ const reviewedStep = steps.find(
+ step => step.name === 'Show reviewed terraform plan'
+ )
+ const mergedStep = steps.find(
+ step => step.name === 'Show merged terraform plan'
+ )
+ const uploadStep = steps.find(
+ step => step.name === 'Upload apply plan summaries'
+ )
+ const compareStep = steps.find(
+ step => step.name === 'Compare reviewed and merged plans'
+ )
+
+ assert.ok(targetStep)
+ assert.equal(
+ targetStep.env?.ENVIRONMENT_REASONS,
+ '${{ toJson(matrix.environmentReasons) }}'
+ )
+ assert.match(targetStep.run ?? '', /## Apply target/)
+ assert.match(targetStep.run ?? '', /Reviewed SHA/)
+ assert.match(targetStep.run ?? '', /Environment reason/)
+ assert.match(targetStep.run ?? '', /Reviewed plan artifact/)
+ assert.ok(reviewedStep)
+ assert.match(reviewedStep.run ?? '', /## Reviewed Terraform plan/)
+ assert.match(reviewedStep.run ?? '', /\.reviewed\.txt/)
+ assert.ok(mergedStep)
+ assert.match(mergedStep.run ?? '', /## Merged Terraform plan/)
+ assert.match(mergedStep.run ?? '', /\.merged\.txt/)
+ assert.ok(uploadStep)
+ assert.equal(
+ uploadStep.with?.name,
+ 'apply-plans-${{ env.TF_WORKSPACE }}-${{ needs.prepare.outputs.sha }}'
+ )
+ assert.match(String(uploadStep.with?.path), /\.reviewed\.txt/)
+ assert.match(String(uploadStep.with?.path), /\.merged\.txt/)
+ assert.ok(compareStep)
+ assert.equal(
+ compareStep.run,
+ 'diff -u "${TF_WORKSPACE}.reviewed.txt" "${TF_WORKSPACE}.merged.txt"\n'
+ )
+ })
+
+ it('creates update-members pull requests with the GitHub App token', () => {
+ const updateMembers = workflow('update-members.yml')
+ const job = updateMembers.jobs.update
+ const steps = job.steps
+ const generateTokenStep = steps.find(
+ step => step.name === 'Generate app token'
+ )
+ const checkoutStep = steps.find(
+ step => step.name === 'Checkout with app token'
+ )
+ const configureGitStep = steps.find(
+ step => step.name === 'Configure git user'
+ )
+ const createPullRequestStep = steps.find(
+ step => step.name === 'Create draft pull request'
+ )
+
+ assert.equal(job.permissions?.contents, 'read')
+ assert.equal(job.permissions?.['pull-requests'], 'read')
+ assert.ok(generateTokenStep)
+ assert.equal(
+ generateTokenStep.if,
+ "github.event.inputs['draft-run'] != 'true'"
+ )
+ assert.equal(
+ generateTokenStep.with?.app_id,
+ '${{ secrets.RW_GITHUB_APP_ID }}'
+ )
+ assert.ok(checkoutStep)
+ assert.equal(checkoutStep.if, "github.event.inputs['draft-run'] != 'true'")
+ assert.equal(checkoutStep.with?.token, '${{ steps.token.outputs.token }}')
+ assert.ok(configureGitStep)
+ assert.equal(
+ configureGitStep.if,
+ "steps.config-modified.outputs.this == 'true' && github.event.inputs['draft-run'] != 'true'"
+ )
+ assert.equal(
+ configureGitStep.env?.GITHUB_MGMT_APP_ID,
+ '${{ secrets.RW_GITHUB_APP_ID }}'
+ )
+ assert.match(configureGitStep.run ?? '', /github-mgmt\[bot\]/)
+ assert.ok(createPullRequestStep)
+ assert.equal(
+ createPullRequestStep.env?.GITHUB_TOKEN,
+ '${{ steps.token.outputs.token }}'
+ )
+ })
+
+ it('supports update-members draft runs without creating pull requests', () => {
+ const updateMembers = workflow('update-members.yml')
+ const workflowDispatch = updateMembers.on.workflow_dispatch as {
+ inputs: Record
+ }
+ const job = updateMembers.jobs.update
+ const steps = job.steps
+ const checkoutStep = steps.find(step => step.name === 'Checkout')
+ const summaryStep = steps.find(
+ step => step.name === 'Summarize member update'
+ )
+ const createPullRequestStep = steps.find(
+ step => step.name === 'Create draft pull request'
+ )
+
+ assert.equal(workflowDispatch.inputs['draft-run'].default, false)
+ assert.equal(workflowDispatch.inputs['draft-run'].type, 'boolean')
+ assert.equal(
+ job.environment,
+ "${{ github.event.inputs['draft-run'] == 'true' && 'read' || 'push' }}"
+ )
+ assert.ok(checkoutStep)
+ assert.equal(checkoutStep.if, "github.event.inputs['draft-run'] == 'true'")
+ assert.ok(summaryStep)
+ assert.match(summaryStep.run ?? '', /## Update members/)
+ assert.match(
+ summaryStep.run ?? '',
+ /Pull request: not created because draft run is enabled/
+ )
+ assert.match(
+ summaryStep.run ?? '',
+ /git diff -- "github\/\$\{ORGANIZATION\}\.yml"/
+ )
+ assert.ok(createPullRequestStep)
+ assert.equal(
+ createPullRequestStep.if,
+ "steps.config-modified.outputs.this == 'true' && github.event.inputs['draft-run'] != 'true'"
+ )
+ })
+})
diff --git a/scripts/src/actions/classify-allow-destroy.ts b/scripts/src/actions/classify-allow-destroy.ts
new file mode 100644
index 0000000..bea8b79
--- /dev/null
+++ b/scripts/src/actions/classify-allow-destroy.ts
@@ -0,0 +1,255 @@
+import 'reflect-metadata'
+
+import * as core from '@actions/core'
+import {pathToFileURL} from 'url'
+import * as fs from 'fs'
+import {Config} from '../yaml/config.js'
+import {State} from '../terraform/state.js'
+import {
+ Resource,
+ ResourceConstructor,
+ ResourceConstructors
+} from '../resources/resource.js'
+import {Member} from '../resources/member.js'
+import {Repository, Visibility} from '../resources/repository.js'
+import {TeamMember} from '../resources/team-member.js'
+import {RepositoryCollaborator} from '../resources/repository-collaborator.js'
+
+const ALLOW_DESTROY_RESOURCE_CLASSES: ResourceConstructor[] = [
+ Member,
+ Repository
+]
+
+type Mode = 'read' | 'write'
+
+type Matrix = {
+ include: {
+ workspace: string
+ environment: string
+ environmentReasons: string[]
+ }[]
+}
+
+function getStateAddress(resource: Resource): string {
+ return resource.getStateAddress().toLowerCase()
+}
+
+function formatAllowDestroyReason(resource: Resource): string {
+ if (resource instanceof Member) {
+ return `removes organization member ${resource.username.toLowerCase()}`
+ }
+
+ if (resource instanceof Repository) {
+ return `removes repository ${resource.name.toLowerCase()}`
+ }
+
+ return `removes ${resource.getStateAddress().toLowerCase()}`
+}
+
+function getMissingResources(
+ config: Config,
+ state: State,
+ resourceClass: ResourceConstructor
+): T[] {
+ const desiredAddresses = new Set(
+ config.getResources(resourceClass).map(getStateAddress)
+ )
+ return state
+ .getResources(resourceClass)
+ .filter(resource => !desiredAddresses.has(getStateAddress(resource)))
+}
+
+export async function getAllowDestroyReasons(
+ config: Config,
+ state: State
+): Promise {
+ const reasons = []
+
+ for (const resourceClass of ALLOW_DESTROY_RESOURCE_CLASSES) {
+ if (
+ ResourceConstructors.includes(resourceClass) &&
+ !(await state.isIgnored(resourceClass))
+ ) {
+ reasons.push(
+ ...getMissingResources(config, state, resourceClass).map(
+ formatAllowDestroyReason
+ )
+ )
+ }
+ }
+
+ return reasons.sort()
+}
+
+export async function hasAllowDestroyChange(
+ config: Config,
+ state: State
+): Promise {
+ return (await getAllowDestroyReasons(config, state)).length > 0
+}
+
+export async function validateRemovedMembersHaveNoDanglingAccess(
+ config: Config,
+ state: State
+): Promise {
+ if (await state.isIgnored(Member)) {
+ return
+ }
+
+ const desiredMembers = new Set(
+ config.getResources(Member).map(member => member.username.toLowerCase())
+ )
+ const removedMembers = state
+ .getResources(Member)
+ .map(member => member.username.toLowerCase())
+ .filter(username => !desiredMembers.has(username))
+
+ if (removedMembers.length === 0) {
+ return
+ }
+
+ const repositoryVisibility = new Map(
+ [...state.getResources(Repository), ...config.getResources(Repository)].map(
+ repository => [
+ repository.name.toLowerCase(),
+ repository.visibility ?? Visibility.Private
+ ]
+ )
+ )
+ const teamMembers = config.getResources(TeamMember)
+ const repositoryCollaborators = config.getResources(RepositoryCollaborator)
+ const errors: string[] = []
+
+ for (const username of removedMembers.sort()) {
+ const teams = teamMembers
+ .filter(teamMember => teamMember.username.toLowerCase() === username)
+ .map(teamMember => teamMember.team.toLowerCase())
+ .sort()
+ const privateRepositories = repositoryCollaborators
+ .filter(collaborator => collaborator.username.toLowerCase() === username)
+ .filter(
+ collaborator =>
+ (repositoryVisibility.get(collaborator.repository.toLowerCase()) ??
+ Visibility.Private) === Visibility.Private
+ )
+ .map(collaborator => collaborator.repository.toLowerCase())
+ .sort()
+
+ if (teams.length > 0) {
+ errors.push(
+ `${username} is still a member of ${teams.length === 1 ? 'team' : 'teams'} ${teams.join(
+ ', '
+ )}`
+ )
+ }
+
+ if (privateRepositories.length > 0) {
+ errors.push(
+ `${username} still has direct access to private ${privateRepositories.length === 1 ? 'repository' : 'repositories'} ${privateRepositories.join(
+ ', '
+ )}`
+ )
+ }
+ }
+
+ if (errors.length > 0) {
+ throw new Error(
+ [
+ 'Cannot remove organization members while leaving dangling access:',
+ ...errors.map(error => `- ${error}`)
+ ].join('\n')
+ )
+ }
+}
+
+export function getEnvironment(mode: Mode, allowDestroy: boolean): string {
+ return allowDestroy ? `${mode}-allow-destroy` : mode
+}
+
+export function describeWorkspaceClassification(matrix: Matrix): string {
+ const lines = [
+ '## Workspace classification',
+ '',
+ '| Workspace | Environment | Reason |',
+ '| --- | --- | --- |'
+ ]
+
+ for (const item of matrix.include) {
+ const reasons =
+ item.environmentReasons.length === 0
+ ? 'No allow-destroy changes detected.'
+ : item.environmentReasons.join('
')
+ lines.push(`| ${item.workspace} | ${item.environment} | ${reasons} |`)
+ }
+
+ return lines.join('\n')
+}
+
+function writeStepSummary(markdown: string): void {
+ const summaryPath = process.env.GITHUB_STEP_SUMMARY
+ if (summaryPath !== undefined) {
+ fs.appendFileSync(summaryPath, `${markdown}\n`)
+ }
+}
+
+export async function classifyWorkspaces({
+ mode,
+ workspaces,
+ githubDir
+}: {
+ mode: Mode
+ workspaces: string[]
+ githubDir: string
+}): Promise {
+ const include = []
+ const originalWorkspace = process.env.TF_WORKSPACE
+
+ try {
+ for (const workspace of workspaces) {
+ process.env.TF_WORKSPACE = workspace
+ const config = Config.FromPath(`${githubDir}/${workspace}.yml`)
+ const state = await State.New()
+ await validateRemovedMembersHaveNoDanglingAccess(config, state)
+ const environmentReasons = await getAllowDestroyReasons(config, state)
+ const environment = getEnvironment(mode, environmentReasons.length > 0)
+ core.info(`${workspace}: ${environment}`)
+ for (const reason of environmentReasons) {
+ core.info(`- ${reason}`)
+ }
+ include.push({workspace, environment, environmentReasons})
+ }
+ } finally {
+ if (originalWorkspace === undefined) {
+ delete process.env.TF_WORKSPACE
+ } else {
+ process.env.TF_WORKSPACE = originalWorkspace
+ }
+ }
+
+ return {include}
+}
+
+async function run(): Promise {
+ const mode = (process.env.MODE ?? 'read') as Mode
+ if (mode !== 'read' && mode !== 'write') {
+ throw new Error(`MODE must be one of "read" or "write", got "${mode}"`)
+ }
+
+ const workspaces = JSON.parse(process.env.WORKSPACES?.trim() || '[]')
+ if (!Array.isArray(workspaces)) {
+ throw new Error('WORKSPACES must be a JSON array')
+ }
+
+ const matrix = await classifyWorkspaces({
+ mode,
+ workspaces,
+ githubDir: process.env.GITHUB_DIR ?? '../github'
+ })
+
+ writeStepSummary(describeWorkspaceClassification(matrix))
+ core.setOutput('matrix', JSON.stringify(matrix))
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1]).href) {
+ run().catch(error => core.setFailed(error))
+}
diff --git a/scripts/src/actions/fix-yaml-config.ts b/scripts/src/actions/fix-yaml-config.ts
index a88b191..142297c 100644
--- a/scripts/src/actions/fix-yaml-config.ts
+++ b/scripts/src/actions/fix-yaml-config.ts
@@ -8,20 +8,9 @@ import * as core from '@actions/core'
async function run(): Promise {
await runToggleArchivedRepos()
- const accessChangesDescription = await runDescribeAccessChanges()
+ const accessChangesComment = await runDescribeAccessChanges()
- core.setOutput(
- 'comment',
- `The following access changes will be introduced as a result of applying the plan:
-
-Access Changes
-
-\`\`\`
-${accessChangesDescription}
-\`\`\`
-
-${title}
`,
+ '',
+ `Affected users: ${users.length > 0 ? users.join(', ') : 'none'}`,
+ '',
+ '```'
+ ]
+
+ if (users.length === 0) {
+ lines.push('No users in this section')
+ }
+
+ for (const username of users) {
+ const access = summary[username]
+ const kind = access.isOutsideCollaborator
+ ? 'outside collaborator'
+ : 'member'
+ lines.push(`User ${username} (${kind}):`)
+ const repositories = Object.entries(access.repositories)
+ if (repositories.length === 0) {
+ lines.push(' - has no repository access')
+ } else {
+ for (const [repository, repositoryAccess] of repositories) {
+ lines.push(
+ ` - has ${formatRepositoryAccessDescription(
+ repository,
+ repositoryAccess
+ )}`
+ )
+ }
+ }
+ }
+
+ lines.push('```', '', 'Access Changes
',
+ '',
+ '```',
+ accessChangesDescription,
+ '```',
+ '',
+ 'Access Changes
',
+ '',
+ '```',
+ accessChangesDescription,
+ '```',
+ '',
+ '