Ignore org-role teams in RepositoryCollaborators to stop per-deploy churn - #179
Merged
Conversation
Pulumi PreviewClick to expand preview output |
claude
Bot
changed the title
GitHub's list-repository-teams API now also returns teams whose access comes from an organization role (orgRoles.ts: lead-maintainers and core-maintainers hold all_repo_admin, security-managers holds security_manager). During `pulumi up --refresh` the provider reads these teams as direct collaborators on every repository, then tries to DELETE the direct team-repo association where repoAccess.ts does not grant it — and GitHub 404s because no direct association exists. This broke every deploy starting with run #253 (first failure on experimental-ext-skills, where refresh picked up lead-maintainers). The pinned @pulumi/github 6.12.1 provider predates the upstream fix that skips non-direct teams (integrations/terraform-provider-github#3571), so work around it by passing ignoreTeams for the org-role-holding teams on each RepositoryCollaborators resource — except teams the repository's repoAccess.ts entry grants directly (e.g. lead-maintainers on maintainer-docs), which must stay managed by Pulumi. Remove this workaround once a @pulumi/github release including the upstream fix is adopted. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4JKj5FVkmj6bRzgh1GPrY
claude
Bot
force-pushed
the
claude/ignore-org-role-teams
branch
from
September 13, 2026 03:39
0029f1e to
83a88f1
Compare
localden
approved these changes
Sep 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Den Delimarsky · Slack thread
Before: Every deploy on
mainspends ~5 minutes rewriting resources that have not changed. GitHub's list-repository-teams API also returns teams whose access comes from an organization role, so thepulumi up --refreshstep reads the org-role teams fromorgRoles.ts(lead-maintainersandcore-maintainersholdall_repo_admin,security-managersholdssecurity_manager) as direct collaborators on repositories that never granted them inrepoAccess.ts, and then rewrites ~45RepositoryCollaboratorsresources on every run to remove them again (e.g. run #265, "~45 updated"). On 2026-09-07 this surfaced as a hard failure: run #253 404'd because the phantomlead-maintainersDELETEtargetedexperimental-ext-skills, a repository that had since been renamed toext-skillson GitHub. That rename was fixed separately in e9e9f1b (config rename plus a temporarypulumi state deleteof the stale resource), and deploys have been green since run #257; the per-deploy churn remains.After: The provider skips
lead-maintainers,core-maintainers, andsecurity-managerson repositories that do not explicitly grant them, so each deploy's refresh no longer sees phantom drift and stops rewriting those ~45 resources. Repositories whoserepoAccess.tsentry grants an org-role team directly (e.g.lead-maintainersandcore-maintainersonmaintainer-docs) keep those grants fully managed by Pulumi, unchanged. A future repository rename can no longer trip the same 404, because there is no phantom association left to delete.This is a workaround to remove once a @pulumi/github release includes the upstream fix integrations/terraform-provider-github#3571 (as of v6.15.0 the pinned upstream commit predates it).
How:
src/github.tsderives the org-role team list fromORG_ROLE_ASSIGNMENTS(so it cannot drift fromorgRoles.ts) and, for each repository, computesignoreTeamsas that list minus the teams the repo's config entry explicitly grants, referencing each team'sslugoutput. No grants change; the only diff to each resource is the addedignoreTeamsinput.The branch is conflict-free against
mainand CI is green.🤖 Generated with Claude Code
https://claude.ai/code/session_01H4JKj5FVkmj6bRzgh1GPrY