Adjust org owners/admins

[BigLep]

Summary

This aligns with the "reduce org owners" step listed in ipfs/ipfs#511.

This is the first step of wider 2024Q1 permissions cleanup.

Why do you need this?

Github org safety. See ipfs/ipfs#511 for more info.

Timeline

• 2024-02-12: public PR
• 2024-02-12: notify affected parties: Adjust org owners/admins #202 (comment)
• 2024-02-16: merge this change assuming no major pushback
• 2024-02-16: @galargh give "github-mgmt stewards" team "moderator" and "security manager" roles

Reviewer's Checklist

• It is clear where the request is coming from (if unsure, ask)
• All the automated checks passed
• The YAML changes reflect the summary of the request
• The Terraform plan posted as a comment reflects the summary of the request

[github-actions]

Before merge, verify that all the following plans are correct. They will be applied as-is after the merge.

Terraform plans

libp2p

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+ create
~ update in-place
- destroy
Terraform will perform the following actions:
# github_membership.this["aschmahmann"] will be updated in-place
~ resource "github_membership" "this" {
id = "libp2p:aschmahmann"
~ role = "admin" -> "member"
# (2 unchanged attributes hidden)
}
# github_membership.this["daviddias"] will be updated in-place
~ resource "github_membership" "this" {
id = "libp2p:daviddias"
~ role = "admin" -> "member"
# (2 unchanged attributes hidden)
}
# github_membership.this["jacobheun"] will be updated in-place
~ resource "github_membership" "this" {
id = "libp2p:jacobheun"
~ role = "admin" -> "member"
# (2 unchanged attributes hidden)
}
# github_membership.this["jbenet"] will be updated in-place
~ resource "github_membership" "this" {
id = "libp2p:jbenet"
~ role = "admin" -> "member"
# (2 unchanged attributes hidden)
}
# github_membership.this["marten-seemann"] will be updated in-place
~ resource "github_membership" "this" {
id = "libp2p:marten-seemann"
~ role = "admin" -> "member"
# (2 unchanged attributes hidden)
}
# github_membership.this["momack2"] will be updated in-place
~ resource "github_membership" "this" {
id = "libp2p:momack2"
~ role = "admin" -> "member"
# (2 unchanged attributes hidden)
}
# github_membership.this["raulk"] will be updated in-place
~ resource "github_membership" "this" {
id = "libp2p:raulk"
~ role = "admin" -> "member"
# (2 unchanged attributes hidden)
}
# github_membership.this["stebalien"] will be updated in-place
~ resource "github_membership" "this" {
id = "libp2p:Stebalien"
~ role = "admin" -> "member"
# (2 unchanged attributes hidden)
}
# github_membership.this["whyrusleeping"] will be updated in-place
~ resource "github_membership" "this" {
id = "libp2p:whyrusleeping"
~ role = "admin" -> "member"
# (2 unchanged attributes hidden)
}
# github_team_membership.this["github-mgmt stewards:aschmahmann"] will be destroyed
# (because key ["github-mgmt stewards:aschmahmann"] is not in for_each map)
- resource "github_team_membership" "this" {
- etag = "W/\"9a9278e94807b5df140bc9e83a2858e322cc655e9c4aa6e275c1338121d8d701\"" -> null
- id = "6630941:aschmahmann" -> null
- role = "maintainer" -> null
- team_id = "6630941" -> null
- username = "aschmahmann" -> null
}
# github_team_membership.this["github-mgmt stewards:biglep"] will be destroyed
# (because key ["github-mgmt stewards:biglep"] is not in for_each map)
- resource "github_team_membership" "this" {
- etag = "W/\"1c935ec0cda977b1b1addfc2f89654addccd7d59e1742357577eaef9e2c0490f\"" -> null
- id = "6630941:BigLep" -> null
- role = "maintainer" -> null
- team_id = "6630941" -> null
- username = "BigLep" -> null
}
# github_team_membership.this["github-mgmt stewards:dhuseby"] will be updated in-place
~ resource "github_team_membership" "this" {
id = "6630941:dhuseby"
~ role = "maintainer" -> "member"
# (3 unchanged attributes hidden)
}
# github_team_membership.this["github-mgmt stewards:marcopolo"] will be destroyed
# (because key ["github-mgmt stewards:marcopolo"] is not in for_each map)
- resource "github_team_membership" "this" {
- etag = "W/\"30e403bcfbe5bf8132d26d88e68de043f2fdfc0e29c674db1d3d5e8bd9b6c2b7\"" -> null
- id = "6630941:MarcoPolo" -> null
- role = "member" -> null
- team_id = "6630941" -> null
- username = "MarcoPolo" -> null
}
# github_team_membership.this["github-mgmt stewards:marten-seemann"] will be destroyed
# (because key ["github-mgmt stewards:marten-seemann"] is not in for_each map)
- resource "github_team_membership" "this" {
- etag = "W/\"f0415098eab48ae64fa625dd40ef9ff028ca2ba5bf83064608eace3b891ad35e\"" -> null
- id = "6630941:marten-seemann" -> null
- role = "maintainer" -> null
- team_id = "6630941" -> null
- username = "marten-seemann" -> null
}
# github_team_membership.this["github-mgmt stewards:mxinden"] will be destroyed
# (because key ["github-mgmt stewards:mxinden"] is not in for_each map)
- resource "github_team_membership" "this" {
- etag = "W/\"5595147afdf0df2570fa819ab45047d656eda600bec6de1b5e962c05142e8218\"" -> null
- id = "6630941:mxinden" -> null
- role = "maintainer" -> null
- team_id = "6630941" -> null
- username = "mxinden" -> null
}
# github_team_membership.this["github-mgmt stewards:raulk"] will be created
+ resource "github_team_membership" "this" {
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ team_id = "6630941"
+ username = "raulk"
}
# github_team_membership.this["github-mgmt stewards:stebalien"] will be created
+ resource "github_team_membership" "this" {
+ etag = (known after apply)
+ id = (known after apply)
+ role = "member"
+ team_id = "6630941"
+ username = "Stebalien"
}
# github_team_membership.this["github-mgmt stewards:willscott"] will be destroyed
# (because key ["github-mgmt stewards:willscott"] is not in for_each map)
- resource "github_team_membership" "this" {
- etag = "W/\"7ebf69ba32f63cd01cac59e0bf76c73051b37c80fd9eb3cdabda41e91c61de4f\"" -> null
- id = "6630941:willscott" -> null
- role = "member" -> null
- team_id = "6630941" -> null
- username = "willscott" -> null
}
Plan: 2 to add, 10 to change, 6 to destroy.

[BigLep]

@aschmahmann
@daviddias
@jacobheun
@jbenet
@MarcoPolo
@marten-seemann
@momack2
@mxinden
@whyrusleeping
@willscott

I'm @mentioning you to inform you that your libp2p github "org ownership" permissions will be removed as part of a ipfs/ipfs#511 unless you respond back with your use-case for having these broad permissions by 2024-02-14. You will still be a member of the libp2p github org, retain your existing direct github repo permissions or team permissions, and be able to make permission requests through https://github.com/lilbp2p/github-mgmt.

The current plan is to merge this change on Thursday, 2024-02-15.

That said, this isn't a one-way door. If we got this wrong or you see the notification after the fact, a new PR can be created fix permissions.

Thanks and let me know if you have any questions or concerns.

[BigLep]

@p-shahi : FYI I have added you as an org owner given the TPM role you play across the project.

[BigLep]

I updated the PR to account for cleaning up the github-mgmt stewards team.

[mxinden]

Thanks for the ping. I am in favor of the change!

[momack2]

Thanks @BigLep ! I'm fine on being removed - but probably makes sense for @jbenet to stay an owner given his continued libp2p involvement

[BigLep]

@momack2:

Thanks @BigLep ! I'm fine on being removed - but probably makes sense for @jbenet to stay an owner given his continued libp2p involvement

Let's have the conversation about what to do with foundational-but-not-currently-active-in-github people like Juan in the similar IPFS PR: ipfs/github-mgmt#189 (comment) . I'm game for whatever is decided.

(I can't pull up Juan's libp2p github activity the last 6 months at https://github.com/organizations/libp2p/settings/audit-log?q=actor%3Ajbenet+ because I'm not an org owner 😄)

[BigLep]

I'll leave this open until 2024-02-15 before merging.

I updated the messaging to be more clear as well:

I'm @mentioning you to inform you that your libp2p github "org ownership" permissions will be removed as part of a ipfs/ipfs#511 unless you respond back with your use-case for having these broad permissions by 2024-02-14. You will still be a member of the libp2p github org, retain your existing direct github repo permissions or team permissions, and be able to make permission requests through https://github.com/lilbp2p/github-mgmt.

[BigLep]

Based on ipfs/ipfs#511 (comment), I did more changes here to reduce the only true org owners to @galargh and @andyschwab-admin.

Here is the summary:

Org members who are no longer org-admins and are not in the "github-mgmt stewards" team (thus a true reduction of permissions):

• @aschmahmann
• @daviddias
• @jacobheun
• @jbenet
• @marten-seemann
• @momack2
• @whyrusleeping

Org members who are no longer org-admins but are still in the "github-mgmt stewards" team (thus can still get to "org owner" mode if needed):

• @p-shahi 🆕
• @raulk 🆕
• @Stebalien 🆕

Org members who were on the "github-mgmt stewards" team but have been removed (thus have had a reduction in permissions):

• @BigLep
• @MarcoPolo 🆕 - I did this since there are already two IP Shipyard representatives)
• @mxinden
• @willscott

🆕 indicates changes as of 2024-02-15

There are comments in the PR explaining more about the decision-making. Feedback welcome. I am shooting to be able to merge this on Friday, 2024-02-16. (I will personally be away on leave for a while starting 2024-02-17, but others like @galargh and @p-shahi can certainly engage here if we can't wrap this up by then.)

[BigLep]

I'm merging, given we've had time on this to iterate and fine-tune, @lidel support for this kind of approach for IPFS in ipfs/ipfs#511 (comment), that we're in a better place than we were before, and knowing further changes can be done in a followup if needed. (A phase 2 to this 2024Q1 permissions cleanup will likely start happening week of 2024-02-19 per ipfs/ipfs#511.)