Retire the Players team from the merge-gate rationale - #173
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
cpitzi
enabled auto-merge (squash)
August 28, 2026 01:10
Contributor
terraform plan (success) |
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
lentagoorg base repository permission movednone→writeon 2026-08-27, giving every member write on every repo. ThePlayersteam carriedtriageon fifteen of the eighteen repos, which is strictly below the new base grant — it no longer affected anyone's effective access, so it was retired rather than left as a misleading artifact. No member lost access; the three newest repos (lupinus,monarda,osmunda) had never been added to the team and gained access for the first time.The Terraform in this repo described the old model in three places, and those comments are the reason the change is worth a PR rather than a live tweak:
protection.tfjustifies its existence by contrast with the access model around it, so a stale premise there is actively misleading to the next reader.terraform/protection.tf— the header no longer describes colleagues as triage-only. It now records the base-writegrant, the team's retirement, and the point the resource exists to make: the gate is an allowlist on the ref, so it is indifferent to permission levels.terraform/locals.tf— thegate_allowlistcomment drops the "(Players team, triage)" parenthetical for the same reason.terraform/README.md— the merge-gate section matches.docs/adr/0003-merge-gate-push-allowlist.md— amended rather than edited. The Context is left as the record of what was true at decision time; the new amendment notes that the write grant the ADR was explicitly built to survive has now arrived, and that the gate held.No resource, variable, or input JSON changed, so the plan is expected to be a no-op.
Verification
restrictionswas re-read on every public repo after the permission change and is unchanged —users: ["cpitzi"],teams: [],apps: []. Because the allowlist is evaluated against the ref rather than derived from permission levels, raising the base grant changed nothing about who may updatemain. Effective permission was confirmed aswritefor both non-owner members across the fleet. NoCODEOWNERSfile, branch-protection team grant, or ruleset bypass actor referenced the team.Follow-ups, not in scope here
default_repository_permissionis live-only org state; this repo has nogithub_organization_settingsresource, so the new base grant is uncodified. The merge gate does not depend on it, but the two belong together.asclepiasonboarding and lab docs still describe the Players team and its triage level as the access model — that repo's own ADR-0003 requires a re-audit when access changes. Tracked separately.Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com