[Spike] Permitting external collaborators to merge ONLY into the subfolder that contains their cluster's spec

[sgibson91]

Part of the vision of 2i2c (Shared Responsibility Model) is that communities own and have agency over the infrastructure we help maintain. A blocker to this has been merge rights on the repository. There isn't a clean way to give hub admins merge rights to only the folder that contains their cluster/hub's config.

I uncovered some information that may reveal a path forward here involving a GitHub App, a CODEOWNERS file, and a YAML config file in the .github folder. We should spend some time investigating what it would mean to deploy this, what permissions would be required by the apps and the external folk we would like to invite, and whether this approach suits our needs.

GitHub Apps:

• Repository-level app: https://github.com/apps/settings (repo: https://github.com/repository-settings/app)
• Org-level app: https://github.com/github/safe-settings

Small config example:

• CODEOWNERS file: https://github.com/todogroup/governance/blob/main/.github/CODEOWNERS
  • Note on L11 that the team is given specific rights to a specific file
• settings.yaml config: https://github.com/todogroup/governance/blob/main/.github/settings.yml

[yuvipanda]

ty for opening this, @sgibson91!