[QUESTION] Add team maintainer for group created using emu group mapping

[BeneHa]

Hi, I have a question about the provider I was not able to solve. I create Github teams like this:

resource "github_team" "this" {
  name        = local.team_name
  description = var.description
  privacy     = var.privacy
}

resource "github_emu_group_mapping" "this" {
  team_slug = github_team.this.slug
  group_id  = local.group_id
}

This works fine but I want to set someone as the maintainer for that team (it would also be fine if all members had Maintainer permissions). But I cannot combine the group_mapping with any resource that allows me to set permissions like github_team_membership, I get errors like

Error: PUT https://api.github.com/organizations/xxx/team/xxx/memberships/xxx: 403 You cannot create or update members for an external group backed team since they are managed by xxx []

Is there any way I can set maintainers for a group managed with the github_emu_group_mapping?

Thanks for any advice! BeneHa

[kfcampbell]

Hmm...that's a good question! I wonder if that's a limitation at the API level, and member permissions are automatically managed by the external platform.

Are you able to use the GitHub UI to set member permissions for external groups as you desire?

[BeneHa]

So I asked our Github organization admin and he also cannot assign individual permissions to users. It really looks like a limitation of the API, which is annoying because that means we cannot use some team features like Pull Request Settings without changing our entire Github setup.

[BeneHa]

@kfcampbell can you please confirm if this is a limitation of the API? Just so we know if there is a chance to get this feature with our current implementation at some point or if we would need to re-setup the entire thing. Thanks for your support!

[kfcampbell]

I'm looking at the external groups API reference and there's no capability that looks useful for what you want to do. Looking at the EMU reference, there's some indication that this should be managed at the IdP level:

On your IdP, you can give each managed user account a role, such as member, enterprise owner, or guest collaborator.

Asking your GitHub rep/contact could be a good further investigative tactic, as I'm not sure if I'm reading the API docs wrong.