Update Github security model to use teams for easier access mgmt

project-everest / everest-ci

CI scripts for project everest

3 stars 8 forks source link

Update Github security model to use teams for easier access mgmt #74

Closed darrenge closed 7 years ago

darrenge commented 7 years ago

Github has the concept of teams which allows access to the entire team instead of one off method.

FStarLang has "Team FStar" with write access to the repo. Onboarding someone gives them access to FStar, Kremlin etc.

Everest has three teams (Ironclad, FStar, Everest). We should consolidate these three into a single team. We need to make sure every single project under project-everest grants write access to that Everest Team.

darrenge commented 7 years ago

Going to assign this to Jonathan as he has the best over arching view of all repos and probably the highest perms to actually do this.

msprotz commented 7 years ago

I can do that. I wonder, however, if it'd be good to have some redundancy. Do we know if anyone is an admin across all projects beyond myself?

darrenge commented 7 years ago

It would make sense that Barry also be an admin across the projects.

darrenge commented 7 years ago

Maybe @sishtiaq should be admin as well to give coverage in Cambridge

msprotz commented 7 years ago

Summary.

Now there's only one team in project everest ("Everest").
The Everest team has write access on all repositories
Now we no longer need any "collaborators", except for:
- Andrew for Vale, as he's technically not part of the Everest team
- dzomo for Vale, in case the bot suddenly starts regenerating things nightly (the permission had been granted already). The same goes for FStarLang.

I've made Barry an owner (maximum privilege) of the FStarLang organization.

msprotz commented 7 years ago

Any new members should be added to the team, not as collaborators. Adding someone to a team guarantees they instantly get access to all the projects, and any new projects created in the future.