Allow specific additional codeowners for Lab migrated projects

[rhoerr]

For discussion: IMO when we move a module from Mage-OS Lab to Mage-OS namespace, the primary original author of the module should keep write permissions so they can still merge PRs and tag releases.

For instance, this would mean Artem having access to
https://github.com/mage-os/theme-adminhtml-m137
https://github.com/mage-os/module-theme-adminhtml-switcher

And Samuele having access to
https://github.com/mage-os/module-automatic-translation
https://github.com/mage-os/module-meta-robots-tag

And Gowri having access to all the Async modules, if he doesn't already

Does our current terraform config support this, or are additional changes needed?

The argument against this is that it's better for security to keep all merging and releasing within our overall maintainer teams. This would give us greater control and visibility of what's getting merged and released. As far as I'm concerned we don't have the resources to realistically manage them all in that way, though, and this is also a big discouragement for those authors that finally had their modules integrated--and can't merge their own work anymore.

[sprankhub]

All permissions are currently team-based. So in case of Gowri, we created an async-events team here:

https://github.com/mage-os/terraform/blob/22f80d6b810bbadc23457b9d02dfc4f7b0ae7a71/variables.tf#L219C5-L226

This team then has access to the async modules, e.g. here:

terraform/variables.tf

Lines 344 to 349 in 22f80d6

	mageos-async-events = {
	description = "This is a Mage-OS repo for the porting of the Magento Asynchronous Events Project found at https://github.com/aligent/magento-async-events."
	teams = ["distribution", "async-events"]
	default_branch = "4.x"
	topics = ["mage-os", "magento", "ecommerce", "magento2", "adobecommerce"]
	}

We could most probably extend this to allow single users to be added to single modules. Creating a team for the theme-related repositories might make sense, but creating teams for each repo Samuele contributed to does not sound reasonable to me.

Do you agree? Then I'll look into this when I have some time.

[rhoerr]

Discussed in today's tech meeting. Consensus is let's move forward.

[sprankhub]

I've implemented this now in the linked PR. Although, it only adds the respective users as CODEOWNERS. This means they still won't be able to push branches or merge their own stuff, but they can approve PRs from others. I think it makes sense this way. Let me know if anything else is needed.

[rhoerr]

This worked as intended. Artem has write access on the admin theme modules now. Thank you Simon.

[rhoerr]

Reopening -- this isn't quite right yet. The users get added to the repo with write permission, but not to the branch protection rules, which means they still can't merge PRs. I manually added Artem to the merge list for theme-adminhtml-m137 for the moment.

[sprankhub]

I thought this would be enough. Since these users are then a code owner, their PR approval should count as an "official" approval. Hence, I thought it should be possible to simply merge the PR.

I manually added Artem to the merge list

@rhoerr, could you post a screenshot of how this looks like in GitHub? This would help me implement the right changes in Terraform.

[rhoerr]

I thought this would be enough. Since these users are then a code owner, their PR approval should count as an "official" approval. Hence, I thought it should be possible to simply merge the PR.

I manually added Artem to the merge list

@rhoerr, could you post a screenshot of how this looks like in GitHub? This would help me implement the right changes in Terraform.

Based on the plan in #127 (comment), the Terraform state difference for this PR approval aspect (which the plan will revert) is:

  # github_branch_protection.repositories["theme-adminhtml-m137"] will be updated in-place
  ~ resource "github_branch_protection" "repositories" {
        id                              = "BPR_kwDOOSaHA84EFjng"
        # (10 unchanged attributes hidden)

      ~ restrict_pushes {
          ~ push_allowances  = [
              - "/artKozynets",
                # (1 unchanged element hidden) # <-- I assume this is "distribution", the assigned group
            ]
            # (1 unchanged attribute hidden)
        }

        # (2 unchanged blocks hidden)
    }

Does that help?