Add user jku and team tuf-root-signing-staging-codeowners

[jku]

• tuf-root-signing-staging-codeowners is for maintainers of planned root-signing-staging repository (see New project root-signing-staging #345)
• New user jku as well as kommendorkapten & haydentherapper are added to the new team

Fixes #347

---

I don't really know what I'm doing with pulumi so feedback is welcome.

[github-actions]

🍹 preview on sigstore-github-sync/sigstore/github-prod

Pulumi report

Previewing update (sigstore/github-prod)

View Live: https://app.pulumi.com/sigstore/sigstore-github-sync/github-prod/previews/684491b0-cf0c-4858-bcae-1bf545ce49ad

@ Previewing update.......
pulumi:pulumi:Stack: (same)
[urn=urn:pulumi:github-prod::sigstore-github-sync::pulumi:pulumi:Stack::sigstore-github-sync-github-prod]
+ github:index/membership:Membership: (create) 🔒
    [urn=urn:pulumi:github-prod::sigstore-github-sync::github:index/membership:Membership::jku]
    downgradeOnDestroy: false
    role              : "member"
    username          : "jku"
+ github:index/team:Team: (create) 🔒
    [urn=urn:pulumi:github-prod::sigstore-github-sync::github:index/team:Team::tuf-root-signing-staging-codeowners]
    createDefaultMaintainer: false
    description            : ""
    name                   : "tuf-root-signing-staging-codeowners"
    privacy                : "closed"
+ github:index/teamMembership:TeamMembership: (create)
    [urn=urn:pulumi:github-prod::sigstore-github-sync::github:index/teamMembership:TeamMembership::jku-tuf-root-signing-staging-codeowners]
    role      : "member"
    teamId    : output<string>
    username  : "jku"
+ github:index/teamMembership:TeamMembership: (create)
    [urn=urn:pulumi:github-prod::sigstore-github-sync::github:index/teamMembership:TeamMembership::kommendorkapten-tuf-root-signing-staging-codeowners]
    role      : "member"
    teamId    : output<string>
    username  : "kommendorkapten"
+ github:index/teamMembership:TeamMembership: (create)
    [urn=urn:pulumi:github-prod::sigstore-github-sync::github:index/teamMembership:TeamMembership::haydentherapper-tuf-root-signing-staging-codeowners]
    role      : "member"
    teamId    : output<string>
    username  : "haydentherapper"
@ Previewing update....
Resources:
+ 5 to create
565 unchanged

[haydentherapper]

@cpanato can you confirm if we need to create the team first and then add people? Or if it can be done in one PR?

@jku can you add me as a maintainer also, since I’m currently a maintainer for root signing?

[cpanato]

can be togther, worst case we re-run the job :)

[jku]

I'll try something... the issues I have based on looking at the existing repository configs

• team id seems to be required (or at least every team definition within a repository has one and https://github.com/sigstore/github-sync README implies I need one)
• Possibly I could use some clever pulumi variable format id: ${some_team.id} but I've spent the morning trying to reconcile the yaml used in this repo with the pulumi github docs and ... there seems to be only a vague resemblance between the two?

I'll come up with something and I guess we'll see what pulumi preview says?

EDIT: I have found the parser in sigstore/github-sync that seems to translate the sigstore config to something pulumi understands... the names being just slightly different from pulumi resources names was pretty hard to figure out

[jku]

Armed with some new understanding (that this is not a variant of pulumi yaml, this is a custom format parsed in sigstore/github-sync), I've tried to come up with a reasonable first configuration for the repository: Some changes will likely be needed later but this could work for now.

currently preview fails with
github:index/getUser:getUser: GET https://api.github.com/users/tuf-root-signing-staging-codeowners: 404 Not Found

Looks like github.LookupTeam() is failing in https://github.com/sigstore/github-sync/blob/main/main.go#L149 when given "tuf-root-signing-staging-codeowners" as argument

[cpanato]

for this we will need to do in a follow up because we need to know the id for the team

[jku]

Cheers. I removed the repository commit, this is now the original branch from two days ago:

• new team tuf-root-signing-staging-codeowners is created
• New user jku as well as kommendorkapten & haydentherapper are added to the new team

[haydentherapper]

cc @bobcallaway @trevrosen @lukehinds @priyawadhwa @SantiagoTorres for LGTM

[jku]

still waiting for a merge of this so that I could then add the new repository.

@cpanato when this is merged, will I find the teamID in the workflow output or is there a more involved process to get it?

[cpanato]

still waiting for a merge of this so that I could then add the new repository.

@cpanato when this is merged, will I find the teamID in the workflow output or is there a more involved process to get it?

you need to get that from the github api, i will do that

[cpanato]

but for reference you will need to run

gh api /orgs/sigstore/teams/tuf-root-signing-staging-codeowners

and get the id :)