From fa5e73a7294f7d94713d21f4802922d543477829 Mon Sep 17 00:00:00 2001 From: leopardracer <136604165+leopardracer@users.noreply.github.com> Date: Thu, 21 Nov 2024 20:11:22 +0200 Subject: [PATCH 1/4] Update README.md --- README.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index bd0712c..287b638 100644 --- a/README.md +++ b/README.md @@ -15,14 +15,14 @@ To learn more, check out: ## Tips / FYIs * [github/filecoin-project.yml](https://github.com/filecoin-project/github-mgmt/blob/master/github/filecoin-project.yml) is the key file where updates are made to adjust permissions. * "github-mgmt" was the old name. The original template repo is now called "github-as-code". We use the terms interchangably in comments/docs. -* Yes, it's confusing to have a `.github` and `github` directory. That is how gitub-mgmt was originally setup an we're living with it. (At least of 2024-09-05, there is [no backlog item for cleaning this up](https://github.com/ipdxco/github-as-code/issues?page=1&q=is%3Aissue+is%3Aopen).) +* Yes, it's confusing to have a `.github` and `github` directory. That is how GitHub-mgmt was originally setup an we're living with it. (At least of 2024-09-05, there is [no backlog item for cleaning this up](https://github.com/ipdxco/github-as-code/issues?page=1&q=is%3Aissue+is%3Aopen).) * Not all [organization-level roles](https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization) are assignable through github-mgmt. For example, organization moderators, billing managers, and ecurity managers need to set through the GitHub UI. * github-mgmt calls [GitHub organization owners](https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization#organization-owners) as "admins" in [filecoin-project.yml](https://github.com/filecoin-project/github-mgmt/blob/master/github/filecoin-project.yml). These terms are used interchangably in comments/docs. * At least as of 202409, AWS resources that terraform uses behind the scenes (e.g., S3 bucket, DDB table) are all stored in an ipdx.co-managed AWS account. * Repo creation is still performed through the GitHub UI. The repo then gets "added" to github-mgmt mgmt as part of the [sync workflow](https://github.com/filecoin-project/github-mgmt/blob/master/.github/workflows/sync.yml), which runs weekly automatically and can be done on demand as well. ## Organization Owner SOPs -Below is documentation/expecations [filecoin-project owners](https://github.com/orgs/filecoin-project/people?query=role%3Aowner). +Below is documentation/expectations [filecoin-project owners](https://github.com/orgs/filecoin-project/people?query=role%3Aowner). ### General 1. Have 2FA enabled on GitHub account @@ -30,7 +30,7 @@ Below is documentation/expecations [filecoin-project owners](https://github.com/ ### Handling App Installation Requests 1. Per [docs](https://docs.github.com/en/apps/using-github-apps/requesting-a-github-app-from-your-organization-owner), org owners have to approve these requests. -2. Pending insallations can be reviewed at https://github.com/organizations/filecoin-project/settings/installations +2. Pending installations can be reviewed at https://github.com/organizations/filecoin-project/settings/installations * New installation requests also come in via GitHub notificaitons to owners. 3. Before approving the installation, ensure you have connected directly with the requester to understand their usecase and to ensure we're scoping down app access as much possible. For example, it's better if an app only need access to specific repos than to the whole organization, especially if the app is created by a 3rd party and/or needs write permissions. 4. After approving, create a "log" of the approval by writing a message in #filecoin-project-owners following this template: @@ -49,11 +49,11 @@ To remove someone, an org admin should follow these steps: 1. (anyone) Open a PR that removes the member from all teams and repositories and leaves a comment next to their name saying they'll be manually removed via the UI. We do this so there is record in the commit history of the intent of the change. 2. Get the PR approved per normal process. 3. (github-mgmt-steward) Merge the PR. -4. (org owner) Confrim in https://github.com/filecoin-project/github-mgmt/actions that the actions are applied. +4. (org owner) Confirm in https://github.com/filecoin-project/github-mgmt/actions that the actions are applied. 5. (org owner) Access the user in the GitHub UI at https://github.com/orgs/filecoin-project/people/USERNAME 6. (org owner) Remove the user from the organization via the "Remove from organization" button. 7. (org owner) Grab a screenshot 8. (org owner) [Run the sync workflow](https://github.com/filecoin-project/github-mgmt/actions/workflows/sync.yml) to remove the user from the terraform state 9. (org owner) Post back in the original PR that the user has been fully removed, including the screenshot and a link to the sync workflow run. -https://github.com/filecoin-project/github-mgmt/pull/66 is an example of this process. \ No newline at end of file +https://github.com/filecoin-project/github-mgmt/pull/66 is an example of this process. From 1627bfa1f06f9360fe31f6d0ee13bda0996b7ba8 Mon Sep 17 00:00:00 2001 From: leopardracer <136604165+leopardracer@users.noreply.github.com> Date: Thu, 21 Nov 2024 20:14:13 +0200 Subject: [PATCH 2/4] Update SETUP.md --- docs/SETUP.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/SETUP.md b/docs/SETUP.md index b36f8ba..f0b18b1 100644 --- a/docs/SETUP.md +++ b/docs/SETUP.md @@ -158,7 +158,7 @@ - [ ] Manually set values that are impossible to control this value via terraform currently - [ ] [Set read repository contents permissions for `GITHUB_TOKEN`](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#setting-the-permissions-of-the-github_token-for-your-repository) - [ ] If the repository is public, [require approval for all outside collaborators](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#configuring-required-approval-for-workflows-from-public-forks) - - [ ] If the repository is private, [disable sending write tokens or secrets to worfklows from fork pull requests](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks) + - [ ] If the repository is private, [disable sending write tokens or secrets to workflows from fork pull requests](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#enabling-workflows-for-private-repository-forks) - [ ] Pull remote changes to the default branch - [ ] Enable required PRs, peer reviews, status checks and branch up-to-date check on the repository by making sure [github/$ORGANIZATION_NAME.yml](github/$ORGANIZATION_NAME.yml) contains the following entry: ```yaml From 4226c3532947f73f828a829c03427371dd10ec9e Mon Sep 17 00:00:00 2001 From: leopardracer <136604165+leopardracer@users.noreply.github.com> Date: Thu, 21 Nov 2024 20:15:04 +0200 Subject: [PATCH 3/4] Update HOWTOS.md --- docs/HOWTOS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/HOWTOS.md b/docs/HOWTOS.md index 2a85afc..fe409de 100644 --- a/docs/HOWTOS.md +++ b/docs/HOWTOS.md @@ -91,7 +91,7 @@ I push my changes to a new branch and create a PR. An admin reviews the PR and m ### ...synchronize GitHub Management with GitHub? -*NOTE*: Remember that the `Sync` operation modifes terraform state. Even if you run it from a branch, it modifies the global state that is shared with other branches. There is only one terraform state per organization. +*NOTE*: Remember that the `Sync` operation modifies terraform state. Even if you run it from a branch, it modifies the global state that is shared with other branches. There is only one terraform state per organization. *NOTE*: `Sync` will force push changes directly to the branch you run it from. From e47f18c1a0041effee05758d030335da4c8adea1 Mon Sep 17 00:00:00 2001 From: leopardracer <136604165+leopardracer@users.noreply.github.com> Date: Mon, 2 Dec 2024 21:10:33 +0200 Subject: [PATCH 4/4] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 287b638..93b435a 100644 --- a/README.md +++ b/README.md @@ -15,7 +15,7 @@ To learn more, check out: ## Tips / FYIs * [github/filecoin-project.yml](https://github.com/filecoin-project/github-mgmt/blob/master/github/filecoin-project.yml) is the key file where updates are made to adjust permissions. * "github-mgmt" was the old name. The original template repo is now called "github-as-code". We use the terms interchangably in comments/docs. -* Yes, it's confusing to have a `.github` and `github` directory. That is how GitHub-mgmt was originally setup an we're living with it. (At least of 2024-09-05, there is [no backlog item for cleaning this up](https://github.com/ipdxco/github-as-code/issues?page=1&q=is%3Aissue+is%3Aopen).) +* Yes, it's confusing to have a `.github` and `github` directory. That is how `github-mgmt` was originally setup an we're living with it. (At least of 2024-09-05, there is [no backlog item for cleaning this up](https://github.com/ipdxco/github-as-code/issues?page=1&q=is%3Aissue+is%3Aopen).) * Not all [organization-level roles](https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization) are assignable through github-mgmt. For example, organization moderators, billing managers, and ecurity managers need to set through the GitHub UI. * github-mgmt calls [GitHub organization owners](https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization#organization-owners) as "admins" in [filecoin-project.yml](https://github.com/filecoin-project/github-mgmt/blob/master/github/filecoin-project.yml). These terms are used interchangably in comments/docs. * At least as of 202409, AWS resources that terraform uses behind the scenes (e.g., S3 bucket, DDB table) are all stored in an ipdx.co-managed AWS account.