Request to be added into `jenkinsci` organization owners

[alecharp]

GitHub repositories

jenkinsci

GitHub users to have permission

@alecharp
@mawinter69

Permission level

Admin

Justification

As part of reviewing the hosting process in RPU, we need to be able to invite user in the organization and add them in GitHub teams.

Because the GitHub organization roles are not diverse, we need to be organization admins to be able to invite people in and manage all teams (based on https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/roles-in-an-organization#permissions-for-organization-roles).

It is not my wish to get this level of permission, I just want to not have to ping current owners to finish the hosting process, plugins adoptions and other tasks. If only a 'organization maintainer' role existed.
It seems possible to create custom organization roles (https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-peoples-access-to-your-organization-with-roles/managing-custom-organization-roles) but on enterprise-cloud instances of Github.

cc @basil @batmat @daniel-beck @kohsuke @NotMyFault @oleg-nenashev @rtyler @timja @Wadeck.

[daniel-beck]

What happened to the bot?

[alecharp]

What happened to the bot?

The bot is not handling adoption request. And for hosting, the bot is not creating teams nor invite users into JenkinsCI organization.

[Wadeck]

From my PoV it has to be included in the bot as the permission is largely more powerful than just adding people in the org, that's an overkill (as you mention about the GH limitation)

[batmat]

While I think Adrien has been in this for long enough to be granted Admin, I think handling the permissions aspect in repositories with the bot should be a thing (👴 remembers how easy this was to do it on IRC 🤷 )

[alecharp]

I was wrong, RPU is able to create / manage teams in jenkinsci organization (https://github.com/jenkins-infra/repository-permissions-updater/blob/28fe19b28b7cdda7f49000c57e78abde8a8f3e89/src/main/java/io/jenkins/infra/repository_permissions_updater/hosting/Hoster.java#L272-L297). But it won't invite user into the organization, which is a pre-requisite to be in a team of the organization. Let me see if I can create some code to invite someone in the organization.

[dduportal]

I was wrong, RPU is able to create / manage teams in jenkinsci organization (https://github.com/jenkins-infra/repository-permissions-updater/blob/28fe19b28b7cdda7f49000c57e78abde8a8f3e89/src/main/java/io/jenkins/infra/repository_permissions_updater/hosting/Hoster.java#L272-L297). But it won't invite user into the organization, which is a pre-requisite to be in a team of the organization. Let me see if I can create some code to invite someone in the organization.

We can manage it with Terraform: https://registry.terraform.io/providers/integrations/github/latest/docs/resources/membership so I guess our bots might be updated with the proper code

[alecharp]

I was thinking of simply adding a /hosting invite as this needs to be done before the /hosting done and I don't think having it in the /hosting check is valid (but that can warn hosting team to run the trigger).

[timja]

While I think Adrien has been in this for long enough to be granted Admin, I think handling the permissions aspect in repositories with the bot should be a thing (👴 remembers how easy this was to do it on IRC 🤷 )

It was a gsoc topic last year which was not completed: https://www.jenkins.io/blog/2024/08/26/gsoc-manage-github-permissions/

It is not my wish to get this level of permission

There is an All-repository admin role which has less permissions than owner but would suffice for what is needed.
Until the hosting management is fully as code again.

I don't like being in the place where its just @NotMyFault and I handling any hosting issues (which is mostly adoption or permission changes) and would really like to have the full hosting team able to manage it.

[timja]

I was wrong, RPU is able to create / manage teams in jenkinsci organization (jenkins-infra/repository-permissions-updater@28fe19b/src/main/java/io/jenkins/infra/repository_permissions_updater/hosting/Hoster.java#L272-L297). But it won't invite user into the organization, which is a pre-requisite to be in a team of the organization. Let me see if I can create some code to invite someone in the organization.

We can manage it with Terraform: registry.terraform.io/providers/integrations/github/latest/docs/resources/membership so I guess our bots might be updated with the proper code

jenkins-infra/repository-permissions-updater#3998 (comment)

[alecharp]

as I said creating this ticket, I don't think I should get the owner permissions for this.

If we want to have this handled with terraform, great. If it could be tied to RPU, even better (but we barely have any Jenkins Account <-> GitHub username knowledge).

The RPU is not handling invite and I was incorrect to think that users have to be in the organization to be in a team. They have only to be a team maintainer.

That doesn't solve the adoption requests situation where an admin (Tim mostly) has to add users to the GH team but if we all agree this is not the solution and we should have something better, I'm fine with that decision. Maybe others (than Tim) could be pinged to invite / manage the teams in the meantime.

[timja]

If we want to have this handled with terraform, great. If it could be tied to RPU, even better (but we barely have any Jenkins Account <-> GitHub username knowledge).

We definitely want this but there's time involved in this project. FWIW I don't think its huge but someone would need to do it and I don't think we need to couple these together.

[alecharp]

we need to couple these together.

I would think it would be great so that adoption and leaving the maintenance of a plugin can handle all Jira / Artifactory and GitHub permissions are the same time. no?