Manage GitHub teams permissions as code

.github/workflows/teamsync_check_for_changes.yml

@@ -0,0 +1,54 @@
+name: teamSync check for changes
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+
+jobs:
+  check-permissions:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+          fetch-depth: 0
+
+    - name: Set up JDK
+      uses: actions/setup-java@v4
+      with:
+        java-version: '21'
+        distribution: 'adopt'
+
+    - name: Build project
+      run: mvn clean install
+
+    - name: Check for yml changes
+      id: files
+      run: |
+        echo "Checking for changes in permissions/*.yml files..."
+        FILES=$(git diff --name-only ${{ github.event.before }} ${{ github.sha }} -- 'permissions/*.yml')
+
+        if [[ -z "$FILES" ]]; then
+          echo "No changes detected in permissions files."
+        else
+          echo "Changes detected. Processing..."
+          for file in $FILES
+          do
+            echo "Processing changes in $file"
+            GIT_DIFF=$(git diff ${{ github.event.before }} ${{ github.sha }} -- "$file")
+
+            if [[ "$GIT_DIFF" == *"github_team"* || "$GIT_DIFF" == *"developers"* ]]; then
+              file="${file#permissions/}"
+              echo "Updating the team in: $file"
+              java -jar target/github_team_sync.jar "$file"
+            else
+              echo "No relevant changes to the team in: $file"
+            fi
+          done
+        fi
+      env:
+        GITHUB_OAUTH: ${{ secrets.HOSTING_PAT }}

.github/workflows/teamsync_update_automatically.yml

@@ -0,0 +1,35 @@
+name: teamSync Update Automatically
+
+on:
+  schedule:
+    - cron: '00 00 * * 1' # UTC time at 00:00 on Monday
+
+jobs:
+  check-permissions:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+          fetch-depth: 0
+
+    - name: Set up JDK
+      uses: actions/setup-java@v4
+      with:
+        java-version: '21'
+        distribution: 'adopt'
+
+    - name: Build project
+      run: mvn clean install
+
+    - name: Update all yml files in permissions directory
+      run: |
+        echo "Updating all permissions files..."
+        for file in permissions/*.yml; do  
+          file="${file#permissions/}"
+          echo "Updating the team in: $file"
+          java -jar target/github_team_sync.jar "$file"
+        done
+        echo "All permissions files updated."
+      env:
+        GITHUB_OAUTH: ${{ secrets.HOSTING_PAT }}

pom.xml

@@ -67,10 +67,32 @@
                         <phase>package</phase>
                         <configuration>
                             <descriptors>
-                                <descriptor>src/assembly.xml</descriptor>
+                                <descriptor>src/assembly/assembly.xml</descriptor>
                             </descriptors>
                         </configuration>
                     </execution>
+                    <execution> <!-- GitHub TeamSync -->
+                        <id>GitHub TeamSync</id>
+                        <phase>package</phase>
+                        <goals>
+                            <goal>single</goal>
+                        </goals>
+                        <configuration>
+                            <descriptors>
+                                <descriptor>src/assembly/teamSync.xml</descriptor>
+                            </descriptors>
+                            <archive>
+                                <manifest>
+                                    <mainClass>io.jenkins.infra.repository_permissions_updater.github_team_sync.GitHubTeamSyncExecutor</mainClass>
+                                </manifest>
+                            </archive>
+                            <descriptorRefs>
+                                <descriptorRef>jar-with-dependencies</descriptorRef>
+                            </descriptorRefs>
+                            <finalName>github_team_sync</finalName>
+                            <appendAssemblyId>false</appendAssemblyId>
+                        </configuration>
+                    </execution>
                 </executions>
             </plugin>
         </plugins>

src/assembly/assembly.xml

@@ -0,0 +1,21 @@
+<assembly>
+    <id>bin</id>
+    <formats>
+        <format>dir</format>
+    </formats>
+    <includeBaseDirectory>false</includeBaseDirectory>
+    <fileSets>
+        <fileSet>
+            <directory>target/classes/</directory>
+            <outputDirectory>/</outputDirectory>
+            <excludes>
+                <exclude>io/jenkins/infra/repository_permissions_updater/github_team_sync/*.class</exclude>
+            </excludes>
+        </fileSet>
+    </fileSets>
+    <dependencySets>
+        <dependencySet>
+            <scope>runtime</scope>
+        </dependencySet>
+    </dependencySets>
+</assembly>

src/assembly/teamSync.xml

@@ -0,0 +1,16 @@
+<assembly>
+    <id>GitHub TeamSync</id>
+    <formats>
+        <format>jar</format>
+    </formats>
+    <includeBaseDirectory>false</includeBaseDirectory>
+    <fileSets>
+        <fileSet>
+            <directory>target/classes/</directory>
+            <outputDirectory>/</outputDirectory>
+            <includes>
+                <include>io/jenkins/infra/repository_permissions_updater/github_team_sync/*.class</include>
+            </includes>
+        </fileSet>
+    </fileSets>
+</assembly>

src/main/java/io/jenkins/infra/repository_permissions_updater/github_team_sync/GitHubTeamSyncExecutor.java

@@ -0,0 +1,17 @@
+package io.jenkins.infra.repository_permissions_updater.github_team_sync;
+
+public class GitHubTeamSyncExecutor {
+
+    public static void main(String[] args) {
+
+        if (args.length == 0) {
+            System.out.println("No file path provided.");
+            System.exit(1);
+        }
+
+        String ymlFilePath = args[0];
+        GithubTeamDefinition team = YmlTeamLoader.loadTeam(ymlFilePath);
+        TeamUpdater.updateTeam(team);
+    }
+
+}

src/main/java/io/jenkins/infra/repository_permissions_updater/github_team_sync/GithubTeamDefinition.java

@@ -0,0 +1,44 @@
+package io.jenkins.infra.repository_permissions_updater.github_team_sync;
+
+import java.util.Set;
+
+public class GithubTeamDefinition {
+
+    private String RepoName = "";
+    private String TeamName = "";
+    private Set<String> developers;
+
+    public GithubTeamDefinition(String RepoName, String TeamName, Set<String> developers) {
+        this.RepoName = RepoName;
+        this.TeamName = TeamName;
+        this.developers = developers;
+    }
+
+    public GithubTeamDefinition() {
+    }
+
+    public String getName() {
+        return RepoName;
+    }
+
+    public void setName(String name) {
+        this.RepoName = name;
+    }
+
+    public Set<String> getDevelopers() {
+        return developers;
+    }
+
+    public void setDevelopers(Set<String> developers) {
+        this.developers = developers;
+    }
+
+    // Lauren part - team name
+    public String getTeamName(){
+        return TeamName;
+    }
+
+    public void setTeamName(String TeamName){
+        this.TeamName = TeamName;
+    }
+}

src/main/java/io/jenkins/infra/repository_permissions_updater/github_team_sync/TeamUpdater.java

@@ -0,0 +1,115 @@
+package io.jenkins.infra.repository_permissions_updater.github_team_sync;
+
+import java.io.IOException;
+import java.util.HashSet;
+import java.util.Set;
+
+import org.kohsuke.github.GHOrganization;
+import org.kohsuke.github.GHRepository;
+import org.kohsuke.github.GHTeam;
+import org.kohsuke.github.GHUser;
+import org.kohsuke.github.GitHub;
+import org.kohsuke.github.GitHubBuilder;
+
+public class TeamUpdater {
+
+
+
+    public static void updateTeam(GithubTeamDefinition team) {
+        try {
+            GitHub github = new GitHubBuilder().withOAuthToken(System.getenv("GITHUB_OAUTH")).build();
+
+            String[] parts = team.getName().split("/");
+            String orgName = parts[0];
+            String repoName = parts[1];
+
+            GHOrganization org = github.getOrganization(orgName);
+            GHRepository repo = org.getRepository(repoName);
+            GHTeam ghTeam = org.getTeamByName(team.getTeamName());
+
+            if (repo != null){
+
+                if (ghTeam == null){
+
+                    if (team.getDevelopers().size() <= 0) {
+                        System.out.println("No developers in the team. Team not created.");
+                        return;
+
+                    }else{
+                        // Case 1: Team does not exist
+                        ghTeam = org.createTeam(team.getTeamName()).privacy(GHTeam.Privacy.CLOSED).create();
+                        updateDevelopers(github, ghTeam, team.getDevelopers(), Operation.ADD);
+                        ghTeam.add(repo, GHOrganization.RepositoryRole.custom("push"));
+                        System.out.println("Team: '" + team.getTeamName() + "' created and added to repository: " + repoName);
+                    }
+
+
+                }
+
+                // Case 2: Team exists
+                Set<String> currentMembers = new HashSet<>();
+                for (GHUser member : ghTeam.listMembers()) {
+                    currentMembers.add(member.getLogin());
+                }
+
+                // Case 2.1: developers to add
+                Set<String> toAdd = new HashSet<>(team.getDevelopers());
+                toAdd.removeAll(currentMembers);
+
+                if (!toAdd.isEmpty()) {
+                    updateDevelopers(github, ghTeam, toAdd, Operation.ADD);
+                }
+
+                // Case 2.2: developers to remove
+                Set<String> toRemove = new HashSet<>(currentMembers);
+                toRemove.removeAll(team.getDevelopers());
+
+                if (!toRemove.isEmpty()){
+                    if  (team.getDevelopers().size() > 0) {
+                        updateDevelopers(github, ghTeam, toRemove, Operation.REMOVE);
+                    }else{
+                        try {
+                            ghTeam.delete();
+                            System.out.println("No developers in the team, team deleted: " + ghTeam.getName());
+                        } catch (IOException e) {
+                            System.err.println("Failed to delete the team: " + ghTeam.getName() + ", error: " + e.getMessage());
+                        }
+                    }
+                }
+
+            } else {
+                System.out.println("Repository not found: " + repoName);
+            }
+
+
+        } catch (IOException e) {
+            System.out.println("Error connecting to GitHub or fetching repository.");
+            e.printStackTrace();
+        }
+    }
+
+    public enum Operation {
+        ADD,
+        REMOVE
+    }
+
+    public static void updateDevelopers(GitHub github, GHTeam ghTeam, Set<String> developers, Operation operation) {
+        for (String dev : developers) {
+            try {
+                GHUser user = github.getUser(dev);
+                if (operation == Operation.ADD) {
+                    ghTeam.add(user);
+                    System.out.println("Developer '" + dev + "' added to team: " + ghTeam.getName());
+                } else if (operation == Operation.REMOVE) {
+                    ghTeam.remove(user);
+                    System.out.println("Developer '" + dev + "' removed from team: " + ghTeam.getName());
+                }
+            } catch (IOException e) {
+                System.out.println("Developer '" + dev + "' not found in GitHub or error in updating: " + e.getMessage());
+            }
+        }
+    }
+
+
+
+}