Skip to content

feat(github): seed org membership via orgs[].members - #206

Open
yonatangross wants to merge 1 commit into
vercel-labs:mainfrom
yonatangross:feat/github-seed-org-members
Open

feat(github): seed org membership via orgs[].members#206
yonatangross wants to merge 1 commit into
vercel-labs:mainfrom
yonatangross:feat/github-seed-org-members

Conversation

@yonatangross

Copy link
Copy Markdown

Summary

  • Add an optional members array to github.orgs[] seed entries: { login, role?: "admin" | "member" }
  • Membership is stored as the synthetic members team, the same representation PUT /orgs/:org/memberships/:username writes at runtime, so admin = maintainer of that team and every existing org-role check applies unchanged
  • Unknown member logins throw at seed time (they must be seeded users), matching the strict seed validation added for apps in 0.10.0

Why

A seeded org has no members and no admin. Every private repo it owns is therefore unreachable by every seeded user token (403), and nothing at runtime can repair that: the membership endpoint itself requires an org admin. Seeding one admin closes the loop. Hit this in Yonatan-HQ/platform when moving the seed from a user owner to the real org owner.

Changes

File Change
index.ts members? on the orgs[] seed type; seedOrgMembers() (team-backed, idempotent per login)
__tests__/org-members.test.ts roles listed, members read a private org repo / outsiders 403, seeded admin can grant membership at runtime, unknown login throws
README.md, skills/github/SKILL.md document the field and the "seed one admin" rule

Test plan

  • pnpm --filter @emulators/github test (5 files pass, incl. the 4 new cases)
  • pnpm -r build
  • pnpm --filter @emulators/github lint (0 errors, no new warnings)

Add an optional `members` array to `github.orgs[]` seed entries
(`{ login, role?: "admin" | "member" }`). Membership is written as the
synthetic "members" team, the same representation
`PUT /orgs/:org/memberships/:username` produces at runtime, so an
`admin` is a maintainer of that team and every org-role check already
in the routes applies unchanged.

Why: a seeded org has no members and no admin. Every private repo owned
by it is therefore unreachable by every seeded user token (403), and
nothing at runtime can repair that because the membership endpoint
itself requires an org admin. Seeding one admin closes the loop.

Unknown member logins throw at seed time (they must be seeded users),
matching the existing strict seed validation for apps.
@vercel

vercel Bot commented Aug 25, 2026

Copy link
Copy Markdown
Contributor

@yonatangross is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant