Validate outside collaborators role before changing permissions about outside-collaborators HOT 14 CLOSED

Thanks for the reply, and good there is support for this.

The kink we see is that members are constantly shown as being removed from the organisation repos where they don't have a formal, defined role, but where they have a base role of "read"

In the example below, marceldumontgh as an outside collaborator, while globaltopmedia is an organisation (and enterprise) user. (the organisation name is fake)

Processing automated repository "example-sandbox/poc-external-access"...

• Skipping invitee "marceldumontgh" with permissions "write"
• Removing collaborator "globaltopmedia"
  ...done with "example-sandbox/poc-external-access" ✔

from outside-collaborators.

I have joined successfully

from outside-collaborators.

Required the following fine-grained permissions to get it to work correctly:

Repository permissions:

• Read access to metadata
• Read and Write access to administration

Organization permissions:

• Read access to members

from outside-collaborators.

Hi @globaltopmedia

Thanks for reaching out!

Although the tool is intended for managing outside collaborators it also affects Members.
If manually added members are not declared within the repo's files, they are being removed as users from the repo.

There are actually safeguards already in place to skip organization members.

See for example:

We essentially check whether a user is a member of the org by relying on org_member?().

Also, we manage several repos with this automation where we have outside collaborators and organization members at the same time without any known problems.

Did you encounter any kinks while using the automation?

from outside-collaborators.

Closing.
Feel free to open it up again if required.

from outside-collaborators.

The kink we see is that members are constantly shown as being removed from the organisation repos where they don't have a formal, defined role, but where they have a base role of "read"

That's actually quite strange as we also rely on the same base role "read" for org members.

Just for clarification, in the example you provided above, globaltopmedia is an org user who has been manually¹ added up to example-sandbox/poc-external-access with which permission²?

I might create some quick snippets to hand you out for debugging, if you're interested.

from outside-collaborators.

globaltopmedia is an org user which has not been added manually or is present in any yaml file related to the repo.

Here a more elaborate example:

• Changed the role of marceldumontgh in "example-sandbox/poc-acquiacms-wiki" from "read" to "write".
  No changes were made for the repo "example-sandbox/poc-external-access" nor was globaltopmedia mentioned anywhere in any yaml file.

Contents of the relevant yml files:

repos/poc-external-access.yml
poc-external-access: marceldumontgh: type: "user" permissions: "write"

repos/poc-acquiacms-wiki.yml
poc-acquiacms-wiki: marceldumontgh: type: "user" permissions: "write"

Processing automated repository "example-sandbox/poc-acquiacms-wiki"...

• Removing invitee "marceldumontgh"
• Inviting collaborator "marceldumontgh" with permissions "write"
• Removing collaborator "globaltopmedia"
  ...done with "example-sandbox/poc-acquiacms-wiki" ✔

Processing automated repository "example-sandbox/poc-external-access"...

• Skipping invitee "marceldumontgh" with permissions "write"
• Removing collaborator "globaltopmedia"
  ...done with "example-sandbox/poc-external-access" ✔

from outside-collaborators.

Hi @globaltopmedia

globaltopmedia is an org user which has not been added manually or is present in any yaml file related to the repo.

Sounds somehow unexpected to me.

I've created an ad-hoc org for this and invited you to join: https://github.com/outside-collaborators-playground.

This way, we can design a shared use case that better fits yours for debugging purposes.

from outside-collaborators.

Tell me once you'll have joined, if you like to do so, so that I can grant you write access to the repos.

from outside-collaborators.

I've granted you write access to the dashboard repo and admin access to the test-repo.

from outside-collaborators.

It turned out that setting up a fine-grained PAT is not as simple as dealing with the classic one with repo scopes.

Warning
A fine-grained PAT not equipped with the necessary permissions makes org_member?() fail to recognize an actual org member without printing any warning/error message.

from outside-collaborators.

README made clearer in this respect: see 82bbb96.

from outside-collaborators.

Fantastic! Thank you @globaltopmedia for the feedback.
I'll update the main README.

from outside-collaborators.

Done via 75bc589.

Thanks again @globaltopmedia!

from outside-collaborators.