feat: restructure peribolos teams and CODEOWNERS for provider split - #97
Merged
marcusburghardt merged 5 commits intoMay 19, 2026
Conversation
Member
Author
|
The CRAPLoad issue was fixed by complytime/org-infra#242 . We can safely wave it in this particular PR. The code here is minimal. We can implement the baseline in a separate PR if necessary. |
Closed
1 task
marcusburghardt
force-pushed
the
opsx/restructure-teams-and-codeowners
branch
from
May 13, 2026 09:18
30ac4d2 to
b0efaee
Compare
Member
Author
|
The CRAPLoad baseline is introduced by #101 together with a Makefile to make local tests easier. |
This was referenced May 13, 2026
Member
Author
|
@jpower432 and @hbraswelrh , it would be great to have your eyes here. : ) |
marcusburghardt
added a commit
to complytime/complyctl
that referenced
this pull request
May 15, 2026
Also connected with changes in: - complytime/.github#97 Signed-off-by: Marcus Burghardt <maburgha@redhat.com>
Define proposal, design, specs, and tasks for restructuring peribolos teams to reflect the provider split from complyctl to complytime-providers, creating per-provider approval teams, establishing Gemara content ownership, and standardizing CODEOWNERS across repositories. Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt <maburgha@redhat.com>
Reflect the organizational split of providers from complyctl to complytime-providers by restructuring GitHub team definitions and CODEOWNERS files across the complytime org. - Rename openscap-plugin-approvers to openscap-provider-approvers - Create ampel-provider-approvers, opa-provider-approvers, and complytime-policies-approvers teams - Repurpose complytime-approvers for non-code repo stakeholder access - Move CODEOWNERS from root to .github/ (GitHub recommended location) - Update config_test.go to validate team references in CODEOWNERS - Update spec artifacts with review council feedback (GIVEN clauses, PRESERVED requirements, dependency annotations) Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt <maburgha@redhat.com>
Add fkolacek-rh, jiprocha, jpadmanrh, ppsomiad, and rmonk-redhat to the org members list. These users exist in the GitHub org but were not declared in peribolos.yaml, causing the apply workflow to fail with "cannot delete 5 memberships (exceeds limit of 0.250)". Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt <maburgha@redhat.com>
pme-bot is a regular user account that was used for the old device flow token approach. It no longer exists in the GitHub org and is not needed as an admin now that authentication uses the complytime-bot GitHub App installation token. Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt <maburgha@redhat.com>
marcusburghardt
force-pushed
the
opsx/restructure-teams-and-codeowners
branch
from
May 18, 2026 15:25
b0efaee to
6be08c8
Compare
Member
Author
|
just rebased @jpower432 . |
jpower432
requested changes
May 18, 2026
- Remove complytime-approvers from .github CODEOWNERS (admin-only approval) - Remove .github from complytime-approvers repo access (no non-admin write) - Add --required-admins flags to apply_peribolos.yml for all current admins - Update spec artifacts to document security decisions These changes prevent privilege escalation through the org management repo: only org admins can approve merges (CODEOWNERS gate), and existing admins cannot be removed by peribolos even if a malicious config passes review. Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt <maburgha@redhat.com>
marcusburghardt
enabled auto-merge (rebase)
May 19, 2026 13:58
auto-merge was automatically disabled
May 19, 2026 18:44
Branch protection rule check failed
sonupreetam
pushed a commit
to complytime/complytime-policies
that referenced
this pull request
May 20, 2026
Related to the initiative in: - complytime/.github#97 Signed-off-by: Marcus Burghardt <maburgha@redhat.com>
marcusburghardt
added a commit
to complytime/complytime-providers
that referenced
this pull request
May 20, 2026
Related to the initiative in: - complytime/.github#97 Signed-off-by: Marcus Burghardt <maburgha@redhat.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Restructure peribolos team definitions and CODEOWNERS files to reflect
the organizational split of providers from complyctl to
complytime-providers.
openscap-plugin-approverstoopenscap-provider-approversand expand membership to all complytime-dev members
ampel-provider-approvers,opa-provider-approvers, andcomplytime-policies-approversteamscomplytime-approversfor non-code repo stakeholder access(.github, community, complytime-demos, website)
.github/CODEOWNERSper GitHubrecommended location
config_test.goto validate team references in CODEOWNERS(split parsing into individual users and team references)
Cross-repo Coordination
This PR covers changes to this repository only. CODEOWNERS files in
complyctl, complytime-providers, and complytime-policies must be
updated separately after peribolos applies the new team definitions
from this PR.
Related Issues
Review Hints
Review
peribolos.yamlchanges first — this is the core of the PRwith 5 team modifications (1 rename, 3 creates, 1 repurpose).
Then review
config/config_test.go— theloadOwnersfunction nowreturns separate lists for individual users and team references, and
TestOrgsvalidates team references exist in peribolos.yaml.The
openspec/changes/restructure-teams-and-codeowners/directorycontains the full change specification (proposal, design, specs,
tasks) that documents the rationale behind each decision.
All teams use
privacy: closedas required by GitHub for CODEOWNERSteam references. See design.md Decision 4 for details and references.