diff --git a/src/config/orgRoles.ts b/src/config/orgRoles.ts index 576ec51..1354cf1 100644 --- a/src/config/orgRoles.ts +++ b/src/config/orgRoles.ts @@ -8,7 +8,8 @@ export type OrgRoleName = | 'all_repo_triage' | 'all_repo_write' | 'all_repo_maintain' - | 'all_repo_admin'; + | 'all_repo_admin' + | 'security_manager'; export interface OrgRoleAssignment { /** GitHub team slug */ @@ -20,4 +21,7 @@ export interface OrgRoleAssignment { export const ORG_ROLE_ASSIGNMENTS: OrgRoleAssignment[] = [ { team: 'lead-maintainers', role: 'all_repo_admin' }, { team: 'core-maintainers', role: 'all_repo_admin' }, + // Security managers can view and manage security alerts and draft security + // advisories (GHSAs) across all repositories in the org. + { team: 'security-managers', role: 'security_manager' }, ]; diff --git a/src/config/roleIds.ts b/src/config/roleIds.ts index d47968d..4a0621f 100644 --- a/src/config/roleIds.ts +++ b/src/config/roleIds.ts @@ -10,6 +10,7 @@ export const ROLE_IDS = { CORE_MAINTAINERS: 'core-maintainers', LEAD_MAINTAINERS: 'lead-maintainers', MODERATORS: 'moderators', + SECURITY_MANAGERS: 'security-managers', // GitHub only (org security_manager role) ADMINISTRATORS: 'administrators', // Discord only COMMUNITY_MANAGERS: 'community-managers', // Discord only diff --git a/src/config/roles.ts b/src/config/roles.ts index 86e53a3..1c4fc3d 100644 --- a/src/config/roles.ts +++ b/src/config/roles.ts @@ -102,6 +102,12 @@ export const ROLES: readonly Role[] = [ discord: { role: 'community moderators (synced)' }, google: { group: 'moderators', provisionUser: true }, }, + { + id: ROLE_IDS.SECURITY_MANAGERS, + description: 'Organization security managers (security_manager org role via orgRoles.ts)', + github: { team: 'security-managers' }, + // GitHub only - grants org-wide visibility into security alerts and draft advisories + }, // =================== // Maintainer Groups diff --git a/src/config/users.ts b/src/config/users.ts index 0df85f2..2cf4f67 100644 --- a/src/config/users.ts +++ b/src/config/users.ts @@ -367,7 +367,7 @@ export const MEMBERS: readonly Member[] = [ }, { github: 'jenn-newton', - memberOf: [ROLE_IDS.SECURITY_WG], + memberOf: [ROLE_IDS.SECURITY_MANAGERS, ROLE_IDS.SECURITY_WG], }, { github: 'jeongukjae', @@ -532,7 +532,12 @@ export const MEMBERS: readonly Member[] = [ firstName: 'Max', lastName: 'Isbey', googleEmailPrefix: 'max', - memberOf: [ROLE_IDS.MAINTAINERS, ROLE_IDS.PYTHON_SDK, ROLE_IDS.TYPESCRIPT_SDK_COLLABORATORS], + memberOf: [ + ROLE_IDS.MAINTAINERS, + ROLE_IDS.PYTHON_SDK, + ROLE_IDS.SECURITY_MANAGERS, + ROLE_IDS.TYPESCRIPT_SDK_COLLABORATORS, + ], }, { github: 'michaelneale',