Add concourse github org to org automation

.github/workflows/org-management-peribolos-dump.yml

@@ -40,9 +40,8 @@ jobs:
         uses: docker://gcr.io/k8s-prow/peribolos
         with:
           entrypoint: /bin/sh
-          # Switch back to app auth once following PR gets merged: https://github.com/kubernetes/test-infra/pull/24882
-          # args: --dump-full --dump cloudfoundry --github-app-id=${{ secrets.GH_APP_ID }} --github-app-private-key-path=private_key > orgs/orgs.yml
-          args: -c "/ko-app/peribolos --dump-full --dump cloudfoundry --github-endpoint http://ghproxy:8888 --github-token-path=token > community/orgs/orgs.yml"
+          # args: -c "/ko-app/peribolos --dump-full --dump cloudfoundry --github-endpoint http://ghproxy:8888 --github-app-id=${{ secrets.GH_APP_ID }} --github-app-private-key-path=private_key --confirm=true > community/orgs/orgs.yml"
+          args: -c "/ko-app/peribolos --dump-full --dump concourse --github-endpoint http://ghproxy:8888 --github-app-id=${{ secrets.GH_APP_ID }} --github-app-private-key-path=private_key --confirm=true > community/orgs/orgs.yml"
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@v5
         with:

.vscode/settings.json

@@ -2,7 +2,7 @@
     "python.testing.unittestArgs": [
         "-v",
         "-s",
-        "./orgs",
+        "./org_management",
         "-p",
         "test_*.py"
     ],

ORGS.md

@@ -13,5 +13,6 @@ This document describes the set of Github Organizations that are overseen by the
 | Github Organization Name                                  | Is it Managed? |
 |-----------------------------------------------------------|----------------|
 | [cloudfoundry](https://github.com/cloudfoundry)           | Yes            |
+| [concourse](https://github.com/concourse)                 | Yes            |
 | [openservicebrokerapi](https://github.com/openservicebrokerapi)| No        |
 | [paketo-buildpacks](https://github.com/paketo-buildpacks) | No             |

orgs/branchprotection.yml

@@ -755,3 +755,169 @@ branch-protection:
           require_code_owner_reviews: true
           required_approving_review_count: 1
 
+    concourse:
+      protect: true
+      enforce_admins: false
+      allow_force_pushes: false
+      allow_deletions: false
+      allow_disabled_policies: true # needed to allow branches w/o branch protection
+
+      repos:
+        .github:
+          include:
+            - "^main$"
+
+        examples:
+          include:
+            - "^main$"
+
+        houdini:
+          include:
+            - "^master$"
+
+        ci:
+          include:
+            - "^master$"
+
+        infrastructure:
+          include:
+            - "^master$"
+
+        retryhttp:
+          include:
+            - "^master$"
+
+        rfcs:
+          include:
+            - "^master$"
+
+        dex:
+          include:
+            - "^master$"
+            - "^maintenance$"
+            - "^upstream$"
+            - "^pr\/.*$"
+
+        docs:
+          required_status_checks:
+            contexts:
+              - "EasyCLA"
+          include:
+            - "^master$"
+
+        oci-build-task:
+          required_pull_request_reviews:
+            dismiss_stale_reviews: true
+            required_approving_review_count: 1
+            bypass_pull_request_allowances:
+              teams: ["wg-concourse-bots"]
+          required_status_checks:
+            contexts:
+              - "EasyCLA"
+          include:
+            - "^master$"
+          branches:
+            version:
+              protect: true
+
+        concourse:
+          required_pull_request_reviews:
+            dismiss_stale_reviews: true
+            required_approving_review_count: 1
+            bypass_pull_request_allowances:
+              teams: ["wg-concourse-bots"]
+          required_status_checks:
+            contexts:
+              - "EasyCLA"
+              - "CodeQL"
+              - "Analyze (go)"
+              - "concourse-ci/compile-check"
+              - "concourse-ci/containerd-integration"
+              - "concourse-ci/go-format-check"
+              - "concourse-ci/integration"
+              - "concourse-ci/testflight"
+              - "concourse-ci/unit"
+              - "concourse-ci/validate-labels"
+              - "concourse-ci/watsjs"
+          include:
+            - "^master$"
+            - "^release\/.*$"
+
+        concourse-chart:
+          required_pull_request_reviews:
+            dismiss_stale_reviews: true
+            bypass_pull_request_allowances:
+              teams: ["wg-concourse-bots"]
+          required_status_checks:
+            contexts:
+              - "EasyCLA"
+              - "concourse-ci/lint-and-install-test"
+              - "concourse-ci/unit-tests"
+          include:
+            - "^master$"
+            - "^dev$"
+            - "^release\/.*$"
+
+        concourse-docker:
+          required_pull_request_reviews:
+            dismiss_stale_reviews: true
+            bypass_pull_request_allowances:
+              teams: ["wg-concourse-bots"]
+          required_status_checks:
+            contexts:
+              - "EasyCLA"
+          include:
+            - "^master$"
+            - "^release\/.*$"
+
+        concourse-bosh-release:
+          required_pull_request_reviews:
+            dismiss_stale_reviews: true
+            bypass_pull_request_allowances:
+              teams: ["wg-concourse-bots"]
+          required_status_checks:
+            contexts:
+              - "EasyCLA"
+          include:
+            - "^master$"
+            - "^release\/.*$"
+
+        concourse-bosh-deployment:
+          required_pull_request_reviews:
+            dismiss_stale_reviews: true
+            bypass_pull_request_allowances:
+              teams: ["wg-concourse-bots"]
+          required_status_checks:
+            contexts:
+              - "EasyCLA"
+          include:
+            - "^master$"
+            - "^release\/.*$"
+
+        git-resource: &concourse-resource-repo
+          protect: false
+          branches:
+            master:
+              protect: true
+              required_pull_request_reviews:
+                dismiss_stale_reviews: true
+                bypass_pull_request_allowances:
+                  teams: ["wg-concourse-bots"]
+              required_status_checks:
+                contexts:
+                  - "EasyCLA"
+                  - "Build and Test"
+            version:
+              protect: true
+
+        bosh-io-stemcell-resource: *concourse-resource-repo
+        bosh-io-release-resource: *concourse-resource-repo
+        docker-image-resource: *concourse-resource-repo
+        github-release-resource: *concourse-resource-repo
+        hg-resource: *concourse-resource-repo
+        mock-resource: *concourse-resource-repo
+        pool-resource: *concourse-resource-repo
+        registry-image-resource: *concourse-resource-repo
+        s3-resource: *concourse-resource-repo
+        semver-resource: *concourse-resource-repo
+        time-resource: *concourse-resource-repo

orgs/contributors.yml

@@ -200,3 +200,15 @@ orgs:
     - ivo1116
     - t-schoell
     - rashedkvm
+  concourse:
+    contributors:
+    - IvanChalukov
+    - Kump3r
+    - Spimtav
+    - concourse-bot
+    - concourse-otto
+    - drich10
+    - ichandrabhatta
+    - taylorsilva
+    - wayneadams
+    - yharish991

orgs/org_management/org_management.py

@@ -35,7 +35,7 @@ def construct_mapping(self, node: Any, deep: bool = False):
 @final
 class OrgGenerator:
     # list of managed orgs, should match ./ORGS.md
-    _MANAGED_ORGS = ["cloudfoundry"]
+    _MANAGED_ORGS = ["cloudfoundry", "concourse"]
     _DEFAULT_ORG = "cloudfoundry"
 
     # parameters intended for testing only, all params are yaml docs

orgs/org_management/test_org_management.py

@@ -359,8 +359,13 @@
 class TestOrgGenerator(unittest.TestCase):
     @override
     def setUp(self) -> None:
+        self._original_managed_orgs = OrgGenerator._MANAGED_ORGS  # pyright: ignore[reportUninitializedInstanceVariable]
         OrgGenerator._MANAGED_ORGS = ["cloudfoundry"]
 
+    @override
+    def tearDown(self) -> None:
+        OrgGenerator._MANAGED_ORGS = self._original_managed_orgs
+
     def test_empty_org(self):
         o = OrgGenerator()
         o.generate_org_members()
@@ -869,14 +874,18 @@ def test_generate_branch_protection_multiple_orgs(self):
 # integration test, depends on data in this repo which may change
 class TestOrgGeneratorIntegrationTest(unittest.TestCase):
     def test_cf_org(self):
-        self.assertEqual(["cloudfoundry"], OrgGenerator._MANAGED_ORGS)
+        self.assertEqual(["cloudfoundry", "concourse"], OrgGenerator._MANAGED_ORGS)
 
         o = OrgGenerator()
         o.load_from_project()
-        self.assertEqual(1, len(o.org_cfg["orgs"]))
+        self.assertEqual(2, len(o.org_cfg["orgs"]))
         self.assertEqual("cloudfoundry", o.toc_org)
         self.assertEqual("Technical Oversight Committee", o.toc["name"])
+
         self.assertGreater(len(o.contributors["cloudfoundry"]), 100)
+        self.assertGreater(len(o.contributors["concourse"]), 9)
+
+        # cloudfoundry WGs
         cf_wgs = o.working_groups["cloudfoundry"]
         self.assertGreater(len(cf_wgs), 5)
         self.assertEqual(1, len([wg for wg in cf_wgs if "Admin" in wg["name"]]))
@@ -888,29 +897,61 @@ def test_cf_org(self):
         # branch protection
         self.assertIn("cloudfoundry", o.branch_protection["branch-protection"]["orgs"])
 
+        # concourse WGs
+        concourse_wgs = o.working_groups["concourse"]
+        self.assertEqual(len(concourse_wgs), 1)
+        self.assertEqual(1, len([wg for wg in concourse_wgs if "Concourse" in wg["name"]]))
+        # no WGs without execution leads
+        self.assertEqual(0, len([wg for wg in concourse_wgs if len(wg["execution_leads"]) == 0]))
+        # branch protection
+        self.assertIn("concourse", o.branch_protection["branch-protection"]["orgs"])
+
         self.assertTrue(o.validate_repo_ownership())
 
         o.generate_org_members()
-        members = o.org_cfg["orgs"]["cloudfoundry"]["members"]
-        admins = o.org_cfg["orgs"]["cloudfoundry"]["admins"]
-        self.assertGreater(len(members), 100)
-        self.assertGreater(len(admins), 7)  # 5 toc members + CFF technical staff
-        self.assertIn("cf-bosh-ci-bot", members)
+        # cloudfoundry
+        cf_members = o.org_cfg["orgs"]["cloudfoundry"]["members"]
+        cf_admins = o.org_cfg["orgs"]["cloudfoundry"]["admins"]
+        self.assertGreater(len(cf_members), 100)
+        self.assertGreater(len(cf_admins), 7)  # 5 toc members + CFF technical staff
+        self.assertIn("cf-bosh-ci-bot", cf_members)
+        # concourse
+        concourse_members = o.org_cfg["orgs"]["concourse"]["members"]
+        concourse_admins = o.org_cfg["orgs"]["concourse"]["admins"]
+        self.assertGreater(len(concourse_members), 9)
+        self.assertGreater(len(concourse_admins), 7)  # 5 toc members + CFF technical staff
+        self.assertIn("concourse-bot", concourse_members)
 
         o.generate_teams()
-        teams = o.org_cfg["orgs"]["cloudfoundry"]["teams"]
-        self.assertIn("wg-app-runtime-deployments", teams)
+        # cloudfoundry
+        cf_teams = o.org_cfg["orgs"]["cloudfoundry"]["teams"]
+        self.assertIn("wg-app-runtime-deployments", cf_teams)
         self.assertIn(
-            "cf-deployment", teams["wg-app-runtime-deployments"]["teams"]["wg-app-runtime-deployments-cf-deployment-approvers"]["repos"]
+            "cf-deployment", cf_teams["wg-app-runtime-deployments"]["teams"]["wg-app-runtime-deployments-cf-deployment-approvers"]["repos"]
         )
-        self.assertIn("cf-deployment", teams["wg-app-runtime-deployments"]["teams"]["wg-app-runtime-deployments-bots"]["repos"])
-        self.assertIn("ard-wg-gitbot", teams["wg-app-runtime-deployments"]["teams"]["wg-app-runtime-deployments-bots"]["members"])
-        self.assertIn("toc", teams)
-        self.assertEqual(5, len(teams["toc"]["maintainers"]))
-        self.assertIn("community", teams["toc"]["repos"])
-        self.assertIn("wg-leads", teams)
-        self.assertIn("community", teams["wg-leads"]["repos"])
+        self.assertIn("cf-deployment", cf_teams["wg-app-runtime-deployments"]["teams"]["wg-app-runtime-deployments-bots"]["repos"])
+        self.assertIn("ard-wg-gitbot", cf_teams["wg-app-runtime-deployments"]["teams"]["wg-app-runtime-deployments-bots"]["members"])
+        self.assertIn("toc", cf_teams)
+        self.assertEqual(5, len(cf_teams["toc"]["maintainers"]))
+        self.assertIn("community", cf_teams["toc"]["repos"])
+        self.assertIn("wg-leads", cf_teams)
+        self.assertIn("community", cf_teams["wg-leads"]["repos"])
+
+        # concourse
+        concourse_teams = o.org_cfg["orgs"]["concourse"]["teams"]
+        self.assertIn("wg-concourse", concourse_teams)
+        self.assertIn("concourse-bosh-deployment", concourse_teams["wg-concourse"]["teams"]["wg-concourse-core-approvers"]["repos"])
+        self.assertIn("concourse-bosh-deployment", concourse_teams["wg-concourse"]["teams"]["wg-concourse-bots"]["repos"])
+        self.assertIn("concourse-bot", concourse_teams["wg-concourse"]["teams"]["wg-concourse-bots"]["members"])
+        self.assertIn("wg-leads", concourse_teams)
+        self.assertEqual(2, len(concourse_teams["wg-leads"]["members"]))
+        # concourse wg leads are also in cloudfoundry wg-leads to grant access to the community repo
+        self.assertIn("wg-leads-concourse", cf_teams)
+        self.assertEqual(2, len(cf_teams["wg-leads-concourse"]["members"]))
+        self.assertIn("community", cf_teams["wg-leads-concourse"]["repos"])
 
         o.generate_branch_protection()
-        bp_repos = o.branch_protection["branch-protection"]["orgs"]["cloudfoundry"]["repos"]
-        self.assertGreaterEqual(len(bp_repos), 3)
+        cf_bp_repos = o.branch_protection["branch-protection"]["orgs"]["cloudfoundry"]["repos"]
+        self.assertGreaterEqual(len(cf_bp_repos), 300)
+        concourse_bp_repos = o.branch_protection["branch-protection"]["orgs"]["concourse"]["repos"]
+        self.assertGreaterEqual(len(concourse_bp_repos), 30)