NO-ISSUE: Add a maintainers parent team for the teams that can write

README.md

@@ -20,8 +20,18 @@ When a commit is pushed to the `main` branch (e.g., when a pull request merges),
 ### Add a new team?
 
 1. Open `teams.csv`
-1. Add a new row of the form `<team_name>,<description>,<privacy>,<contributor>`, where `<privacy>` can be either `closed` (visible to all members of the organization) or `secret` (visible to organization owners and members of this team).
+1. Add a new row of the form `<team_name>,<description>,<privacy>,<contributor>,<maintainer>`, where `<privacy>` can be either `closed` (visible to all members of the organization) or `secret` (visible to organization owners and members of this team).
    Set `<contributor>` to `true` to give the team push access on every repository that uses `local.contributor_teams` in `repositories.tf` (the working group teams), or `false` otherwise.
+   Set `<maintainer>` to `true` or `false` (see the next section); a team that is not explicitly authorized to approve changes is `false`.
+
+### Let a team approve changes (be a maintainer)?
+
+1. Open `teams.csv`
+1. Set the `maintainer` column of the team to `true`.
+
+The team then becomes a child of the `maintainers` team, whose members are everyone in those teams, and it inherits the push access that `maintainers` has on `osac`. A team joins only when it is explicitly authorized both to have that push access on `osac` and to approve changes there as a code owner; having write access to a repository is not enough on its own. The team must be visible (`closed`). Today they are the working-group (`wg-*`) teams.
+
+The point of the team is `osac`'s CODEOWNERS: a follow-up change to that file will make `@osac-project/maintainers` the owner of every path that no other rule names, so that a person in one of these teams has to approve it and a bot (CodeRabbit included) never counts. Until that change is merged, the team is only created, and paths with no owner can still be approved by a bot.
 
 ### Add an organization member to a team?
 

repositories.tf

@@ -136,7 +136,9 @@ module "repo_osac" {
   # Always show "Update branch" (merge or rebase). The merge queue does not
   # require up-to-date branches, so GitHub otherwise hides the button.
   allow_update_branch = true
-  contributor_teams   = local.contributor_teams
+  # The contributor teams, and "maintainers" (the parent of the wg-* teams): the owner of every path in CODEOWNERS that no
+  # other rule names.
+  contributor_teams = concat(local.contributor_teams, [github_team.maintainers.name])
   teams = [
     {
       team_id    = github_team.all["managers"].name

teams.csv

@@ -1,26 +1,26 @@
-name,description,privacy,contributor
-org-admins,Organization Administrators,secret,false
-fulfillment-wg,Fulfillment working group,secret,false
-observability-wg,observability working group,secret,false
-personas-wg,Personas working group,secret,false
-documentation-wg,Documentation working group,secret,false
-wg-infra,OSAC Infrastructure working group,closed,true
-wg-storage,OSAC Storage working group,closed,true
-managers,OSAC working group managers,closed,true
-architects,Architects across all OSAC working groups,closed,true
-wg-leads,Leads of the OSAC working groups,closed,true
-ci-duty,CI duty and merge assistance - force-merge on osac osac-test-infra and enhancement-proposals and CI/CD admin,closed,false
-contributors,OSAC contributors outside the working groups,closed,true
-wg-architecture,OSAC Architecture working group,closed,true
-wg-bmaas,OSAC BMaaS working group,closed,true
-wg-caas,OSAC CaaS working group,closed,true
-wg-vmaas,OSAC VMaaS working group,closed,true
-wg-maas,OSAC MaaS working group,closed,true
-wg-enclave,OSAC Enclave working group,closed,true
-wg-connectivity,OSAC Connectivity & Fabric working group,closed,true
-wg-core,OSAC Core working group,closed,true
-wg-metering,OSAC Metering working group,closed,true
-wg-ui,OSAC UI working group,closed,true
-wg-e2e,OSAC E2E working group,closed,true
-wg-soln-eng,OSAC Solution Engineering working group,closed,true
-wg-qe,OSAC QE working group,closed,true
+name,description,privacy,contributor,maintainer
+org-admins,Organization Administrators,secret,false,false
+fulfillment-wg,Fulfillment working group,secret,false,false
+observability-wg,observability working group,secret,false,false
+personas-wg,Personas working group,secret,false,false
+documentation-wg,Documentation working group,secret,false,false
+wg-infra,OSAC Infrastructure working group,closed,true,true
+wg-storage,OSAC Storage working group,closed,true,true
+managers,OSAC working group managers,closed,true,false
+architects,Architects across all OSAC working groups,closed,true,false
+wg-leads,Leads of the OSAC working groups,closed,true,true
+ci-duty,CI duty and merge assistance - force-merge on osac osac-test-infra and enhancement-proposals and CI/CD admin,closed,false,false
+contributors,OSAC contributors outside the working groups,closed,true,false
+wg-architecture,OSAC Architecture working group,closed,true,true
+wg-bmaas,OSAC BMaaS working group,closed,true,true
+wg-caas,OSAC CaaS working group,closed,true,true
+wg-vmaas,OSAC VMaaS working group,closed,true,true
+wg-maas,OSAC MaaS working group,closed,true,true
+wg-enclave,OSAC Enclave working group,closed,true,true
+wg-connectivity,OSAC Connectivity & Fabric working group,closed,true,true
+wg-core,OSAC Core working group,closed,true,true
+wg-metering,OSAC Metering working group,closed,true,true
+wg-ui,OSAC UI working group,closed,true,true
+wg-e2e,OSAC E2E working group,closed,true,true
+wg-soln-eng,OSAC Solution Engineering working group,closed,true,true
+wg-qe,OSAC QE working group,closed,true,true

teams.tf

@@ -5,9 +5,20 @@ resource "github_team" "all" {
     team.name => team
   }
 
-  name        = each.value.name
-  description = each.value.description
-  privacy     = each.value.privacy
+  name           = each.value.name
+  description    = each.value.description
+  privacy        = each.value.privacy
+  parent_team_id = each.value.maintainer == "true" ? github_team.maintainers.id : null
+}
+
+# The parent of every working-group team (the teams flagged "maintainer" in teams.csv: the wg-* teams). GitHub counts the
+# members of a child team as members of its parent, so "@osac-project/maintainers" in CODEOWNERS means "a person of any
+# working group", and a bot, which is in none of them, is not one. Child teams inherit the access of their parent; the
+# parent only has push on osac (see repositories.tf), which they all have already.
+resource "github_team" "maintainers" {
+  name        = "maintainers"
+  description = "Everyone who may approve changes: the members of the working-group teams (their parent team)"
+  privacy     = "closed"
 }
 
 # Populate team members based on the csv files in the team-members directory.