Merge pull request #1923 from rust-lang/team-access-refers-to-team-name-of-toml-instead-of-github

marcoieni · web-flow · commit 9127e1a0d232 · 2025-08-01T10:19:19.000Z
team access refers to team name of toml instead of github
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -24,8 +24,11 @@
 /teams/team-repo-admins.toml @Mark-Simulacrum @pietroalbini @jdno @marcoieni
 /people/Mark-Simulacrum.toml @Mark-Simulacrum @pietroalbini @jdno @marcoieni
 /people/Nadrieril.toml @Mark-Simulacrum @pietroalbini @jdno @marcoieni
+/people/Noratrieb.toml @Mark-Simulacrum @pietroalbini @jdno @marcoieni
+/people/apiraino.toml @Mark-Simulacrum @pietroalbini @jdno @marcoieni
 /people/jackh726.toml @Mark-Simulacrum @pietroalbini @jdno @marcoieni
 /people/jdno.toml @Mark-Simulacrum @pietroalbini @jdno @marcoieni
+/people/jieyouxu.toml @Mark-Simulacrum @pietroalbini @jdno @marcoieni
 /people/marcoieni.toml @Mark-Simulacrum @pietroalbini @jdno @marcoieni
 /people/oli-obk.toml @Mark-Simulacrum @pietroalbini @jdno @marcoieni
 /people/pietroalbini.toml @Mark-Simulacrum @pietroalbini @jdno @marcoieni
diff --git a/docs/toml-schema.md b/docs/toml-schema.md
@@ -329,6 +329,10 @@ See [GitHub's documentation][github-roles] for information on what each role is
 # - "write"
 # - "maintain"
 # - "admin"
+#
+# Instead of showing the team name, the API contains the names of all the GitHub teams
+# in the `[[github]]` list of the team TOML file.
+# In other words, the teams are "expanded" to their corresponding GitHub teams.
 [access.teams]
 compiler = "write"
 
@@ -365,8 +369,8 @@ pattern = "master"
 # Which CI checks to are required for merging (optional)
 # Cannot be set if `pr-required` is `false`.
 ci-checks = ["CI"]
-# Whether new commits after a reviewer's approval of a PR 
-# merging into this branch require another review. 
+# Whether new commits after a reviewer's approval of a PR
+# merging into this branch require another review.
 # (optional - default `false`)
 dismiss-stale-review = false
 # Is a PR required when making changes to this branch?
diff --git a/repos/rust-lang/async-crashdump-debugging-initiative.toml b/repos/rust-lang/async-crashdump-debugging-initiative.toml
@@ -4,4 +4,4 @@ description = ""
 bots = []
 
 [access.teams]
-initiative-async-crashdump-debugging = "write"
+project-async-crashdump-debugging = "write"
diff --git a/repos/rust-lang/discord-mods-bot.toml b/repos/rust-lang/discord-mods-bot.toml
@@ -4,4 +4,4 @@ description = "discord moderation bot"
 bots = []
 
 [access.teams]
-mods = "maintain"
+mods-venue = "maintain"
diff --git a/repos/rust-lang/dyn-upcasting-coercion-initiative.toml b/repos/rust-lang/dyn-upcasting-coercion-initiative.toml
@@ -4,4 +4,4 @@ description = "Initiative to support upcasting dyn Trait values to supertraits"
 bots = []
 
 [access.teams]
-initiative-dyn-upcasting = "write"
+project-dyn-upcasting = "write"
diff --git a/repos/rust-lang/generic-associated-types-initiative.toml b/repos/rust-lang/generic-associated-types-initiative.toml
@@ -5,4 +5,4 @@ homepage = "https://rust-lang.github.io/generic-associated-types-initiative/"
 bots = []
 
 [access.teams]
-initiative-generic-associated-types = "write"
+project-generic-associated-types = "write"
diff --git a/repos/rust-lang/impl-trait-initiative.toml b/repos/rust-lang/impl-trait-initiative.toml
@@ -5,4 +5,4 @@ homepage = "https://rust-lang.github.io/impl-trait-initiative/"
 bots = []
 
 [access.teams]
-initiative-impl-trait = "maintain"
+project-impl-trait = "maintain"
diff --git a/repos/rust-lang/keyword-generics-initiative.toml b/repos/rust-lang/keyword-generics-initiative.toml
@@ -5,4 +5,4 @@ homepage = "https://rust-lang.github.io/keyword-generics-initiative/"
 bots = []
 
 [access.teams]
-initiative-keyword-generics = "write"
+project-keyword-generics = "write"
diff --git a/repos/rust-lang/moderation-team.toml b/repos/rust-lang/moderation-team.toml
@@ -4,4 +4,4 @@ description = "Home of the Rust Moderation team."
 bots = []
 
 [access.teams]
-mods = "write"
+mods-venue = "write"
diff --git a/repos/rust-lang/negative-impls-initiative.toml b/repos/rust-lang/negative-impls-initiative.toml
@@ -4,4 +4,4 @@ description = "Lang team negative impls initiative"
 bots = []
 
 [access.teams]
-initiative-negative-impls = "write"
+project-negative-impls = "write"
diff --git a/repos/rust-lang/rust-dbg-ext.toml b/repos/rust-lang/rust-dbg-ext.toml
@@ -4,4 +4,4 @@ description = ""
 bots = []
 
 [access.teams]
-initiative-async-crashdump-debugging = "maintain"
+project-async-crashdump-debugging = "maintain"
diff --git a/repos/rust-lang/team.toml b/repos/rust-lang/team.toml
@@ -4,7 +4,7 @@ description = "Rust teams structure"
 bots = []
 
 [access.teams]
-mods = "write"
+mods-venue = "write"
 team-repo-admins = "write"
 infra = "triage"
 
diff --git a/repos/rust-lang/trait-system-refactor-initiative.toml b/repos/rust-lang/trait-system-refactor-initiative.toml
@@ -4,4 +4,4 @@ description = "The Rustc Trait System Refactor Initiative"
 bots = []
 
 [access.teams]
-initiative-trait-system-refactor = "maintain"
+project-trait-system-refactor = "maintain"
diff --git a/repos/rust-lang/wg-security-response.toml b/repos/rust-lang/wg-security-response.toml
@@ -4,4 +4,4 @@ description = "Documentation for the Rust Security Response WG"
 bots = []
 
 [access.teams]
-security = "write"
+wg-security-response = "write"
diff --git a/src/static_api.rs b/src/static_api.rs
@@ -93,23 +93,35 @@ impl<'a> Generator<'a> {
                         Bot::Renovate => v1::Bot::Renovate,
                     })
                     .collect(),
-                teams: r
-                    .access
-                    .teams
-                    .iter()
-                    .map(|(name, permission)| {
+                teams: {
+                    let mut teams = Vec::new();
+                    for (team_name, permission) in &r.access.teams {
                         let permission = match permission {
                             RepoPermission::Admin => v1::RepoPermission::Admin,
                             RepoPermission::Write => v1::RepoPermission::Write,
                             RepoPermission::Maintain => v1::RepoPermission::Maintain,
                             RepoPermission::Triage => v1::RepoPermission::Triage,
                         };
-                        v1::RepoTeam {
-                            name: name.clone(),
-                            permission,
+
+                        // Look up the team by name and get all its GitHub teams
+                        let team = self.data.team(team_name).with_context(|| {
+                            format!("failed to find team '{team_name}' in teams directory")
+                        })?;
+                        let github_teams = team.github_teams(self.data).with_context(|| {
+                            format!("failed to get GitHub teams for '{team_name}'")
+                        })?;
+                        for gh_team in github_teams {
+                            if gh_team.org == r.org {
+                                let new_team = v1::RepoTeam {
+                                    name: gh_team.name.to_string(),
+                                    permission: permission.clone(),
+                                };
+                                teams.push(new_team);
+                            }
                         }
-                    })
-                    .collect(),
+                    }
+                    teams
+                },
                 members: r
                     .access
                     .individuals
diff --git a/src/validate.rs b/src/validate.rs
@@ -2,9 +2,10 @@ use crate::api::github::GitHubApi;
 use crate::api::zulip::ZulipApi;
 use crate::data::Data;
 use crate::schema::{
-    Bot, Email, MergeBot, Permissions, RepoPermission, Team, TeamKind, TeamPeople, ZulipMember,
+    Bot, Email, MergeBot, Permissions, Repo, RepoPermission, Team, TeamKind, TeamPeople,
+    ZulipMember,
 };
-use anyhow::{bail, Error};
+use anyhow::{bail, Context as _, Error};
 use log::{error, warn};
 use regex::Regex;
 use std::collections::hash_map::{Entry, HashMap};
@@ -854,7 +855,6 @@ fn validate_zulip_stream_extra_people(data: &Data, errors: &mut Vec<String>) {
 /// Ensure repos reference valid teams and that they are unique
 fn validate_repos(data: &Data, errors: &mut Vec<String>) {
     let allowed_orgs = data.config().allowed_github_orgs();
-    let github_teams = data.github_teams();
     let mut repo_map = HashSet::new();
 
     wrapper(data.all_repos(), errors, |repo, _| {
@@ -870,20 +870,9 @@ fn validate_repos(data: &Data, errors: &mut Vec<String>) {
             );
         }
         for team_name in repo.access.teams.keys() {
-            if !github_teams.contains(&(repo.org.clone(), team_name.clone())) {
-                let error_reason = if data.is_team_archived(team_name, &repo.org) {
-                    "is archived. Please remove the team access from the `[access.teams]` section of the repo"
-                } else {
-                    "is not present in the `/teams/` folder"
-                };
-
-                bail!(
-                    "Access for the repo {}/{} is invalid: the team '{}/{team_name}' {error_reason}.",
-                    repo.org,
-                    repo.name,
-                    repo.org,
-                );
-            }
+            check_team_access(data, repo, team_name).with_context(|| {
+                format!("Access for the repo {}/{} is invalid", repo.org, repo.name)
+            })?;
         }
 
         for name in repo.access.individuals.keys() {
@@ -900,6 +889,23 @@ fn validate_repos(data: &Data, errors: &mut Vec<String>) {
     });
 }
 
+fn check_team_access(data: &Data, repo: &Repo, team_name: &str) -> anyhow::Result<()> {
+    let team = data
+        .team(team_name)
+        .with_context(|| format!("The file 'teams/{team_name}.toml' does not exist."))?;
+    if data.is_team_archived(team.name(), &repo.org) {
+        bail!("The team '{}/{team_name}' is archived. Please remove the team access from the `[access.teams]` section of the repo", repo.org);
+    }
+
+    let are_gh_teams_in_org = team.github_teams(data)?.iter().any(|t| t.org == repo.org);
+    anyhow::ensure!(
+        are_gh_teams_in_org,
+        "The team '{team_name}' does not have any GitHub teams in the org '{}'.",
+        repo.org
+    );
+    Ok(())
+}
+
 fn validate_archived_repos(data: &Data, errors: &mut Vec<String>) {
     wrapper(data.archived_repos(), errors, |repo, _| {
         if !repo.access.teams.is_empty() {
diff --git a/tests/static-api/_expected/v1/repos.json b/tests/static-api/_expected/v1/repos.json
@@ -38,6 +38,10 @@
         {
           "name": "foo",
           "permission": "maintain"
+        },
+        {
+          "name": "renamed-team",
+          "permission": "maintain"
         }
       ],
       "members": [],
diff --git a/tests/static-api/_expected/v1/repos/some_repo.json b/tests/static-api/_expected/v1/repos/some_repo.json
@@ -8,6 +8,10 @@
     {
       "name": "foo",
       "permission": "maintain"
+    },
+    {
+      "name": "renamed-team",
+      "permission": "maintain"
     }
   ],
   "members": [],
