Dashboard › publish › Distillation
bfd082aa-fbad-4fbf-911b-7e80a9bc0d1d["lore_tm_v1_sMsLuLmKItNjc5x9NWtEBUo-7tb11wSRrO6VFJxjmZ0","lore_tm_v1_DyGVCp53OyiWKPismsnU_Q3lVhf9kKhCQnjSk6yoT6s","lore_tm_v1_IOYSPJ1tslbnu0jxTtxAN-EJi9IuaZI0LHGluVNvprw","lore_tm_v1_dejBX-HQGJh0LpRJZSTtteSVwcXKMafAlWXHyrLdAaU","lore_tm_v1_CXciT66hBKr5w_57QsRvQkm0KuLo0Q0UEPxS2HF-XKA","lore_tm_v1_Y_omQoqJ05u7r2PGc7j5rP7tJXVQ95vh1C0yB3MWJ0s","lore_tm_v1_csTsBLEw2H0zxXB2gfnVnlAd_xUb362km4HcDvpCQKg","lore_tm_v1_CnDSkdL-e8u_uIlEa6-Yv8KdLq5zru2eOTed9HxzTWo","lore_tm_v1_JFm5VMN94TcjVFEWmdBVHzjVN5SONDagUHetU2iHKZI","lore_tm_v1_i0isEjMsc7pR3eG5xFf2YfPXnD_hCDtjQoD5UwkWro0","lore_tm_v1_XQxu2CFoUM9hGeTFkeTcTUGV8vm5Qejgyp_OG0Nfixg","lore_tm_v1_m6iidy9LstFlUskfUsHKrXp5O0NjuHjUV0Fv4MBgXIQ","lore_tm_v1_Xq5FL5lbsfTTUS9dnOQHPFFZxyTtavh_aKdr5mPMc_g"]
Date: Aug 27, 2026
/home/byk/Code/getsentry/security-as-code/rbac/env/prod-github/ includes root Terraform files moved.tf, .terraform.lock.hcl, _backend.tf, README.md, executable/directory sac-terraformer; organization configuration org/variables.yml, org/ruleset_warden-scan.tf, org/ruleset_secret-scanning.tf, org/ruleset_dependency-review.tf, org/_init.tf, org/variables.tf; and at least the first 100 results including numerous team/*.tf GitHub-team definitions. Search output was truncated after 100 results.env/prod-github/team/release-approvers.tf defines module "github-team--release-approvers" sourced from "../../../module/github/team", with github_team = "Release Approvers", github_team_parent = "engineering", description “People authorized to approve releases from the getsentry/publish repo”, and teams = ["team-release-approvers@sentry.io"].release-approvers in env/prod-github/diagram.md:134; env/prod/team/engineering/release-approvers.tf (module "team-group--release-approvers", team = "release-approvers", display_name = "Team Release Approvers"); and env/prod-github/team/release-approvers.tf.rbac/module/github/team/main.tf creates role module module "role" from "../../group/role" with role = "github-${github_team._.slug}", description, members = concat(var.members, var.sub_dynamic_group), teams, and sub-roles; creates resource "github_team" "_" with name, description, privacy, and parent ID. Variables: github_team required string; description and github_team_parent default null; github_team_privacy defaults "closed"; members, teams, sub-roles, and sub_dynamic_group default []; outputs email and members from module.role.env/prod-github/moved.tf and env/prod-github/repo/_collaborator.tf; moved.tf:2-3 moves module.repo.github_repository_collaborators._["sentry-for-claude"] to module.repo.github_repository_collaborators._["sentry-for-ai"].env/prod-github/repo/_collaborator.tf establishes production repo access as authoritative through resource "github_repository_collaborators" "_" (lines 118-153), while non-production and production-gaming repository user/team assignments are non-authoritative through github_repository_collaborator and github_team_repository resources.repo/_collaborator.tf, custom_role_map = {"security" = "triage"}; permission levels are admin=6, elevated_bot=5, maintain=4, write=3, triage=2, read=1; GitHub permission mappings are admin→admin, maintain→maintain, write→push, triage→triage, read→pull, elevated_bot→"Elevated Bot".repo/_collaborator.tf loads *.yml repository configurations, filters production configs by repo.tag == "prod", and constructs role maps for users and teams. For team security, lower-or-equal YAML permissions are omitted so its custom triage role remains, while YAML permissions higher than triage override it.repo/_collaborator.tf maps team slugs to IDs via data.github_organization_teams.all.teams; production github_repository_collaborators team blocks resolve team_id using lookup(local.team_id_map, team.key, team.key). It adds missing custom-role teams to ignore_team and requires each production repository’s topic to equal "tag-production".repo/_collaborator.tf builds non-production maps from YAML configurations with repo.tag == "nonprod" and production-gaming maps with repo.tag == "prod-gaming". For nonprod/gaming team assignments, read permission for team security is converted to triage; nonprod resources require "tag-non-production" and gaming resources require "tag-production".Authorization: Bearer <YOUR-TOKEN>, Accept: application/vnd.github+json, and X-GitHub-Api-Version: 2026-03-10; GET /repos/{owner}/{repo}/collaborators includes outside collaborators, direct organization-member collaborators, team-derived access (including child-team members), default organization permissions, and organization owners.permissions gives base-role permissions, while role_name is the highest role across repo, teams, organization, and enterprise grants; the endpoint cannot distinguish organization-level from repository-level grants. It requires repository write/maintain/admin plus organization membership for organization-owned repos; OAuth and classic PATs need read:org and repo scopes. Permission filter values are pull, triage, push, maintain, and admin.GET /repos/{owner}/{repo}/collaborators/{username} and that collaborator invitation/permission updates use the same endpoint; changing an existing collaborator’s permission yields 204 without other indication. Invitations are limited to 50 per repository per 24 hours, except invitations of organization members to organization repositories; Enterprise Managed Users are automatically added without invitations and only within their enterprise.getCollaboratorPermissionLevel endpoint definitions in /home/byk/Code/getsentry/publish/node_modules/@octokit/plugin-rest-endpoint-methods/dist-web/index.js:1528, dist-src/generated/endpoints.js:1524, and dist-node/index.js:1555.{"permission":"admin","role_name":"admin"}.{"permission":"read","role_name":"read"}.( repo:"getsentry/publish (accepted OR approv*) (permission OR triage OR retract)" ) type:issue was invalid; GitHub reported that listed users/repositories could not be searched because resources do not exist or were inaccessible.getsentry/publish release issues: #9167 getsentry/craft@2.29.0 (updated 2026-08-07T17:04:27Z); #9219 getsentry/sentry-refactor-tasks@0.2.0 (2026-08-12T04:57:55Z); #9332 getsentry/devservices@1.5.0 (2026-08-25T20:50:05Z); #9207 getsentry/dotagents@3.0.0 (2026-08-11T17:47:05Z); #8949 getsentry/sentry-unreal@1.17.0 (2026-07-22T17:34:19Z); #8922 getsentry/sentry-python@2.66.0 (2026-07-16T12:49:32Z); #8782 getsentry/script-runner@1.0.2 (2026-07-02T20:56:47Z); #8643 getsentry/devservices@1.4.2 (2026-06-22T10:58:08Z); #8504 getsentry/devservices@1.4.1 (2026-06-09T20:37:53Z); #8370 getsentry/devservices@1.4.0 (2026-06-02T16:17:27Z); #7163 getsentry/symbol-collector@2.4.0 (2026-06-16T01:32:36Z); #7952 and #7951 getsentry/sentry-react-native@8.9.2 (2026-04-27T10:56:47Z and 09:34:53Z); #8245 getsentry/sentry-cli@3.4.3 (2026-05-21T15:03:42Z); #7782 getsentry/sentry-dart@9.17.0 (2026-04-14T09:07:05Z); #7957 getsentry/devservices@1.3.2 (2026-04-27T22:26:05Z); #9054 getsentry/cli@0.39.0 (2026-07-28T20:12:47Z); #7850 and #7852 getsentry/devservices@1.3.0 and @1.3.1 (2026-04-17T22:54:07Z and 2026-04-18T00:59:04Z); #8495 getsentry/sentry-javascript@10.57.0 (2026-06-09T09:52:56Z); #7739 getsentry/sentry-javascript-node-native-stacktrace@0.4.0 (2026-04-08T14:53:57Z); #7648 getsentry/action-release@3.6.0 (2026-03-31T07:58:31Z); #7500 getsentry/sentry-java@8.36.0 (2026-03-17T17:56:36Z); #7398 getsentry/dotagents@1.2.0 (2026-03-10T04:44:44Z); #7986 and #7732 getsentry/cli@0.30.0 and @0.25.0 (2026-04-29T15:34:09Z and 2026-04-07T14:03:56Z); #7473 getsentry/replay-debugger@0.1.0 (2026-03-16T19:54:29Z); #7422 and #7419 getsentry/sentry-cocoa@9.7.0 (2026-03-11T15:10:26Z and 14:17:25Z); #8902 getsentry/sentry@26.7.0 (2026-07-15T17:43:42Z); #7138 getsentry/sentry-infra-tools@1.25.4 (2026-02-11T22:02:04Z); #7000 getsentry/sentry-go@0.42.0 (2026-01-27T10:23:29Z); #7650 getsentry/sentry-python@2.57.0 (2026-03-31T09:40:18Z); #6992 getsentry/sentry-electron@7.7.0 (2026-01-26T19:29:04Z); #6988 getsentry/sentry-react-native@7.9.9 (2026-01-26T10:37:59Z); #6991 getsentry/sentry-javascript-bundler-plugins@4.8.0 (2026-01-26T13:39:43Z); #7003 getsentry/sentry-toolbar@1.0.0-beta.23 (2026-01-27T18:35:00Z); #7023 getsentry/json-schema-diff@0.1.8 (2026-01-29T14:53:01Z); #7085 and #7084 getsentry/craft@2.21.1 and @2.21.0 (2026-02-06T18:40:45Z and 18:30:17Z); #7320 getsentry/sentry-wizard@6.12.0 (2026-03-02T16:40:07Z); #6884 getsentry/craft@2.18.1 (2026-01-09T23:13:04Z); #7008 and #7009 getsentry/sentry-python@2.51.0a1 and @2.51.0 (2026-01-28T09:41:17Z and 10:30:30Z); #9272 getsentry/sentry@26.8.0 (2026-08-15T17:18:55Z); #7089 getsentry/sentry-java@8.32.0 (2026-02-09T10:10:51Z); #7015 getsentry/cli@0.3.0 (2026-01-28T21:37:06Z); #6950 getsentry/sentry-python@2.50.0 (2026-01-20T12:53:50Z); and Sentry releases #7233 26.2.1, #7498 26.3.1, #8191 26.5.0, #8077 26.4.2, #8288 26.5.1, and #7208 26.2.0 (updated respectively 2026-02-21T00:39:03Z, 2026-03-17T17:23:58Z, 2026-05-18T08:10:37Z, 2026-05-05T13:43:44Z, 2026-05-27T16:48:19Z, and 2026-02-18T21:42:44Z).