Backport organization role assignments

[ejfine]

Link to Issue or Message thread

None. Backport ahead of a ruleset change that touches the same files, so that change can be reviewed on its own.

Why is this change necessary?

A downstream project added organization role assignments (granting a predefined GitHub organization role, such as all-repository triage, to individual members) directly in its copy of the template-managed github_repos files and never backported it. The next template change to lib/teams.py or lib/program.py would collide with that local divergence during copier update.

How does this change address the issue?

Ports the feature as it runs downstream:

• GithubOrgMembers.org_role_assignments: role name to list of usernames.
• create_org_role_assignments looks role IDs up by name at deploy time (get_organization_roles) and creates OrganizationRoleUser resources.
• fully_configure_teams validates that every assignee is an org member, with GithubOrgRoleUserNotInOrgMembersError and GithubOrganizationRoleNotFoundError for the failure cases.
• ALL_REPOSITORY_TRIAGE_ROLE constant for the predefined Enterprise Cloud role.
• README and the token comment list the extra Custom organization roles: Read & write permission the deploy token needs when assignments are configured.

The one project-specific line in the downstream program.py (an extra repo in root_team_push_repos) was left out.

What side effects does this change have?

None for projects that leave org_role_assignments empty: create_org_role_assignments returns before any API call, so no new token permission is needed until a role is assigned.

How do we know this works?

• Unit tests cover the validation paths and the role-ID lookup, including the error messages naming the user, role and available roles. Also brings over tests for ensure_full_repo_name and root_team_push_repos that had only existed downstream.
• Deploy path is exercised in production downstream, where the role assignment has been live for weeks.
• Pre-commit passes locally on the template repo. CI's instantiate-template job lints and tests the rendered project.

Other

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 3 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: LabAutomationAndScreening/copier-aws-central-infrastructure/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: f46e362b-f028-4764-98b0-1b890a3c4770

📥 Commits

Reviewing files that changed from the base of the PR and between a2d1fb9 and 0a6de47.

📒 Files selected for processing: 5

• template/README.md.jinja
• template/src/aws_central_infrastructure/{% if manage_github_repos %}github_repos{% endif %}/lib/__init__.py
• template/src/aws_central_infrastructure/{% if manage_github_repos %}github_repos{% endif %}/lib/program.py
• template/src/aws_central_infrastructure/{% if manage_github_repos %}github_repos{% endif %}/lib/teams.py
• template/tests/unit/{% if manage_github_repos %}github_repos{% endif %}/test_teams.py

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}