What does "You cannot remove repositories from a security manager team" mean?

[justinmchase]

I am getting this error in my logs and the teams are not updated

You cannot remove repositories from a security manager team

I have a suborg file and a repo specific file which I would expect to merge into three teams. Plus there is a security team added to all repos from the enterprise level. The payload for this error appears to only be referencing the two teams from the suborg file.

[svg153]

Apparently, it's a bug here: #315 (comment)

[justinmchase]

Well I think that fix in that comment sounds perfect, I'd love to have this just work without thinking about it.

But [the documentation] does say this:

It is possible to provide an include or exclude settings to restrict the collaborators, teams, labels to a list of repos or exclude a set of repos for a collaborator.

Is that just wrong?

[svg153]

As far as I know, I do think it's wrong. Let's see if @decyjphr can confirm.

[decyjphr]

Yes, that config setting is not correct. You can use include and exclude within teams but that is to include or exclude a list of repos from this setting. So for org-level or suborg-level settings we can include or exclude a set of repos from this setting. This setting does not take a list of teams to include or exclude.

The error you are seeing in the logs is because there are security manager teams configured for the org, and safe-settings is trying to remove them because the teams: settings do not contain them. It is not the normal pattern to include these teams in teams: settings and the correct expectation that safe-settings ignores these. But the current behavior is it tries to remove any teams that are added to the repos but are not in the settings. However, security managers cannot be removed from repos using the API.

This error does not cause any issues but we should enhance the code so it handles security manager teams better and doesn't try to remove them. Let me see if I can add this code fix, but if anyone has the bandwidth, the API for security managers is here

[justinmchase]

Ok, thats ok I didn't want to necessarily have include and exclude there anyway, I just misread the docs there. I'd say those docs if not exactly innacurate are easy to misread.

That being said, what I'm really hoping to know is if they "merge" all of the applicable files.

So if I have settings.yml, suborgs/example.yml and repos/example.yml which all apply to a specific repo and each one has 1 team in it, will the repo end up with 3 teams?

So for example if I just add the security managers into the settings.yml file will it append it to the list of teams all reapos are trying to set and be a workaround?

[martinm82]

From what I have seen, the repos/example.yml will take precedence and will ignore the ones defined in org and suborg settings.