run_e4c51e1ed1556869

input

{
  "request": "Triage Jira ticket MZCLD-3828: Fix perma-diff with `moco-security-managers` pull access",
  "references": [
    "https://mozilla-hub.atlassian.net/browse/MZCLD-3828"
  ],
  "sourceContext": {
    "issue": "MZCLD-3828"
  }
}

summary

MZCLD-3828 tracks a Terraform perma-diff caused by the `moco-security-managers` GitHub team being granted org-level "security manager" access outside of Terraform. Because the `github_repository_collaborators` resource is treated as authoritative, Terraform sees this out-of-band team grant every run and tries to reconcile it, causing perpetual drift. The ticket is already "In Progress" with no comments yet, so this triage note is to confirm the fix path and flag a couple of open questions before the fix lands.

findings

• Root cause: an org/enterprise-level team (moco-security-managers) was granted GitHub 'security manager' access outside of Terraform, and the github_repository_collaborators Terraform resource is authoritative — it doesn't know about this team, so every plan shows a diff trying to remove/alter it.
• The ticket description already cites the correct remediation per the Terraform GitHub provider docs: either (a) add the team to the Terraform configuration with the correct role, or (b) add it to an ignore_team block so Terraform stops trying to manage it.
• No linked runbook/design doc or comments exist on the ticket, and no Confluence reference was provided beyond the GitHub org team URL, so there is no additional design context to pull — the fix is scoped entirely to Terraform config for repos using github_repository_collaborators.
• Because 'security manager' is an org-level role that doesn't map 1:1 to a repo-level permission (pull/push/admin), simply adding the team to configuration with a role could misrepresent its actual access; using ignore_team is likely the safer, lower-risk fix unless explicit management of the team's repo role is desired.

proposed actions

Triage: Confirmed root cause — `moco-security-managers` is an org-level team with GitHub "security manager" access, granted outside Terraform. Since `github_repository_collaborators` is authoritative, every plan shows drift trying to reconcile this team.

Recommended fix (per GitHub Terraform provider docs already referenced in the description): for each affected repo's `github_repository_collaborators` resource, add an `ignore_team { team_id = "moco-security-managers" }` block rather than trying to explicitly manage the team's role — since GitHub's org-level "security manager" role doesn't map cleanly to a repo-level permission (pull/push/admin), attempting to codify a specific role risks misrepresenting actual access and could still drift.

Before merging: (1) enumerate all repos where this team currently has access to make sure the ignore_team block (or module-level default) is applied consistently, ideally via a shared module rather than per-repo edits, and (2) run `terraform plan` across affected repos to confirm the diff clears. No linked runbook/design doc was found on this ticket — if one exists elsewhere, please link it for future reference.

tool calls

[
  {
    "capability": "jira.issue.read",
    "args": {
      "key": "MZCLD-3828"
    },
    "result": {
      "key": "MZCLD-3828",
      "summary": "Fix perma-diff with `moco-security-managers` pull access",
      "status": "In Progress",
      "description_text": "https://github.com/orgs/mozilla/teams/moco-security-managers   has been granted security manager access at the organization level. The  github_repository_collaborators  resource we\u2019re using is an authoritative binding so we\u2019ll need to add the team to the configuration with the correct role or add it to an  ignore_team  block. From Teams added to the repository outside of Terraform can be managed by adding them to the configuration, or ignored by using the  ignore_team  argument. This is particularly important for organization/enterprise teams, which either need to be added to the configuration or ignored, as otherwise they will cause perpetual drift.",
      "comment_count": 0,
      "comments": []
    }
  }
]

log