GithubOrganization

Service-level GitHub organisation governance component.

Remarks

This component orchestrates three capability areas in one resource instance: teams, organisation memberships (including team assignments), and repository collaborators.

It also exposes an informational userDirectory output with resolved user metadata for downstream inspection.

Admin organisation memberships are retained on delete to prevent accidental admin removal from GitHub through stack changes. Admin-to-member downgrades are blocked and must be performed manually in GitHub.

Naming:

• The component type is ${namespace}:github:GithubOrganization; logical-only args.identity produces ${env}-${projectHash}-github-organization-${sanitised args.identity}.
• Under parent ${namespace}:github:GithubOrganization, github:index/team:Team uses [args.identity, args.githubTeams.<key>], github:index/membership:Membership uses [args.identity, args.githubUsers.<key>], and github:index/teamMembership:TeamMembership uses [args.identity, args.githubTeams.<key>, <accountName>]. The account name comes from either args.githubTeams.<key>.maintainers[] or args.githubUsers.<key>.teams[]; when both declare the same assignment, maintainer takes precedence.
• github:index/repositoryCollaborator:RepositoryCollaborator uses [args.identity, args.repositoryCollaborators.<repository>::<accountName>]; this map key is the sole composite identity and follows the documented <repository>::<accountName> grammar.
• GitHub team names, usernames, repository names, and permissions are semantic provider values; provider validation owns their constraints.

Example

const governance = new GithubOrganization({
  identity: 'governance',
  githubTeams: { platform: { maintainers: ['alice'] } },
  githubUsers: { alice: { email: 'alice@example.com', role: 'admin', teams: ['platform'] } },
  repositoryCollaborators: { 'jobcloud/infra::contractor': { email: 'contractor@example.com', permission: 'push' } },
});

Constructors

new GithubOrganization( args: GithubOrganizationArgs, options?: ComponentResourceOptions, ): GithubOrganization

Parameters

• args (GithubOrganizationArgs) — Team, user, and repository collaborator governance inputs.
• options (ComponentResourceOptions, optional) — Pulumi resource options.

Returns

GithubOrganization

Hierarchy

• ComponentResource
• GithubOrganization

Properties

repositoryCollaboratorList: RepositoryCollaborator[]

Repository collaborator resources as an ordered list.

repositoryCollaborators: Record<string, github.RepositoryCollaborator>

Repository collaborator resources keyed by repository::accountName.

teams: Record<string, github.Team>

Team resources keyed by team name.

urn: Output<string>

Inherited from urn

The stable logical URN used to distinctly address a resource, both before and after deployments.

userDirectory: Record<string, { accountName: string; email: string; role: 'member' | 'admin'; teams: string[] }>

Informational user metadata keyed by account name.

users: Record<string, github.Membership>

Organisation membership resources keyed by account name.

Methods

getData(): Promise<any>

Inherited from getData

Retrieves the data produces by initialize. The data is immediately available in a derived class's constructor after the super(...) call to ComponentResource.

Returns

• Promise<any>

getProvider(moduleMember: string): ProviderResource | undefined

Inherited from getProvider

Returns the provider for the given module member, if one exists.

Parameters

• moduleMember (string)

Returns

• ProviderResource | undefined

initialize( args: Inputs, opts?: ComponentResourceOptions, name?: string, type?: string, ): Promise<any>

Inherited from initialize

Can be overridden by a subclass to asynchronously initialize data for this component automatically when constructed. The data will be available immediately for subclass constructors to use. To access the data use getData.

Parameters

• args (Inputs)
• opts (ComponentResourceOptions, optional)
• name (string, optional)
• type (string, optional)

Returns

• Promise<any>

registerOutputs( outputs?: Inputs | Promise<Inputs> | Output<Inputs>, ): void

Inherited from registerOutputs

Registers synthetic outputs that a component has initialized, usually by allocating other child sub-resources and propagating their resulting property values.

Component resources can call this at the end of their constructor to indicate that they are done creating child resources. This is not strictly necessary as this will automatically be called after the initialize method completes.

Parameters

• outputs (Inputs | Promise<Inputs> | Output<Inputs>, optional)

Returns

• void

Static Methods

isInstance(obj: any): obj is ComponentResource<any>

Inherited from isInstance

Returns true if the given object is a CustomResource. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

Parameters

• obj (any)

Returns

• obj is ComponentResource<any>