List everyone who holds a key to the project

How to do it

Users need to know who can change what they install. You need the list to remove access when someone leaves. Name the role and the systems for each person, such as "release, npm owner, domain". Fetch the people with admin, maintain or write rights from the code host's API. Fetch the owners from each registry. Remove access the way Protect the accounts that can change the code describes.

Examples

JavaScript example

import { readFile } from 'node:fs/promises';

const headers = { Authorization: `Bearer ${process.env.GITHUB_TOKEN}` };
const people = await (await fetch('https://api.github.com/repos/example-shop/cart/collaborators?per_page=100', { headers })).json();
const holders = people.filter(person => ['admin', 'maintain', 'push'].some(right => person.permissions[right])).map(person => person.login);
const listed = [...(await readFile('MAINTAINERS.md', 'utf8')).matchAll(/@([\w-]+)/g)].map(([, login]) => login);
const missing = holders.filter(login => !listed.includes(login));
const stale = listed.filter(login => !holders.includes(login));
if (missing.length || stale.length) throw new Error(`Missing: ${missing}. Listed without rights: ${stale}`);

Python example

import json, os, re, urllib.request
from pathlib import Path

request = urllib.request.Request("https://api.github.com/repos/example-shop/cart/collaborators?per_page=100",
                                 headers={"Authorization": f"Bearer {os.environ['GITHUB_TOKEN']}"})
people = json.load(urllib.request.urlopen(request))
holders = {p["login"] for p in people if any(p["permissions"][right] for right in ("admin", "maintain", "push"))}
listed = set(re.findall(r"@([\w-]+)", Path("MAINTAINERS.md").read_text()))
assert holders == listed, f"missing: {holders - listed}, listed without rights: {listed - holders}"

How to check

The weekly job lists the accounts with admin, maintain or write rights and the registry owners. It fails when any account is missing from MAINTAINERS.md, or the file names someone who holds no rights.

Sources

• OpenSSF OSPS Baseline (OSPS-GV-01.01)
• GitHub Docs on roles in an organization

Related rules

• OSS-13 Write down how decisions are made in Open source maintenance
• ENG-20 Protect the accounts that can change the code in Engineering