fix: updated changelog, added example for team_permissions, added patch

Author: WolfgangFischerEtas

CHANGELOG.md

@@ -4,6 +4,7 @@
 
 ### Added
 
+ - Add team_permissions support to repository ([#623](https://github.com/eclipse-csi/otterdog/pull/612))
  - Add tests for workflow validation settings ([#633](https://github.com/eclipse-csi/otterdog/pull/633))
  - Add support for `OTTERDOG_CONFIG_ROOT` environment variable ([#632](https://github.com/eclipse-csi/otterdog/pull/632))
 

examples/template/otterdog-defaults.libsonnet

@@ -109,7 +109,10 @@ local newRepo(name) = {
   branch_protection_rules: [],
 
   # rulesets
-  rulesets: []
+  rulesets: [],
+
+  # team permissions
+  team_permissions: {},
 };
 
 # Function to extend an existing repo with the same name.

otterdog/models/github_organization.py

@@ -46,7 +46,7 @@
 from otterdog.models.repo_workflow_settings import RepositoryWorkflowSettings
 from otterdog.models.repository import Repository
 from otterdog.models.team import Team
-from otterdog.utils import IndentingPrinter, associate_by_key, debug_times, jsonnet_evaluate_file
+from otterdog.utils import IndentingPrinter, associate_by_key, debug_times, is_set_and_present, jsonnet_evaluate_file
 
 if TYPE_CHECKING:
     from collections.abc import AsyncIterator, Callable, Iterator
@@ -672,7 +672,7 @@ async def _process_single_repo(
     repo_name: str,
     jsonnet_config: JsonnetConfig,
     teams: dict[str, Any],
-    repo_permissions: dict[str, list[dict[str, Any]]],
+    repo_permissions: dict[str, list[dict[str, Any]]] | None,
     app_installations: dict[str, str],
 ) -> tuple[str, Repository]:
     rest_api = gh_client.rest_api
@@ -683,8 +683,11 @@ async def _process_single_repo(
 
     github_repo_workflow_data = await rest_api.repo.get_workflow_settings(github_id, repo_name)
     repo.workflows = RepositoryWorkflowSettings.from_provider_data(github_id, github_repo_workflow_data)
-    repo_permission = repo_permissions.get(repo_name, [])
-    repo.set_team_permissions({entry["name"]: entry["permission"] for entry in repo_permission})
+    if repo_permissions is not None:
+        repo_permission = repo_permissions.get(repo_name, [])
+        repo.set_team_permissions({entry["name"]: entry["permission"] for entry in repo_permission})
+    else:
+        repo.unset_team_permissions()
 
     if jsonnet_config.default_branch_protection_rule_config is not None:
         # get branch protection rules of the repo
@@ -803,7 +806,12 @@ async def _load_repos_from_provider(
         repo_names = fnmatch.filter(repo_names, repo_filter)
 
     teams = {str(team["id"]): f"{github_id}/{team['slug']}" for team in await provider.get_org_teams(github_id)}
-    repo_permissions = build_repo_permissions(await provider.get_team_permissions(github_id))
+
+    default_org_repo = Repository.from_model_data(jsonnet_config.default_repo_config)
+    if is_set_and_present(default_org_repo.team_permissions):
+        repo_permissions = build_repo_permissions(await provider.get_team_permissions(github_id))
+    else:
+        repo_permissions = None
 
     # limit the number of repos that are processed concurrently to avoid hitting secondary rate limits
     sem = asyncio.Semaphore(50 if concurrency is None else concurrency)

otterdog/models/repository.py

@@ -28,6 +28,7 @@
     UNSET,
     Change,
     IndentingPrinter,
+    _Unset,
     associate_by_key,
     is_set_and_present,
     is_set_and_valid,
@@ -107,7 +108,7 @@ class Repository(ModelObject):
     fork_default_branch_only: bool = dataclasses.field(metadata={"model_only": True})
 
     workflows: RepositoryWorkflowSettings = dataclasses.field(metadata={"embedded_model": True})
-    team_permissions: dict[str, str] | None
+    team_permissions: dict[str, str] | None | _Unset
 
     # model only fields
     aliases: list[str] = dataclasses.field(metadata={"model_only": True}, default_factory=list)
@@ -264,6 +265,9 @@ def set_team_permissions(self, permissions: dict[str, str]) -> None:
             team: self._valid_team_permissions.get(perm, perm) for team, perm in permissions.items()
         }
 
+    def unset_team_permissions(self) -> None:
+        self.team_permissions = UNSET
+
     def coerce_from_org_settings(self, org_settings: OrganizationSettings, for_patch: bool = False) -> Repository:
         copy = dataclasses.replace(self)
 
@@ -473,7 +477,7 @@ def validate(self, context: ValidationContext, parent_object: Any) -> None:
                         f"{self.get_model_header()} defines an unknown custom property with key '{k}'.",
                     )
 
-        if is_set_and_present(self.team_permissions):
+        if is_set_and_present(self.team_permissions) and isinstance(self.team_permissions, dict):
             for k, v in self.team_permissions.items():
                 if v not in self._valid_team_permissions:
                     context.add_failure(