TeamAccess

Source: src/GitHub/TeamAccess.ts

A GitHub team repository access grant.

TeamAccess grants a team access to a repository within an organization. Teams provide a scalable way to manage repository permissions — add users to teams instead of granting individual collaborator access.

Team access grants default to retain on removal — destroying the stack does NOT remove the team’s access, preventing accidental lockout. Opt in to actual removal by wrapping the resource in destroy() from alchemy/RemovalPolicy.

Authentication is resolved via the GitHubCredentials service supplied by GitHub.providers() (env, stored PAT, gh CLI, or OAuth). The token needs repo scope and admin:org for managing team access.

Granting Team Access

Grant Push Access to a Team

yield* GitHub.TeamAccess("platform-access", {
  owner: "my-org",
  repository: "my-repo",
  teamSlug: "platform",
  permission: "push",
})

Grant Admin Access to a Team

yield* GitHub.TeamAccess("admin-access", {
  owner: "my-org",
  repository: "my-repo",
  teamSlug: "admins",
  permission: "admin",
})

Grant Read-Only Access

yield* GitHub.TeamAccess("readonly", {
  owner: "my-org",
  repository: "my-repo",
  teamSlug: "contractors",
  permission: "pull",
})

Multiple Teams

yield* GitHub.TeamAccess("platform-write", {
  owner: "my-org",
  repository: "api",
  teamSlug: "platform",
  permission: "push",
})

yield* GitHub.TeamAccess("security-read", {
  owner: "my-org",
  repository: "api",
  teamSlug: "security",
  permission: "pull",
})

Removing Team Access

import { destroy } from "alchemy/RemovalPolicy"

yield* GitHub.TeamAccess("temp", {
  owner: "my-org",
  repository: "my-repo",
  teamSlug: "contractors",
  permission: "push",
}).pipe(destroy())