Skip repository team changes for security-manager teams

lib/plugins/teams.js

@@ -40,7 +40,8 @@ module.exports = class Teams extends Diffable {
         { org: this.repo.owner })
 
       this.log.debug(`Response from the call is ${JSON.stringify(resp)}`)
-      return teams.filter(team => !resp.some(sec => sec.name === team.name))
+      this.securityManagerTeams = resp
+      return teams.filter(team => !this.isSecurityManagerTeam(team))
     } catch (e) {
       if (e.status === 404) {
         this.log.debug(`${this.repo.owner} Org does not have Security manager teams set up ${e}`)
@@ -61,7 +62,19 @@ module.exports = class Teams extends Diffable {
     return existing.permission !== attrs.permission
   }
 
+  isSecurityManagerTeam (team) {
+    const name = team && (team.name || team.slug || team.team_slug)
+
+    return Boolean(name) && (this.securityManagerTeams || []).some(sec => {
+      return [sec.name, sec.slug, sec.team_slug].some(secName => secName && secName.toLowerCase() === name.toLowerCase())
+    })
+  }
+
   update (existing, attrs) {
+    if (this.isSecurityManagerTeam(existing) || this.isSecurityManagerTeam(attrs)) {
+      return Promise.resolve()
+    }
+
     if (this.nop) {
       return Promise.resolve([
         new NopCommand(this.constructor.name, this.repo, this.github.request.endpoint(`PUT ${teamRepoEndpoint}`, this.toParams(existing, attrs)), 'Add Teams to Repo')
@@ -71,6 +84,10 @@ module.exports = class Teams extends Diffable {
   }
 
   add (attrs) {
+    if (this.isSecurityManagerTeam(attrs)) {
+      return Promise.resolve()
+    }
+
     let existing = { team_id: 1 }
     this.log.debug(`Getting team with the parms ${JSON.stringify(attrs)}`)
     return this.github.rest.teams.getByName({ org: this.repo.owner, team_slug: attrs.name }).then(res => {
@@ -114,6 +131,10 @@ module.exports = class Teams extends Diffable {
   }
 
   remove (existing) {
+    if (this.isSecurityManagerTeam(existing)) {
+      return Promise.resolve()
+    }
+
     if (this.nop) {
       return Promise.resolve([
         new NopCommand(this.constructor.name, this.repo, this.github.request.endpoint(

test/unit/lib/plugins/teams.test.js

@@ -10,6 +10,8 @@ describe('Teams', () => {
   const updatedTeamId = any.integer()
   const removedTeamName = 'removed'
   const removedTeamId = any.integer()
+  const securityManagerTeamName = 'security-manager'
+  const securityManagerTeamId = any.integer()
   const unchangedTeamName = 'unchanged'
   const unchangedTeamId = any.integer()
   const org = 'bkeepers'
@@ -91,6 +93,53 @@ describe('Teams', () => {
       expectTeamDeleted(removedTeamName)
     })
 
+    it('does not add configured security manager teams', async () => {
+      github.paginate.mockImplementation(async (fetch, params) => {
+        if (fetch === 'GET /orgs/{org}/security-managers') {
+          return [{ name: securityManagerTeamName }]
+        }
+
+        const response = await fetch(params)
+        return response.data
+      })
+      github.rest.repos.listTeams.mockResolvedValue({
+        data: [
+          {
+            id: securityManagerTeamId,
+            name: securityManagerTeamName,
+            slug: securityManagerTeamName,
+            permission: 'admin'
+          }
+        ]
+      })
+      const plugin = configure([
+        { name: securityManagerTeamName, permission: 'pull' }
+      ])
+
+      await plugin.sync()
+
+      expect(github.rest.teams.getByName).not.toHaveBeenCalled()
+      expect(github.rest.teams.addOrUpdateRepoPermissionsInOrg).not.toHaveBeenCalled()
+      expect(github.request).not.toHaveBeenCalled()
+    })
+
+    it('does not update or remove security manager teams', async () => {
+      const plugin = configure()
+      github.paginate.mockResolvedValue([{ name: securityManagerTeamName }])
+      const securityManagerTeam = {
+        id: securityManagerTeamId,
+        name: securityManagerTeamName,
+        slug: securityManagerTeamName,
+        permission: 'admin'
+      }
+
+      await plugin.checkSecurityManager([securityManagerTeam])
+      await plugin.update(securityManagerTeam, { name: securityManagerTeamName, permission: 'pull' })
+      await plugin.remove(securityManagerTeam)
+
+      expect(github.request).not.toHaveBeenCalled()
+    })
+
     function expectTeamDeleted (teamSlug) {
       expect(github.request).toHaveBeenCalledWith(
         'DELETE /orgs/:owner/teams/:team_slug/repos/:owner/:repo',