what's up with GitHub permissions

[Bob Carpenter]

I can't invite Devin to join:

https://github.com/orgs/stan-dev/teams/all-stan-dev-repos

It says all seats are full and we need to buy more "seats"
at $9 per month per seat.

Any suggestions on what we should do?

- Bob

[Michael Betancourt]

Fuuuuuuuuuck. It looks like the recent changes to GitHub’s
pricing schemes went further that we all though, and now it’s
more like Bitbucket where you get unlimited private repositories
but organizations have to pay per user to get tight control of
permissions. I’m not sure how many free users the academic
account buys us (just 5 users maybe? but our current devs
are grandfathered in?), but it looks like we’ll have to manage
them one at a time from here on in.

> --
> You received this message because you are subscribed to the Google Groups "stan development mailing list" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to stan-dev+u...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

[Daniel Lee]

For stan-dev, we can get rid of all the private repos and then drop the teams. They changed all their permissioning and I'm not sure what's a good way to manage groups anymore.


Daniel

[Michael Betancourt]

But is there anyway to limit merges to specific individuals?

[Daniel Lee]

Could you check the collaborator settings on the individual repo? I can't get to it right now.


Daniel

[Bob Carpenter]

Didn't we already get rid of all the private repos? If not,
we should just move them to the gelman org and be done with them.

What does dropping teams do for us?

- Bob

[Jonah Gabry]

I doubt getting rid of teams will have any effect by itself. But anyone on a team probably counts as someone we'd need to pay for I guess. Looks like for all of the stan-dev repos (or at least the 4 or 5 that I've checked but I assume for all) if you go to 'Settings' and then 'Collaborators & teams' then in the box where you can add collaborators it says "0 seats left — Buy more". So that's a bummer.

[Jonah Gabry]

If we don't have private repos then I think we can maybe add people as "outside collaborators" and they won't count towards the paid seats. From https://help.github.com/articles/about-per-user-pricing/:

"Outside collaborators and bot accounts will count toward your organization's total of paid seats if they are given access to a private repository."

[Michael Betancourt]

There are teams for each repo and then individual collaborators
that can be added on top of that. Collaborates definitely count
towards this new collaborator limit, and from the error message
Bob saw it sounds like teams do, as well. But I can’t find a page
that documents all of this clearly.

I _think_ what we want to due is drop teams altogether and
just stick with “Owners” and “Members”. See

https://github.com/orgs/stan-dev/migration

and

https://github.com/orgs/stan-dev/migration/customize_member_privileges (admins only)

[Allen B. Riddell]

I don't think private repos matter anymore. Any paid plan gets unlimited
private repos: https://github.com/pricing

[Michael Betancourt]

Right, but you need teams to manage detailed permissions
across private repositories, and the pricing structure has moved
over to those teams. I think if we drop all of the private repos
then we won’t need teams (we can control permissions with
owners, members, and then everyone else) entirely.