fix(ci): create team CI roles only for registry teams

CLAUDE.md

@@ -181,6 +181,7 @@ terraform/state/
 | `scripts/generate-modules.py` | CI: validates app.yaml, generates fmt-clean module blocks into terraform/ (tests: `scripts/tests/`) |
 | `scripts/registry.py` | Module sources + boilerplate templates for generate-modules.py |
 | `scripts/resolve-tool-version.sh` | CI: resolve node/java version from the app repo's version files |
+| `scripts/sync-registered-teams.py` | CI: registry `teams/*.yaml` → `registered-teams.auto.tfvars` (needs App token) |
 | `scripts/sync-registered-teams.py` | CI: GitHub org teams → `registered-teams.auto.tfvars` (needs App token) |
 | `scripts/github-oidc-token.sh` | CI: mint a GitHub OIDC token for the broker / apply gate |
 | `scripts/provision-teams.py` | CI: fetch team YAMLs from registry, invoke team-provisioner Lambda |

scripts/sync-registered-teams.py

@@ -1,19 +1,22 @@
 #!/usr/bin/env python3
-"""Sync registered teams from GitHub org teams.
+"""Sync registered teams from the registry.
 
-Queries the GitHub API for all teams in the javaBin org and writes
-registered-teams.auto.tfvars. This drives team-scoped IAM role creation.
+Lists teams/*.yaml in javaBin/registry and writes
+registered-teams.auto.tfvars. This drives team-scoped IAM role creation
+(CI roles, ECS execution roles).
 
-Source of truth: GitHub teams (created by team-provisioner from registry).
+Source of truth: the registry. GitHub org teams also include non-app teams
+(owners, developer, ...) that must not get AWS CI roles.
 
 Usage: sync-registered-teams.py <tfvars-output-path>
 
-Requires: GITHUB_TOKEN env var (with org team read access).
+Requires: GITHUB_TOKEN env var (read access to javaBin/registry).
 """
 
 import json
 import logging
 import os
+import re
 import sys
 import urllib.request
 
@@ -45,10 +48,15 @@ def github_get(path, token):
     return results
 
 
+REGISTRY_REPO = os.environ.get("REGISTRY_REPO", "registry")
+TEAM_NAME = re.compile(r"^[a-z]{1,12}$")
+
+
 def get_teams(token):
-    """Get all org teams, excluding platform-internal ones."""
-    teams = github_get(f"/orgs/{GITHUB_ORG}/teams", token)
-    slugs = sorted(t["slug"] for t in teams if t["slug"] not in EXCLUDED_TEAMS)
+    """Registry team names (teams/<name>.yaml), excluding platform-internal ones."""
+    files = github_get(f"/repos/{GITHUB_ORG}/{REGISTRY_REPO}/contents/teams", token)
+    names = [f["name"][:-5] for f in files if f["type"] == "file" and f["name"].endswith(".yaml")]
+    slugs = sorted(n for n in names if TEAM_NAME.match(n) and n not in EXCLUDED_TEAMS)
     logger.info("Found %d teams (excluding %s)", len(slugs), ", ".join(EXCLUDED_TEAMS))
     for slug in slugs:
         logger.info("  %s", slug)
@@ -59,7 +67,7 @@ def write_tfvars(teams, output_path):
     """Write the registered-teams.auto.tfvars file."""
     lines = [
         "# GENERATED by sync-registered-teams.py — do not edit manually",
-        "# Source of truth: GitHub teams in javaBin org",
+        "# Source of truth: teams/*.yaml in javaBin/registry",
         "",
         "registered_teams = [",
     ]

terraform/platform/registered-teams.auto.tfvars

@@ -1,6 +1,8 @@
 # GENERATED by sync-registered-teams.py — do not edit manually
-# Source of truth: GitHub teams in javaBin org
+# Source of truth: teams/*.yaml in javaBin/registry
 
 registered_teams = [
+  "cupcake",
+  "jzwatch",
   "testteam",
 ]