Add a script for updating the triage group (#64)

We're using labels for proposals... https://github.com/carbon-language/carbon-lang/settings/access allows granting triage access for specific teams. https://github.com/organizations/carbon-language/settings/member_privileges doesn't appear to allow doing the same at the org-level. So I've decided to create a team that mirrors the org, and grants triage access. `¯\_(ツ)_/¯`

I don't know that this is the right solution long-term, but for now I think it's right.

Manually updating this group is slow and error-prone, so the script automates it.

docs/project/groups.md

@@ -22,6 +22,9 @@ We use a mix of:
 ## All contributors
 
 - [GitHub organization](https://github.com/orgs/carbon-language/people)
+  - [GitHub team: Contributors with label access](https://github.com/orgs/carbon-language/teams/contributors-with-label-access):
+    Mirrors the GitHub organization for write access.
+    [Manually updated](/src/scripts/update-label-access.js).
 - [Discourse Forums account](https://forums.carbon-lang.dev)
 - [Discord Chat access](https://discord.com/app)
 - [Google group](https://groups.google.com/g/carbon-lang-contributors): Grants

src/scripts/README.md

@@ -0,0 +1,11 @@
+# Scripts
+
+<!--
+Part of the Carbon Language project, under the Apache License v2.0 with LLVM
+Exceptions. See /LICENSE for license information.
+SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+-->
+
+Self-contained scripts used as part of maintaining Carbon infrastructure.
+
+See individual scripts for more details.

src/scripts/update-label-access.js

@@ -0,0 +1,84 @@
+/*
+Part of the Carbon Language project, under the Apache License v2.0 with LLVM
+Exceptions. See /LICENSE for license information.
+SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+*/
+
+/*
+Mirrors the carbon-language organization to the contributors-with-label-access
+team.
+
+Set GITHUB_AUTH_KEY in your environment to use this script. e.g.:
+  GITHUB_AUTH_KEY=abc123 node update-label-access.js
+
+This team exists because we need a team to manage triage access to repos;
+GitHub doesn't allow the org to be set to triage access, only read/write.
+
+This does not handle removing ex-members from contributors-with-label-access.
+*/
+
+'use strict';
+
+const updateTriageAccess = async () => {
+  // The org and team to mirror.
+  const org = 'carbon-language';
+  const team = 'contributors-with-label-access';
+  // Accounts in the org to skip mirroring.
+  const ignore = ['CarbonLangInfra', 'google-admin', 'googlebot'];
+
+  // Set up the GitHub API.
+  const { Octokit } = require('@octokit/rest');
+  const key = process.env.GITHUB_AUTH_KEY;
+  if (!key) {
+    console.log('Missing GITHUB_AUTH_KEY');
+    return;
+  }
+  const octokit = new Octokit({ auth: key });
+
+  // Load org members.
+  var orgMembers = {};
+  try {
+    const ret = await octokit.orgs.listMembers({ org: org });
+    for (var i = 0; i < ret.data.length; ++i) {
+      orgMembers[ret.data[i].id] = ret.data[i].login;
+    }
+  } catch (error) {
+    console.log(`org.listMembers failed: ${error}`);
+    return;
+  }
+
+  // Load team members.
+  var teamMembers = new Set();
+  try {
+    const ret = await octokit.teams.listMembersInOrg({
+      org: org,
+      team_slug: team,
+    });
+    for (var i = 0; i < ret.data.length; ++i) {
+      teamMembers[ret.data[i].id] = ret.data[i].login;
+    }
+  } catch (error) {
+    console.log(`teams.listMembersInOrg failed: ${error}`);
+    return;
+  }
+
+  // Copy members from the org to the team.
+  for (const member in orgMembers) {
+    if (
+      teamMembers.hasOwnProperty(member) ||
+      ignore.indexOf(orgMembers[member]) >= 0
+    ) {
+      continue;
+    }
+    console.log(`Adding ${orgMembers[member]}`);
+    octokit.teams.addOrUpdateMembershipForUserInOrg({
+      org: org,
+      team_slug: team,
+      username: orgMembers[member],
+    });
+  }
+
+  console.log('Done!');
+};
+
+updateTriageAccess();