Default GitHub team members to member role, not maintainer

[Alexanderamiri]

Summary

• Team members now get role from their YAML entry (default: member)
• Only members with role: maintainer can manage the team on GitHub (add/remove repos and members)
• Previously all members were added as maintainers, which allowed anyone to add repos to their team (granting those repos CI access to the team's AWS role)

members:
  - google: alice.smith
    github: alicesmith
    role: maintainer    # can manage team
  - google: bob.jones
    github: bobjones     # defaults to "member"

Companion: javaBin/registry docs/member-role-field

Test plan

• Existing teams: next provisioner run will downgrade all members to member unless they have role: maintainer in YAML
• Verify maintainers can still add repos
• Verify members cannot add repos

[github-actions]

Terraform Plan

🚧 Changes detected — Plan: 0 to add, 1 to change, 0 to destroy.

Plan output

Acquiring state lock. This may take a few moments...

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.lambdas.aws_lambda_function.team_provisioner will be updated in-place
  ~ resource "aws_lambda_function" "team_provisioner" {
        id                             = "javabin-team-provisioner"
      ~ last_modified                  = "2026-03-17T19:20:07.000+0000" -> (known after apply)
      ~ source_code_hash               = "DOsqyX7kl+NoVN861D4rN0ieHND77GeWwpYD1A93gdQ=" -> "wX2pv1QxWt5RN/akAYhiGmQHMGivVw80weFw6a1vHPQ="
        tags                           = {}
        # (21 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

---

LLM Review

Risk: 🟢 LOW

Routine Lambda function code update for team_provisioner with source code hash change.

• ✅ [routine] Lambda function team_provisioner source code updated (hash change from DOsqyX7kl+NoVN861D4rN0ieHND77GeWwpYD1A93gdQ= to wX2pv1QxWt5RN/akAYhiGmQHMGivVw80weFw6a1vHPQ=). This is an in-place update with no infrastructure changes.
• ✅ [routine] Only metadata fields (last_modified, source_code_hash) are changing. No IAM permissions, environment variables, or function configuration modified.
• ✅ [routine] No resources being created or destroyed. Plan shows 0 additions, 1 modification, 0 deletions - minimal blast radius.
• ✅ [routine] All other infrastructure components (VPC, security groups, IAM roles, monitoring, databases) remain unchanged and stable.
• ✅ [routine] No cost implications - existing Lambda function is being redeployed with new code, no new billable resources provisioned.