Don't automatically add external contributors to the org to assign them

[emilyalbini]

I'd prefer if we assign the bot itself and post a comment saying that user is assigned.

[Mark-Simulacrum]

@pietroalbini We recently discussed on Zulip -- do you feel fine with the read-only addition to the organization? I think your concern was centered around granting write access which we'd no longer be doing.

cc @rust-lang/release since we discussed this at the last meeting as well

[cuviper]

Note that any org membership lets you see private people, where you can otherwise only see those that have chosen to make that status public. It also lets you see the teams, which are completely hidden from outsiders.

[Mark-Simulacrum]

My thought was to add them to the specific repository as "outside collaborators" which I think might not grant any further rights? Obviously that'll look somewhat ugly in the UI, but maybe not too bad.

[emilyalbini]

I'd still prefer to assign the bot instead of external contributors to avoid the UI issue of showing them as members of the repo, since that gives them some sort of official look when they reply (and that could cause issues if they write something controversial).

Since there should be no security concerns anymore I'm less "opinionated" (spent like 5 minutes looking for the right word lol) about this issue though.

[Mark-Simulacrum]

That's a good point. It's also lighter on the implementation burden -- no need to send invites and wait for them to be accepted. Do we want to edit the top-level comment still? I'm personally somewhat hesitant to do so (especially as we essentially must be able to edit our own edits as the assignee changes).

[emilyalbini]

Editing shouldn't be a problem, you can just write the message like:

<!--triagebot:assignee-->Assigned to @pietroalbini<!--triagebot:end-->

And then replace it with a regex.

[Mark-Simulacrum]

This is described and implemented as of the latest master.