Teams and repository access

Workspace administrators can create teams from Teams, add people who have signed in to Finluth, and grant each team read, write, or admin access per repository through Access & rulesets. Direct collaborator and team access combine using the highest granted role.

Team mentions use @team-slug in issues, pull request descriptions, and comments; notifications go to team members who can access that repository. CODEOWNERS entries using @workspace/team-slug (or @team-slug) request reviews from that team's repository writers. Team creation, membership, deletion, and repository grants are recorded in the audit log.

Sign-in and administrators

Any verified Google account can sign in unless GOOGLE_ALLOWED_DOMAINS is set. Set GOOGLE_ADMIN_EMAILS to a comma-separated list of verified Google account emails before enabling repository access control; these workspace administrators can access and manage every repository.

Repository creators are admins for their repositories. Private repositories require explicit read, write, or admin access; signed-in users can read public repositories. Repository admins can grant access to an email address, including before that user has signed in.

Roles

Role	Can
Read	Browse code, review, open issues and comments
Write	Git pushes, pull request create or merge, manage labels and assignees
Admin	Members, branch and tag rules, repository settings

Git access tokens inherit the permissions of their Google account.

Data directory

Repository files and pull request metadata are stored under .finluth/; back up that directory. .env contains OAuth credentials and is excluded from Git.