Add hero provisioning and Google Sheets sync support#33
Merged
Conversation
Extend the team-provisioner Lambda with sync_groups_and_heros action: - Auto-create Google Workspace accounts for new heroes - Manage email aliases for heroes - Sync Google Workspace groups with resolved member lists from heros.yaml - Add admin.directory.user and user.alias scopes for account/alias management New scripts: - provision-groups.py: resolves memberships from groups.yaml + heros.yaml, invokes Lambda with resolved member lists per group - sync-heros.py: reads Google Sheets API, normalizes names, derives emails, maps group affiliations, merges with existing heros.yaml
Terraform PlanChanges detected — review required. Plan output |
LLM Plan ReviewRisk: 🟢 LOW Routine Lambda function update for team_provisioner with code changes, no infrastructure modifications or security concerns.
|
Alexanderamiri
added a commit
that referenced
this pull request
May 9, 2026
## Summary - Extend team-provisioner Lambda with `sync_groups_and_heros` action - Auto-create Google Workspace accounts for new heroes (invite sent to personal email) - Manage email aliases for heroes in Google Workspace - Sync Google Workspace groups with resolved member lists from heros.yaml - Add `admin.directory.user` and `admin.directory.user.alias` scopes - New `provision-groups.py` script: resolves memberships from groups.yaml + heros.yaml, invokes Lambda - New `sync-heros.py` script: reads Google Sheets API, normalizes Norwegian names, derives @java.no emails, maps group affiliations ## Related - javaBin/registry PR for directory restructure + workflows (depends on this PR) ## Manual steps after merge 1. Update GCP Admin Console domain-wide delegation scopes for the service account: - `admin.directory.user` (account creation) - `admin.directory.user.alias` (alias management) - `spreadsheets.readonly` (Sheets sync) ## Test plan - [ ] Lambda handler syntax validates (Python AST check passes) - [ ] Platform CI plan + review + apply succeeds (Lambda zip updated) - [ ] Test `sync_groups_and_heros` action via direct Lambda invocation - [ ] Test `sync-heros.py` with a test spreadsheet
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
sync_groups_and_herosactionadmin.directory.userandadmin.directory.user.aliasscopesprovision-groups.pyscript: resolves memberships from groups.yaml + heros.yaml, invokes Lambdasync-heros.pyscript: reads Google Sheets API, normalizes Norwegian names, derives @java.no emails, maps group affiliationsRelated
Manual steps after merge
admin.directory.user(account creation)admin.directory.user.alias(alias management)spreadsheets.readonly(Sheets sync)Test plan
sync_groups_and_herosaction via direct Lambda invocationsync-heros.pywith a test spreadsheet