Create GitHub teams in the background of Org requests #338
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,169 @@ | ||
| import { AvailableSQSFunctions } from "common/types/sqsMessage.js"; | ||
| import { currentEnvironmentConfig, SQSHandlerFunction } from "../index.js"; | ||
| import { | ||
| DynamoDBClient, | ||
| GetItemCommand, | ||
| TransactWriteItemsCommand, | ||
| } from "@aws-sdk/client-dynamodb"; | ||
| import { genericConfig, SecretConfig } from "common/config.js"; | ||
| import { getSecretConfig } from "../utils.js"; | ||
| import RedisModule from "ioredis"; | ||
| import { createLock, IoredisAdapter } from "redlock-universal"; | ||
| import { marshall, unmarshall } from "@aws-sdk/util-dynamodb"; | ||
| import { InternalServerError } from "common/errors/index.js"; | ||
| import { | ||
| assignIdpGroupsToTeam, | ||
| createGithubTeam, | ||
| } from "api/functions/github.js"; | ||
| import { buildAuditLogTransactPut } from "api/functions/auditLog.js"; | ||
| import { Modules } from "common/modules.js"; | ||
| import { retryDynamoTransactionWithBackoff } from "api/utils.js"; | ||
| import { SKIP_EXTERNAL_ORG_LEAD_UPDATE } from "common/overrides.js"; | ||
| import { getOrgByName } from "@acm-uiuc/js-shared"; | ||
|
|
||
| export const createOrgGithubTeamHandler: SQSHandlerFunction< | ||
| AvailableSQSFunctions.CreateOrgGithubTeam | ||
| > = async (payload, metadata, logger) => { | ||
| const secretConfig: SecretConfig = await getSecretConfig({ | ||
| logger, | ||
| commonConfig: { region: genericConfig.AwsRegion }, | ||
| }); | ||
| const redisClient = new RedisModule.default(secretConfig.redis_url); | ||
| try { | ||
| const { orgName, githubTeamName, githubTeamDescription } = payload; | ||
| const orgImmutableId = getOrgByName(orgName)!.id; | ||
| if (SKIP_EXTERNAL_ORG_LEAD_UPDATE.includes(orgImmutableId)) { | ||
| logger.info( | ||
| `Organization ${orgName} has external updates disabled, exiting.`, | ||
| ); | ||
| return; | ||
| } | ||
| const dynamo = new DynamoDBClient({ | ||
| region: genericConfig.AwsRegion, | ||
| }); | ||
| const lock = createLock({ | ||
| adapter: new IoredisAdapter(redisClient), | ||
| key: `createOrgGithubTeamHandler:${orgImmutableId}`, | ||
| retryAttempts: 5, | ||
| retryDelay: 300, | ||
| }); | ||
| return await lock.using(async (signal) => { | ||
| const getMetadataCommand = new GetItemCommand({ | ||
| TableName: genericConfig.SigInfoTableName, | ||
| Key: marshall({ | ||
| primaryKey: `DEFINE#${orgName}`, | ||
| entryId: "0", | ||
| }), | ||
| ProjectionExpression: "#entra,#gh", | ||
| ExpressionAttributeNames: { | ||
| "#entra": "leadsEntraGroupId", | ||
| "#gh": "leadsGithubTeamId", | ||
| }, | ||
| ConsistentRead: true, | ||
| }); | ||
| const existingData = await dynamo.send(getMetadataCommand); | ||
| if (!existingData || !existingData.Item) { | ||
| throw new InternalServerError({ | ||
| message: `Could not find org entry for ${orgName}`, | ||
| }); | ||
| } | ||
| const currentOrgInfo = unmarshall(existingData.Item) as { | ||
| leadsEntraGroupId?: string; | ||
| leadsGithubTeamId?: string; | ||
| }; | ||
| if (!currentOrgInfo.leadsEntraGroupId) { | ||
| logger.info(`${orgName} does not have an Entra group, skipping!`); | ||
| return; | ||
| } | ||
| if (currentOrgInfo.leadsGithubTeamId) { | ||
| logger.info("This org already has a GitHub team, skipping"); | ||
| return; | ||
| } | ||
| if (signal.aborted) { | ||
| throw new InternalServerError({ | ||
| message: | ||
| "Checked on lock before creating GitHub team, we've lost the lock!", | ||
| }); | ||
| } | ||
| logger.info(`Creating GitHub team for ${orgName}!`); | ||
| const suffix = currentEnvironmentConfig.GroupEmailSuffix; | ||
| const finalName = `${githubTeamName}${suffix === "" ? "" : `-${suffix}`}`; | ||
| const { updated, id: teamId } = await createGithubTeam({ | ||
| orgId: currentEnvironmentConfig.GithubOrgName, | ||
| githubToken: secretConfig.github_pat, | ||
| parentTeamId: currentEnvironmentConfig.ExecGithubTeam, | ||
| name: finalName, | ||
| description: githubTeamDescription, | ||
| logger, | ||
| }); | ||
| if (!updated) { | ||
| logger.info( | ||
| `Github team "${finalName}" already existed. We're assuming team sync was already set up (if not, please configure manually).`, | ||
| ); | ||
| } else { | ||
| logger.info( | ||
| `Github team "${finalName}" created with team ID "${teamId}".`, | ||
| ); | ||
| if (currentEnvironmentConfig.GithubIdpSyncEnabled) { | ||
| logger.info( | ||
| `Setting up IDP sync for Github team from Entra ID group ${currentOrgInfo.leadsEntraGroupId}`, | ||
| ); | ||
| await assignIdpGroupsToTeam({ | ||
| githubToken: secretConfig.github_pat, | ||
| teamId, | ||
| logger, | ||
| groupsToSync: [currentOrgInfo.leadsEntraGroupId], | ||
| orgId: currentEnvironmentConfig.GithubOrgId, | ||
| orgName: currentEnvironmentConfig.GithubOrgName, | ||
| }); | ||
| } | ||
| } | ||
| logger.info("Adding updates to audit log"); | ||
| const logStatement = updated | ||
| ? buildAuditLogTransactPut({ | ||
| entry: { | ||
| module: Modules.ORG_INFO, | ||
| message: `Created GitHub team "${finalName}" for organization leads.`, | ||
| actor: metadata.initiator, | ||
| target: orgName, | ||
| }, | ||
| }) | ||
| : undefined; | ||
| const storeGithubIdOperation = async () => { | ||
| const commandTransaction = new TransactWriteItemsCommand({ | ||
| TransactItems: [ | ||
| ...(logStatement ? [logStatement] : []), | ||
| { | ||
| Update: { | ||
| TableName: genericConfig.SigInfoTableName, | ||
| Key: marshall({ | ||
| primaryKey: `DEFINE#${orgName}`, | ||
| entryId: "0", | ||
| }), | ||
| UpdateExpression: | ||
| "SET leadsGithubTeamId = :githubTeamId, updatedAt = :updatedAt", | ||
| ExpressionAttributeValues: marshall({ | ||
| ":githubTeamId": teamId, | ||
| ":updatedAt": new Date().toISOString(), | ||
| }), | ||
| }, | ||
| }, | ||
| ], | ||
| }); | ||
| return await dynamo.send(commandTransaction); | ||
| }; | ||
|
|
||
| await retryDynamoTransactionWithBackoff( | ||
| storeGithubIdOperation, | ||
| logger, | ||
| `Store GitHub team ID for ${orgName}`, | ||
| ); | ||
| }); | ||
| } finally { | ||
| try { | ||
| await redisClient.quit(); | ||
| } catch { | ||
| redisClient.disconnect(); | ||
| } | ||
| } | ||
| }; | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -22,6 +22,7 @@ import { | |
| import { ValidationError } from "../../common/errors/index.js"; | ||
| import { RunEnvironment } from "../../common/roles.js"; | ||
| import { environmentConfig } from "../../common/config.js"; | ||
| import { createOrgGithubTeamHandler } from "./handlers/createOrgGithubTeam.js"; | ||
|
There was a problem hiding this comment. Fix ESLint import/extensions and consolidate handler import ESLint flags the explicit “.js” on the direct handler import. To avoid the rule while keeping NodeNext-friendly imports, pull the symbol from the existing handlers barrel import and drop the extra line. -import { createOrgGithubTeamHandler } from "./handlers/createOrgGithubTeam.js";
// ...
-import {
+import {
emailMembershipPassHandler,
pingHandler,
provisionNewMemberHandler,
sendSaleEmailHandler,
- emailNotificationsHandler,
+ emailNotificationsHandler,
+ createOrgGithubTeamHandler,
} from "./handlers/index.js";
// ...
[AvailableSQSFunctions.EmailNotifications]: emailNotificationsHandler,
[AvailableSQSFunctions.CreateOrgGithubTeam]: createOrgGithubTeamHandler,Additionally, consider awaiting the handler so the “Finished” log prints after completion: - const result = func(
+ const result = await func(
parsedBody.payload,
parsedBody.metadata,
childLogger,
);Also applies to: 43-44 🧰 Tools🪛 ESLint[error] 25-25: Unexpected use of file extension "js" for "./handlers/createOrgGithubTeam.js" (import/extensions) 🤖 Prompt for AI Agents |
||
|
|
||
| export type SQSFunctionPayloadTypes = { | ||
| [K in keyof typeof sqsPayloadSchemas]: SQSHandlerFunction<K>; | ||
|
|
@@ -39,6 +40,7 @@ const handlers: SQSFunctionPayloadTypes = { | |
| [AvailableSQSFunctions.ProvisionNewMember]: provisionNewMemberHandler, | ||
| [AvailableSQSFunctions.SendSaleEmail]: sendSaleEmailHandler, | ||
| [AvailableSQSFunctions.EmailNotifications]: emailNotificationsHandler, | ||
| [AvailableSQSFunctions.CreateOrgGithubTeam]: createOrgGithubTeamHandler, | ||
| }; | ||
| export const runEnvironment = process.env.RunEnvironment as RunEnvironment; | ||
| export const currentEnvironmentConfig = environmentConfig[runEnvironment]; | ||
|
|
||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Avoid non-null assertion on getOrgByName; harden against malformed payloads.
A bad SQS payload would crash the worker. Guard and emit a clear error.
🤖 Prompt for AI Agents