This action can be used to create Azure AD groups and GitHub teams for all teams at NAV. The action is used by navikt/teams.
When the action is triggered it will open the teams YAML file pointed to by the TEAMS_YAML_PATH
environment variable, loop over all teams, and for each team it will do the following:
- If the team already exists as a group in Azure AD, skip to the next team
- If the team already exists as a team on GitHub, skip to the next one
- Create a mail and security enabled group in Azure AD for the team
- Create a GitHub team for the team
The action requires the following environment variables to be set (using for instance env
in a GitHub workflow):
The Azure AD application ID (client ID) of the application used to access the Microsoft Graph API. The application must have the following API permissions:
Application.ReadWrite.All
Group.ReadWrite.All
The Azure AD application secret of the application used to access the Microsoft Graph API.
Each group that is created by this action will be added to this enterprise application. This is the object ID of the application. This application is used to easily identify teams managed by this solution.
When adding groups to the enterprise application they will receive this role.
The personal access token used to access the GitHub API. The token must have the following scopes:
admin:org
The token must also be enabled for SSO.
The reason for using a personal access token instead of the auto-generated GITHUB_TOKEN
is because the Team synchronization API does not support GitHub App authentication yet. Once this is supported the GITHUB_PAT
secret can be superseded by the auto generated GITHUB_TOKEN
.
Path to where the teams YAML file is located. Documentation regarding this file is available in the navikt/teams repository.
Hex-encoded secret used to create Nais deployment key for the teams.
GitHub username of the user who committed the change. This user will be added as an owner to the created Azure AD group.
Comma separated list of Azure AD group object IDs to add the user object that is connected to COMMITTER
to.
There is a workflow that runs when a tag starting with v
is pushed, which publishes a docker image to dockerhub.