maint: Report team members with a blocked GitLab account

Jeston Singhrequested to merge
sjestonsingh/www-gitlab-com:35556-flag-blocked-team-member-accounts into master

What does this MR do and why?

Adds a scheduled check that reports team members whose GitLab account is blocked or no longer exists, so a departed person's record does not keep them in the reviewer suggestion pool.

Background: #35556. The reviewer roulette and the contributor platform's suggestions are built from the team member data here. When someone leaves, their account is blocked, but their data/team_members/person record can linger until it is removed, so the platform keeps offering a reviewer who can never respond.

How

  • lib/team/account_status.rb — Gitlab::Homepage::Team::AccountStatus: looks up a username against the GitLab users API (net/http, no new gem). An empty result, or a state other than active, means the account is blocked or removed. It sends TEAM_ACCOUNT_CHECK_TOKEN or GITLAB_API_TOKEN when one is set, to avoid rate limits.
  • lib/tasks/team_accounts.rake — verify_team_gitlab_accounts: checks every non-acting person with a gitlab username and fails with the list (username and source_file_path) when any account is stale.
  • .gitlab-ci.yml — a verify-team-accounts job that runs only on schedules ($CI_PIPELINE_SOURCE == "schedule"), so the per-merge-request pipeline never makes these network calls.
  • spec/team/account_status_spec.rb.

Design notes, open for steer

  • Report-only and schedule-only. It surfaces stale accounts for offboarding; it does not edit or delete any data/team_members/person file. A scheduled pipeline is where this belongs, since it depends on live account state rather than on the diff.
  • A pipeline schedule and a token (TEAM_ACCOUNT_CHECK_TOKEN) still need to be set up for the job to run. Happy to follow the maintainers' preference on cadence and token.
  • Not validated locally. This environment has no Ruby toolchain or Docker for the repository's suite, so I could not run bundle exec rspec, rubocop or rake. The Ruby and YAML are syntax-checked (ruby -c, YAML parse) and the active? logic was exercised with a stubbed lookup, but please treat the suite as unproven until CI runs.

Related to #35556.

Draft until the approach is agreed.

Merge request reports