[adamrtalbot]

Stacked on #24. The base is feat/seqera-megatests-sync, so the diff only shows this change. Retarget to main once #24 merges.

Closes #25

Why

The auto-sync in #24 only handles new joiners and the megatests workspace. Admins also need to fix access by hand: when someone's Slack email differs from their Seqera email, and for groups other than megatests.

What

/nf-core seqera add @user <group> [--email foo@bar.com]
/nf-core seqera remove @user <group>
/nf-core seqera list [@user]

• Groups are defined in code. Each SeqeraGroup targets either a workspace with a role or an org team. seqera_groups() returns megatests plus anything in SEQERA_GROUPS (checks/seqera.py), so a new group goes through PR review and mypy. Only the token and org ID live in SSM.
• One shared module. checks/seqera.py has add_to_group, remove_from_group, remove_record and groups_for_user. add_to_megatests (the joiner auto-sync) is now a thin wrapper around add_to_group(..., "megatests"). The weekly removal job loops over every configured group and calls remove_record.
• --email overrides the Slack email. It accepts --email x, --email=x, and Slack's <mailto:…> form.
• Tracking. Each add is stored in DynamoDB with its group name. Workspace records keep Sync nf-core joiners to Seqera workspace #24's key (SEQERA#<workspace-id>). Team records use SEQERA#TEAM#<team-id>. remove only touches access the bot recorded. For anything else it says to remove the person in Seqera Platform, which matches how the removal job already behaves.
• GitHub username required for add. The removal job needs it to check org membership, so add refuses when the Slack profile has no GitHub username.
• Permissions and Slack behaviour. Restricted to @core-team in _route_seqera(), the same way on-call does it. The router calls ack() first, and every reply is ephemeral. Added to the help text, docs/commands.md, docs/deployment.md and CLAUDE.md.

Needs input from reviewers

• Megatests IDs stay in config. megatests still reads its workspace ID and role from SEQERA_WORKSPACE_ID / SEQERA_WORKSPACE_ROLE, as Sync nf-core joiners to Seqera workspace #24 set up. I don't have the real numeric IDs, so I haven't hard-coded them, and SEQERA_GROUPS ships empty, with a commented example and no maintainers team yet. Send me the IDs and I'll move megatests into code and add more groups.
• Team endpoints are untested against the live API. They follow the Seqera OpenAPI spec: POST /orgs/{org}/teams/{team}/members and DELETE …/members/{memberId}/delete. The spec only lists 400 and 403 errors for team adds, so the 409 "already a member" and 404 "no account" handling is copied from the workspace endpoint and may never trigger for teams. Worth one manual test once a team group exists.

Testing

• ruff check, ruff format --check and mypy src/ (strict) pass.
• pytest: 641 passed. The new tests/test_seqera_command.py covers team add/remove URLs and records, not-managed and unknown-group cases, --email parsing, handler replies, list in both forms, removal-sync coverage of team groups, and the router gate. tests/test_seqera.py is updated for remove_record.

---

Generated by Claude Code