feat: add stackit org user roles

[henryde]

No description provided.

[github-actions]

Scorecard Check

Scorecard run on commit bfdf95887ed412f547a80da9aec1ba3f26f5173f relative to origin/main

modules/stackit/meshstack_integration.tf

Module directory not found (deleted?).

📊 meshstack-hub Module Scorecard

Generated: 2026-07-09 | Modules scanned: 1 | Categories: 5

📋 Per-Module Category Summary

Score per category per building block. n/a = category does not apply to this module.

Module	Overall	Core Structure	Integration	Azure Backplane	STACKIT Backplane	Testing
stackit/project	🟡 79%	🟢 86%	n/a	n/a	🟢 100%	🔴 33%

⚠️ 1 module has failing checks — failing categories are expanded below.

Core Structure — some checks failing

Basic module file structure and documentation — applies to 1 modules

Module	Score	📦	🔗	📋	📝	🖼️	📌	🔒
stackit/project	🟢 86%	✅	❌	✅	✅	✅	✅	✅

Core Structure — Summary

Emoji	Criterion	Coverage	Status
📦	buildingblock/ directory exists	1/1	🟢 100%
🔗	meshstack_integration.tf present	0/1	🔴 0%
📋	buildingblock/APP_TEAM_README.md present (no-integration fallback)	1/1	🟢 100%
📝	buildingblock/README.md with YAML front-matter	1/1	🟢 100%
🖼️	buildingblock/logo.png included	1/1	🟢 100%
📌	buildingblock/versions.tf present	1/1	🟢 100%
🔒	Provider versions use minimum constraint (>=)	1/1	🟢 100%

Integration — not applicable

meshstack_integration.tf conventions — applies to 0 modules

No applicable modules.

Azure Backplane — not applicable

Azure UAMI-based automation principal conventions — applies to 0 modules

No applicable modules.

STACKIT Backplane — ✅ all passing

STACKIT WIF-based automation principal conventions — applies to 1 modules

Module	Score	🔐	🚫	📤	⚡
stackit/project	🟢 100%	✅	✅	✅	✅

STACKIT Backplane — Summary

Emoji	Criterion	Coverage	Status
🔐	Uses stackit_service_account_federated_identity_provider	1/1	🟢 100%
🚫	No stackit_service_account_key resource	1/1	🟢 100%
📤	Outputs service_account_email (not key)	1/1	🟢 100%
⚡	Buildingblock provider uses use_oidc = true	1/1	🟢 100%

Testing — some checks failing

End-to-end test coverage — applies to 1 modules

Module	Score	⚙️	🧪	✅
stackit/project	🔴 33%	✅	❌	❌

Testing — Summary

Emoji	Criterion	Coverage	Status
⚙️	backplane/ directory (optional tier)	1/1	🟢 100%
🧪	e2e/ test directory exists	0/1	🔴 0%
✅	e2e/ contains .tftest.hcl files	0/1	🔴 0%

[grubmeshi]

LGTM, what could be added is a summary output (reading a file created by the prerunscript?) which shows the current member status assignment (see the stackit/git-repo module how it's done there), including a suggestion how to fix missing access

[Copilot]

Pull request overview

This PR extends the STACKIT project building block to support best-effort onboarding of assigned meshStack users into a STACKIT organization before applying project-level role assignments. It does so by introducing a pre-run script executed by the meshStack building block runner and by granting the backplane service account the additional organization permission needed for membership management.

Changes:

• Add a building block pre-run script that attempts to add assigned users to the STACKIT organization before project role assignment.
• Extend the STACKIT backplane with iam.member-admin to enable organization membership changes.
• Update module documentation and meshStack integration wiring to describe and enable the onboarding behavior.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
modules/stackit/project/buildingblock/README.md	Documents the new best-effort org onboarding behavior when used via meshStack integration.
modules/stackit/project/buildingblock/prerun.sh	New pre-run script performing organization membership onboarding via STACKIT APIs.
modules/stackit/project/buildingblock/APP_TEAM_README.md	Adds guidance about the organization membership onboarding behavior for app teams.
modules/stackit/project/backplane/README.md	Documents the added backplane permission/resource for org membership onboarding.
modules/stackit/project/backplane/main.tf	Grants the building block service account iam.member-admin at org scope.
modules/stackit/meshstack_integration.tf	Wires the pre-run script and passes required environment variables/inputs for onboarding.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[aws-amplify-eu-central-1]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-219.d1o16zfeoh2slu.amplifyapp.com

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.