Offboard with Google Sign-Out and GitHub Org Removal

arazzo: 1.0.1
info:
  title: Offboard with Google Sign-Out and GitHub Org Removal
  summary: Sign a Google Workspace user out, remove them from a GitHub org, then notify Slack.
  description: >-
    An offboarding workflow that forces sign-out of a departing employee from all
    Google Workspace sessions, removes the user from a GitHub organization to cut
    repository access, and posts a Slack notification to the security channel.
    Demonstrates revoking access across a directory and a source-control platform.
  version: 1.0.0
sourceDescriptions:
  - name: googleWorkspaceApi
    url: https://raw.githubusercontent.com/api-evangelist/google-workspace/refs/heads/main/openapi/admin-sdk-directory-api.yml
    type: openapi
  - name: githubApi
    url: https://raw.githubusercontent.com/api-evangelist/github/refs/heads/main/openapi/github-organizations-openapi.yml
    type: openapi
  - name: slackApi
    url: https://raw.githubusercontent.com/api-evangelist/slack/refs/heads/main/openapi/slack-chat-openapi.yml
    type: openapi
workflows:
  - workflowId: offboard-signout-and-remove
    summary: Sign out Google user, remove from GitHub org, and notify Slack.
    description: >-
      Forces Google Workspace sign-out for a departing user, removes them from a
      GitHub organization, and posts a Slack security notification.
    inputs:
      type: object
      properties:
        userKey:
          type: string
        githubOrg:
          type: string
        githubUsername:
          type: string
        slackChannel:
          type: string
    steps:
      - stepId: signout-user
        description: Force sign-out of the departing user from Google Workspace.
        operationId: $sourceDescriptions.googleWorkspaceApi.signOutUser
        parameters:
          - name: userKey
            in: path
            value: $inputs.userKey
        successCriteria:
          - condition: $statusCode == 204
        outputs:
          signoutStatus: $statusCode
      - stepId: remove-github-membership
        description: Remove the user from the GitHub organization.
        operationId: $sourceDescriptions.githubApi.removeOrganizationMembershipForUser
        parameters:
          - name: org
            in: path
            value: $inputs.githubOrg
          - name: username
            in: path
            value: $inputs.githubUsername
        successCriteria:
          - condition: $statusCode == 204
        outputs:
          removeStatus: $statusCode
      - stepId: notify-slack
        description: Post a security notification to Slack.
        operationId: $sourceDescriptions.slackApi.postChatPostmessage
        requestBody:
          contentType: application/json
          payload:
            channel: $inputs.slackChannel
            text: Offboarded $inputs.userKey - Google sessions revoked and removed from $inputs.githubOrg.
        successCriteria:
          - condition: $statusCode == 200
        outputs:
          messageTs: $response.body#/ts
    outputs:
      signoutStatus: $steps.signout-user.outputs.signoutStatus
      removeStatus: $steps.remove-github-membership.outputs.removeStatus
      messageTs: $steps.notify-slack.outputs.messageTs