Improve error handling by not failing group rename step if a group was removed from account before reflecting it to workspace (#762)

Fixes #761

In rare cases, it can happen that a group is removed from the account
before we manage to reflect it in the workspace. It's usually a couple
of minutes between listing the groups and reflecting it. This PR will
log such cases without failing the tool.

---------

Co-authored-by: Serge Smertin <[email protected]>

Author: mwojtyczka

src/databricks/labs/ucx/workspace_access/groups.py

@@ -507,6 +507,10 @@ def _reflect_account_group_to_workspace(self, account_group_id: str):
         except BadRequest:
             # already exists
             return True
+        except NotFound:
+            # the given group has been removed from the account after getting the group and before running this method
+            logger.warning("Group with ID: %s does not exist anymore in the Databricks account.", account_group_id)
+            return True
 
     def _get_strategy(
         self, workspace_groups_in_workspace: dict[str, Group], account_groups_in_account: dict[str, Group]

tests/unit/workspace_access/test_groups.py

@@ -1,10 +1,11 @@
+import json
 from unittest.mock import MagicMock
 
 import pytest
 from _pytest.outcomes import fail
 from databricks.labs.blueprint.parallel import ManyError
 from databricks.labs.blueprint.tui import MockPrompts
-from databricks.sdk.errors import DatabricksError
+from databricks.sdk.errors import DatabricksError, ResourceDoesNotExist
 from databricks.sdk.service import iam
 from databricks.sdk.service.iam import ComplexValue, Group, ResourceMeta
 
@@ -380,6 +381,32 @@ def do_side_effect(*args, **kwargs):
         gm.reflect_account_groups_on_workspace()
 
 
+def test_reflect_account_should_not_fail_if_group_not_in_the_account_anymore():
+    backend = MockBackend(rows={"SELECT": [("1", "de", "de", "test-group-de", "", "", "", "")]})
+    wsclient = MagicMock()
+    account_group1 = Group(id="11", display_name="de")
+
+    def reflect_account_side_effect(method, *args, **kwargs):
+        if method == "GET":
+            return {
+                "Resources": [g.as_dict() for g in [account_group1]],
+            }
+        if method == "PUT":
+            raise ResourceDoesNotExist(
+                "The group has been removed from the Databricks account after getting the group "
+                "and before reflecting it to the workspace."
+            )
+
+    wsclient.api_client.do.side_effect = reflect_account_side_effect
+    GroupManager(backend, wsclient, inventory_database="inv").reflect_account_groups_on_workspace()
+
+    wsclient.api_client.do.assert_called_with(
+        "PUT",
+        f"/api/2.0/preview/permissionassignments/principals/{account_group1.id}",
+        data=json.dumps({"permissions": ["USER"]}),
+    )
+
+
 def test_delete_original_workspace_groups_should_delete_relected_acc_groups_in_workspace():
     account_id = "11"
     ws_id = "1"