feat: Add dry-run mode for team sync

src/insiders/_internal/cli.py

@@ -936,6 +936,12 @@ class CommandTeamSync:
         Doc("""Minimum amount to be considered an insider."""),
     ] = 0
 
+    dry_run: An[
+        bool,
+        cappa.Arg(short=False, long=True, group=_GROUP_OPTIONS),
+        Doc("Display the changes that would be made, without making them."),
+    ] = False
+
     def __call__(self) -> int:
         # TODO: Gather sponsors from configured platforms.
         with GitHub(self.github_token) as github:
@@ -945,6 +951,7 @@ def __call__(self) -> int:
                 include_users=set(self.github_include_users),
                 exclude_users=set(self.github_exclude_users),
                 org_users=self.github_organization_members,  # type: ignore[arg-type]
+                dry_run=self.dry_run,
             )
         return 0
 

src/insiders/_internal/clients/github.py

@@ -387,6 +387,7 @@ def sync_team(
         include_users: An[set[str] | None, Doc("Users to always grant access to.")] = None,
         exclude_users: An[set[str] | None, Doc("Users to never grant access to.")] = None,
         org_users: An[dict[str, set[str]] | None, Doc("Users to grant access to based on org.")] = None,
+        dry_run: An[bool, Doc("Display changes without applying them.")] = False,
     ) -> None:
         """Sync sponsors with members of a GitHub team."""
         sponsors = sponsors or self.get_sponsors(org_users)
@@ -404,12 +405,18 @@ def sync_team(
         # Revoke accesses.
         for user in members:
             if user not in eligible_users:
-                self.revoke_access(user, org, team)
+                if dry_run:
+                    logger.info(f"Would revoke access from @{user} to {org}/{team} team.")
+                else:
+                    self.revoke_access(user, org, team)
 
         # Grant accesses.
         for user in invitable_users:
             if user not in members:
-                self.grant_access(user, org, team)
+                if dry_run:
+                    logger.info(f"Would grant access to @{user} to {org}/{team} team.")
+                else:
+                    self.grant_access(user, org, team)
 
     def create_repo(
         self,