Demonstrating a bug in salt: user.present state removes all group membership if no groups argument provided

.gitignore

.vagrant

minion.conf

fileserver_backend:
 - roots

file_client: local

file_roots:
  base:
    - /opt/salt

pillar_roots:
  base:
    - /srv

my-env.sls

include:
  - nginx

webapps-group:
  group.present:
    - name: webapps
    - addusers:
        - www-data
    - require:
        - pkg: nginx

nginx.sls

nginx:
  pkg.installed

www-data:
  user.present:
    - require:
      - pkg: nginx

provision_salt.sh

#!/bin/sh
start_seconds="$(date +%s)"

if [ ! -d "/etc/salt" ]; then
    echo "Bootstrap salt"
    sudo wget -O /root/install_salt.sh https://bootstrap.saltstack.com
    sudo sh /root/install_salt.sh -P git v2015.8.8
fi

sudo mkdir -p /etc/salt
sudo cp /vagrant/minion.conf /etc/salt/minion
echo "Restart salt-minion"
sudo salt-minion -d
sudo service salt-minion restart

echo "Executing salt highstate (provisioning)"
sudo salt-call state.highstate

end_seconds="$(date +%s)"
echo "-----------------------------"
echo "Provisioning complete in "$(expr $end_seconds - $start_seconds)" seconds"

top.sls

base:
  '*':
    - nginx
    - my-env

Vagrantfile

# -*- mode: ruby -*-
# vi: set ft=ruby :

# Vagrantfile API/syntax version. Don't touch unless you know what you're doing!
VAGRANTFILE_API_VERSION = "2"

Vagrant.configure(VAGRANTFILE_API_VERSION) do |config|
  config.vm.define :salt_testbed do |salt|
    # All Vagrant configuration is done here. The most common configuration
    # options are documented and commented below. For a complete reference,
    # please see the online documentation at vagrantup.com.

    # Every Vagrant virtual environment requires a box to build off of.
    salt.vm.box = "ubuntu/trusty64"

    # Share for masterless salt minion
    salt.vm.synced_folder "./", "/opt/salt"

    salt.vm.provision :shell, path: "provision_salt.sh", privileged: false
  end
end