Skip to content

Commit 80a07ec

Browse files
joshjohanningjoshjohanning
committed
refactor: reduce code duplication
1 parent 89c3641 commit 80a07ec

File tree

1 file changed

+122
-103
lines changed

1 file changed

+122
-103
lines changed

‎gh-cli/enable-secret-scanning-on-repositories.sh‎

Lines changed: 122 additions & 103 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,96 @@
66
# Uses the repository update API to enable secret scanning features
77
# Usage: <org|file> [features] [--dry-run]
88

9+
# Helper function to build JSON payload for secret scanning features
10+
build_json_payload() {
11+
local include_advanced_security="$1"
12+
local payload='{"security_and_analysis":{'
13+
local has_changes=false
14+
15+
# Add Advanced Security if requested
16+
if [ "$include_advanced_security" = true ] && [ "$repo_private" = "true" ] && [ "$advanced_security_enabled" != "enabled" ]; then
17+
payload+='"advanced_security":{"status":"enabled"},'
18+
has_changes=true
19+
fi
20+
21+
# Add secret scanning features
22+
if [ "$enable_scanning" = true ] && [ "$secret_scanning_enabled" != "enabled" ]; then
23+
payload+='"secret_scanning":{"status":"enabled"},'
24+
has_changes=true
25+
fi
26+
27+
if [ "$enable_push_protection" = true ] && [ "$push_protection_enabled" != "enabled" ]; then
28+
payload+='"secret_scanning_push_protection":{"status":"enabled"},'
29+
has_changes=true
30+
fi
31+
32+
if [ "$enable_ai_detection" = true ] && [ "$ai_detection_enabled" != "enabled" ]; then
33+
payload+='"secret_scanning_ai_detection":{"status":"enabled"},'
34+
has_changes=true
35+
fi
36+
37+
if [ "$enable_non_provider_patterns" = true ] && [ "$non_provider_patterns_enabled" != "enabled" ]; then
38+
payload+='"secret_scanning_non_provider_patterns":{"status":"enabled"},'
39+
has_changes=true
40+
fi
41+
42+
if [ "$enable_validity_checks" = true ] && [ "$validity_checks_enabled" != "enabled" ]; then
43+
payload+='"secret_scanning_validity_checks":{"status":"enabled"},'
44+
has_changes=true
45+
fi
46+
47+
# Remove trailing comma and close JSON
48+
payload=$(echo "$payload" | sed 's/,$//')
49+
payload+='}}'
50+
51+
# Return both payload and whether there are changes
52+
echo "$has_changes|$payload"
53+
}
54+
55+
# Helper function to check if a feature needs updating
56+
check_feature_status() {
57+
local feature="$1"
58+
local current_status="$2"
59+
local enable_flag="$3"
60+
61+
if [ "$enable_flag" = true ] && [ "$current_status" != "enabled" ]; then
62+
echo "needs_update"
63+
elif [ "$enable_flag" = true ]; then
64+
echo "already_enabled"
65+
else
66+
echo "not_requested"
67+
fi
68+
}
69+
70+
# Helper function to display dry-run information
71+
show_dry_run_info() {
72+
echo " 🔍 Would enable the following features:"
73+
74+
if [ "$enable_scanning" = true ] && [ "$secret_scanning_enabled" != "enabled" ]; then
75+
echo " - Secret scanning (currently: ${secret_scanning_enabled:-disabled})"
76+
fi
77+
78+
if [ "$enable_push_protection" = true ] && [ "$push_protection_enabled" != "enabled" ]; then
79+
echo " - Push protection (currently: ${push_protection_enabled:-disabled})"
80+
fi
81+
82+
if [ "$enable_ai_detection" = true ] && [ "$ai_detection_enabled" != "enabled" ]; then
83+
echo " - AI detection (currently: ${ai_detection_enabled:-disabled})"
84+
fi
85+
86+
if [ "$enable_non_provider_patterns" = true ] && [ "$non_provider_patterns_enabled" != "enabled" ]; then
87+
echo " - Non-provider patterns (currently: ${non_provider_patterns_enabled:-disabled})"
88+
fi
89+
90+
if [ "$enable_validity_checks" = true ] && [ "$validity_checks_enabled" != "enabled" ]; then
91+
echo " - Validity checks (currently: ${validity_checks_enabled:-disabled})"
92+
fi
93+
94+
if [ "$repo_private" = "true" ] && [ "$advanced_security_enabled" != "enabled" ]; then
95+
echo " Note: Private repo requires Advanced Security to be enabled first"
96+
fi
97+
}
98+
999
function print_usage {
10100
echo "Usage: $0 <org|file> [features] [--dry-run]"
11101
echo "Example: ./enable-secret-scanning-on-repositories.sh joshjohanning-org"
@@ -189,38 +279,46 @@ while IFS= read -r repo_full; do
189279
needs_update=false
190280
status_messages=()
191281

192-
if [ "$enable_scanning" = true ] && [ "$secret_scanning_enabled" != "enabled" ]; then
282+
# Check each feature status
283+
scanning_status=$(check_feature_status "scanning" "$secret_scanning_enabled" "$enable_scanning")
284+
push_protection_status=$(check_feature_status "push-protection" "$push_protection_enabled" "$enable_push_protection")
285+
ai_detection_status=$(check_feature_status "ai-detection" "$ai_detection_enabled" "$enable_ai_detection")
286+
non_provider_patterns_status=$(check_feature_status "non-provider-patterns" "$non_provider_patterns_enabled" "$enable_non_provider_patterns")
287+
validity_checks_status=$(check_feature_status "validity-checks" "$validity_checks_enabled" "$enable_validity_checks")
288+
289+
# Build status messages and check if updates are needed
290+
if [ "$scanning_status" = "needs_update" ]; then
193291
needs_update=true
194292
status_messages+=("secret scanning")
195-
elif [ "$enable_scanning" = true ]; then
293+
elif [ "$scanning_status" = "already_enabled" ]; then
196294
status_messages+=("✅ secret scanning already enabled")
197295
fi
198296

199-
if [ "$enable_push_protection" = true ] && [ "$push_protection_enabled" != "enabled" ]; then
297+
if [ "$push_protection_status" = "needs_update" ]; then
200298
needs_update=true
201299
status_messages+=("push protection")
202-
elif [ "$enable_push_protection" = true ]; then
300+
elif [ "$push_protection_status" = "already_enabled" ]; then
203301
status_messages+=("✅ push protection already enabled")
204302
fi
205303

206-
if [ "$enable_ai_detection" = true ] && [ "$ai_detection_enabled" != "enabled" ]; then
304+
if [ "$ai_detection_status" = "needs_update" ]; then
207305
needs_update=true
208306
status_messages+=("AI detection")
209-
elif [ "$enable_ai_detection" = true ]; then
307+
elif [ "$ai_detection_status" = "already_enabled" ]; then
210308
status_messages+=("✅ AI detection already enabled")
211309
fi
212310

213-
if [ "$enable_non_provider_patterns" = true ] && [ "$non_provider_patterns_enabled" != "enabled" ]; then
311+
if [ "$non_provider_patterns_status" = "needs_update" ]; then
214312
needs_update=true
215313
status_messages+=("non-provider patterns")
216-
elif [ "$enable_non_provider_patterns" = true ]; then
314+
elif [ "$non_provider_patterns_status" = "already_enabled" ]; then
217315
status_messages+=("✅ non-provider patterns already enabled")
218316
fi
219317

220-
if [ "$enable_validity_checks" = true ] && [ "$validity_checks_enabled" != "enabled" ]; then
318+
if [ "$validity_checks_status" = "needs_update" ]; then
221319
needs_update=true
222320
status_messages+=("validity checks")
223-
elif [ "$enable_validity_checks" = true ]; then
321+
elif [ "$validity_checks_status" = "already_enabled" ]; then
224322
status_messages+=("✅ validity checks already enabled")
225323
fi
226324

@@ -233,70 +331,20 @@ while IFS= read -r repo_full; do
233331
echo " ✅ All requested features already enabled"
234332
else
235333
if [ "$dry_run" = "true" ]; then
236-
echo " 🔍 Would enable the following features:"
237-
if [ "$enable_scanning" = true ] && [ "$secret_scanning_enabled" != "enabled" ]; then
238-
echo " - Secret scanning (currently: ${secret_scanning_enabled:-disabled})"
239-
fi
240-
if [ "$enable_push_protection" = true ] && [ "$push_protection_enabled" != "enabled" ]; then
241-
echo " - Push protection (currently: ${push_protection_enabled:-disabled})"
242-
fi
243-
if [ "$enable_ai_detection" = true ] && [ "$ai_detection_enabled" != "enabled" ]; then
244-
echo " - AI detection (currently: ${ai_detection_enabled:-disabled})"
245-
fi
246-
if [ "$enable_non_provider_patterns" = true ] && [ "$non_provider_patterns_enabled" != "enabled" ]; then
247-
echo " - Non-provider patterns (currently: ${non_provider_patterns_enabled:-disabled})"
248-
fi
249-
if [ "$enable_validity_checks" = true ] && [ "$validity_checks_enabled" != "enabled" ]; then
250-
echo " - Validity checks (currently: ${validity_checks_enabled:-disabled})"
251-
fi
252-
if [ "$repo_private" = "true" ] && [ "$advanced_security_enabled" != "enabled" ]; then
253-
echo " Note: Private repo requires Advanced Security to be enabled first"
254-
fi
334+
show_dry_run_info
255335
else
256336
echo " 🔄 Enabling features..."
257337

258-
# Build JSON payload for API call
259-
json_payload='{"security_and_analysis":{'
260-
has_changes=false
261-
262-
# For private repositories, we may need to enable Advanced Security first
263-
if [ "$repo_private" = "true" ] && [ "$advanced_security_enabled" != "enabled" ]; then
264-
echo " Private repository detected - enabling Advanced Security..."
265-
json_payload+='"advanced_security":{"status":"enabled"},'
266-
has_changes=true
267-
fi
268-
269-
# Add secret scanning features
270-
if [ "$enable_scanning" = true ] && [ "$secret_scanning_enabled" != "enabled" ]; then
271-
json_payload+='"secret_scanning":{"status":"enabled"},'
272-
has_changes=true
273-
fi
274-
275-
if [ "$enable_push_protection" = true ] && [ "$push_protection_enabled" != "enabled" ]; then
276-
json_payload+='"secret_scanning_push_protection":{"status":"enabled"},'
277-
has_changes=true
278-
fi
279-
280-
if [ "$enable_ai_detection" = true ] && [ "$ai_detection_enabled" != "enabled" ]; then
281-
json_payload+='"secret_scanning_ai_detection":{"status":"enabled"},'
282-
has_changes=true
283-
fi
284-
285-
if [ "$enable_non_provider_patterns" = true ] && [ "$non_provider_patterns_enabled" != "enabled" ]; then
286-
json_payload+='"secret_scanning_non_provider_patterns":{"status":"enabled"},'
287-
has_changes=true
288-
fi
289-
290-
if [ "$enable_validity_checks" = true ] && [ "$validity_checks_enabled" != "enabled" ]; then
291-
json_payload+='"secret_scanning_validity_checks":{"status":"enabled"},'
292-
has_changes=true
293-
fi
338+
# Build JSON payload for API call (include Advanced Security if needed)
339+
result=$(build_json_payload true)
340+
has_changes=$(echo "$result" | cut -d'|' -f1)
341+
json_payload=$(echo "$result" | cut -d'|' -f2)
294342

295343
# Only send API request if there are actual changes to make
296-
if [ "$has_changes" = true ]; then
297-
# Remove trailing comma and close JSON
298-
json_payload=$(echo "$json_payload" | sed 's/,$//')
299-
json_payload+='}}'
344+
if [ "$has_changes" = "true" ]; then
345+
if [ "$repo_private" = "true" ] && [ "$advanced_security_enabled" != "enabled" ]; then
346+
echo " Private repository detected - enabling Advanced Security..."
347+
fi
300348

301349
echo " Sending API request..."
302350
response=$(echo "$json_payload" | gh api -X PATCH "/repos/$repo_full" --input - 2>&1)
@@ -310,42 +358,13 @@ while IFS= read -r repo_full; do
310358
echo " Advanced Security not required - retrying without it..."
311359

312360
# Rebuild payload without Advanced Security
313-
json_payload='{"security_and_analysis":{'
314-
has_retry_changes=false
315-
316-
# Add only the secret scanning features (skip Advanced Security)
317-
if [ "$enable_scanning" = true ] && [ "$secret_scanning_enabled" != "enabled" ]; then
318-
json_payload+='"secret_scanning":{"status":"enabled"},'
319-
has_retry_changes=true
320-
fi
321-
322-
if [ "$enable_push_protection" = true ] && [ "$push_protection_enabled" != "enabled" ]; then
323-
json_payload+='"secret_scanning_push_protection":{"status":"enabled"},'
324-
has_retry_changes=true
325-
fi
326-
327-
if [ "$enable_ai_detection" = true ] && [ "$ai_detection_enabled" != "enabled" ]; then
328-
json_payload+='"secret_scanning_ai_detection":{"status":"enabled"},'
329-
has_retry_changes=true
330-
fi
331-
332-
if [ "$enable_non_provider_patterns" = true ] && [ "$non_provider_patterns_enabled" != "enabled" ]; then
333-
json_payload+='"secret_scanning_non_provider_patterns":{"status":"enabled"},'
334-
has_retry_changes=true
335-
fi
336-
337-
if [ "$enable_validity_checks" = true ] && [ "$validity_checks_enabled" != "enabled" ]; then
338-
json_payload+='"secret_scanning_validity_checks":{"status":"enabled"},'
339-
has_retry_changes=true
340-
fi
361+
retry_result=$(build_json_payload false)
362+
has_retry_changes=$(echo "$retry_result" | cut -d'|' -f1)
363+
retry_payload=$(echo "$retry_result" | cut -d'|' -f2)
341364

342-
if [ "$has_retry_changes" = true ]; then
343-
# Remove trailing comma and close JSON
344-
json_payload=$(echo "$json_payload" | sed 's/,$//')
345-
json_payload+='}}'
346-
365+
if [ "$has_retry_changes" = "true" ]; then
347366
echo " Retrying API request without Advanced Security..."
348-
retry_response=$(echo "$json_payload" | gh api -X PATCH "/repos/$repo_full" --input - 2>&1)
367+
retry_response=$(echo "$retry_payload" | gh api -X PATCH "/repos/$repo_full" --input - 2>&1)
349368

350369
if [ $? -eq 0 ]; then
351370
echo " ✅ Successfully enabled requested features"

0 commit comments

Comments
 (0)