Add scripts for GitHub repository management

- Implement `github-enable-issues.sh` to enable issues on all repositories in a GitHub organization that currently have it disabled, with support for dry-run mode.
- Create `github-get-public-repos.sh` to list all public repositories across organizations in a GitHub Cloud Enterprise account and generate a timestamped CSV report.
- Add `github-get-repo-list.sh` to retrieve and export a list of repositories for a specified organization, including details such as visibility and creation dates.
- Introduce `github-migrate-internal-repos-to-private.sh` to convert internal repositories to private within a specified organization.

Author: locus313

.gitignore

@@ -0,0 +1,10 @@
+# Local environment files
+.envrc
+
+# Generated report artifacts
+**/reports/*.csv
+**/reports/*.txt
+
+# Python bytecode/cache
+**/__pycache__/
+**/*.pyc

github-add-enterprise-team-read-permissions/github-add-enterprise-team-read-permissions.sh

@@ -0,0 +1,242 @@
+#!/bin/bash
+set -euo pipefail
+
+###
+## GitHub Enterprise Team Org Role Assignment
+## Assigns the built-in "All-repository read" organization role to the
+## configured enterprise team in every org in the enterprise.
+##
+## This org-level role grants read access to all current AND future
+## repositories, so the assignment only needs to be made once per org.
+###
+
+###
+## GLOBAL VARIABLES
+###
+GITHUB_TOKEN=${GITHUB_TOKEN:-''}
+# GitHub Enterprise Cloud slug (visible in your enterprise URL: github.com/enterprises/{slug})
+ENTERPRISE=${ENTERPRISE:-''}
+API_URL_PREFIX=${API_URL_PREFIX:-'https://api.github.com'}
+# Slug used in the org-roles API - enterprise teams use name WITHOUT the "ent:" prefix
+ENTERPRISE_TEAM_SLUG=${ENTERPRISE_TEAM_SLUG:-''}
+# API name of the built-in org role that grants read on all repositories
+ALL_REPO_READ_ROLE_NAME=${ALL_REPO_READ_ROLE_NAME:-'all_repo_read'}
+
+###
+## Color codes for output
+###
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+print_status() { echo -e "${BLUE}[INFO]${NC} $1"; }
+print_success() { echo -e "${GREEN}[SUCCESS]${NC} $1"; }
+print_warning() { echo -e "${YELLOW}[WARNING]${NC} $1"; }
+print_error() { echo -e "${RED}[ERROR]${NC} $1"; }
+
+# Check if GITHUB_TOKEN is set
+if [ -z "${GITHUB_TOKEN}" ]; then
+  print_error "GITHUB_TOKEN is empty. Please set your token and try again"
+  exit 1
+fi
+
+# Check if ENTERPRISE is set
+if [ -z "${ENTERPRISE}" ]; then
+  print_error "ENTERPRISE is empty. Please set the enterprise slug and try again"
+  exit 1
+fi
+
+# Check if ENTERPRISE_TEAM_SLUG is set
+if [ -z "${ENTERPRISE_TEAM_SLUG}" ]; then
+  print_error "ENTERPRISE_TEAM_SLUG is empty. Please set the enterprise team slug and try again"
+  exit 1
+fi
+
+# Check if jq is installed
+if ! command -v jq &> /dev/null; then
+  print_error "jq is required but not installed. Install it and try again."
+  exit 1
+fi
+
+print_status "Validating GitHub token..."
+
+# Validate GITHUB_TOKEN by calling GitHub API
+RESPONSE=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: token $GITHUB_TOKEN" "${API_URL_PREFIX}/user")
+
+if [ "$RESPONSE" -ne 200 ]; then
+  print_error "GITHUB_TOKEN is invalid or does not have required permissions."
+  exit 1
+fi
+
+print_success "GitHub token validated successfully"
+print_status "Enterprise: ${ENTERPRISE}"
+print_status "Enterprise team slug: ${ENTERPRISE_TEAM_SLUG}"
+print_status "Org role to assign: ${ALL_REPO_READ_ROLE_NAME}"
+
+###
+## Fetch all organization logins in the enterprise via GraphQL (cursor-based pagination)
+###
+get_enterprise_orgs () {
+  local orgs=()
+  local cursor=""
+  local has_next_page="true"
+
+  while [ "${has_next_page}" = "true" ]; do
+    local after_clause=""
+    if [ -n "${cursor}" ]; then
+      after_clause=", after: \\\"${cursor}\\\""
+    fi
+
+    local query="{\"query\":\"{ enterprise(slug: \\\"${ENTERPRISE}\\\") { organizations(first: 100${after_clause}) { nodes { login } pageInfo { hasNextPage endCursor } } } }\"}"
+
+    local response
+    response=$(curl -s \
+      -H "Authorization: token ${GITHUB_TOKEN}" \
+      -H "Content-Type: application/json" \
+      "${API_URL_PREFIX}/graphql" \
+      -d "${query}")
+
+    local batch
+    batch=$(echo "${response}" | jq -r '.data.enterprise.organizations.nodes[].login // empty' 2>/dev/null)
+
+    [ -z "${batch}" ] && break
+
+    while IFS= read -r org; do
+      orgs+=("${org}")
+    done <<< "${batch}"
+
+    has_next_page=$(echo "${response}" | jq -r '.data.enterprise.organizations.pageInfo.hasNextPage')
+    cursor=$(echo "${response}" | jq -r '.data.enterprise.organizations.pageInfo.endCursor')
+  done
+
+  printf '%s\n' "${orgs[@]}"
+}
+
+###
+## Look up the numeric role_id for the all_repo_read built-in org role
+###
+get_role_id () {
+  local org="$1"
+
+  local response
+  response=$(curl -s \
+    -H "Authorization: token ${GITHUB_TOKEN}" \
+    -H "Accept: application/vnd.github+json" \
+    -H "X-GitHub-Api-Version: 2022-11-28" \
+    "${API_URL_PREFIX}/orgs/${org}/organization-roles")
+
+  local status
+  status=$(echo "${response}" | jq -r '.status // empty' 2>/dev/null)
+  if [ "${status}" = "403" ]; then
+    echo "SAML"
+    return
+  fi
+  if [ "${status}" = "404" ]; then
+    echo "NOT_FOUND"
+    return
+  fi
+
+  echo "${response}" | jq -r --arg name "${ALL_REPO_READ_ROLE_NAME}" \
+    '.roles[] | select(.name == $name) | .id' 2>/dev/null
+}
+
+###
+## Assign the org role to the enterprise team
+###
+process_org () {
+  local org="$1"
+
+  print_status "========================================="
+  print_status "Processing organization: ${org}"
+  print_status "========================================="
+
+  print_status "Looking up role ID for '${ALL_REPO_READ_ROLE_NAME}'..."
+  local role_id
+  role_id=$(get_role_id "${org}")
+
+  case "${role_id}" in
+    SAML)
+      print_warning "Skipping ${org}: SAML SSO block — authorize token at github.com/settings/tokens"
+      return 2
+      ;;
+    NOT_FOUND)
+      print_warning "Skipping ${org}: org roles not available (org may not be on Enterprise Cloud)"
+      return 2
+      ;;
+    "")
+      print_error "Could not find role '${ALL_REPO_READ_ROLE_NAME}' in org ${org}. Skipping."
+      return 1
+      ;;
+  esac
+
+  print_status "Found role ID: ${role_id}"
+  print_status "Assigning role to team '${ENTERPRISE_TEAM_SLUG}'..."
+
+  local http_code
+  http_code=$(curl -s -o /dev/null -w "%{http_code}" \
+    -X PUT \
+    -H "Authorization: token ${GITHUB_TOKEN}" \
+    -H "Accept: application/vnd.github+json" \
+    -H "X-GitHub-Api-Version: 2022-11-28" \
+    "${API_URL_PREFIX}/orgs/${org}/organization-roles/teams/${ENTERPRISE_TEAM_SLUG}/${role_id}")
+
+  if [ "${http_code}" -eq 204 ]; then
+    print_success "'${ALL_REPO_READ_ROLE_NAME}' org role assigned to '${ENTERPRISE_TEAM_SLUG}' in ${org}"
+  else
+    print_error "Failed to assign role in ${org} (HTTP ${http_code})"
+    return 1
+  fi
+}
+
+###
+## Main
+###
+print_status "Starting org role assignment..."
+print_status "Fetching organizations in enterprise: ${ENTERPRISE}..."
+
+mapfile -t ORG_LIST < <(get_enterprise_orgs)
+
+if [ "${#ORG_LIST[@]}" -eq 0 ]; then
+  print_error "No organizations found in enterprise '${ENTERPRISE}'. Check the enterprise slug and token permissions."
+  exit 1
+fi
+
+print_status "Found ${#ORG_LIST[@]} organization(s)"
+echo ""
+
+SUCCESS_COUNT=0
+SKIP_COUNT=0
+FAIL_COUNT=0
+SKIPPED_ORGS=()
+FAILED_ORGS=()
+
+for ORG in "${ORG_LIST[@]}"; do
+  rc=0
+  process_org "${ORG}" || rc=$?
+  case $rc in
+    0) SUCCESS_COUNT=$((SUCCESS_COUNT + 1)) ;;
+    2) SKIP_COUNT=$((SKIP_COUNT + 1)); SKIPPED_ORGS+=("${ORG}") ;;
+    *) FAIL_COUNT=$((FAIL_COUNT + 1)); FAILED_ORGS+=("${ORG}") ;;
+  esac
+done
+
+echo ""
+print_success "Done! ${SUCCESS_COUNT} assigned, ${SKIP_COUNT} skipped (SAML/unsupported), ${FAIL_COUNT} failed."
+
+if [ "${#SKIPPED_ORGS[@]}" -gt 0 ]; then
+  echo ""
+  print_warning "Skipped orgs (SAML SSO block or org roles unsupported):"
+  for org in "${SKIPPED_ORGS[@]}"; do
+    echo "  - ${org}"
+  done
+fi
+
+if [ "${#FAILED_ORGS[@]}" -gt 0 ]; then
+  echo ""
+  print_error "Failed orgs (role not found or assignment error):"
+  for org in "${FAILED_ORGS[@]}"; do
+    echo "  - ${org}"
+  done
+fi

github-add-repo-collaborators-by-pattern/github-add-repo-collaborators-by-pattern.sh

@@ -0,0 +1,99 @@
+#!/bin/bash
+set -euo pipefail
+
+###
+## GLOBAL VARIABLES
+###
+GITHUB_TOKEN=${GITHUB_TOKEN:-''}
+ORG=${ORG:-''}
+API_URL_PREFIX=${API_URL_PREFIX:-'https://api.github.com'}
+COLLABORATORS=${COLLABORATORS:-''}   # Comma-separated usernames, e.g. alice,bob
+PERMISSION=${PERMISSION:-'push'}      # pull|triage|push|maintain|admin
+REPO_NAME_REGEX=${REPO_NAME_REGEX:-''}
+REPO_EXCLUDE_REGEX=${REPO_EXCLUDE_REGEX:-''}
+
+###
+## FUNCTIONS
+###
+usage() {
+  echo "Usage: ORG=<org> GITHUB_TOKEN=<token> COLLABORATORS=<u1,u2> REPO_NAME_REGEX=<regex> $0"
+  echo "Optional: PERMISSION=push REPO_EXCLUDE_REGEX=<regex> API_URL_PREFIX=<url>"
+}
+
+get_repo_pagination() {
+  local repo_pages
+  repo_pages=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" -I "${API_URL_PREFIX}/orgs/${ORG}/repos?per_page=100" | grep -Eo '&page=[0-9]+' | grep -Eo '[0-9]+' | tail -1)
+  echo "${repo_pages:-1}"
+}
+
+limit_repo_pagination() {
+  seq "$(get_repo_pagination)"
+}
+
+validate() {
+  if [ -z "${GITHUB_TOKEN}" ] || [ -z "${ORG}" ] || [ -z "${COLLABORATORS}" ] || [ -z "${REPO_NAME_REGEX}" ]; then
+    echo "Error: missing required variable(s)."
+    usage
+    exit 1
+  fi
+
+  if ! command -v jq > /dev/null 2>&1; then
+    echo "Error: jq is required but not installed."
+    exit 1
+  fi
+
+  local auth_status
+  auth_status=$(curl -s -o /dev/null -w "%{http_code}" -H "Authorization: token ${GITHUB_TOKEN}" "${API_URL_PREFIX}/user")
+  if [ "${auth_status}" -ne 200 ]; then
+    echo "Error: invalid GITHUB_TOKEN or insufficient permissions (HTTP ${auth_status})."
+    exit 1
+  fi
+}
+
+get_matching_repos() {
+  local page repos_json
+  for page in $(limit_repo_pagination); do
+    repos_json=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/json" "${API_URL_PREFIX}/orgs/${ORG}/repos?type=all&per_page=100&page=${page}&sort=full_name")
+
+    if [ -n "${REPO_EXCLUDE_REGEX}" ]; then
+      while IFS= read -r repo_name; do
+        [ -n "${repo_name}" ] && echo "${repo_name}"
+      done < <(echo "${repos_json}" | jq -r --arg include "${REPO_NAME_REGEX}" --arg exclude "${REPO_EXCLUDE_REGEX}" '.[] | select(has("name") and (.name | test($include)) and (.name | test($exclude) | not)) | .name')
+    else
+      while IFS= read -r repo_name; do
+        [ -n "${repo_name}" ] && echo "${repo_name}"
+      done < <(echo "${repos_json}" | jq -r --arg include "${REPO_NAME_REGEX}" '.[] | select(has("name") and (.name | test($include))) | .name')
+    fi
+  done
+}
+
+add_collaborators_to_repos() {
+  local repo collaborator response
+  local collaborators_space
+  collaborators_space=$(echo "${COLLABORATORS}" | tr ',' ' ')
+
+  while IFS= read -r repo; do
+    [ -z "${repo}" ] && continue
+    for collaborator in ${collaborators_space}; do
+      response=$(curl -s -o /dev/null -w "%{http_code}" -X PUT -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/vnd.github.v3+json" "${API_URL_PREFIX}/repos/${ORG}/${repo}/collaborators/${collaborator}" -d "{\"permission\": \"${PERMISSION}\"}")
+
+      if [[ "${response}" =~ ^2 ]]; then
+        echo "Added '${collaborator}' to '${repo}' with '${PERMISSION}' permission"
+      else
+        echo "Failed to add '${collaborator}' to '${repo}' (HTTP ${response})"
+      fi
+    done
+  done < <(get_matching_repos)
+}
+
+###
+## MAIN PROGRAM
+###
+validate
+echo "Matching repositories:"
+get_matching_repos
+
+echo "Applying collaborator permissions..."
+add_collaborators_to_repos
+
+echo "Done"