NickLiffen / ghas-enablement

A tool that aims to bulk automates the enablement of GitHub Code Scanning, Secret Scanning and Dependabot across multiple repositories.
152 stars 52 forks source link

Enable on all orgs repositories and add CLI utility #111

Closed theztefan closed 1 year ago

theztefan commented 1 year ago

Enable GHAS features on organization level

With this PR we are adding the option to enable GHAS features on an organization level APIs. This is useful for bulk enablements where we don't have different features pre repo in repos.json. By using this API we are making a lot less requests.

This REST API is available on GHEC and on GHES >= 3.7.

I added another method for the Action enablement on Organization level via the permissions API

This feature is added as a script and can be run as yarn run enableOrg (npm run enableOrg). It will enable all ENABLE_ON features to the GITHUB_ORG defined in the .env file.

CLI attempt

The PR also includes an attempt to augment the functionalities of the tool into a CLI. It is written in bash script and it basically uses the bin/*.json files and runs the yarn/npm scripts.

There is a configuration option that currently only supports the GitHub Token authnz. It should be straight forward to add the GitHub App as well moving forward.

In the README I've described two example Use Cases that the CLI script supports including the steps. Was thinking about adding a short video of the run. Maybe Monday... šŸ˜„

Misc

theztefan commented 1 year ago

Oh, and I forgot to mention that the new functionality now allows GHEC users to also use the tool to do the Default Code Scanning setup on their orgs. This is not yet available on GHES.

NickLiffen commented 1 year ago

@theztefan this is a really good PR šŸ‘ I am happy with the changes šŸ‘ I have not reviewed the huge bash script in detail, but part from that, this PR is good šŸ‘

NickLiffen commented 1 year ago

Approved šŸ’Æ Let's wait for CI to finish šŸ‘