Skip to content

scripts

Directory actions

More options

Directory actions

More options

Latest commit

 

History

History

scripts

README.adoc

scripts/

Estate-wide bash automation. Every script is built on lib/common.sh, which provides safe-by-default strict mode, structured logging, dry-run support, bounded parallelism, single-instance locking, signal-safe cleanup, GH CLI rate-limit + retry, snapshot-based rollback, and repo-iteration helpers.

Table of Contents

Layout

The directory tree is grouped by purpose via symlinks. The actual scripts continue to live at scripts/ root (the Elixir TUI hardcodes those paths).

Group Purpose

lib/

Shared library (common.sh); source it from every script.

audit/

Read-only inspection: contractiles, wiki, About metadata, sync, secrets+deps.

fix/

Mutating remediations: unwrap, innerHTML, branch protection, composite all.sh.

sync/

Estate-wide sync: update-repos, README standardisation, mirror-policy verification.

health/

Diagnostics: gh-doctor, estate-report aggregator.

Common flags

Every script that uses lib/common.sh understands:

Flag Effect

-n / --dry-run

Read-only; destructive ops are logged, not executed.

-y / --yes

Skip confirmation prompts (CI mode).

-j / --jobs N

Bounded parallelism (default 4).

-v / --verbose

Debug-level logging.

-q / --quiet

Warnings/errors only.

-h / --help

Per-script help text.

Common environment

Var Default

GS_REPOS_DIR

/var/mnt/eclipse/repos

GS_LOG_LEVEL

info

GS_DRY_RUN

0

GS_PARALLEL

4

GS_BACKUP_DIR

~/.cache/git-scripts/backups

GS_REPORT_DIR

~/.cache/git-scripts/reports

GS_LOCK_DIR

${TMPDIR}/git-scripts.locks

GS_REPO_LIST

(optional) one-repo-per-line filter list

NO_COLOR

non-empty disables ANSI colours

audit/

Script Reports

audit/contractiles.sh

6 canonical verbs (intend trust must bust adjust dust), K9 SVC location, accessibility hooks/docs. Drift vs missing vs ok.

audit/wiki.sh

Wiki enabled/disabled + page count + page list.

audit/project-tabs.sh

GitHub repo About: description, homepage, mandatory topics.

audit/sync-status.sh

Local HEAD vs origin/<branch> table. Read-only (no fetch).

audit/secrets-and-deps.sh

gitleaks scan + open-Dependabot-alert count.

fix/

Script Effect

fix/unwrap.sh

Reports bare .unwrap() in non-test Rust. Rewrite is opt-in via --apply-expect (anti-pattern; see memory).

fix/innerhtml.sh

Annotates / rewrites XSS-prone DOM writes. Snapshot+rollback per file.

fix/branch-protection.sh

Applies the canonical 'Base' ruleset to every non-archived repo. Updates pre-existing rulesets in place.

fix/all.sh

Runs every fixer in sequence against one repo. Replaces legacy fix-security-issues.sh.

sync/

Script Effect

sync/update-repos.sh

Fetch + safe-rebase + force-with-lease push across the configured set. ff-only safety; per-repo failure capture.

sync/standardize-readmes.sh

README.md → README.adoc via pandoc; snapshots saved.

sync/mirror-check.sh

Verifies the GitHub-only-push policy. Flags non-github origins, multi-forge drift, suspicious pushurl redirects. Honours estate-wide exceptions (007, bitfuckit).

health/

Script Effect

health/gh-doctor.sh

Validates gh installed, authenticated, scoped (repo, workflow, read:org), rate-limit headroom, jq present, git credential helper sane. Replaces legacy USE-GH-CLI.sh.

health/estate-report.sh

Runs every read-only audit and aggregates into a single Markdown report.

Removed / deprecated

  • ci-integration-example.sh → moved to docs/ci-integration-example.adoc (it was prose, not a script).

  • md_to_adoc_converter.sh → deprecation stub forwarding to standardize_readmes.sh (original sed regexes were broken).

  • fix-security-issues.sh → deprecation stub forwarding to fix/all.sh.

  • USE-GH-CLI.sh → deprecation stub forwarding to health/gh-doctor.sh.

The deprecation stubs still resolve, so the Elixir TUI’s hardcoded names keep working — they just print a notice and exec the replacement.

Writing a new script

#!/usr/bin/env bash
# SPDX-License-Identifier: MPL-2.0
set -uo pipefail
SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
. "${SCRIPT_DIR}/lib/common.sh"   # or ../lib/common.sh from a subgroup

GS_SCRIPT_NAME="my-thing"
GS_HELP_TEXT="Usage: my-thing.sh [--dry-run] [--help]"
gs::strict
gs::install_trap
gs::install_trap_summary
gs::lock my-thing            # single-instance protection
gs::need gh jq               # fail fast on missing tools
gs::gh_check                 # auth + rate-limit headroom

while (( $# > 0 )); do
    case "$1" in
        -n|--dry-run) GS_DRY_RUN=1 ;;
        -h|--help)    printf '%s\n' "${GS_HELP_TEXT}"; exit 0 ;;
        *)            gs::die "unknown flag: $1" ;;
    esac
    shift
done

while IFS= read -r repo; do
    gs::info "scanning $(basename "${repo}")..."
    gs::do touch "${repo}/.scanned"     # honours --dry-run
done < <(gs::repos)