Ops scripts

argo-add-role-members_gitlab.sh

#!/bin/sh

# Vérification des arguments
if [ "$#" -ne 5 ]; then
    echo "Usage: $0 <GITLAB_URL> <GITLAB_TOKEN> <GROUP_NAME> <PROJECT_NAME> <ARGO_PROJECT_NAME>"
    exit 1
fi

GITLAB_URL="$1"
GITLAB_TOKEN="$2"
GROUP_NAME="$3"
PROJECT_NAME="$4"
ARGO_PROJECT_NAME="$5"

# Fonction pour faire des requêtes à l'API GitLab
gitlab_api_call() {
    curl --silent --header "PRIVATE-TOKEN: $GITLAB_TOKEN" "$GITLAB_URL/api/v4/$1"
}

# Fonction pour remplacer le domaine de l'email
replace_email_domain() {
    echo "$1" | sed 's/@smile\.ci/@synelia.tech/'
}

echo "$GROUP_NAME" | awk -F'/' '{ for (i=1; i<=NF; i++) print $i }' | while IFS= read -r GROUP_NAME_X; do

# Récupérer l'ID du groupe
GROUP_ID=$(gitlab_api_call "groups?search=$GROUP_NAME_X" | jq '.[] | select(.name == "'$GROUP_NAME_X'")' |  jq -r '.id')

if [ -z "$GROUP_ID" ] || [ "$GROUP_ID" = "null" ]; then
    #echo "Groupe non trouvé."
    #echo "Recherche de l'ID du projet..."
    echo "Deep search..."
    PROJECT_ID=$(gitlab_api_call "projects?search=$PROJECT_NAME" | jq -r '.[0].id')
    if [ -z "$PROJECT_ID" ] || [ "$PROJECT_ID" = "null" ]; then
    	echo "Projet non trouvé."
	exit 1
    fi
fi

# Récupérer les membres du groupe
MEMBERS=$(gitlab_api_call "groups/$GROUP_ID/members")


# Un peu de gagie ooooh
if echo "$MEMBERS" | grep -q '{"message":"404 Group Not Found"}'; then
    MEMBERS=null
fi

if echo "$MEMBERS" | jq -e '. | length > 0' > /dev/null 2>&1; then
   echo
else
   MEMBERS=$(gitlab_api_call "projects/$PROJECT_ID/members")
fi


# Traiter chaque membre
echo "$MEMBERS" | jq -r '.[].username' | while read -r username; do
    user_info=$(gitlab_api_call "users?username=$username")
    email=$(echo "$user_info" | jq -r '.[0].email')
    modified_email=$(replace_email_domain "$email")
    
    # Exécuter la commande ArgoCD
    argocd proj role add-group "$ARGO_PROJECT_NAME" owner "$modified_email"
    
    #echo "Ajout de $modified_email au projet ArgoCD $ARGO_PROJECT_NAME"
done
done

echo "Opération terminée."

gitlab-argocd-users-sync.sh

#!/usr/bin/env bash
set -euo pipefail

GITLAB_URL="${1}"
GITLAB_TOKEN="${2}"
PROJECT_ID="${3}"
ARGOCD_PROJECT="${4}"
ARGOCD_ROLE="${5:-owner}"

GITLAB_API="${GITLAB_URL}/api/v4"

log() { echo "[$(date +%H:%M:%S)] $*"; }

gitlab_get() {
  curl -sf --header "PRIVATE-TOKEN: ${GITLAB_TOKEN}" "${GITLAB_API}/${1}"
}

gitlab_paged() {
  local endpoint="${1}" page=1 result="[]"
  while true; do
    local batch
    batch=$(gitlab_get "${endpoint}?per_page=100&page=${page}")
    local n
    n=$(echo "${batch}" | jq 'if type=="array" then length else 0 end')
    [[ "${n}" -eq 0 ]] && break
    result=$(jq -n --argjson a "${result}" --argjson b "${batch}" '$a+$b')
    page=$((page + 1))
  done
  echo "${result}"
}

log "Checking ArgoCD project '${ARGOCD_PROJECT}'..."
argocd proj get "${ARGOCD_PROJECT}"

log "Checking role '${ARGOCD_ROLE}'..."
argocd proj role create "${ARGOCD_PROJECT}" "${ARGOCD_ROLE}" || true
argocd proj role get "${ARGOCD_PROJECT}" "${ARGOCD_ROLE}"

echo "Add role permissions"
argocd proj role add-policy "${ARGOCD_PROJECT}" "${ARGOCD_ROLE}" -a '*'      -p allow  -o '*'  -r applications || true
argocd proj role add-policy "${ARGOCD_PROJECT}" "${ARGOCD_ROLE}" -a get      -p allow  -o '*'  -r logs || true
argocd proj role add-policy "${ARGOCD_PROJECT}" "${ARGOCD_ROLE}" -a create   -p allow  -o '*'  -r exec || true
argocd proj role add-policy "${ARGOCD_PROJECT}" "${ARGOCD_ROLE}" -a '*'      -p allow  -o '*'  -r applicationsets || true

log "Fetching members from project ID: ${PROJECT_ID}..."
MEMBERS=$(gitlab_paged "projects/${PROJECT_ID}/members/all")

# Filter active only
MEMBERS=$(echo "${MEMBERS}" | jq '[.[] | select(.state == "active")]')

MEMBER_COUNT=$(echo "${MEMBERS}" | jq length)
log "Found ${MEMBER_COUNT} active member(s)"

ADDED=0
FAILED=0
SKIPPED=0

while IFS=' ' read -r user_id username; do
  [[ -z "${user_id}" ]] && continue

  # Resolve email
  email=$(gitlab_get "users/${user_id}" | jq -r '.email // empty')

  if [[ -z "${email}" || "${email}" == "null" ]]; then
    log "  ! ${username} — no email, skipping"
    SKIPPED=$((SKIPPED + 1))
    continue
  fi

  output=$(argocd proj role add-group "${ARGOCD_PROJECT}" "${ARGOCD_ROLE}" "${email}" 2>&1) && {
    log "  + ${email}"
    ADDED=$((ADDED + 1))
  } || {
    log "  x ${email} — ${output}"
    FAILED=$((FAILED + 1))
  }

done < <(echo "${MEMBERS}" | jq -r '.[] | "\(.id) \(.username)"')

log "Done — added: ${ADDED}  skipped: ${SKIPPED}  failed: ${FAILED}"
[[ "${FAILED}" -gt 0 ]] && exit 1
exit 0