github-codecov-audit.sh

#!/usr/bin/env bash
# based upon https://gist.github.com/mbohun/b161521b2440b9f08b59
# re: https://about.codecov.io/security-update/

DEBUG=false
GITHUB_API_BASE="https://api.github.com"
GITHUB_API_REST="/orgs/wikimedia/repos"
GITHUB_API_HEADER_ACCEPT="Accept: application/vnd.github.v3+json"

# set GITHUB_TOKEN
source .env

github_api_data=""
cwd=$(pwd)

function rest_call {
    curl -s $1 -H "${GITHUB_API_HEADER_ACCEPT}" -H "Authorization: token $GITHUB_TOKEN"
}

# single page result-s (no pagination), have no link: section, the grep result is empty
last_page=$(curl -s -I "${GITHUB_API_BASE}${GITHUB_API_REST}" -H "${GITHUB_API_HEADER_ACCEPT}" \
    -H "Authorization: token $GITHUB_TOKEN" | grep '^link:' | sed -e 's/^link:.*page=//g' -e 's/>.*$//g')

# does this result use pagination? (or in abbreviated debug mode)
if [ -z "$last_page" ] || [ $DEBUG = true ]; then
    # no - this result has only one page
    github_api_data+=$(rest_call "${GITHUB_API_BASE}${GITHUB_API_REST}" | sed '1d;$d')
elif [ $DEBUG = false ]; then
    # yes - this result is on multiple pages
    for p in `seq 1 $last_page`; do
        github_api_data+=$(rest_call "${GITHUB_API_BASE}${GITHUB_API_REST}?page=$p" | sed '1d;$d')
        if [ $p != $last_page ]; then
            github_api_data+=","
        fi  
    done
fi

# filter mirrored repositories based upon common strings
deduped_repo_urls=$(echo "[ $github_api_data ]" | jq '[ .[] | select(.archived==false and .disabled==false and (.description | values | test("Mirror.+of|Mirorr.+of|Mirror.+from|Github.+mirror|is.+a.+mirror"; "i") | not)) ] | .[] | .html_url')

for url in ${deduped_repo_urls[@]}
do
    proc_url=$(echo $url | tr -d '"')
    str_url=$(echo ${url#*\/wikimedia\/} | tr -d '"')
    gerrit_api_response=$(curl -s "https://gerrit.wikimedia.org/r/projects/?query=$str_url" | sed 1d | jq '.[] | select(.state=="ACTIVE")' | xargs)
    # no duplicate results found
    if [ "$gerrit_api_response"  == "" ]; then
        git clone --quiet $proc_url repos/$str_url > /dev/null
        cd repos/$str_url
        echo -e "----- $proc_url -----\n\n"
        git_log_data=$(git log --all -p -G"codecov.io/bash|Codecov-bash|Codecov-action|Codecov-circleci-orb|Codecov-bitrise-step")
        echo "$git_log_data"
        cd "$cwd"
    fi
done