From 157a59bbbbd77eaf807ec448ef96112b1c1719f2 Mon Sep 17 00:00:00 2001
From: Caleb Woodbine <c.woodbine@gns.cri.nz>
Date: Wed, 11 Oct 2023 11:24:56 +1300
Subject: [PATCH] chore: add script to write branchprotector checks

from the format of ./hack/list-checks.sh
---
 hack/set-bp-yaml-checks.sh | 43 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100755 hack/set-bp-yaml-checks.sh

diff --git a/hack/set-bp-yaml-checks.sh b/hack/set-bp-yaml-checks.sh
new file mode 100755
index 0000000..e26748b
--- /dev/null
+++ b/hack/set-bp-yaml-checks.sh
@@ -0,0 +1,43 @@
+#!/bin/bash
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+# NOTE must be in format from ./hack/list-checks.sh
+INPUT="$(< /dev/stdin yq e)"
+# NOTE only manages the fields
+# .branch-protection.orgs.ORG.repos.REPO.branches.DEFAULT
+#   - .protect
+#   - .required_status_checks.contexts
+OUTPUT="${1:-}"
+
+if [ -z "$OUTPUT" ]; then
+    cat <<EOF
+usage: $0 OUTPUTFILE.yaml
+EOF
+    exit 1
+fi
+
+if [ ! -f "$OUTPUT" ]; then
+    touch "$OUTPUT"
+fi
+
+for REPO in $(echo "$INPUT" | yq e '. | keys | .[]'); do
+    ORG="$(gh api repos/$REPO --jq '.owner.login')"
+    export ORG
+    REPO="$(gh api repos/$REPO --jq '.name')"
+    export REPO
+    DEFAULT_BRANCH="$(gh api "repos/$ORG/$REPO" --jq .default_branch)"
+    export DEFAULT_BRANCH
+    CHECKS="$(echo "$INPUT" | yq e '.[env(ORG) + "/" + env(REPO)]' -o json | jq -rcM)"
+    export CHECKS
+    echo "$REPO : $CHECKS"
+
+    yq e -i '.branch-protection.orgs[env(ORG)].repos[env(REPO)].branches[env(DEFAULT_BRANCH)] = {
+               "protect": true,
+               "required_status_checks": {
+                 "contexts": env(CHECKS)
+                }
+             }' "$OUTPUT"
+done