Skip to content

Commit 165c88a

Browse files
mickeygoussetCopilot
mickeygousset
and
Copilot
authored
feat: add script to create enterprise team tied to IdP group via SCIM (#150)
* feat: add script to create enterprise team tied to IdP group via SCIM * Update scripts/create-enterprise-team-tied-to-idp-group.sh Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
1 parent 0b8430c commit 165c88a

File tree

2 files changed

+150
-0
lines changed

2 files changed

+150
-0
lines changed

‎scripts/README.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,23 @@ The script generates a JWT that is valid for 10 minutes, which can be used to au
7070
> [!NOTE]
7171
> Requires `openssl` to be installed. The JWT can be used with the GitHub API to generate installation access tokens.
7272
73+
## create-enterprise-team-tied-to-idp-group.sh
74+
75+
Creates an enterprise team in GitHub and ties it to an Identity Provider (IdP) group via SCIM. The script paginates through all SCIM groups in the enterprise to find the target IdP group by display name, then creates an enterprise team linked to that group.
76+
77+
Prerequisites:
78+
79+
- `curl` and `jq` must be installed
80+
- Set the `GH_PAT` environment variable: `export GH_PAT=ghp_abc` (must have `admin:enterprise` scope)
81+
- SCIM/SSO must be configured for the enterprise with IdP groups provisioned
82+
83+
Usage:
84+
85+
```bash
86+
export GH_PAT=ghp_abc
87+
./create-enterprise-team-tied-to-idp-group.sh <enterprise> <team-name> <idp-group-name> [api-url]
88+
```
89+
7390
## delete-branch-protection-rules.ps1
7491

7592
Delete branch protection rules programmatically based on a pattern.

‎scripts/create-enterprise-team-tied-to-idp-group.sh‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
#!/bin/bash
2+
3+
#
4+
# Description:
5+
# Creates an enterprise team in GitHub and ties it to an Identity Provider (IdP)
6+
# group via SCIM. The script first paginates through all SCIM groups in the
7+
# enterprise to find the target IdP group by display name, then creates an
8+
# enterprise team linked to that group.
9+
#
10+
# Usage:
11+
# ./create-enterprise-team-tied-to-idp-group.sh <enterprise> <team-name> <idp-group-name> [api-url]
12+
#
13+
# Parameters:
14+
# enterprise - The enterprise slug (e.g., "fabrikam")
15+
# team-name - The name of the enterprise team to create (e.g., "MyTeam")
16+
# idp-group-name - The display name of the IdP group to link (e.g., "Engineering Team")
17+
# api-url - (Optional) The GitHub API base URL (default: https://api.github.com)
18+
#
19+
# Prerequisites:
20+
# 1. curl and jq must be installed
21+
# 2. Set the GH_PAT environment variable: export GH_PAT=ghp_abc
22+
# - Token must have the `admin:enterprise` scope
23+
# 3. SCIM/SSO must be configured for the enterprise with IdP groups provisioned
24+
#
25+
# Notes:
26+
# - The script paginates through SCIM groups (100 per page) to find the target group
27+
# - If the IdP group is not found, the script exits with an error
28+
# - For GitHub Enterprise Server, pass the API URL as the 4th parameter
29+
# (e.g., https://github.example.com/api/v3)
30+
#
31+
32+
set -e
33+
34+
# --- Input parameters ---
35+
ENTERPRISE=$1 # Enterprise slug
36+
TEAM=$2 # Enterprise team name to create
37+
IDP_GROUP=$3 # IdP group display name to search for
38+
API=${4:-"https://api.github.com"} # GitHub API base URL (optional, defaults to github.com)
39+
40+
# --- Input validation ---
41+
if [ "$#" -lt 3 ]; then
42+
echo "Usage: $0 <enterprise> <team-name> <idp-group-name> [api-url]"
43+
echo ""
44+
echo "Example: $0 fabrikam MyTeam \"Engineering Team\""
45+
exit 1
46+
fi
47+
48+
if [ -z "$ENTERPRISE" ]; then
49+
echo "Error: enterprise slug (first argument) must not be empty."
50+
echo "Usage: $0 <enterprise> <team-name> <idp-group-name> [api-url]"
51+
exit 1
52+
fi
53+
54+
if [ -z "$TEAM" ]; then
55+
echo "Error: team name (second argument) must not be empty."
56+
echo "Usage: $0 <enterprise> <team-name> <idp-group-name> [api-url]"
57+
exit 1
58+
fi
59+
60+
if [ -z "$IDP_GROUP" ]; then
61+
echo "Error: IdP group name (third argument) must not be empty."
62+
echo "Usage: $0 <enterprise> <team-name> <idp-group-name> [api-url]"
63+
exit 1
64+
fi
65+
if [ -z "$GH_PAT" ]; then
66+
echo "Error: GH_PAT environment variable is not set."
67+
echo "Set it with: export GH_PAT=ghp_abc"
68+
exit 1
69+
fi
70+
71+
# --- Paginate through SCIM groups to find the target IdP group ---
72+
PAGE_SIZE=100 # Number of SCIM groups to fetch per page
73+
START_INDEX=1 # SCIM pagination start index (1-based)
74+
GROUP_ID="" # Will hold the SCIM group ID once found
75+
76+
while true; do
77+
RESPONSE=$(curl -s \
78+
-H "Authorization: Bearer $GH_PAT" \
79+
-H "Accept: application/scim+json" \
80+
-H "X-GitHub-Api-Version: 2022-11-28" \
81+
"$API/scim/v2/enterprises/$ENTERPRISE/Groups?startIndex=$START_INDEX&count=$PAGE_SIZE")
82+
83+
# Try to find the group in this page by matching the display name
84+
GROUP_ID=$(echo "$RESPONSE" | jq -r ".Resources[] | select(.displayName==\"$IDP_GROUP\") | .id")
85+
86+
# If found, break out of the loop
87+
if [[ -n "$GROUP_ID" ]]; then
88+
break
89+
fi
90+
91+
# Check if there are more pages to fetch
92+
TOTAL=$(echo "$RESPONSE" | jq -r ".totalResults")
93+
START_INDEX=$((START_INDEX + PAGE_SIZE))
94+
95+
if [[ $START_INDEX -gt $TOTAL ]]; then
96+
echo "Group '$IDP_GROUP' not found in $TOTAL groups."
97+
break
98+
fi
99+
100+
echo "Group not found in this page, fetching next page (startIndex=$START_INDEX)..."
101+
done
102+
103+
echo "Finished searching for group '$IDP_GROUP'."
104+
echo "GROUP_ID: $GROUP_ID"
105+
106+
# Exit if GROUP_ID was not found
107+
if [[ -z "$GROUP_ID" ]]; then
108+
echo "Cannot create team without a valid GROUP_ID. Exiting."
109+
exit 1
110+
fi
111+
112+
# --- Create the enterprise team tied to the IdP group ---
113+
echo ""
114+
echo "Creating enterprise team '$TEAM' with IdP group '$IDP_GROUP' (group_id: $GROUP_ID)..."
115+
CREATE_RESPONSE=$(curl -s -w "\n%{http_code}" \
116+
-X POST \
117+
-H "Accept: application/vnd.github+json" \
118+
-H "Authorization: Bearer $GH_PAT" \
119+
-H "X-GitHub-Api-Version: 2022-11-28" \
120+
"$API/enterprises/$ENTERPRISE/teams" \
121+
-d "$(jq -n --arg name "$TEAM" --arg gid "$GROUP_ID" '{name: $name, group_id: $gid}')")
122+
123+
HTTP_CODE=$(echo "$CREATE_RESPONSE" | tail -1) # Extract HTTP status code
124+
BODY=$(echo "$CREATE_RESPONSE" | sed '$d') # Extract response body
125+
126+
if [[ "$HTTP_CODE" == "201" ]]; then
127+
echo "Team '$TEAM' created successfully!"
128+
echo "$BODY" | jq .
129+
else
130+
echo "Failed to create team. HTTP $HTTP_CODE"
131+
echo "$BODY" | jq .
132+
exit 1
133+
fi

0 commit comments

Comments
 (0)