ghreport

# ghreport: what state are an org's repos in? `ghsync` answers "do I have all the code locally and up to date?" `ghreport` answers the companion question: "across everything I can see, what needs attention right now?" It is **read-only** - it never clones, pulls, or mutates anything. It reuses `ghsync`'s discovery so the team-union / org-repo-list logic lives in exactly one place: `ghreport` shells out to `ghsync --porcelain` to get the deduplicated repo list, then queries each repo's remote state over `gh api`. ## What it reports, per repo | Signal | Source | Reported as | |--------|--------|-------------| | Open PRs | `repos/{o}/{r}/pulls?state=open` | count (drafts noted) | | CI on default branch | latest completed run per workflow on the default branch | `pass` / `fail` (names the failing workflows) / `none` | | Security alerts | Dependabot + code-scanning + secret-scanning, `?state=open` | three counts, or `n/a` (no-access) | | Branch protection | `repos/{o}/{r}/branches/{default}/protection` | `protected` / `unprotected` / `unknown` | ### The no-access rule Security-alert and branch-protection endpoints require admin on the repo. When the caller is denied (`403`/`404`), `ghreport` reports `n/a` (alerts) or `unknown` (protection) - **never** a clean `0`. Reporting "no access" as "no problems" would be a dangerous lie, so the two are kept distinct. A repo whose own metadata can't be read at all is listed as `could not assess`. ## How to run it The script lives nex...