Audit Requirements

audit.rb

#!/usr/bin/env ruby
# Generates a CSV report listing all organizations, their teams,
# team permissions, team repositories, and team members
#
# Written for https://github.zendesk.com/agent/tickets/19831
# Caveats: Does not list personal repositories
#
# Set OCTOKIT_ACCESS_TOKEN to a token with read:org scope owned by a site admin
# and OCTOKIT_API_ENDPOINT to http(s)://[your-hostname]/api/v3/
#
# Use `ghe-org-owner-promote` to make the site admin an owner of all
# organizations
require 'octokit'

# Uncomment this line if you're using a self-signed SSL certificate
# Octokit.connection_options[:ssl] = { verify: false }
ghe = Octokit::Client.new

puts 'Organization,Team,Permission,Repository,User'
ghe.orgs(ghe.user).each do |org|
  ghe.org_teams(org.login).each do |team|
    begin
      repos = ghe.team_repositories(team.id).map(&:name)
    rescue  Octokit::NotFound
      repos = ['']
    end

    ghe.team_members(team.id).each do |member|
      repos.each do |repo|
        puts "#{org.login},#{team.name},#{team.permission},#{repo},#{member.login}"
      end
    end
  end
end

Gemfile

source 'https://rubygems.org'

gem 'octokit'

instructions.md

In order to run audit.rb you'll need:

• An environment capable to run Ruby scripts.
• Download audit.rb and Gemfile to a new folder
• Install the script dependencies by running bundle install

To get an instance wide audit you'll also need to:

• Log in as the GHE Site Admin and generate a personal access token with read:org scope
• SSH into the GHE VM and run ghe-org-owner-promote. This will make the site admin an owner in all organizations.
• Set OCTOKIT_ACCESS_TOKEN to the token you've just generated
• Set OCTOKIT_API_ENDPOINT to http(s)://[your-hostname]/api/v3/
• Run the script