ghreport: what state are an org's repos in?

ghsync answers "do I have all the code locally and up to date?" ghreport answers the companion question: "across everything I can see, what needs attention right now?" It is read-only - it never clones, pulls, or mutates anything.

It reuses ghsync's discovery so the team-union / org-repo-list logic lives in exactly one place: ghreport shells out to ghsync --porcelain to get the deduplicated repo list, then queries each repo's remote state over gh api.

What it reports, per repo

The no-access rule

Security-alert and branch-protection endpoints require admin on the repo. When the caller is denied (403/404), ghreport reports n/a (alerts) or unknown (protection) - never a clean 0. Reporting "no access" as "no problems" would be a dangerous lie, so the two are kept distinct. A repo whose own metadata can't be read at all is listed as could not assess.

How to run it

The script lives next to this file. Claude Code writes this skill's directory into the script paths below when it loads the skill, so each path is already absolute:

# Org is derived from the directory you run in, exactly like ghsync. To report
# on the "meridianhub" org, run from a directory named meridianhub:
cd ~/dev/github.com/meridianhub
bash "${CLAUDE_SKILL_DIR}/scripts/ghreport.sh"

Override the org or target directory explicitly when they differ:

bash "${CLAUDE_SKILL_DIR}/scripts/ghreport.sh" --org meridianhub --root ~/dev/github.com/meridianhub

What to do when invoked

1. Run it from (or pointed at) the org directory. It streams a progress dot per repo, then prints the summary.
2. Read the headline - the counts of repos with failing CI, open alerts, and an unprotected default branch. These are the repos that need attention.
3. Surface the "Needs attention" list to the user verbatim; that is the actionable core of the report.
4. Point at the saved file (org-state-<org>-<date>.md in the root) for the full per-repo table.

Flags

Output

• Terminal: a one-line headline (counts that tripped a signal), a rollup table, and a "Needs attention" section listing only the repos with an issue.
• File (unless --no-file): org-state-<org>-<YYYY-MM-DD>.md in the root, with the full table and per-section detail.

Requirements

• gh and jq on PATH, and gh auth status authenticated (the same prerequisites as ghsync; discovery is delegated to it).
• For a GitHub Enterprise host, set GH_HOST or gh auth login --hostname first, as with ghsync.
• Very large orgs make many REST calls (~5 per repo); use --limit to sample.