scan_github_organization.sh

#!/bin/bash

while IFS= read -r ORG_NAME; do
    echo "[*] Processing organization: $ORG_NAME"
    mkdir -p "$ORG_NAME"
    cd "$ORG_NAME" || exit

    #####################################
    # 1. Clone all non-fork repos
    #####################################
    echo "[*] Cloning repositories..."
    for REPO_NAME in $(gh repo list "$ORG_NAME" -L 1000 --json name,isFork --jq '.[] | select(.isFork == false) | .name'); do
        FULL_REPO_URL="https://github.com/$ORG_NAME/$REPO_NAME.git"
        echo "    [+] Cloning $FULL_REPO_URL"
        git clone "$FULL_REPO_URL" "$REPO_NAME"
    done

    #####################################
    # 2. Recover deleted files & blobs
    #####################################
    ROOT_DIR=$(pwd)
    for repo in */; do
        [[ "$repo" == secrets/ ]] && continue

        echo "[*] Recovering deleted data from: $repo"
        cd "$repo" || continue

        # Identify git dir
        if [ -d "./.git" ]; then
            GIT_DIR=".git"
        elif [ -f "config" ] && grep -q "\[core\]" config; then
            GIT_DIR="."
        else
            echo "    [-] Skipping $repo — not a valid git repo"
            cd "$ROOT_DIR" || exit
            continue
        fi

        RESTORE_DIR="$ROOT_DIR/${repo%/}-recovered"
        mkdir -p "$RESTORE_DIR"

        # Recover deleted files
        git --git-dir="$GIT_DIR" rev-list --all | while read -r commit; do
            git --git-dir="$GIT_DIR" diff-tree --no-commit-id --diff-filter=D -r "$commit" | while read -r mode type sha path; do
                [ -f "$RESTORE_DIR/$path" ] && continue
                mkdir -p "$(dirname "$RESTORE_DIR/$path")"
                git --git-dir="$GIT_DIR" show "$sha" > "$RESTORE_DIR/$path" 2>/dev/null && echo "      [restored] $path"
            done
        done

        # Unpack packfiles
        find "$GIT_DIR/objects/pack/" -name "*.pack" 2>/dev/null | while read -r packfile; do
            git --git-dir="$GIT_DIR" unpack-objects < "$packfile"
        done

        # Recover dangling blobs
        git --git-dir="$GIT_DIR" fsck --full --unreachable --no-reflogs | grep 'dangling blob' | cut -d ' ' -f3 | while read -r sha; do
            out_file="$RESTORE_DIR/dangling_$sha"
            git --git-dir="$GIT_DIR" show "$sha" > "$out_file" 2>/dev/null && echo "      [dangling] Saved $out_file"
        done

        cd "$ROOT_DIR" || exit
    done

    #####################################
    # 3. Run TruffleHog on everything
    #####################################
    OUTPUT_DIR="$ROOT_DIR/secrets"
    mkdir -p "$OUTPUT_DIR"
    echo "[*] Running TruffleHog scans..."

    for repo in */; do
        [[ "$repo" == secrets/ || "$repo" == *-recovered/ ]] && continue

        REPO_NAME="${repo%/}"
        REPO_PATH="$ROOT_DIR/$REPO_NAME"
        RECOVERED_PATH="$ROOT_DIR/${REPO_NAME}-recovered"

        SCAN_PATHS="$REPO_PATH"
        [ -d "$RECOVERED_PATH" ] && SCAN_PATHS="$SCAN_PATHS $RECOVERED_PATH"

        OUTPUT_FILE="$OUTPUT_DIR/${REPO_NAME}_secrets.txt"
        echo "    [+] Scanning $REPO_NAME..."
        trufflehog filesystem \
            --only-verified \
            --print-avg-detector-time \
            --include-detectors="all" \
            $SCAN_PATHS > "$OUTPUT_FILE" 2>/dev/null
        echo "        [✔] Results saved to $OUTPUT_FILE"
    done

    echo "[✔] Finished $ORG_NAME"
    cd .. || exit
done < orgs.txt

echo "[🏁] All organizations processed."