From 6d69ad9aefcc792e9df6c23e5810efba78946c0c Mon Sep 17 00:00:00 2001
From: Patrick Lewis <4015312+locus313@users.noreply.github.com>
Date: Fri, 26 Jun 2026 22:16:53 -0700
Subject: [PATCH] =?UTF-8?q?fix:=20ponytail=20audit=20=E2=80=94=20remove=20?=
 =?UTF-8?q?~330=20lines=20of=20redundant=20code?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- lib: add err(), --api-version param to gh_api()
- close-archived-alerts: collapse 3 close_*_alerts() into 1 generic
  close_alerts(); replace hand-rolled pagination with gh_api_paginate
- copilot-report: collapse _copilot_api() 30→3 lines using --api-version;
  remove info()/warn() pass-through aliases
- repo-permissions-report: remove info() pass-through alias
- dockerfile-discovery: delete dead gh_api_link() + RESPONSE_LINK global;
  remove vestigial print_* redefines; inline check_prerequisites()
- get-public-repos: inline check_prerequisites(); drop no-op print_error override
- 7 pagination scripts: remove local get_repo_pagination() wrappers, use
  lib get_repo_page_count() directly
- organize-stars: replace 7-line command check loop with require_command
- archive-old-repos: inline validate_environment(); move local declarations
  to assignment site; drop stale comments
- auto-repo-creation: merge add_teams_to_repo + add_repo_owners_to_repo
  into single add_team_to_repo with permission param
- docs: update AGENTS.md and copilot-instructions.md with err(), --api-version,
  correct pagination example, and fill blank shared-library section

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/copilot-instructions.md               |  22 +-
 AGENTS.md                                     |   3 +-
 .../github-dockerfile-discovery.sh            |  64 +-----
 .../github-get-public-repos.sh                |  16 +-
 lib/github-common.sh                          |  15 +-
 ...ithub-add-repo-collaborators-by-pattern.sh |  12 +-
 .../github-add-repo-permissions.sh            |  11 +-
 .../github-archive-old-repos.sh               |  97 +++------
 .../github-auto-repo-creation.sh              |  29 +--
 ...hub-close-archived-repo-security-alerts.sh | 205 ++++--------------
 .../github-enable-issues.sh                   |  19 +-
 .../github-get-repo-list.sh                   |  11 +-
 ...ithub-migrate-internal-repos-to-private.sh |  11 +-
 .../github-organize-stars.sh                  |   9 +-
 .../github-copilot-report.sh                  |  78 ++-----
 .../github-monthly-issues-report.sh           |  11 +-
 .../github-repo-permissions-report.sh         |  19 +-
 17 files changed, 149 insertions(+), 483 deletions(-)

diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index ea19be4..02aa54c 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -23,6 +23,19 @@ Each script follows the `github-<script-name>/github-<script-name>.sh` naming co
 
 Provides reusable helpers sourced by scripts:
 
+| Function | Purpose |
+|----------|---------|
+| `print_status` / `print_success` / `print_warning` / `print_error` | Colored output |
+| `err <message>` | `print_error` + `exit 1` in one call |
+| `require_env_var <VAR>` | Exit with message if variable unset/empty |
+| `require_command <cmd>` | Exit if binary not in PATH |
+| `configure_gh_auth [scope_hint]` | Bridge GITHUB_TOKEN→GH_TOKEN or verify gh auth session |
+| `validate_github_token [bearer]` | Verify GITHUB_TOKEN via /user endpoint |
+| `validate_slug <value> <label>` | Reject values with non-alphanumeric/hyphen/underscore chars |
+| `gh_api <path> [--api-version V] [curl args...]` | Bearer-auth REST helper with 5-retry rate-limit handling; optional `--api-version` overrides the default `2022-11-28` header; returns literal `__404__` or `__422__` for those HTTP statuses — callers must check for these sentinels |
+| `gh_api_paginate <path> [filter] [version]` | Paginated REST helper, follows Link headers, streams items; returns silently with empty output on 404/422 |
+| `get_enterprise_orgs` | Three-tier enterprise org resolver (REST → GraphQL → /user/orgs) |
+| `get_repo_page_count <url>` | Returns total pages for a paginated endpoint |
 
 ### Script Anatomy (Standardized Pattern)
 
@@ -84,12 +97,7 @@ API_URL_PREFIX=${API_URL_PREFIX:-'https://api.github.com'}
 
 For org-level repo iteration (REST):
 ```bash
-get_repo_pagination () {
-    repo_pages=$(curl -H "Authorization: token ${GITHUB_TOKEN}" -I "${API_URL_PREFIX}/orgs/${ORG}/repos?per_page=100" | grep -Eo '&page=[0-9]+' | grep -Eo '[0-9]+' | tail -1;)
-    echo "${repo_pages:-1}"
-}
-
-for PAGE in $(seq "$(get_repo_pagination)"); do
+for PAGE in $(seq "$(get_repo_page_count "${API_URL_PREFIX}/orgs/${ORG}/repos?per_page=100")"); do
   # Process repos on this page with per_page=100
 done
 ```
@@ -101,7 +109,7 @@ For enterprise-level org iteration (GraphQL), use cursor-based pagination — se
 Rate limiting delays are calibrated per operation type:
 - **Repo-level operations** (permission grants, archival): `sleep 5` between each repository.
 - **Code search** (`github-dockerfile-discovery`): configurable via `SEARCH_SLEEP` (default 2 s) and `CONTENT_SLEEP` (default 1 s).
-- **gh_api helper** (lib): auto-retries up to 5 times on HTTP 403/429, sleeping 60 s before each retry. Returns the literal string `__404__` or `__422__` (exit 0) for those HTTP statuses instead of failing — every caller must check for these sentinels before passing the result to `jq`. `gh_api_paginate` returns silently with empty output on 404/422.
+- **gh_api helper** (lib): auto-retries up to 5 times on HTTP 403/429, sleeping 60 s before each retry. Pass `--api-version VERSION` immediately after the URL to override the default `2022-11-28` header. Returns the literal string `__404__` or `__422__` (exit 0) for those HTTP statuses instead of failing — every caller must check for these sentinels before passing the result to `jq`. `gh_api_paginate` returns silently with empty output on 404/422.
 
 ### Authentication Headers
 
diff --git a/AGENTS.md b/AGENTS.md
index fcdd0b4..6a70967 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -140,12 +140,13 @@ Always use `SCRIPT_DIR` to build the path to `lib/github-common.sh`. The library
 | Function | Purpose |
 |----------|---------|
 | `print_status` / `print_success` / `print_warning` / `print_error` | Colored output |
+| `err <message>` | `print_error` + `exit 1` in one call |
 | `require_env_var <VAR>` | Exit with message if variable unset/empty |
 | `require_command <cmd>` | Exit if binary not in PATH |
 | `configure_gh_auth [scope_hint]` | Bridge GITHUB_TOKEN→GH_TOKEN or verify gh auth session |
 | `validate_github_token [bearer]` | Verify GITHUB_TOKEN via /user endpoint |
 | `validate_slug <value> <label>` | Reject values with non-alphanumeric/hyphen/underscore chars |
-| `gh_api <path> [curl args...]` | Bearer-auth REST helper with 5-retry rate-limit handling; returns literal `__404__` or `__422__` for those HTTP statuses — callers must check for these sentinels |
+| `gh_api <path> [--api-version V] [curl args...]` | Bearer-auth REST helper with 5-retry rate-limit handling; optional `--api-version` overrides the default `2022-11-28` header; returns literal `__404__` or `__422__` for those HTTP statuses — callers must check for these sentinels |
 | `gh_api_paginate <path> [filter] [version]` | Paginated REST helper, follows Link headers, streams items; returns silently with empty output on 404/422 |
 | `get_enterprise_orgs` | Three-tier enterprise org resolver (REST → GraphQL → /user/orgs) |
 | `get_repo_page_count <url>` | Returns total pages for a paginated endpoint |
diff --git a/enterprise/github-dockerfile-discovery/github-dockerfile-discovery.sh b/enterprise/github-dockerfile-discovery/github-dockerfile-discovery.sh
index 29d0523..2e337e8 100755
--- a/enterprise/github-dockerfile-discovery/github-dockerfile-discovery.sh
+++ b/enterprise/github-dockerfile-discovery/github-dockerfile-discovery.sh
@@ -32,11 +32,6 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=../../lib/github-common.sh
 source "${SCRIPT_DIR}/../../lib/github-common.sh"
-# Redirect status output to stderr — stdout is reserved for CSV data
-print_status()  { echo -e "${BLUE}[INFO]${NC}    $1" >&2; }
-print_success() { echo -e "${GREEN}[SUCCESS]${NC} $1" >&2; }
-print_warning() { echo -e "${YELLOW}[WARNING]${NC} $1" >&2; }
-print_error()   { echo -e "${RED}[ERROR]${NC}   $1" >&2; }
 
 ###
 ## GLOBAL VARIABLES
@@ -68,60 +63,6 @@ cleanup() {
 }
 trap cleanup EXIT
 
-###
-## Prerequisite checks
-###
-check_prerequisites() {
-  print_status "Checking prerequisites..."
-  require_command curl
-  require_command jq
-  require_command base64
-  require_env_var GITHUB_TOKEN "GITHUB_TOKEN"
-  print_success "Prerequisites OK"
-}
-
-###
-## gh_api_link – like gh_api but also returns the Link header for pagination
-## Writes body to stdout, sets global RESPONSE_LINK
-###
-RESPONSE_LINK=""
-gh_api_link() {
-  local url="$1"
-  shift
-  [[ "${url}" == http* ]] || url="${API_URL_PREFIX}${url}"
-
-  local attempt
-  for attempt in 1 2 3 4 5; do
-    local response
-    response=$(curl -s -D - \
-      -H "Authorization: Bearer ${GITHUB_TOKEN}" \
-      -H "Accept: application/vnd.github+json" \
-      -H "X-GitHub-Api-Version: 2022-11-28" \
-      "$@" "${url}")
-
-    local http_code
-    http_code=$(echo "${response}" | head -1 | grep -oE '[0-9]{3}' | head -1)
-    RESPONSE_LINK=$(echo "${response}" | grep -i '^Link:' | tr -d '\r' | sed 's/Link: //' || true)
-    local body
-    body=$(echo "${response}" | awk 'BEGIN{p=0} /^\r?$/{p=1; next} p{print}')
-
-    if [[ "${http_code}" == "200" ]]; then
-      echo "${body}"
-      return 0
-    elif [[ "${http_code}" == "403" || "${http_code}" == "429" ]]; then
-      local retry_after=60
-      print_warning "Rate limited (HTTP ${http_code}). Sleeping ${retry_after}s..."
-      sleep "${retry_after}"
-    else
-      print_warning "HTTP ${http_code} for ${url} (attempt ${attempt}/5)"
-      sleep 5
-    fi
-  done
-
-  print_error "Failed to GET ${url} after 5 attempts"
-  return 1
-}
-
 ###
 ## search_dockerfiles_in_org <org>
 ## Appends TSV rows (org TAB repo_full_name TAB path TAB html_url) to REFS_TEMP
@@ -383,7 +324,10 @@ build_text_summary() {
 ## MAIN
 ###
 main() {
-  check_prerequisites
+  require_command curl
+  require_command jq
+  require_command base64
+  require_env_var GITHUB_TOKEN "GITHUB_TOKEN"
   validate_github_token
 
   mkdir -p "${REPORT_DIR}"
diff --git a/enterprise/github-get-public-repos/github-get-public-repos.sh b/enterprise/github-get-public-repos/github-get-public-repos.sh
index e5515d2..9614012 100755
--- a/enterprise/github-get-public-repos/github-get-public-repos.sh
+++ b/enterprise/github-get-public-repos/github-get-public-repos.sh
@@ -33,7 +33,6 @@ source "${SCRIPT_DIR}/../../lib/github-common.sh"
 print_status()  { echo -e "${BLUE}[INFO]${NC}    $1" >&2; }
 print_success() { echo -e "${GREEN}[SUCCESS]${NC} $1" >&2; }
 print_warning() { echo -e "${YELLOW}[WARNING]${NC} $1" >&2; }
-print_error()   { echo -e "${RED}[ERROR]${NC}   $1" >&2; }
 
 ###
 ## GLOBAL VARIABLES
@@ -60,17 +59,6 @@ cleanup() {
 }
 trap cleanup EXIT
 
-###
-## Prerequisite checks
-###
-check_prerequisites() {
-  print_status "Checking prerequisites..."
-  require_command curl
-  require_command jq
-  require_env_var GITHUB_TOKEN "GITHUB_TOKEN"
-  print_success "Prerequisites OK"
-}
-
 ###
 ## resolve_orgs
 ## Returns the final deduplicated list of org logins to scan.
@@ -186,7 +174,9 @@ get_public_repos_for_org() {
 ## Main
 ###
 main() {
-  check_prerequisites
+  require_command curl
+  require_command jq
+  require_env_var GITHUB_TOKEN "GITHUB_TOKEN"
   validate_github_token
 
   mkdir -p "${REPORT_DIR}"
diff --git a/lib/github-common.sh b/lib/github-common.sh
index 1ea2647..5efec66 100755
--- a/lib/github-common.sh
+++ b/lib/github-common.sh
@@ -18,7 +18,7 @@
 #   validate_github_token [bearer]            — verify GITHUB_TOKEN via /user endpoint
 #   validate_token <VAR_NAME>                 — verify a secondary token variable
 #   validate_slug <value> [label]             — exit if value contains unsafe chars
-#   gh_api <path|url> [curl args...]          — Bearer-auth REST helper with retry;
+#   gh_api <path|url> [--api-version V] [curl args…] — Bearer-auth REST helper with retry;
 #                                               returns "__404__"/"__422__" (exit 0) for those codes
 #   gh_api_paginate <path> [filter] [version] — paginated REST, follows Link headers;
 #                                               silently returns empty output on 404/422
@@ -50,6 +50,7 @@ print_status()  { echo -e "${BLUE}[INFO]${NC} $1"; }
 print_success() { echo -e "${GREEN}[SUCCESS]${NC} $1"; }
 print_warning() { echo -e "${YELLOW}[WARNING]${NC} $1"; }
 print_error()   { echo -e "${RED}[ERROR]${NC} $1" >&2; }
+err()           { print_error "$*"; exit 1; }
 
 ###
 ## require_env_var <VAR_NAME> [description]
@@ -167,15 +168,21 @@ validate_slug() {
 }
 
 ###
-## gh_api <path_or_full_url> [extra curl args...]
+## gh_api <path_or_full_url> [--api-version VERSION] [extra curl args...]
 ## GitHub REST/GraphQL API helper with Bearer auth and rate-limit retries.
 ## Prepends API_URL_PREFIX when the first argument starts with /.
 ## Returns __404__ / __422__ for those status codes rather than failing.
-## Any extra arguments after the URL are passed directly to curl (e.g. -X POST -d ...).
+## Pass --api-version VERSION immediately after the URL to override the default
+## API version (2022-11-28). Any remaining arguments are passed to curl.
 ###
 gh_api() {
   local url="$1"
+  local api_version="2022-11-28"
   shift
+  if [[ "${1:-}" == "--api-version" ]]; then
+    api_version="$2"
+    shift 2
+  fi
   [[ "${url}" == http* ]] || url="${API_URL_PREFIX}${url}"
 
   local attempt
@@ -184,7 +191,7 @@ gh_api() {
     body=$(curl -s -w "\n%{http_code}" \
       -H "Authorization: Bearer ${GITHUB_TOKEN}" \
       -H "Accept: application/vnd.github+json" \
-      -H "X-GitHub-Api-Version: 2022-11-28" \
+      -H "X-GitHub-Api-Version: ${api_version}" \
       "$@" "${url}")
     http_code=$(echo "${body}" | tail -1)
     body=$(echo "${body}" | sed '$d')
diff --git a/org-admin/github-add-repo-collaborators-by-pattern/github-add-repo-collaborators-by-pattern.sh b/org-admin/github-add-repo-collaborators-by-pattern/github-add-repo-collaborators-by-pattern.sh
index 0cdf32e..7181f95 100755
--- a/org-admin/github-add-repo-collaborators-by-pattern/github-add-repo-collaborators-by-pattern.sh
+++ b/org-admin/github-add-repo-collaborators-by-pattern/github-add-repo-collaborators-by-pattern.sh
@@ -51,16 +51,6 @@ usage() {
   echo "Optional: PERMISSION=push REPO_EXCLUDE_REGEX=<regex> API_URL_PREFIX=<url>"
 }
 
-get_repo_pagination() {
-  local repo_pages
-  repo_pages=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" -I "${API_URL_PREFIX}/orgs/${ORG}/repos?per_page=100" | grep -Eo '&page=[0-9]+' | grep -Eo '[0-9]+' | tail -1)
-  echo "${repo_pages:-1}"
-}
-
-limit_repo_pagination() {
-  seq "$(get_repo_pagination)"
-}
-
 validate() {
   require_env_var GITHUB_TOKEN "GitHub token"
   require_env_var ORG "GitHub organization"
@@ -79,7 +69,7 @@ validate() {
 
 get_matching_repos() {
   local page repos_json
-  for page in $(limit_repo_pagination); do
+  for page in $(seq "$(get_repo_page_count "${API_URL_PREFIX}/orgs/${ORG}/repos?per_page=100")"); do
     repos_json=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/json" "${API_URL_PREFIX}/orgs/${ORG}/repos?type=all&per_page=100&page=${page}&sort=full_name")
 
     if [ -n "${REPO_EXCLUDE_REGEX}" ]; then
diff --git a/org-admin/github-add-repo-permissions/github-add-repo-permissions.sh b/org-admin/github-add-repo-permissions/github-add-repo-permissions.sh
index 7883212..4784279 100755
--- a/org-admin/github-add-repo-permissions/github-add-repo-permissions.sh
+++ b/org-admin/github-add-repo-permissions/github-add-repo-permissions.sh
@@ -70,15 +70,6 @@ if [ -n "${REPO_NAME_FILTER}" ]; then
   print_status "Repository filter: ${REPO_NAME_FILTER}*"
 fi
 
-get_repo_pagination () {
-    repo_pages=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" -I "${API_URL_PREFIX}/orgs/${ORG}/repos?per_page=100" | grep -Eo '&page=[0-9]+' | grep -Eo '[0-9]+' | tail -1;)
-    echo "${repo_pages:-1}"
-}
-
-limit_repo_pagination () {
-  seq "$(get_repo_pagination)"
-}
-
 apply_team_permissions () {
   local REPO_NAME=$1
   local PERMISSION=$2
@@ -107,7 +98,7 @@ process_repos () {
   local REPO
   local repos_json
 
-  for PAGE in $(limit_repo_pagination); do
+  for PAGE in $(seq "$(get_repo_page_count "${API_URL_PREFIX}/orgs/${ORG}/repos?per_page=100")"); do
     repos_json=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" "${API_URL_PREFIX}/orgs/${ORG}/repos?page=${PAGE}&per_page=100&sort=full_name")
 
     if ! echo "${repos_json}" | jq -e 'type == "array"' > /dev/null 2>&1; then
diff --git a/org-admin/github-archive-old-repos/github-archive-old-repos.sh b/org-admin/github-archive-old-repos/github-archive-old-repos.sh
index 6cea6bf..4dcedf5 100755
--- a/org-admin/github-archive-old-repos/github-archive-old-repos.sh
+++ b/org-admin/github-archive-old-repos/github-archive-old-repos.sh
@@ -49,36 +49,11 @@ cleanup() {
 
 trap cleanup EXIT
 
-###
-## VALIDATION
-###
-validate_environment() {
-    print_status "Validating environment..."
-    require_env_var GITHUB_TOKEN "GitHub token"
-    require_env_var ORG "GitHub organization"
-    require_command jq
-    validate_github_token
-    print_success "Environment validation complete"
-}
-
-###
-## PAGINATION FUNCTIONS
-###
-get_repo_pagination() {
-    repo_pages=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" -I "${API_URL_PREFIX}/orgs/${ORG}/repos?per_page=100" | grep -Eo '&page=[0-9]+' | grep -Eo '[0-9]+' | tail -1;)
-    echo "${repo_pages:-1}"
-}
-
-limit_repo_pagination() {
-    seq "$(get_repo_pagination)"
-}
-
 ###
 ## DATE CALCULATION
 ###
 calculate_cutoff_date() {
-    # Calculate the cutoff date (5 years ago)
-    # Using 'date' command compatible with both GNU and BSD date
+    # Using 'date' compatible with both GNU (Linux) and BSD (macOS)
     if date -v-1d > /dev/null 2>&1; then
         # BSD date (macOS)
         CUTOFF_DATE=$(date -u -v-${YEARS_THRESHOLD}y +"%Y-%m-%dT%H:%M:%SZ")
@@ -95,73 +70,56 @@ calculate_cutoff_date() {
 fetch_old_repos() {
     local cutoff_date="$1"
     local total_old_repos=0
-    local PAGE
-    local REPOS
-    local REPO_NAME
-    local REPO_PAYLOAD
-    local REPO_FULLNAME
-    local REPO_PRIVATE
-    local REPO_ARCHIVED
-    local REPO_HTMLURL
-    local REPO_DESCRIPTION
-    local REPO_FORK
-    local REPO_UPDATEDAT
-    local UPDATED_EPOCH
-    local CURRENT_EPOCH
-    local DAYS_SINCE
-    local ESCAPED_DESC
-    
+
     print_status "Cutoff date: $cutoff_date (repos not updated since this date will be identified)"
     print_status "Fetching repositories from organization: $ORG"
-    
+
     # Initialize CSV with headers
     echo "name,full_name,private,archived,html_url,description,fork,last_updated,days_since_update" > "$REPORT_FILE"
-    
-    for PAGE in $(limit_repo_pagination); do
+
+    for PAGE in $(seq "$(get_repo_page_count "${API_URL_PREFIX}/orgs/${ORG}/repos?per_page=100")"); do
         print_status "Processing page $PAGE..."
-        
+
+        local REPOS
         REPOS=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" "${API_URL_PREFIX}/orgs/${ORG}/repos?page=${PAGE}&per_page=100&sort=updated&direction=asc")
-        
+
         while IFS= read -r REPO_NAME; do
             [ -z "${REPO_NAME}" ] && continue
+            local REPO_PAYLOAD
             REPO_PAYLOAD=$(echo "$REPOS" | jq -r --arg name "$REPO_NAME" '.[] | select(.name == $name)')
-            
-            REPO_FULLNAME=$(echo "$REPO_PAYLOAD" | jq -r .full_name)
-            REPO_PRIVATE=$(echo "$REPO_PAYLOAD" | jq -r .private)
+
+            local REPO_ARCHIVED REPO_UPDATEDAT
             REPO_ARCHIVED=$(echo "$REPO_PAYLOAD" | jq -r .archived)
-            REPO_HTMLURL=$(echo "$REPO_PAYLOAD" | jq -r .html_url)
-            REPO_DESCRIPTION=$(echo "$REPO_PAYLOAD" | jq -r .description)
-            REPO_FORK=$(echo "$REPO_PAYLOAD" | jq -r .fork)
             REPO_UPDATEDAT=$(echo "$REPO_PAYLOAD" | jq -r .updated_at)
-            
-            # Skip already archived repos
+
             if [ "$REPO_ARCHIVED" == "true" ]; then
                 continue
             fi
-            
-            # Compare dates
+
             if [[ "$REPO_UPDATEDAT" < "$cutoff_date" ]]; then
-                # Calculate days since last update
+                local UPDATED_EPOCH CURRENT_EPOCH DAYS_SINCE
                 if date -v-1d > /dev/null 2>&1; then
-                    # BSD date (macOS)
                     UPDATED_EPOCH=$(date -jf "%Y-%m-%dT%H:%M:%SZ" "$REPO_UPDATEDAT" +%s 2>/dev/null || echo "0")
                 else
-                    # GNU date (Linux)
                     UPDATED_EPOCH=$(date -d "$REPO_UPDATEDAT" +%s 2>/dev/null || echo "0")
                 fi
-                
                 CURRENT_EPOCH=$(date +%s)
                 DAYS_SINCE=$((($CURRENT_EPOCH - $UPDATED_EPOCH) / 86400))
-                
-                # Write to CSV (escape description for CSV)
+
+                local REPO_FULLNAME REPO_PRIVATE REPO_HTMLURL REPO_DESCRIPTION REPO_FORK ESCAPED_DESC
+                REPO_FULLNAME=$(echo "$REPO_PAYLOAD" | jq -r .full_name)
+                REPO_PRIVATE=$(echo "$REPO_PAYLOAD"  | jq -r .private)
+                REPO_HTMLURL=$(echo "$REPO_PAYLOAD"  | jq -r .html_url)
+                REPO_DESCRIPTION=$(echo "$REPO_PAYLOAD" | jq -r .description)
+                REPO_FORK=$(echo "$REPO_PAYLOAD"     | jq -r .fork)
                 ESCAPED_DESC=$(echo "$REPO_DESCRIPTION" | sed 's/"/""/g')
                 echo "${REPO_NAME},${REPO_FULLNAME},${REPO_PRIVATE},${REPO_ARCHIVED},${REPO_HTMLURL},\"${ESCAPED_DESC}\",${REPO_FORK},${REPO_UPDATEDAT},${DAYS_SINCE}" >> "$REPORT_FILE"
-                
+
                 total_old_repos=$((total_old_repos + 1))
             fi
         done < <(echo "$REPOS" | jq -r '.[] | .name')
     done
-    
+
     echo "$total_old_repos"
 }
 
@@ -260,8 +218,13 @@ prompt_for_archive() {
 main() {
     print_status "GitHub Old Repository Archival Tool"
     print_status "====================================="
-    
-    validate_environment
+
+    print_status "Validating environment..."
+    require_env_var GITHUB_TOKEN "GitHub token"
+    require_env_var ORG "GitHub organization"
+    require_command jq
+    validate_github_token
+    print_success "Environment validation complete"
     
     CUTOFF_DATE=$(calculate_cutoff_date)
     
diff --git a/org-admin/github-auto-repo-creation/github-auto-repo-creation.sh b/org-admin/github-auto-repo-creation/github-auto-repo-creation.sh
index 3b2c90e..670a508 100755
--- a/org-admin/github-auto-repo-creation/github-auto-repo-creation.sh
+++ b/org-admin/github-auto-repo-creation/github-auto-repo-creation.sh
@@ -33,13 +33,12 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPT_DIR}/../../lib/github-common.sh"
 
 ###
-## GLOBAL VARIABLES - Set default values for the required environment variables
+## GLOBAL VARIABLES
 ###
 GITHUB_TOKEN=${GITHUB_TOKEN:-''}
 ORG=${ORG:-''}
 API_URL_PREFIX=${API_URL_PREFIX:-'https://api.github.com'}
 
-# Set default values for repository names and admin teams and code owners
 REPO_NAMES=${REPO_NAMES:-''}
 ADMIN_TEAMS=${ADMIN_TEAMS:-''}
 REPO_OWNERS=${REPO_OWNERS:-''}
@@ -85,7 +84,6 @@ CODEOWNERS_CONTENT=$(cat << EOF
 EOF
 )
 
-# Function to create a new GitHub repository
 create_github_repo() {
   local repo_name="$1"
   local _payload
@@ -98,7 +96,6 @@ create_github_repo() {
     -d "${_payload}"
 }
 
-# Function to enable branch protection on the main branch
 enable_branch_protection() {
   local repo_name=$1
   curl -s -X PUT -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/vnd.github+json" "${API_URL_PREFIX}/repos/${ORG}/${repo_name}/branches/main/protection" -d "{
@@ -113,7 +110,6 @@ enable_branch_protection() {
   }"
 }
 
-# Function to create a CODEOWNERS file in the repository
 create_codeowners_file() {
   local repo_name=$1
   curl -s -X PUT -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/vnd.github+json" "${API_URL_PREFIX}/repos/${ORG}/${repo_name}/contents/.github/CODEOWNERS" -d "{
@@ -122,25 +118,15 @@ create_codeowners_file() {
   }"
 }
 
-# Function to add a team with admin permissions to the repository
-add_teams_to_repo() {
+# Function to add a team with a given permission to the repository
+add_team_to_repo() {
   local repo_name=$1
   local team_name=$2
+  local permission=$3
   validate_slug "${repo_name}" "repository name"
   validate_slug "${team_name}" "team name"
   curl -s -X PUT -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/vnd.github+json" "${API_URL_PREFIX}/orgs/${ORG}/teams/${team_name}/repos/${ORG}/${repo_name}" -d "{
-    \"permission\": \"admin\"
-  }"
-}
-
-# Function to add a team with write permissions to the repository
-add_repo_owners_to_repo() {
-  local repo_name=$1
-  local team_name=$2
-  validate_slug "${repo_name}" "repository name"
-  validate_slug "${team_name}" "team name"
-  curl -s -X PUT -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/vnd.github+json" "${API_URL_PREFIX}/orgs/${ORG}/teams/${team_name}/repos/${ORG}/${repo_name}" -d "{
-    \"permission\": \"push\"
+    \"permission\": \"${permission}\"
   }"
 }
 
@@ -149,7 +135,6 @@ mapfile -t REPO_NAMES  < <(tr ',' '\n' <<< "${REPO_NAMES}")
 mapfile -t ADMIN_TEAMS < <(tr ',' '\n' <<< "${ADMIN_TEAMS:-}")
 mapfile -t REPO_OWNERS < <(tr ',' '\n' <<< "${REPO_OWNERS}")
 
-# Loop through each repository and perform the required actions
 for repo_name in "${REPO_NAMES[@]}"; do
   echo "Creating repository ${repo_name}"
   create_github_repo "${repo_name}"
@@ -163,14 +148,14 @@ for repo_name in "${REPO_NAMES[@]}"; do
   # Add each admin team to the repository
   for team_name in "${ADMIN_TEAMS[@]}"; do
     echo "Adding team ${team_name} as admin to ${repo_name}"
-    add_teams_to_repo "${repo_name}" "${team_name}"
+    add_team_to_repo "${repo_name}" "${team_name}" "admin"
   done
 
     # Add each repo owner team to the repository with write permissions, but only if it's not an admin team
   for team_name in "${REPO_OWNERS[@]}"; do
     if [[ ! "${ADMIN_TEAMS[*]}" =~ ${team_name} ]]; then
       echo "Adding team ${team_name} as a repo owner (write permission) to ${repo_name}"
-      add_repo_owners_to_repo "${repo_name}" "${team_name}"
+      add_team_to_repo "${repo_name}" "${team_name}" "push"
     fi
   done
 done
\ No newline at end of file
diff --git a/org-admin/github-close-archived-repo-security-alerts/github-close-archived-repo-security-alerts.sh b/org-admin/github-close-archived-repo-security-alerts/github-close-archived-repo-security-alerts.sh
index d5d55be..d6f41ea 100755
--- a/org-admin/github-close-archived-repo-security-alerts/github-close-archived-repo-security-alerts.sh
+++ b/org-admin/github-close-archived-repo-security-alerts/github-close-archived-repo-security-alerts.sh
@@ -48,7 +48,7 @@ DEPENDABOT_REASON=${DEPENDABOT_REASON:-'tolerable_risk'}       # fix_started | i
 CODE_SCANNING_REASON=${CODE_SCANNING_REASON:-"won't fix"}      # false positive | won't fix | used in tests
 SECRET_SCANNING_RESOLUTION=${SECRET_SCANNING_RESOLUTION:-'wont_fix'}  # false_positive | wont_fix | revoked | used_in_tests
 
-ALERT_TYPE='all'   # default, can be overridden by --type flag
+ALERT_TYPE='all'
 DRY_RUN=false
 
 ###
@@ -181,94 +181,40 @@ get_all_pages() {
 }
 
 ###
-## CLOSE DEPENDABOT ALERTS
+## close_alerts <type> <repo> <summary_jq> <action> <payload>
+## Generic alert-closer: fetches all open alerts on the given type endpoint,
+## then dismisses/resolves each one.
+##   type        — endpoint segment and display label (dependabot, code-scanning, secret-scanning)
+##   repo        — repository name (without org prefix)
+##   summary_jq  — jq expression to extract a human-readable alert summary from one alert object
+##   action      — verb for messages and CSV (dismissed | resolved)
+##   payload     — pre-built JSON body for the PATCH request
 ###
-close_dependabot_alerts() {
-  local repo="$1"
-  print_status "[dependabot] Processing ${ORG}/${repo}..."
+close_alerts() {
+  local type="$1" repo="$2" summary_jq="$3" action="$4" payload="$5"
+  local base_path="/repos/${ORG}/${repo}/${type}/alerts"
 
-  local alerts
-  alerts=$(get_all_pages "${API_URL_PREFIX}/repos/${ORG}/${repo}/dependabot/alerts?state=open")
-
-  local count
-  count=$(echo "${alerts}" | jq 'length')
-
-  if [ "${count}" -eq 0 ]; then
-    print_status "[dependabot] No open alerts in ${repo}"
-    return
-  fi
-
-  print_status "[dependabot] Found ${count} open alert(s) in ${repo}"
-
-  for i in $(seq 0 $((count - 1))); do
-    local alert_number summary
-    alert_number=$(echo "${alerts}" | jq -r ".[${i}].number")
-    summary=$(echo "${alerts}" | jq -r ".[${i}].security_advisory.summary // \"N/A\"")
-
-    if [ "${DRY_RUN}" = true ]; then
-      print_warning "[DRY-RUN] Would dismiss dependabot alert #${alert_number} in ${ORG}/${repo}: ${summary}"
-      continue
-    fi
-
-    local http_status _payload
-    _payload=$(jq -n \
-      --arg reason "${DEPENDABOT_REASON}" \
-      '{"state":"dismissed","dismissed_reason":$reason,"dismissed_comment":"Bulk dismissed by repository automation"}')
-    http_status=$(curl -s -o /dev/null -w "%{http_code}" \
-      -X PATCH \
-      -H "Authorization: token ${GITHUB_TOKEN}" \
-      -H "Accept: application/vnd.github+json" \
-      -H "X-GitHub-Api-Version: 2022-11-28" \
-      -H "Content-Type: application/json" \
-      -d "${_payload}" \
-      "${API_URL_PREFIX}/repos/${ORG}/${repo}/dependabot/alerts/${alert_number}")
-
-    if [ "${http_status}" -eq 200 ]; then
-      print_success "[dependabot] Dismissed alert #${alert_number} in ${ORG}/${repo}"
-      echo "$(date -u +"%Y-%m-%dT%H:%M:%SZ"),${ORG},${repo},dependabot,${alert_number},\"${summary}\",dismissed" >> "${REPORT_FILE}"
-      TOTAL_CLOSED=$((TOTAL_CLOSED + 1))
-    else
-      print_error "[dependabot] Failed to dismiss alert #${alert_number} in ${ORG}/${repo} (HTTP ${http_status})"
-      TOTAL_ERRORS=$((TOTAL_ERRORS + 1))
-    fi
-
-    sleep 0.2  # Respect rate limits
-  done
-}
-
-###
-## CLOSE CODE SCANNING ALERTS
-###
-close_code_scanning_alerts() {
-  local repo="$1"
-  print_status "[code-scanning] Processing ${ORG}/${repo}..."
-
-  local alerts
-  alerts=$(get_all_pages "${API_URL_PREFIX}/repos/${ORG}/${repo}/code-scanning/alerts?state=open")
-
-  local count
+  print_status "[${type}] Processing ${ORG}/${repo}..."
+  local alerts count
+  alerts=$(get_all_pages "${API_URL_PREFIX}${base_path}?state=open")
   count=$(echo "${alerts}" | jq 'length')
 
   if [ "${count}" -eq 0 ]; then
-    print_status "[code-scanning] No open alerts in ${repo}"
+    print_status "[${type}] No open alerts in ${repo}"
     return
   fi
-
-  print_status "[code-scanning] Found ${count} open alert(s) in ${repo}"
+  print_status "[${type}] Found ${count} open alert(s) in ${repo}"
 
   for i in $(seq 0 $((count - 1))); do
     local alert_number summary
     alert_number=$(echo "${alerts}" | jq -r ".[${i}].number")
-    summary=$(echo "${alerts}" | jq -r ".[${i}].rule.description // \"N/A\"")
+    summary=$(echo "${alerts}" | jq -r ".[${i}] | ${summary_jq}")
 
     if [ "${DRY_RUN}" = true ]; then
-      print_warning "[DRY-RUN] Would dismiss code-scanning alert #${alert_number} in ${ORG}/${repo}: ${summary}"
+      print_warning "[DRY-RUN] Would ${action} ${type} alert #${alert_number} in ${ORG}/${repo}: ${summary}"
       continue
     fi
 
-    local dismissed_reason_json
-    dismissed_reason_json=$(printf '%s' "${CODE_SCANNING_REASON}" | jq -Rs '.')
-
     local http_status
     http_status=$(curl -s -o /dev/null -w "%{http_code}" \
       -X PATCH \
@@ -276,71 +222,15 @@ close_code_scanning_alerts() {
       -H "Accept: application/vnd.github+json" \
       -H "X-GitHub-Api-Version: 2022-11-28" \
       -H "Content-Type: application/json" \
-      -d "{\"state\":\"dismissed\",\"dismissed_reason\":${dismissed_reason_json},\"dismissed_comment\":\"Bulk dismissed by repository automation\"}" \
-      "${API_URL_PREFIX}/repos/${ORG}/${repo}/code-scanning/alerts/${alert_number}")
+      -d "${payload}" \
+      "${API_URL_PREFIX}${base_path}/${alert_number}")
 
     if [ "${http_status}" -eq 200 ]; then
-      print_success "[code-scanning] Dismissed alert #${alert_number} in ${ORG}/${repo}"
-      echo "$(date -u +"%Y-%m-%dT%H:%M:%SZ"),${ORG},${repo},code-scanning,${alert_number},\"${summary}\",dismissed" >> "${REPORT_FILE}"
+      print_success "[${type}] ${action^} alert #${alert_number} in ${ORG}/${repo}"
+      echo "$(date -u +"%Y-%m-%dT%H:%M:%SZ"),${ORG},${repo},${type},${alert_number},\"${summary}\",${action}" >> "${REPORT_FILE}"
       TOTAL_CLOSED=$((TOTAL_CLOSED + 1))
     else
-      print_error "[code-scanning] Failed to dismiss alert #${alert_number} in ${ORG}/${repo} (HTTP ${http_status})"
-      TOTAL_ERRORS=$((TOTAL_ERRORS + 1))
-    fi
-
-    sleep 0.2
-  done
-}
-
-###
-## CLOSE SECRET SCANNING ALERTS
-###
-close_secret_scanning_alerts() {
-  local repo="$1"
-  print_status "[secret-scanning] Processing ${ORG}/${repo}..."
-
-  local alerts
-  alerts=$(get_all_pages "${API_URL_PREFIX}/repos/${ORG}/${repo}/secret-scanning/alerts?state=open")
-
-  local count
-  count=$(echo "${alerts}" | jq 'length')
-
-  if [ "${count}" -eq 0 ]; then
-    print_status "[secret-scanning] No open alerts in ${repo}"
-    return
-  fi
-
-  print_status "[secret-scanning] Found ${count} open alert(s) in ${repo}"
-
-  for i in $(seq 0 $((count - 1))); do
-    local alert_number secret_type
-    alert_number=$(echo "${alerts}" | jq -r ".[${i}].number")
-    secret_type=$(echo "${alerts}" | jq -r ".[${i}].secret_type_display_name // \"N/A\"")
-
-    if [ "${DRY_RUN}" = true ]; then
-      print_warning "[DRY-RUN] Would resolve secret-scanning alert #${alert_number} in ${ORG}/${repo}: ${secret_type}"
-      continue
-    fi
-
-    local http_status _payload
-    _payload=$(jq -n \
-      --arg resolution "${SECRET_SCANNING_RESOLUTION}" \
-      '{"state":"resolved","resolution":$resolution}')
-    http_status=$(curl -s -o /dev/null -w "%{http_code}" \
-      -X PATCH \
-      -H "Authorization: token ${GITHUB_TOKEN}" \
-      -H "Accept: application/vnd.github+json" \
-      -H "X-GitHub-Api-Version: 2022-11-28" \
-      -H "Content-Type: application/json" \
-      -d "${_payload}" \
-      "${API_URL_PREFIX}/repos/${ORG}/${repo}/secret-scanning/alerts/${alert_number}")
-
-    if [ "${http_status}" -eq 200 ]; then
-      print_success "[secret-scanning] Resolved alert #${alert_number} in ${ORG}/${repo}"
-      echo "$(date -u +"%Y-%m-%dT%H:%M:%SZ"),${ORG},${repo},secret-scanning,${alert_number},\"${secret_type}\",resolved" >> "${REPORT_FILE}"
-      TOTAL_CLOSED=$((TOTAL_CLOSED + 1))
-    else
-      print_error "[secret-scanning] Failed to resolve alert #${alert_number} in ${ORG}/${repo} (HTTP ${http_status})"
+      print_error "[${type}] Failed to ${action} alert #${alert_number} in ${ORG}/${repo} (HTTP ${http_status})"
       TOTAL_ERRORS=$((TOTAL_ERRORS + 1))
     fi
 
@@ -352,33 +242,7 @@ close_secret_scanning_alerts() {
 ## FETCH ARCHIVED REPOS IN ORG
 ###
 print_status "Fetching archived repositories in ${ORG}..."
-REPOS=()
-page=1
-
-while true; do
-  response=$(curl -s \
-    -H "Authorization: token ${GITHUB_TOKEN}" \
-    -H "Accept: application/vnd.github+json" \
-    -H "X-GitHub-Api-Version: 2022-11-28" \
-    "${API_URL_PREFIX}/orgs/${ORG}/repos?type=all&per_page=100&page=${page}")
-
-  if echo "${response}" | jq -e '.message' &>/dev/null; then
-    print_error "Failed to fetch repositories: $(echo "${response}" | jq -r '.message')"
-    exit 1
-  fi
-
-  count=$(echo "${response}" | jq 'length')
-  if [ "${count}" -eq 0 ]; then
-    break
-  fi
-
-  while IFS= read -r repo; do
-    REPOS+=("${repo}")
-  done < <(echo "${response}" | jq -r '.[] | select(.archived == true) | .name')
-
-  page=$((page + 1))
-done
-
+mapfile -t REPOS < <(gh_api_paginate "/orgs/${ORG}/repos?type=all&per_page=100" '.[] | select(.archived == true) | .name')
 REPO_COUNT=${#REPOS[@]}
 print_success "Found ${REPO_COUNT} archived repositories"
 
@@ -390,21 +254,28 @@ echo ""
 ###
 ## MAIN LOOP — iterate over all repos
 ###
+_DEP_PAYLOAD=$(jq -n --arg r "${DEPENDABOT_REASON}" \
+  '{"state":"dismissed","dismissed_reason":$r,"dismissed_comment":"Bulk dismissed by repository automation"}')
+_CS_PAYLOAD=$(jq -n --arg r "${CODE_SCANNING_REASON}" \
+  '{"state":"dismissed","dismissed_reason":$r,"dismissed_comment":"Bulk dismissed by repository automation"}')
+_SS_PAYLOAD=$(jq -n --arg r "${SECRET_SCANNING_RESOLUTION}" \
+  '{"state":"resolved","resolution":$r}')
+
 for repo in "${REPOS[@]}"; do
   case "${ALERT_TYPE}" in
     dependabot)
-      close_dependabot_alerts "${repo}"
+      close_alerts "dependabot"     "${repo}" '.security_advisory.summary // "N/A"' "dismissed" "${_DEP_PAYLOAD}"
       ;;
     code-scanning)
-      close_code_scanning_alerts "${repo}"
+      close_alerts "code-scanning"  "${repo}" '.rule.description // "N/A"'          "dismissed" "${_CS_PAYLOAD}"
       ;;
     secret-scanning)
-      close_secret_scanning_alerts "${repo}"
+      close_alerts "secret-scanning" "${repo}" '.secret_type_display_name // "N/A"' "resolved"  "${_SS_PAYLOAD}"
       ;;
     all)
-      close_dependabot_alerts "${repo}"
-      close_code_scanning_alerts "${repo}"
-      close_secret_scanning_alerts "${repo}"
+      close_alerts "dependabot"     "${repo}" '.security_advisory.summary // "N/A"' "dismissed" "${_DEP_PAYLOAD}"
+      close_alerts "code-scanning"  "${repo}" '.rule.description // "N/A"'          "dismissed" "${_CS_PAYLOAD}"
+      close_alerts "secret-scanning" "${repo}" '.secret_type_display_name // "N/A"' "resolved"  "${_SS_PAYLOAD}"
       ;;
   esac
   echo ""
diff --git a/org-admin/github-enable-issues/github-enable-issues.sh b/org-admin/github-enable-issues/github-enable-issues.sh
index 2c22159..c8eae55 100755
--- a/org-admin/github-enable-issues/github-enable-issues.sh
+++ b/org-admin/github-enable-issues/github-enable-issues.sh
@@ -75,27 +75,10 @@ if [ "${DRY_RUN}" = true ]; then
   print_warning "DRY RUN mode — no changes will be made"
 fi
 
-###
-## PAGINATION HELPER
-## Returns the total number of pages for the org's full repo list.
-###
-get_repo_pagination() {
-  local pages
-  pages=$(curl -s -I \
-    -H "Authorization: token ${GITHUB_TOKEN}" \
-    -H "Accept: application/vnd.github.v3+json" \
-    "${API_URL_PREFIX}/orgs/${ORG}/repos?per_page=100" \
-    | grep -i '^link:' \
-    | grep -Eo 'page=[0-9]+' \
-    | grep -Eo '[0-9]+' \
-    | tail -1)
-  echo "${pages:-1}"
-}
-
 ###
 ## MAIN LOGIC
 ###
-TOTAL_PAGES=$(get_repo_pagination)
+TOTAL_PAGES=$(get_repo_page_count "${API_URL_PREFIX}/orgs/${ORG}/repos?per_page=100")
 print_status "Total pages of repos: ${TOTAL_PAGES}"
 
 COUNT_UPDATED=0
diff --git a/org-admin/github-get-repo-list/github-get-repo-list.sh b/org-admin/github-get-repo-list/github-get-repo-list.sh
index e1fcddc..b766ff3 100755
--- a/org-admin/github-get-repo-list/github-get-repo-list.sh
+++ b/org-admin/github-get-repo-list/github-get-repo-list.sh
@@ -39,15 +39,6 @@ require_env_var ORG "GitHub organization"
 require_command jq
 validate_github_token
 
-get_repo_pagination () {
-    repo_pages=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" -I "${API_URL_PREFIX}/orgs/${ORG}/repos?per_page=100" | grep -Eo '&page=[0-9]+' | grep -Eo '[0-9]+' | tail -1;)
-    echo "${repo_pages:-1}"
-}
-
-limit_repo_pagination () {
-  seq "$(get_repo_pagination)"
-}
-
 process_repos () {
   local PAGE
   local i
@@ -64,7 +55,7 @@ process_repos () {
   local REPO_UPDATEDAT
   local ESCAPED_DESCRIPTION
 
-  for PAGE in $(limit_repo_pagination); do
+  for PAGE in $(seq "$(get_repo_page_count "${API_URL_PREFIX}/orgs/${ORG}/repos?per_page=100")"); do
     repos_json=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" "${API_URL_PREFIX}/orgs/${ORG}/repos?page=${PAGE}&per_page=100&sort=full_name")
 
     while IFS= read -r i; do
diff --git a/org-admin/github-migrate-internal-repos-to-private/github-migrate-internal-repos-to-private.sh b/org-admin/github-migrate-internal-repos-to-private/github-migrate-internal-repos-to-private.sh
index 10669b3..4385dd1 100755
--- a/org-admin/github-migrate-internal-repos-to-private/github-migrate-internal-repos-to-private.sh
+++ b/org-admin/github-migrate-internal-repos-to-private/github-migrate-internal-repos-to-private.sh
@@ -35,22 +35,13 @@ require_env_var ORG "GitHub organization"
 require_command jq
 validate_github_token
 
-get_repo_pagination () {
-    repo_pages=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" -I "${API_URL_PREFIX}/orgs/${ORG}/repos?type=internal&per_page=100" | grep -Eo '&page=[0-9]+' | grep -Eo '[0-9]+' | tail -1;)
-    echo "${repo_pages:-1}"
-}
-
-limit_repo_pagination () {
-  seq "$(get_repo_pagination)"
-}
-
 process_repos () {
   local PAGE
   local i
   local repos_json
   local response
 
-  for PAGE in $(limit_repo_pagination); do
+  for PAGE in $(seq "$(get_repo_page_count "${API_URL_PREFIX}/orgs/${ORG}/repos?type=internal&per_page=100")"); do
     repos_json=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" "${API_URL_PREFIX}/orgs/${ORG}/repos?type=internal&page=${PAGE}&per_page=100&sort=full_name")
 
     while IFS= read -r i; do
diff --git a/personal/github-organize-stars/github-organize-stars.sh b/personal/github-organize-stars/github-organize-stars.sh
index 7c84c27..24cc887 100755
--- a/personal/github-organize-stars/github-organize-stars.sh
+++ b/personal/github-organize-stars/github-organize-stars.sh
@@ -30,14 +30,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=../../lib/github-common.sh
 source "${SCRIPT_DIR}/../../lib/github-common.sh"
 
-# ---- Dependency check -------------------------------------------------------
-for cmd in gh jq; do
-  if ! command -v "$cmd" &>/dev/null; then
-    echo "ERROR: '$cmd' is required but not installed." >&2
-    [[ "$cmd" == "jq" ]] && echo "  Install: sudo dnf install -y jq" >&2
-    exit 1
-  fi
-done
+require_command jq
 
 # ---- Defaults ---------------------------------------------------------------
 DRY_RUN=false
diff --git a/reporting/github-copilot-report/github-copilot-report.sh b/reporting/github-copilot-report/github-copilot-report.sh
index 3594837..ff4e5b3 100755
--- a/reporting/github-copilot-report/github-copilot-report.sh
+++ b/reporting/github-copilot-report/github-copilot-report.sh
@@ -50,11 +50,6 @@ NO_ENTRA=false
 GRAPH_TOKEN=""
 ENTRA_ENABLED=false
 
-# ── Thin wrappers around lib output functions ─────────────────────────────────
-err()  { print_error  "$*"; exit 1; }
-info() { print_status "$*"; }
-warn() { print_warning "$*"; }
-
 # ── Derive UPN from GitHub login when no email is available ─────────────────
 # Pattern: 'john_example' + domain 'example.com'  →  'john@example.com'
 # Strips everything from the last underscore onwards, then appends @domain.
@@ -171,10 +166,10 @@ validate_github_token "bearer"
 
 # ── Acquire Microsoft Graph token via az CLI ──────────────────────────────────
 if [[ "$NO_ENTRA" == "true" ]]; then
-    warn "Entra ID lookup disabled (--no-entra). Department column will be N/A."
+    print_warning "Entra ID lookup disabled (--no-entra). Department column will be N/A."
 elif ! command -v az &>/dev/null; then
-    warn "az CLI is not installed — department/division grouping will be skipped."
-    warn "Install the Azure CLI and run 'az login' to enable Entra ID enrichment, or pass --no-entra."
+    print_warning "az CLI is not installed — department/division grouping will be skipped."
+    print_warning "Install the Azure CLI and run 'az login' to enable Entra ID enrichment, or pass --no-entra."
 elif az account show &>/dev/null 2>&1; then
     # Auto-resolve tenant ID from UPN domain via OIDC discovery when not explicitly set.
     # GET https://login.microsoftonline.com/{domain}/.well-known/openid-configuration
@@ -187,61 +182,36 @@ elif az account show &>/dev/null 2>&1; then
             | grep -oE '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}') || true
         if [[ -n "$_resolved_tenant" ]]; then
             ENTRA_TENANT="$_resolved_tenant"
-            info "Auto-resolved Entra tenant '${ENTRA_TENANT}' from domain '${UPN_DOMAIN}'."
+            print_status "Auto-resolved Entra tenant '${ENTRA_TENANT}' from domain '${UPN_DOMAIN}'."
         else
-            warn "Could not resolve tenant from domain '${UPN_DOMAIN}' — using default az tenant."
+            print_warning "Could not resolve tenant from domain '${UPN_DOMAIN}' — using default az tenant."
         fi
     fi
-    info "Acquiring Microsoft Graph token via az CLI..."
+    print_status "Acquiring Microsoft Graph token via az CLI..."
     GRAPH_TOKEN=$(az account get-access-token \
         --resource https://graph.microsoft.com \
         ${ENTRA_TENANT:+--tenant "$ENTRA_TENANT"} \
         --query accessToken -o tsv 2>/dev/null) || true
     if [[ -n "$GRAPH_TOKEN" ]]; then
         ENTRA_ENABLED=true
-        [[ -n "$ENTRA_TENANT" ]] && info "Graph token acquired (tenant: ${ENTRA_TENANT})." \
-                                  || info "Graph token acquired."
+        [[ -n "$ENTRA_TENANT" ]] && print_status "Graph token acquired (tenant: ${ENTRA_TENANT})." \
+                                  || print_status "Graph token acquired."
     else
-        warn "az is logged in but could not get a Graph token — department lookup disabled."
-        warn "Ensure your account has User.Read.All permission in the target tenant."
+        print_warning "az is logged in but could not get a Graph token — department lookup disabled."
+        print_warning "Ensure your account has User.Read.All permission in the target tenant."
         [[ -z "$ENTRA_TENANT" ]] && \
-            warn "If you have multiple tenants, try: --entra-tenant <TENANT_ID>"
+            print_warning "If you have multiple tenants, try: --entra-tenant <TENANT_ID>"
     fi
 else
-    warn "az CLI is not logged in — department/division grouping will be skipped."
-    warn "Run 'az login' to enable Entra ID enrichment, or pass --no-entra."
+    print_warning "az CLI is not logged in — department/division grouping will be skipped."
+    print_warning "Run 'az login' to enable Entra ID enrichment, or pass --no-entra."
 fi
 
 # ── GitHub API via curl with Copilot API version ──────────────────────────────
 # The Copilot usage-metrics endpoints require API version 2026-03-10.
-# Uses the same retry/rate-limit logic as lib's gh_api.
 _copilot_api() {
-    local url="$1"
-    shift
-    [[ "${url}" == http* ]] || url="${API_URL_PREFIX:-https://api.github.com}${url}"
-
-    local _attempt _http_code _body
-    for _attempt in 1 2 3 4 5; do
-        _body=$(curl -s -w "\n%{http_code}" \
-            -H "Authorization: Bearer ${GITHUB_TOKEN}" \
-            -H "Accept: application/vnd.github+json" \
-            -H "X-GitHub-Api-Version: 2026-03-10" \
-            "$@" "${url}")
-        _http_code=$(echo "${_body}" | tail -1)
-        _body=$(echo "${_body}" | sed '$d')
-        case "${_http_code}" in
-            200) echo "${_body}"; return 0 ;;
-            404) echo "__404__";  return 0 ;;
-            422) echo "__422__";  return 0 ;;
-            403|429)
-                warn "Rate limited (HTTP ${_http_code}). Sleeping 60s before retry ${_attempt}/5..."
-                sleep 60 ;;
-            *)
-                warn "HTTP ${_http_code} from GitHub API (attempt ${_attempt}/5)"
-                sleep 5 ;;
-        esac
-    done
-    err "Failed to reach ${url} after 5 attempts"
+    local url="$1"; shift
+    gh_api "${url}" --api-version 2026-03-10 "$@"
 }
 
 # fetch_usage_ndjson REPORT_PATH
@@ -314,7 +284,7 @@ graph_user_info() {
 }
 
 # ── Fetch seats ───────────────────────────────────────────────────────────────
-info "Fetching Copilot seats for enterprise '${GITHUB_ENTERPRISE}'..."
+print_status "Fetching Copilot seats for enterprise '${GITHUB_ENTERPRISE}'..."
 SEATS_RAW=$(fetch_seats "$GITHUB_ENTERPRISE")
 
 # The seats endpoint returns one entry per org per user — deduplicate by login,
@@ -329,7 +299,7 @@ SEATS=$(echo "$SEATS_RAW" | jq '
 ')
 
 SEAT_COUNT=$(echo "$SEATS" | jq 'length')
-info "Found ${SEAT_COUNT} unique licensed user(s)  ($(echo "$SEATS_RAW" | jq 'length') raw seat entries across orgs)."
+print_status "Found ${SEAT_COUNT} unique licensed user(s)  ($(echo "$SEATS_RAW" | jq 'length') raw seat entries across orgs)."
 # Enterprise seats endpoint has no total_seats field; use unique user count.
 TOTAL_ASSIGNED_SEATS=$SEAT_COUNT
 
@@ -339,7 +309,7 @@ TOTAL_ASSIGNED_SEATS=$SEAT_COUNT
 # Requires manage_billing:enterprise scope (classic/OAuth token; not fine-grained PATs).
 _BILLING_YEAR=$(date +%Y)
 _BILLING_MONTH=$(( 10#$(date +%m) ))   # strip leading zero (macOS compatible)
-info "Fetching per-user AI credit consumption (billing API, ${_BILLING_YEAR}-$(printf '%02d' $_BILLING_MONTH))..."
+print_status "Fetching per-user AI credit consumption (billing API, ${_BILLING_YEAR}-$(printf '%02d' $_BILLING_MONTH))..."
 declare -A USER_CREDITS_USED
 declare -A USER_MODEL_CREDITS   # key: "login|model"  value: credits
 declare -A _ALL_MODELS_SET      # keys are unique model names seen
@@ -377,12 +347,12 @@ done <<< "$_ALL_LOGINS"
 printf '\r%-60s\r' '' >&2   # clear progress line
 
 if [[ "$_billing_ok" == "true" ]]; then
-    info "Loaded billing data for ${#USER_CREDITS_USED[@]} user(s)."
+    print_status "Loaded billing data for ${#USER_CREDITS_USED[@]} user(s)."
 else
-    warn "Some billing API calls failed — credits may show 0 for affected users."
-    warn "Ensure manage_billing:enterprise scope: set GITHUB_TOKEN with the required scopes"
+    print_warning "Some billing API calls failed — credits may show 0 for affected users."
+    print_warning "Ensure manage_billing:enterprise scope: set GITHUB_TOKEN with the required scopes"
     [[ -n "$_billing_fail_statuses" ]] && \
-        warn "Failed users:${_billing_fail_statuses}"
+        print_warning "Failed users:${_billing_fail_statuses}"
 fi
 
 # Build sorted list of all model names seen across all users
@@ -392,7 +362,7 @@ while IFS= read -r _m; do
 done < <(printf '%s\n' "${!_ALL_MODELS_SET[@]}" | sort)
 
 # ── Fetch enterprise-level model usage (new usage metrics API, 28-day) ────────
-info "Fetching enterprise model usage metrics (last 28 days)..."
+print_status "Fetching enterprise model usage metrics (last 28 days)..."
 ENT_NDJSON=$(fetch_usage_ndjson \
     "/enterprises/${GITHUB_ENTERPRISE}/copilot/metrics/reports/enterprise-28-day/latest")
 
@@ -426,7 +396,7 @@ declare -A DEPT_CREDITS
 TOTAL_CREDITS=0
 
 # ── Process each seat ────────────────────────────────────────────────────────
-info "Enriching ${SEAT_COUNT} users with Entra ID info (this may take a moment)..."
+print_status "Enriching ${SEAT_COUNT} users with Entra ID info (this may take a moment)..."
 
 while IFS= read -r seat; do
     login=$(       echo "$seat" | jq -r '.assignee.login          // ""')
diff --git a/reporting/github-monthly-issues-report/github-monthly-issues-report.sh b/reporting/github-monthly-issues-report/github-monthly-issues-report.sh
index 671893b..47ccd7a 100755
--- a/reporting/github-monthly-issues-report/github-monthly-issues-report.sh
+++ b/reporting/github-monthly-issues-report/github-monthly-issues-report.sh
@@ -67,17 +67,8 @@ ISSUES_TEMP=$(mktemp)
 trap 'rm -f "${ISSUES_TEMP}"' EXIT
 mkdir -p "${REPORT_DIR}"
 
-get_issue_pagination () {
-    issue_pages=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" -I "${API_URL_PREFIX}/repos/${ORG}/${REPO}/issues?state=all&labels=Linked%20[AC]&per_page=100" | grep -Eo '&page=[0-9]+' | grep -Eo '[0-9]+' | tail -1;)
-    echo "${issue_pages:-1}"
-}
-
-limit_issue_pagination () {
-  seq "$(get_issue_pagination)"
-}
-
 repo_issues () {
-  for PAGE in $(limit_issue_pagination); do
+  for PAGE in $(seq "$(get_repo_page_count "${API_URL_PREFIX}/repos/${ORG}/${REPO}/issues?state=all&labels=Linked%20[AC]&per_page=100")"); do
     while IFS= read -r i; do
       [ -z "${i}" ] && continue
       ISSUE_PAYLOAD=$(curl -s -H "Authorization: token ${GITHUB_TOKEN}" "${API_URL_PREFIX}/repos/${ORG}/${REPO}/issues/${i}" -H "Accept: application/vnd.github.mercy-preview+json")
diff --git a/reporting/github-repo-permissions-report/github-repo-permissions-report.sh b/reporting/github-repo-permissions-report/github-repo-permissions-report.sh
index e1c54dd..888b370 100755
--- a/reporting/github-repo-permissions-report/github-repo-permissions-report.sh
+++ b/reporting/github-repo-permissions-report/github-repo-permissions-report.sh
@@ -51,9 +51,6 @@ Examples:
 EOF
 }
 
-err()  { print_error  "$*"; exit 1; }
-info() { print_status "$*"; }
-
 while [[ $# -gt 0 ]]; do
   case "$1" in
     -r|--repo)
@@ -95,7 +92,7 @@ BP_JSON="${TMP_DIR}/branch_protection.json"
 RULESETS_JSON="${TMP_DIR}/rulesets.json"
 BYPASS_JSON="${TMP_DIR}/bypass.json"
 
-info "Fetching repository metadata for ${REPO}..."
+print_status "Fetching repository metadata for ${REPO}..."
 _repo_resp=$(gh_api "/repos/${REPO}")
 [[ "${_repo_resp}" == "__404__" ]] && err "Repository ${REPO} not found or not accessible"
 echo "${_repo_resp}" > "$REPO_JSON"
@@ -110,15 +107,15 @@ if [[ -z "$OUTPUT_CSV" ]]; then
   OUTPUT_CSV="${REPO//\//-}-permissions-${BRANCH}-$(date +%Y%m%d).csv"
 fi
 
-info "Fetching collaborators..."
+print_status "Fetching collaborators..."
 gh_api_paginate "/repos/${REPO}/collaborators?affiliation=all&per_page=100" '.[]' \
   | jq -s '.' > "$COLLAB_JSON"
 
-info "Fetching teams with repository access..."
+print_status "Fetching teams with repository access..."
 gh_api_paginate "/repos/${REPO}/teams?per_page=100" '.[]' \
   | jq -s '.' > "$TEAMS_JSON"
 
-info "Fetching branch protection for ${BRANCH} (if configured)..."
+print_status "Fetching branch protection for ${BRANCH} (if configured)..."
 _bp_resp=$(gh_api "/repos/${REPO}/branches/${BRANCH}/protection")
 if [[ "${_bp_resp}" == "__404__" || "${_bp_resp}" == "__422__" ]]; then
   echo '{}' > "$BP_JSON"
@@ -126,11 +123,11 @@ else
   echo "${_bp_resp}" > "$BP_JSON"
 fi
 
-info "Fetching repository rulesets (if configured)..."
+print_status "Fetching repository rulesets (if configured)..."
 gh_api_paginate "/repos/${REPO}/rulesets?includes_parents=true&per_page=100" '.[]' \
   | jq -s '. // []' > "$RULESETS_JSON"
 
-info "Building bypass actor list (branch protection + applicable rulesets)..."
+print_status "Building bypass actor list (branch protection + applicable rulesets)..."
 jq -n \
   --argjson bp "$(cat "$BP_JSON")" \
   --argjson rulesets "$(cat "$RULESETS_JSON")" \
@@ -223,7 +220,7 @@ jq -n \
   ]
 ' > "$BYPASS_JSON"
 
-info "Normalizing team references in bypass data..."
+print_status "Normalizing team references in bypass data..."
 jq -n \
   --argjson bypass "$(cat "$BYPASS_JSON")" \
   --argjson teams "$(cat "$TEAMS_JSON")" '
@@ -242,7 +239,7 @@ jq -n \
 ' > "$BYPASS_JSON.tmp"
 mv "$BYPASS_JSON.tmp" "$BYPASS_JSON"
 
-info "Generating CSV report: ${OUTPUT_CSV}"
+print_status "Generating CSV report: ${OUTPUT_CSV}"
 jq -r -n \
   --arg repo "$REPO" \
   --arg branch "$BRANCH" \