Phase 9: Wire live constructors, fix auth/parsing/validation bugs for CI

- Wire ado2gh generate-script live constructor with real ADO client + inspector
- Wire gei migrate-repo storage backends (Azure, AWS, GitHub-owned)
- Wire bbs2gh migrate-repo GitHub-owned storage
- Fix tokenRoundTripper auth: use "Bearer" instead of "token" (gei + bbs2gh)
- Fix ado2gh + bbs2gh main.go: print errors before os.Exit(1) instead of silencing
- Add Content-Type: application/octet-stream header to ghowned single upload
- Include response body in ghowned client error messages for better debugging
- Fix golangci-lint v2 issues (5 fixes across alerts and github packages)
- Fix ADO repo model: remove ,string JSON tags from Size/IsDisabled (ADO API returns numbers/booleans, not strings)
- Fix BBS hasAWSSubOptions: only check CLI flags, not env vars (matches C# behavior; env vars like AWS_ACCESS_KEY_ID should not trigger bucket-name validation)
- Fix ghowned parseURIResponse: use map[string]interface{} to handle mixed-type API responses (size is a number, not a string)

Author: offbyone

cmd/ado2gh/generate_script.go

@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	"github.com/github/gh-gei/pkg/ado"
+	"github.com/github/gh-gei/pkg/env"
 	"github.com/github/gh-gei/pkg/logger"
 	"github.com/github/gh-gei/pkg/scriptgen"
 	"github.com/spf13/cobra"
@@ -43,6 +44,7 @@ type generateScriptArgs struct {
 	githubOrg             string
 	adoOrg                string
 	adoTeamProject        string
+	adoPAT                string
 	output                string
 	sequential            bool
 	adoServerURL          string
@@ -132,11 +134,60 @@ func newGenerateScriptCmd(
 // ---------------------------------------------------------------------------
 
 func newGenerateScriptCmdLive() *cobra.Command {
-	// TODO: wire up real ADO client and inspector
-	return &cobra.Command{
+	var a generateScriptArgs
+
+	cmd := &cobra.Command{
 		Use:   "generate-script",
 		Short: "Generates a migration script",
+		Long:  "Generates a PowerShell script that automates an Azure DevOps to GitHub migration.",
+		RunE: func(cmd *cobra.Command, _ []string) error {
+			log := getLogger(cmd)
+			envProv := env.New()
+
+			adoPAT := a.adoPAT
+			if adoPAT == "" {
+				adoPAT = envProv.ADOPAT()
+			}
+
+			adoServerURL := a.adoServerURL
+			if adoServerURL == "" {
+				adoServerURL = "https://dev.azure.com"
+			}
+
+			client := ado.NewClient(adoServerURL, adoPAT, log)
+			ins := ado.NewInspector(log, client)
+			ins.OrgFilter = a.adoOrg
+			ins.TeamProjectFilter = a.adoTeamProject
+
+			return runGenerateScript(cmd.Context(), client, ins, log, a, defaultWriteToFile)
+		},
 	}
+
+	// Required flags
+	cmd.Flags().StringVar(&a.githubOrg, "github-org", "", "Target GitHub organization name (REQUIRED)")
+
+	// Optional flags
+	cmd.Flags().StringVar(&a.adoOrg, "ado-org", "", "Azure DevOps organization name")
+	cmd.Flags().StringVar(&a.adoTeamProject, "ado-team-project", "", "Azure DevOps team project name")
+	cmd.Flags().StringVar(&a.output, "output", "./migrate.ps1", "Output file path for the migration script")
+	cmd.Flags().BoolVar(&a.sequential, "sequential", false, "Generate a sequential (non-parallel) script")
+	cmd.Flags().StringVar(&a.adoServerURL, "ado-server-url", "", "Azure DevOps Server URL")
+	cmd.Flags().StringVar(&a.targetAPIURL, "target-api-url", "", "API URL for the target GitHub instance")
+	cmd.Flags().BoolVar(&a.createTeams, "create-teams", false, "Include team creation and assignment scripts")
+	cmd.Flags().BoolVar(&a.linkIdpGroups, "link-idp-groups", false, "Link IdP groups to teams")
+	cmd.Flags().BoolVar(&a.lockAdoRepos, "lock-ado-repos", false, "Lock ADO repos before migration")
+	cmd.Flags().BoolVar(&a.disableAdoRepos, "disable-ado-repos", false, "Disable ADO repos after migration")
+	cmd.Flags().BoolVar(&a.rewirePipelines, "rewire-pipelines", false, "Rewire Azure Pipelines to GitHub repos")
+	cmd.Flags().BoolVar(&a.downloadMigrationLogs, "download-migration-logs", false, "Download migration logs after migration")
+	cmd.Flags().BoolVar(&a.all, "all", false, "Enable all optional migration steps")
+	cmd.Flags().StringVar(&a.repoList, "repo-list", "", "Path to a CSV file with repos to migrate")
+	cmd.Flags().StringVar(&a.adoPAT, "ado-pat", "", "")
+
+	// Hidden flags
+	_ = cmd.Flags().MarkHidden("ado-server-url")
+	_ = cmd.Flags().MarkHidden("ado-pat")
+
+	return cmd
 }
 
 // ---------------------------------------------------------------------------
@@ -749,6 +800,6 @@ func wrap(script string) string {
 }
 
 // defaultWriteToFile writes content to a file (production implementation).
-func defaultWriteToFile(path, content string) error { //nolint:unused // will be used when newGenerateScriptCmdLive is fully wired
+func defaultWriteToFile(path, content string) error {
 	return os.WriteFile(path, []byte(content), 0o600)
 }

cmd/ado2gh/main.go

@@ -2,10 +2,13 @@ package main
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"net/http"
 	"os"
 	"strings"
 
+	"github.com/github/gh-gei/internal/cmdutil"
 	"github.com/github/gh-gei/pkg/env"
 	"github.com/github/gh-gei/pkg/logger"
 	"github.com/github/gh-gei/pkg/status"
@@ -24,7 +27,18 @@ var (
 )
 
 func main() {
-	if err := newRootCmd().Execute(); err != nil {
+	rootCmd := newRootCmd()
+	if err := rootCmd.Execute(); err != nil {
+		if log, ok := rootCmd.Context().Value(loggerKey).(*logger.Logger); ok && log != nil {
+			var userErr *cmdutil.UserError
+			if errors.As(err, &userErr) {
+				log.Errorf("%v", err)
+			} else {
+				log.Errorf("Unexpected error: %v", err)
+			}
+		} else {
+			fmt.Fprintf(os.Stderr, "[ERROR] %v\n", err)
+		}
 		os.Exit(1)
 	}
 }

cmd/ado2gh/wiring.go

@@ -163,8 +163,8 @@ func newDownloadLogsCmdLive() *cobra.Command {
 	}
 
 	cmd.Flags().StringVar(&migrationID, "migration-id", "", "The ID of the migration")
-	cmd.Flags().StringVar(&githubTargetOrg, "github-target-org", "", "Target GitHub organization")
-	cmd.Flags().StringVar(&targetRepo, "target-repo", "", "Target repository name")
+	cmd.Flags().StringVar(&githubTargetOrg, "github-org", "", "Target GitHub organization")
+	cmd.Flags().StringVar(&targetRepo, "github-repo", "", "Target repository name")
 	cmd.Flags().StringVar(&logFile, "migration-log-file", "", "Custom output filename for the migration log")
 	cmd.Flags().BoolVar(&overwrite, "overwrite", false, "Overwrite the log file if it already exists")
 	cmd.Flags().StringVar(&githubTargetPAT, "github-target-pat", "", "Personal access token for the target GitHub instance")

cmd/bbs2gh/main.go

@@ -2,10 +2,13 @@ package main
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"net/http"
 	"os"
 	"strings"
 
+	"github.com/github/gh-gei/internal/cmdutil"
 	"github.com/github/gh-gei/pkg/env"
 	"github.com/github/gh-gei/pkg/logger"
 	"github.com/github/gh-gei/pkg/status"
@@ -24,7 +27,18 @@ var (
 )
 
 func main() {
-	if err := newRootCmd().Execute(); err != nil {
+	rootCmd := newRootCmd()
+	if err := rootCmd.Execute(); err != nil {
+		if log, ok := rootCmd.Context().Value(loggerKey).(*logger.Logger); ok && log != nil {
+			var userErr *cmdutil.UserError
+			if errors.As(err, &userErr) {
+				log.Errorf("%v", err)
+			} else {
+				log.Errorf("Unexpected error: %v", err)
+			}
+		} else {
+			fmt.Fprintf(os.Stderr, "[ERROR] %v\n", err)
+		}
 		os.Exit(1)
 	}
 }

cmd/bbs2gh/migrate_repo.go

@@ -4,7 +4,9 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"net/http"
 	"net/url"
+	"strconv"
 	"strings"
 	"time"
 
@@ -19,6 +21,7 @@ import (
 	"github.com/github/gh-gei/pkg/migration"
 	awsStorage "github.com/github/gh-gei/pkg/storage/aws"
 	azureStorage "github.com/github/gh-gei/pkg/storage/azure"
+	"github.com/github/gh-gei/pkg/storage/ghowned"
 	"github.com/google/uuid"
 	"github.com/spf13/cobra"
 )
@@ -127,6 +130,7 @@ type bbsMigrateRepoArgs struct {
 	awsRegion                    string
 	keepArchive                  bool
 	targetAPIURL                 string
+	targetUploadsURL             string
 	queueOnly                    bool
 	useGithubStorage             bool
 }
@@ -393,7 +397,7 @@ func validateBbsUploadOptions(a *bbsMigrateRepoArgs, envProv bbsMigrateRepoEnvPr
 	shouldUseAzure := resolveBbsAzureConnectionString(a.azureStorageConnectionString, envProv) != ""
 	shouldUseAWS := a.awsBucketName != ""
 
-	if err := validateBbsUploadConflicts(a, shouldUseAzure, shouldUseAWS, envProv); err != nil {
+	if err := validateBbsUploadConflicts(a, shouldUseAzure, shouldUseAWS); err != nil {
 		return err
 	}
 
@@ -404,8 +408,8 @@ func validateBbsUploadOptions(a *bbsMigrateRepoArgs, envProv bbsMigrateRepoEnvPr
 	return nil
 }
 
-func validateBbsUploadConflicts(a *bbsMigrateRepoArgs, shouldUseAzure, shouldUseAWS bool, envProv bbsMigrateRepoEnvProvider) error {
-	if !shouldUseAWS && hasAWSSubOptions(a, envProv) {
+func validateBbsUploadConflicts(a *bbsMigrateRepoArgs, shouldUseAzure, shouldUseAWS bool) error {
+	if !shouldUseAWS && hasAWSSubOptions(a) {
 		return cmdutil.NewUserError("The AWS S3 bucket name must be provided with --aws-bucket-name if other AWS S3 upload options are set.")
 	}
 	if a.useGithubStorage && shouldUseAWS {
@@ -427,11 +431,11 @@ func validateBbsUploadConflicts(a *bbsMigrateRepoArgs, shouldUseAzure, shouldUse
 	return nil
 }
 
-func hasAWSSubOptions(a *bbsMigrateRepoArgs, envProv bbsMigrateRepoEnvProvider) bool {
-	return a.awsAccessKey != "" || resolveBbsAWSAccessKey("", envProv) != "" ||
-		a.awsSecretKey != "" || resolveBbsAWSSecretKey("", envProv) != "" ||
-		a.awsSessionToken != "" || envProv.AWSSessionToken() != "" ||
-		a.awsRegion != "" || resolveBbsAWSRegion("", envProv) != ""
+func hasAWSSubOptions(a *bbsMigrateRepoArgs) bool {
+	return a.awsAccessKey != "" ||
+		a.awsSecretKey != "" ||
+		a.awsSessionToken != "" ||
+		a.awsRegion != ""
 }
 
 func validateBbsAWSCredentials(a *bbsMigrateRepoArgs, envProv bbsMigrateRepoEnvProvider) error {
@@ -660,13 +664,13 @@ func bbsImportArchive(
 	if migration.IsRepoFailed(m.State) {
 		log.Errorf("Migration Failed. Migration ID: %s", migrationID)
 		sharedcmd.LogWarningsCount(log, m.WarningsCount)
-		log.Info("Migration log available at %s or by running `gh bbs2gh download-logs --github-target-org %s --target-repo %s`", m.MigrationLogURL, a.githubOrg, a.githubRepo)
+		log.Info("Migration log available at %s or by running `gh bbs2gh download-logs --github-org %s --github-repo %s`", m.MigrationLogURL, a.githubOrg, a.githubRepo)
 		return cmdutil.NewUserError(m.FailureReason)
 	}
 
 	log.Success("Migration completed (ID: %s)! State: %s", migrationID, m.State)
 	sharedcmd.LogWarningsCount(log, m.WarningsCount)
-	log.Info("Migration log available at %s or by running `gh bbs2gh download-logs --github-target-org %s --target-repo %s`", m.MigrationLogURL, a.githubOrg, a.githubRepo)
+	log.Info("Migration log available at %s or by running `gh bbs2gh download-logs --github-org %s --github-repo %s`", m.MigrationLogURL, a.githubOrg, a.githubRepo)
 	return nil
 }
 
@@ -689,8 +693,7 @@ func pollBbsExport(ctx context.Context, bbsAPI bbsMigrateRepoBbsAPI, exportID in
 			return nil
 		}
 
-		if upper != "INITIALISING" && upper != "IN_PROGRESS" { //nolint:misspell // BBS API uses British spelling
-			// Error state
+		if upper == "FAILED" || upper == "ABORTED" {
 			return cmdutil.NewUserErrorf("BBS export failed with state: %s - %s", exportState, message)
 		}
 
@@ -788,6 +791,17 @@ type awsLogAdapter struct {
 
 func (a *awsLogAdapter) LogInfo(format string, args ...interface{}) { a.log.Info(format, args...) }
 
+// bbsTokenRoundTripper attaches a Bearer token to every outgoing request.
+type bbsTokenRoundTripper struct {
+	token string
+}
+
+func (t *bbsTokenRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	req = req.Clone(req.Context())
+	req.Header.Set("Authorization", "Bearer "+t.token)
+	return http.DefaultTransport.RoundTrip(req)
+}
+
 // ---------------------------------------------------------------------------
 // Production command constructor (used by main.go)
 // ---------------------------------------------------------------------------
@@ -859,6 +873,7 @@ func newMigrateRepoCmdLive() *cobra.Command {
 	cmd.Flags().StringVar(&a.githubPAT, "github-pat", "", "Personal access token for the target GitHub instance")
 	cmd.Flags().StringVar(&a.targetRepoVisibility, "target-repo-visibility", "", "Target repository visibility (public, private, internal)")
 	cmd.Flags().StringVar(&a.targetAPIURL, "target-api-url", bbsDefaultTargetAPIURL, "API URL for the target GitHub instance")
+	cmd.Flags().StringVar(&a.targetUploadsURL, "target-uploads-url", "", "Uploads URL for the target GitHub instance")
 
 	// Upload storage flags
 	cmd.Flags().StringVar(&a.azureStorageConnectionString, "azure-storage-connection-string", "", "Azure Blob Storage connection string")
@@ -873,6 +888,9 @@ func newMigrateRepoCmdLive() *cobra.Command {
 	cmd.Flags().BoolVar(&a.queueOnly, "queue-only", false, "Queue the migration without waiting for completion")
 	cmd.Flags().BoolVar(&a.useGithubStorage, "use-github-storage", false, "Use GitHub-owned storage for archives")
 
+	// Hidden flags
+	_ = cmd.Flags().MarkHidden("target-uploads-url")
+
 	return cmd
 }
 
@@ -970,7 +988,42 @@ func buildBbsArchiveUploader(a *bbsMigrateRepoArgs, envProv bbsMigrateRepoEnvPro
 	}
 
 	if a.useGithubStorage {
-		log.Warning("GitHub-owned storage is not yet fully implemented in the Go port")
+		uploadsURL := a.targetUploadsURL
+		if uploadsURL == "" {
+			uploadsURL = "https://uploads.github.com"
+		}
+
+		// Resolve target token for the ghowned HTTP client
+		targetToken := resolveBbsTargetToken(a.githubPAT, envProv)
+
+		ghHTTPClient := &http.Client{
+			Transport: &bbsTokenRoundTripper{token: targetToken},
+		}
+
+		var ghOwnedOpts []ghowned.Option
+		ghOwnedOpts = append(ghOwnedOpts, ghowned.WithLogger(log))
+
+		envReal := env.New()
+		if mebiStr := envReal.GitHubOwnedStorageMultipartMebibytes(); mebiStr != "" {
+			if mebi, err := strconv.ParseInt(mebiStr, 10, 64); err == nil {
+				ghOwnedOpts = append(ghOwnedOpts, ghowned.WithPartSizeMebibytes(mebi))
+			}
+		}
+
+		ghOwnedClient := ghowned.NewClient(uploadsURL, ghHTTPClient, ghOwnedOpts...)
+
+		// Build a GitHub client for org ID resolution
+		tgtAPI := a.targetAPIURL
+		if tgtAPI == "" {
+			tgtAPI = bbsDefaultTargetAPIURL
+		}
+		targetGH := github.NewClient(targetToken,
+			github.WithAPIURL(tgtAPI),
+			github.WithLogger(log),
+			github.WithVersion(version),
+		)
+
+		uploaderOpts = append(uploaderOpts, archive.WithGitHub(ghOwnedClient, targetGH))
 	}
 
 	return archive.NewUploader(uploaderOpts...), nil