set -e

repos=(
  business-support-finder
  collections
  collections-publisher
  content-tagger
  email-alert-api
  email-alert-service
  finder-frontend
  policy-publisher
  rummager
  search-admin
)

for repo_name in "${repos[@]}"; do
  echo "------ Auditing $repo_name -------"
  bundle exec govuk_security_audit github alphagov $repo_name
done

# Panopticon runs an old Rails version, which depends on a vulnerable version of
# the `mail` gem. This is not an issue because we don't send email from Panopticon.
echo "------ Auditing panopticon -------"
bundle exec govuk_security_audit github alphagov panopticon --ignore OSVDB-131677

((error_count=0))
on_error() {
  ((error_count++))
}

output=""
check_repo() {
  trap on_error ERR
  repo_name=$1
  shift
  results=$(bundle exec govuk_security_audit github alphagov "${repo_name}" $@)
  if [ $? -ne 0 ]; then
    output=$(printf "%s\n%s\n%s" "${output}" "------ Auditing ${repo_name} -------" "${results}")
  fi
}

repos=(
  business-support-finder
  collections
  collections-publisher
  content-tagger
  email-alert-api
  email-alert-service
  finder-frontend
  panopticon
  policy-publisher
  rummager
  search-admin
)

for repo_name in "${repos[@]}"; do
  check_repo "${repo_name}"
done

if [ $error_count == 0 ]; then
  output="No vulnerabilities found!"
fi

printf "Found %s repos with issues:\n%s\n" "${error_count}" "${output}"
exit $error_count

Update vulnerability checking script to report all results
Update vulnerability checking script to report all results

It used to bail on the first repo with an issue.

Also, we don't need to special case panopticon any
more since it no longer uses the 'mail' gem.
