Self-managed GitLab

#!/usr/bin/env bash

## gitlab-webhook.sh

# Add a webhook to one project, or every project in a subgroup tree

set -euo pipefail

migrate() (
  set +x
  umask 077
  local host='' project='' group='' from='' to='' report='' secret_map=''
  local secret_env=GITLAB_WEBHOOK_SECRET auth=private-token subgroups=false
  local apply=false test_event=false explicit_dry_run=false
  fail() { printf '[ERROR] %s\n' "$1" >&2; exit 1; }
  while (( $# )); do
    case "$1" in
      --help)
        printf '%s\n' \
          'Usage: gitlab-webhook.sh migrate --host HTTPS_ORIGIN (--project INPUT | --group INPUT)' \
          '  INPUT: ID, full path, GitLab URL, or .csv file prefixed with ./, ../, / or @.' \
          '  CSV files have no header: one value per row; the flag selects project or group.' \
          '  Group mode migrates existing group hooks, then removes matching project hooks.' \
          '  Groups without a matching group webhook are left unchanged.' \
          '  --from-url OLD_URL --to-url HTTPS_URL --report NEW_JSONL_FILE' \
          '  [--include-subgroups] [--dry-run | --apply] [--test]' \
          '  [--secret-env NAME | --secret-map JSON_FILE] [--auth private-token|bearer]' \
          'Set GITLAB_TOKEN; apply also requires the destination secret (default: GITLAB_WEBHOOK_SECRET).'
        exit 0 ;;
      --apply) apply=true; shift ;;
      --dry-run) explicit_dry_run=true; shift ;;
      --include-subgroups) subgroups=true; shift ;;
      --test) test_event=true; shift ;;
      --host|--project|--group|--from-url|--to-url|--report|--secret-env|--secret-map|--auth)
        (( $# >= 2 )) && [[ -n $2 && $2 != --* ]] || fail 'Missing option value'
        case "$1" in
          --host) host=$2 ;; --project) project=$2 ;; --group) group=$2 ;;
          --from-url) from=$2 ;; --to-url) to=$2 ;; --report) report=$2 ;;
          --secret-env) secret_env=$2 ;; --secret-map) secret_map=$2 ;; --auth) auth=$2 ;;
        esac
        shift 2 ;;
      *) fail 'Unknown migration option; use migrate --help' ;;
    esac
  done
  command -v jq >/dev/null || fail 'jq is required'
  command -v python3 >/dev/null || fail 'Python 3 is required for migration inputs'
  [[ -n $host && -n $from && -n $to && -n $report ]] || fail 'Specify host, from-url, to-url and report'
  [[ -n $project && -z $group || -z $project && -n $group ]] || fail 'Choose exactly one project or group'
  [[ $subgroups == false || -n $group ]] || fail 'include-subgroups requires a group'
  [[ $apply == false || $explicit_dry_run == false ]] || fail 'Choose apply or dry-run, not both'
  [[ $test_event == false || $apply == true ]] || fail 'test requires apply and can trigger reviews'
  [[ $host =~ ^https://[^/?#@[:space:]]+/?$ ]] || fail 'Use an HTTPS GitLab origin without credentials'
  [[ $from =~ ^https?://[^/?#@[:space:]]+(/[^[:space:]#]*)?$ ]] || fail 'Invalid old webhook URL'
  [[ $to =~ ^https://[^/?#@[:space:]]+(/[^[:space:]#]*)?$ && $to != "$from" ]] || fail 'Use a different HTTPS destination without credentials'
  [[ -n ${GITLAB_TOKEN:-} && $GITLAB_TOKEN != *$'\n'* && $GITLAB_TOKEN != *$'\r'* ]] || fail 'Set GITLAB_TOKEN to an API token'
  [[ $auth == private-token || $auth == bearer ]] || fail 'auth must be private-token or bearer'
  local scope=project inputs
  [[ -z $group ]] || scope=group
  inputs=$(python3 - "$host" "$scope" "${project:-$group}" <<'PY'
import csv
import json
import re
import sys
from urllib.parse import unquote, urlsplit

host, scope, source = sys.argv[1:]

def origin_key(url):
    return (url.scheme, url.hostname, url.port if url.port is not None else 443)

try:
    if source.startswith(('./', '../', '/', '@')) and source.lower().endswith('.csv'):
        filename = source[1:] if source.startswith('@') else source
        with open(filename, encoding='utf-8-sig', newline='') as stream:
            rows = list(csv.reader(stream, skipinitialspace=True, strict=True))
        rows = [row for row in rows if row and (len(row) != 1 or row[0].strip())]
    else:
        rows = [[source]]
    values = {}
    for row in rows:
        if len(row) != 1:
            raise ValueError('Use one project or group per CSV row')
        value = row[0].strip()
        if any(ord(char) < 32 or ord(char) == 127 for char in value):
            raise ValueError('Input values cannot contain control characters')
        if '://' in value:
            url = urlsplit(value)
            origin = urlsplit(host)
            if origin_key(url) != origin_key(origin) or url.username is not None or url.password is not None or url.query or url.fragment:
                raise ValueError('Input URLs must match --host without queries or fragments')
            value = unquote(url.path).strip('/')
            if scope == 'group' and value.startswith('groups/'):
                value = value[len('groups/'):]
        parts = value.split('/')
        if not all(re.fullmatch(r'[A-Za-z0-9_][A-Za-z0-9_.-]*', part) and part not in ('.', '..') for part in parts):
            raise ValueError('Use an ID, full namespace path or project/group URL')
        values[value] = None
    if not values:
        raise ValueError('No project or group inputs found')
    print(json.dumps(list(values)))
except (OSError, UnicodeError, csv.Error, ValueError):
    sys.exit('Invalid migration input: use an ID, full path, same-host URL or readable single-column CSV with at least one value')
PY
  ) || fail 'Cannot load project or group inputs; no updates applied'
  if [[ -n $secret_map ]]; then
    jq -e 'type == "object" and all(.[]; type == "string")' "$secret_map" >/dev/null || fail 'Invalid secret map'
  fi
  local tmp api="${host%/}/api/v4"
  tmp=$(mktemp -d)
  trap 'rm -f "$tmp/auth" "$tmp/response" "$tmp/plan"; rmdir "$tmp"' EXIT
  if [[ $auth == bearer ]]; then
    printf 'Authorization: Bearer %s\n' "$GITLAB_TOKEN" > "$tmp/auth"
  else
    printf 'PRIVATE-TOKEN: %s\n' "$GITLAB_TOKEN" > "$tmp/auth"
  fi
  set -C
  exec 3> "$report" || fail 'Report must be a new writable file'
  set +C

  request() {
    local method=$1 path=$2 status attempt
    local body=()
    [[ $method != PUT ]] || body=(--header 'Content-Type: application/json' --data-binary @-)
    for attempt in 1 2 3; do
      status=$(curl --disable --silent --proto '=https' --connect-timeout 10 --max-time 60 \
        --header "@$tmp/auth" --request "$method" "${body[@]}" \
        --output "$tmp/response" --write-out '%{http_code}' "$api$path") || return 1
      if [[ $status == 2?? ]]; then
        [[ $method != DELETE ]] || return 0
        jq -e . "$tmp/response"
        return
      fi
      [[ $method == GET && $status == 429 && $attempt -lt 3 ]] || return 1
      sleep "$((attempt * 2))"
    done
  }
  encode() { jq -rn --arg value "$1" '$value | @uri'; }
  list_all() {
    local path=$1 page=1 separator='?' batch count
    [[ $path != *'?'* ]] || separator='&'
    while :; do
      batch=$(request GET "$path${separator}per_page=100&page=$page") || return 1
      jq -e 'type == "array"' <<< "$batch" >/dev/null || return 1
      jq -c '.[]' <<< "$batch"
      count=$(jq length <<< "$batch")
      (( count == 100 )) || break
      page=$((page + 1))
    done
  }
  snapshot() {
    jq -cS 'with_entries(select(.key | test("^(id|url|.*_events|push_events_branch_filter|branch_filter_strategy|enable_ssl_verification)$")))'
  }
  report_row() {
    local result
    result=$(jq -cn --arg type "$resource_type" --argjson id "$resource_id" --arg status "$1" --argjson hook "$2" \
      --arg destination "$to" '{($type + "_id"):$id,status:$status,hook:$hook,destination:$destination}')
    printf '%s\n' "$result" >&3
    printf '%s\n' "$result"
  }
  resolve_secret() {
    local name=$secret_env key=$resource_id
    if [[ -n $secret_map ]]; then
      [[ $resource_type != group ]] || key="group:$resource_id"
      name=$(jq -r --arg key "$key" '.[$key] // empty' "$secret_map") || return 1
    fi
    [[ $name =~ ^[a-zA-Z_][a-zA-Z0-9_]*$ ]] || return 1
    export MIGRATION_WEBHOOK_SECRET="${!name:-}"
    [[ -n $MIGRATION_WEBHOOK_SECRET && $MIGRATION_WEBHOOK_SECRET != *$'\n'* && $MIGRATION_WEBHOOK_SECRET != *$'\r'* ]]
  }

  local group_test_available=true
  if [[ $scope == group && $test_event == true ]]; then
    group_test_available=$(request GET '/version' | jq -er '.version | capture("^(?<major>[0-9]+)\\.(?<minor>[0-9]+)\\.") | if (.major | tonumber) > 17 or ((.major | tonumber) == 17 and (.minor | tonumber) >= 1) then "true" else "false" end') || fail 'Cannot determine GitLab version; no updates applied'
  fi

  local resources='' resource resource_type resource_id hooks_path batch input hooks old target hook state group_id failed=0
  local eligible_groups='[]' matches
  while IFS= read -r input; do
    batch=$(request GET "/${scope}s/$(encode "$input")") || fail "Cannot read $scope"
    resources+="$(jq -c --arg type "$scope" '{type:$type,id:.id}' <<< "$batch")"$'\n'
    if [[ $scope == group ]]; then
      group_id=$(jq -r .id <<< "$batch")
      batch=$(list_all "/groups/$(encode "$input")/projects?include_subgroups=$subgroups&with_shared=false") || fail 'Cannot list all group projects'
      resources+="$(jq -c --argjson group_id "$group_id" '{type:"project",id:.id,group_id:$group_id}' <<< "$batch")"$'\n'
    fi
  done < <(jq -r '.[]' <<< "$inputs")
  resources=$(jq -sc 'if length > 0 and all(.[]; (.id | type == "number") and (.id > 0)) then group_by([.type,.id]) | map(.[0] + {group_ids:(map(.group_id) | map(select(. != null)) | unique)}) else error("Invalid resources") end' <<< "$resources") || fail 'Invalid project or group response'
  : > "$tmp/plan"
  while IFS= read -r resource; do
    resource_type=$(jq -r .type <<< "$resource")
    resource_id=$(jq -r .id <<< "$resource")
    hooks_path="/${resource_type}s/$resource_id/hooks"
    if [[ $scope == group && $resource_type == project ]] && ! jq -e --argjson groups "$eligible_groups" 'any(.group_ids[]; . as $id | $groups | index($id) != null)' <<< "$resource" >/dev/null; then
      report_row SKIPPED_GROUP_NOT_READY null
      continue
    fi
    hooks=$(list_all "$hooks_path") || fail "Cannot list all $resource_type webhooks; no updates applied"
    hooks=$(jq -s . <<< "$hooks")
    jq -e 'all(.[]; (.id | type == "number") and (.url | type == "string"))' <<< "$hooks" >/dev/null || fail 'Invalid webhook response'
    if [[ $scope == group && $resource_type == project ]]; then
      matches=$(jq -c --arg from "$from" --arg to "$to" '.[] | select(.url == $from or .url == $to)' <<< "$hooks" | snapshot | jq -sc 'sort_by(.id)')
      if [[ $(jq length <<< "$matches") == 0 ]]; then
        report_row NO_MATCH null
      else
        while IFS= read -r hook; do report_row WOULD_REMOVE "$hook"; done < <(jq -c '.[]' <<< "$matches")
        jq -c --argjson hooks "$matches" '. + {action:"remove",hooks:$hooks}' <<< "$resource" >> "$tmp/plan"
      fi
      continue
    fi
    old=$(jq -c --arg url "$from" '[.[] | select(.url == $url)]' <<< "$hooks")
    target=$(jq -c --arg url "$to" '[.[] | select(.url == $url)]' <<< "$hooks")
    hook=null
    if [[ $(jq length <<< "$old") == 1 && $(jq length <<< "$target") == 0 ]]; then
      hook=$(jq '.[0]' <<< "$old" | snapshot)
      state=WOULD_UPDATE
      if [[ $apply == true && $resource_type != group ]] && ! resolve_secret; then state=MISSING_SECRET; failed=1; fi
    elif [[ $(jq length <<< "$old") == 0 && $(jq length <<< "$target") == 1 ]]; then
      state=ALREADY_TARGET_AUTH_UNVERIFIED
      hook=$(jq '.[0]' <<< "$target" | snapshot)
    elif [[ $(jq length <<< "$old") == 0 && $(jq length <<< "$target") == 0 ]]; then
      state=NO_MATCH
      [[ $resource_type != group ]] || state=SKIPPED_NO_GROUP_WEBHOOK
    else
      state=CONFLICT; failed=1
    fi
    if [[ $resource_type == group && $hook != null ]]; then
      eligible_groups=$(jq -c --argjson id "$resource_id" '. + [$id]' <<< "$eligible_groups")
      state=WOULD_UPDATE
      if [[ $apply == true ]] && ! resolve_secret; then state=MISSING_SECRET; failed=1; fi
    fi
    report_row "$state" "$hook"
    if [[ $state == WOULD_UPDATE ]]; then
      jq -c --argjson hook "$hook" '. + {hook:$hook}' <<< "$resource" >> "$tmp/plan"
    fi
  done < <(jq -c '.[]' <<< "$resources")
  [[ $apply == true ]] || exit "$failed"
  (( failed == 0 )) || fail 'Resolve conflicts or missing secrets before applying; no updates applied'

  local row id current expected actual
  while IFS= read -r row; do
    resource_type=$(jq -r .type <<< "$row")
    resource_id=$(jq -r .id <<< "$row")
    hooks_path="/${resource_type}s/$resource_id/hooks"
    if [[ $(jq -r '.action // empty' <<< "$row") == remove ]]; then
      hooks=$(list_all "$hooks_path") || { report_row READ_FAILED null; exit 1; }
      current=$(jq -c --arg from "$from" --arg to "$to" 'select(.url == $from or .url == $to)' <<< "$hooks" | snapshot | jq -scS 'sort_by(.id)')
      expected=$(jq -cS .hooks <<< "$row")
      if [[ $current != "$expected" ]]; then
        report_row CHANGED_SINCE_PLAN null; exit 1
      fi
      while IFS= read -r hook; do
        id=$(jq -r .id <<< "$hook")
        report_row REMOVING "$hook"
        if ! request DELETE "$hooks_path/$id" >/dev/null; then
          report_row REMOVE_OUTCOME_UNKNOWN "$hook"; exit 1
        fi
        hooks=$(list_all "$hooks_path") || { report_row REMOVE_VERIFY_FAILED "$hook"; exit 1; }
        if ! jq -se --argjson id "$id" 'all(.[]; (.id | type == "number") and (.url | type == "string") and .id != $id)' <<< "$hooks" >/dev/null; then
          report_row REMOVE_VERIFY_FAILED "$hook"; exit 1
        fi
        report_row REMOVED "$hook"
      done < <(jq -c '.hooks[]' <<< "$row")
      if ! jq -se --arg from "$from" --arg to "$to" 'all(.[]; .url != $from and .url != $to)' <<< "$hooks" >/dev/null; then
        report_row CLEANUP_INCOMPLETE null; exit 1
      fi
      continue
    fi
    hook=$(jq -cS .hook <<< "$row")
    id=$(jq -r .id <<< "$hook")
    hooks=$(list_all "$hooks_path") || { report_row READ_FAILED "$hook"; exit 1; }
    current=$(jq -sc --argjson id "$id" --arg from "$from" --arg to "$to" \
      '[.[] | select(.url == $from or .url == $to or .id == $id)]' <<< "$hooks")
    if [[ $(jq length <<< "$current") != 1 ]] || [[ $(jq '.[0]' <<< "$current" | snapshot) != "$hook" ]]; then
      report_row CHANGED_SINCE_PLAN "$hook"; exit 1
    fi
    resolve_secret || { report_row MISSING_SECRET "$hook"; exit 1; }
    report_row UPDATING "$hook"
    if ! jq -cn --arg url "$to" '{url:$url,token:env.MIGRATION_WEBHOOK_SECRET}' | request PUT "$hooks_path/$id" >/dev/null; then
      report_row UPDATE_OUTCOME_UNKNOWN "$hook"; exit 1
    fi
    current=$(request GET "$hooks_path/$id") || { report_row VERIFY_FAILED "$hook"; exit 1; }
    expected=$(jq -cS --arg url "$to" '.url=$url' <<< "$hook")
    actual=$(snapshot <<< "$current")
    if [[ $actual != "$expected" ]] || jq -e '.token_present == false' <<< "$current" >/dev/null; then
      report_row VERIFY_FAILED "$hook"; exit 1
    fi
    report_row UPDATED_AUTH_UNVERIFIED "$actual"
    if [[ $test_event == true ]]; then
      if [[ $resource_type == group && $group_test_available == false ]]; then
        report_row TEST_UNAVAILABLE "$actual"
      elif request POST "$hooks_path/$id/test/merge_requests_events" >/dev/null; then
        report_row TEST_REQUESTED_DELIVERY_UNVERIFIED "$actual"
      else
        report_row TEST_REQUEST_FAILED "$actual"; exit 1
      fi
    fi
  done < "$tmp/plan"
)

if [[ ${1:-} == migrate ]]; then
  shift
  migrate "$@"
  exit
fi

usage() {
  cat <<EOF
Usage:
  $0 -h <gitlab-host> -u <webhook-url> -s <webhook-secret> \\
     [-t <access-token>] [-A <auth-header>] [-p <project> | -g <group>] [-v]

Required:
  -h  GitLab host (e.g. gitlab.example.com)
  -u  Webhook endpoint URL to receive POSTs
  -s  Webhook secret token (used for signature verification)

Authentication (one of):
  -t  Access token (PAT, project, group or OAuth). If omitted, \$GITLAB_TOKEN is used
  -A  Auth header to use. Default detects:
        PAT → "PRIVATE-TOKEN"
        anything else → "Authorization: Bearer"

Scope (choose one):
  -p  Project ID or full path (e.g. 42 or group/app)
  -g  Group ID or full path, recurse through all subgroups & projects

Options:
  -v  Verbose output (show individual project IDs in final summary)
EOF
  exit 1
}

HOST="" HOOK_URL="" HOOK_SECRET=""
TOKEN="${GITLAB_TOKEN:-}" AUTH_HEADER=""
PROJECT="" GROUP="" VERBOSE=false

while getopts "h:u:s:t:A:p:g:v" opt; do
  case "$opt" in
    h) HOST=$OPTARG ;;
    u) HOOK_URL=$OPTARG ;;
    s) HOOK_SECRET=$OPTARG ;;
    t) TOKEN=$OPTARG ;;
    A) AUTH_HEADER=$OPTARG ;;
    p) PROJECT=$OPTARG ;;
    g) GROUP=$OPTARG ;;
    v) VERBOSE=true ;;
    *) usage ;;
  esac
done

# Mandatory checks

[[ -z $HOST || -z $HOOK_URL || -z $HOOK_SECRET ]] && usage
[[ -n $PROJECT && -n $GROUP ]] && usage
[[ -z $PROJECT && -z $GROUP ]] && usage

# Token handling

if [[ -z $TOKEN ]]; then
  echo "[ERROR] No access token provided. Use -t or set \$GITLAB_TOKEN" >&2
  exit 1
fi

# Choose header if not forced

if [[ -z $AUTH_HEADER ]]; then
  if [[ $TOKEN == glpat-* || $TOKEN == "PAT-"* ]]; then
    AUTH_HEADER="PRIVATE-TOKEN"
  else
    AUTH_HEADER="Authorization: Bearer"
  fi
fi

API="https://${HOST}/api/v4"
CURL_BASE=(curl -sSf --header "${AUTH_HEADER}: ${TOKEN}")

# Track processed projects to avoid duplicates

declare -A PROCESSED_PROJECTS
WEBHOOK_PROJECTS=()
EXISTING_WEBHOOK_PROJECTS=()
TOTAL_PROJECTS_FOUND=0
PROJECTS_PROCESSED=0

url_encode() {
  local string="$1"
  printf '%s' "$string" | sed 's/\//%2F/g; s/ /%20/g; s/@/%40/g; s/:/%3A/g; s/#/%23/g; s/?/%3F/g; s/&/%26/g; s/=/%3D/g; s/+/%2B/g'
}

fetch_paginated() {
  local url=$1
  local page=1
  local per_page=100

  while true; do
    local paginated_url
    if [[ "$url" == *"?"* ]]; then
      paginated_url="${url}&per_page=${per_page}&page=${page}"
    else
      paginated_url="${url}?per_page=${per_page}&page=${page}"
    fi

    local response
    response=$("${CURL_BASE[@]}" "$paginated_url" 2>/dev/null) || {
      echo "[ERROR] Failed to fetch page $page from $url" >&2
      return 1
    }

    if [[ "$response" == "[]" || "$response" == "null" ]]; then
      break
    fi

    local page_results
    page_results=$(echo "$response" | jq -r '.[].id' 2>/dev/null) || {
      echo "[ERROR] Failed to parse JSON response from page $page" >&2
      return 1
    }

    if [[ -z "$page_results" ]]; then
      break
    fi

    local page_count
    page_count=$(echo "$page_results" | wc -l)
    TOTAL_PROJECTS_FOUND=$((TOTAL_PROJECTS_FOUND + page_count))
    echo "[PROGRESS] Found $page_count projects on page $page (total: $TOTAL_PROJECTS_FOUND)" >&2

    echo "$page_results"

    local item_count
    item_count=$(echo "$response" | jq '. | length' 2>/dev/null) || 0
    if [[ "$item_count" -lt "$per_page" ]]; then
      break
    fi

    ((page++))
  done
}

create_hook() {
  local pid=$1

  if [[ -n "${PROCESSED_PROJECTS[$pid]:-}" ]]; then
    return 0
  fi

  PROCESSED_PROJECTS[$pid]=1
  PROJECTS_PROCESSED=$((PROJECTS_PROCESSED + 1))

  local encoded_pid
  if [[ $pid =~ ^[0-9]+$ ]]; then
    encoded_pid=$pid
  else
    encoded_pid=$(url_encode "$pid")
  fi

  local existing_webhooks
  existing_webhooks=$("${CURL_BASE[@]}" "${API}/projects/${encoded_pid}/hooks" 2>/dev/null) || {
    echo "[ERROR] Failed to fetch existing webhooks for project $pid" >&2
    return 1
  }

  if echo "$existing_webhooks" | jq -e --arg url "$HOOK_URL" '.[] | select(.url == $url)' >/dev/null 2>&1; then
    [[ "$VERBOSE" == "true" ]] && echo "[INFO] Webhook already exists for project: $pid" >&2
    EXISTING_WEBHOOK_PROJECTS+=("$pid")
    return 0
  fi

  [[ "$VERBOSE" == "true" ]] && echo "[INFO] Adding webhook to project: $pid" >&2

  "${CURL_BASE[@]}" --request POST \
    --data-urlencode "url=${HOOK_URL}" \
    --data "token=${HOOK_SECRET}" \
    --data "push_events=true" \
    --data "note_events=true" \
    --data "issues_events=true" \
    --data "merge_requests_events=true" \
    --data "enable_ssl_verification=true" \
    "${API}/projects/${encoded_pid}/hooks" \
    > /dev/null

  WEBHOOK_PROJECTS+=("$pid")
}

traverse_group() {
  local gid=$1
  local encoded_gid
  if [[ $gid =~ ^[0-9]+$ ]]; then
    encoded_gid=$gid
  else
    encoded_gid=$(url_encode "$gid")
  fi

  while IFS= read -r pid; do
    [[ -n "$pid" ]] && create_hook "$pid"
  done < <(
    fetch_paginated "${API}/groups/${encoded_gid}/projects?include_subgroups=true"
  )

  while IFS= read -r sg; do
    [[ -n "$sg" ]] && traverse_group "$sg"
  done < <(
    fetch_paginated "${API}/groups/${encoded_gid}/subgroups"
  )
}

echo "[INFO] Starting webhook processing..." >&2

if [[ -n $PROJECT ]]; then
  echo "[INFO] Processing single project: $PROJECT" >&2
  create_hook "$PROJECT"
else
  echo "[INFO] Processing group and subgroups: $GROUP" >&2
  traverse_group "$GROUP"
fi

echo "[INFO] Finished processing all projects" >&2

total_projects=$((${#WEBHOOK_PROJECTS[@]} + ${#EXISTING_WEBHOOK_PROJECTS[@]}))

if [[ $total_projects -eq 0 ]]; then
  echo "[INFO] No projects were processed"
else
  if [[ ${#WEBHOOK_PROJECTS[@]} -gt 0 ]]; then
    if [[ "$VERBOSE" == "true" ]]; then
      echo "[INFO] Webhooks installed successfully on ${#WEBHOOK_PROJECTS[@]} project(s):"
      for pid in "${WEBHOOK_PROJECTS[@]}"; do
        echo "  - Project ID: $pid"
      done
    else
      echo "[INFO] Webhooks installed successfully on ${#WEBHOOK_PROJECTS[@]} project(s)"
    fi
  fi

  if [[ ${#EXISTING_WEBHOOK_PROJECTS[@]} -gt 0 ]]; then
    if [[ "$VERBOSE" == "true" ]]; then
      echo "[INFO] Webhooks already existed on ${#EXISTING_WEBHOOK_PROJECTS[@]} project(s):"
      for pid in "${EXISTING_WEBHOOK_PROJECTS[@]}"; do
        echo "  - Project ID: $pid"
      done
    else
      echo "[INFO] Webhooks already existed on ${#EXISTING_WEBHOOK_PROJECTS[@]} project(s)"
    fi
  fi

  echo "[INFO] Total projects processed: $total_projects"
fi