[locus313]

Description

Adds github-enterprise-billing-report, which reports GitHub Enterprise net cost by billing product over the last complete months (the current, partial month is excluded). It writes HTML, PDF and CSV output with:

• Summary cards, a stacked monthly chart, per-product trend charts and a growth chart
• Top 10 organizations and repositories by net cost, broken down by month
• A separate table for enterprise-account charges (seat licenses billed with no organization)
• Per-SKU detail tables with per-month net columns
• Optional branding through BRAND_NAME, BRAND_LOGO, BRAND_COLOR, BRAND_PALETTE and BRAND_CSS, with no organization-specific styling built in

Also fixes the block-file-writes-via-bash preToolUse hook, which denied every bash call because Copilot CLI passes toolArgs as an object rather than a JSON string.

Generated reports (**/reports/*.html and **/reports/*.pdf) are now gitignored because they contain billing data.

Changes

• New script: reporting/github-enterprise-billing-report/github-enterprise-billing-report.sh
• Modified: lib/github-common.sh
• Other:
  • reporting/github-enterprise-billing-report/action.yml
  • .github/hooks/scripts/block-file-writes-via-bash.sh and tests/test_hooks.bats
  • tests/test_script_validation.bats (billing report section)
  • README.md, docs/script-behaviors.md, GLOSSARY.md, .gitignore

How to test

export GITHUB_TOKEN=ghp_REDACTED
export GITHUB_ENTERPRISE=my-enterprise
./reporting/github-enterprise-billing-report/github-enterprise-billing-report.sh [--no-pdf]

Expected output: reports/billing-report-<enterprise>-<YYYY-MM>.html, .csv and (unless --no-pdf) .pdf, covering the last MONTHS complete months (default 3).

Validation run:

• shellcheck --severity=warning --exclude=SC2034,SC1091 --shell=bash reporting/github-enterprise-billing-report/github-enterprise-billing-report.sh: passed
• bats tests/: passed (146 tests, 0 failures)
• Generated against a live enterprise and checked rendered screenshots of the HTML, including at print width

Checklist

• set -euo pipefail is the first executable line after the # === header
• Script sources lib/github-common.sh via SCRIPT_DIR
• All required env vars validated with require_env_var
• Token validated with validate_github_token (or validate_token for secondary tokens)
• User-supplied slugs validated with validate_slug
• sleep added between repo-level operations to respect rate limits (not applicable: two enterprise-level calls per month, no repo-level operations)
• README.md updated with the new/changed script (env var table + usage example)
• Script header comment matches README documentation
• Tested on a non-production org before production (read-only report)
• shellcheck passes (shellcheck --severity=warning --exclude=SC2034,SC1091 --shell=bash <script>)