Repository: lindell/multi-gitter
Pull request #394 (2023-10-11 23:14:06)

build(deps): bump golang.org/x/net from 0.15.0 to 0.17.0
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.15.0 to 0.17.0.
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/golang/net/commit/b225e7ca6dde1ef5a5ae5ce922861bda011cfabd"><code>b225e7c</code></a> http2: limit maximum handler goroutines to MaxConcurrentStreams</li>
<li><a href="https://github.com/golang/net/commit/88194ad8ab44a02ea952c169883c3f57db6cf9f4"><code>88194ad</code></a> go.mod: update golang.org/x dependencies</li>
<li><a href="https://github.com/golang/net/commit/2b60a61f1e4cf3a5ecded0bd7e77ea168289e6de"><code>2b60a61</code></a> quic: fix several bugs in flow control accounting</li>
<li><a href="https://github.com/golang/net/commit/73d82efb96cacc0c378bc150b56675fc191894b9"><code>73d82ef</code></a> quic: handle DATA_BLOCKED frames</li>
<li><a href="https://github.com/golang/net/commit/5d5a036a503f8accd748f7453c0162115187be13"><code>5d5a036</code></a> quic: handle streams moving from the data queue to the meta queue</li>
<li><a href="https://github.com/golang/net/commit/350aad2603e57013fafb1a9e2089a382fe67dc80"><code>350aad2</code></a> quic: correctly extend peer's flow control window after MAX_DATA</li>
<li><a href="https://github.com/golang/net/commit/21814e71db756f39b69fb1a3e06350fa555a79b1"><code>21814e7</code></a> quic: validate connection id transport parameters</li>
<li><a href="https://github.com/golang/net/commit/a600b3518eed7a9a4e24380b4b249cb986d9b64d"><code>a600b35</code></a> quic: avoid redundant MAX_DATA updates</li>
<li><a href="https://github.com/golang/net/commit/ea633599b58dc6a50d33c7f5438edfaa8bc313df"><code>ea63359</code></a> http2: check stream body is present on read timeout</li>
<li><a href="https://github.com/golang/net/commit/ddd8598e5694aa5e966e44573a53e895f6fa5eb2"><code>ddd8598</code></a> quic: version negotiation</li>
<li>Additional commits viewable in <a href="https://github.com/golang/net/compare/v0.15.0...v0.17.0">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/net&package-manager=go_modules&previous-version=0.15.0&new-version=0.17.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/lindell/multi-gitter/network/alerts).

</details>


Patch:
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
old mode 100755
new mode 100644
index 5035413..118c591
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -1,5 +1,8 @@
 name: Building
 on: [push, pull_request]
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 27cd405..c3f70cc 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -9,8 +9,15 @@ on:
   schedule:
     - cron: '10 6 * * 2'
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
+    permissions:
+      actions: read  # for github/codeql-action/init to get workflow details
+      contents: read  # for actions/checkout to fetch code
+      security-events: write  # for github/codeql-action/autobuild to send a status report
     name: Analyze
     runs-on: ubuntu-latest
 
@@ -23,6 +30,11 @@ jobs:
     - name: Checkout repository
       uses: actions/checkout@v3
 
+    - name: Set up Go
+      uses: actions/setup-go@v4
+      with:
+        go-version-file: 'go.mod'
+
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v2
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
old mode 100755
new mode 100644
index 2466fd0..b35e0e0
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -5,8 +5,13 @@ on:
 
 name: Generate docs
 
+permissions:
+  contents: read
+
 jobs:
   build:
+    permissions:
+      contents: write  # for Git to git push
     name: Release
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/goreleaser-check.yaml b/.github/workflows/goreleaser-check.yaml
index c0e7cc7..ca7c680 100644
--- a/.github/workflows/goreleaser-check.yaml
+++ b/.github/workflows/goreleaser-check.yaml
@@ -4,6 +4,9 @@ on:
     branches:
       - 'release-please--**'
 
+permissions:
+  contents: read
+
 jobs:
   verify-goreleaser:
     name: Check GoReleaser config
diff --git a/.github/workflows/linting.yaml b/.github/workflows/linting.yaml
index be1a571..ef3775f 100644
--- a/.github/workflows/linting.yaml
+++ b/.github/workflows/linting.yaml
@@ -1,7 +1,13 @@
 name: reviewdog
 on: [pull_request]
+permissions:
+  contents: read
+
 jobs:
   golangci-lint:
+    permissions:
+      checks: write  # for reviewdog/action-golangci-lint to report issues using checks
+      contents: read  # for actions/checkout to fetch code
     name: golangci-lint
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/readme.yaml b/.github/workflows/readme.yaml
old mode 100755
new mode 100644
index 04e6814..4595d0b
--- a/.github/workflows/readme.yaml
+++ b/.github/workflows/readme.yaml
@@ -5,8 +5,13 @@ on:
 
 name: Generate readme
 
+permissions:
+  contents: read
+
 jobs:
   build:
+    permissions:
+      contents: write  # for Git to git push
     name: Release
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
new file mode 100644
index 0000000..ac04695
--- /dev/null
+++ b/.github/workflows/scorecards.yml
@@ -0,0 +1,48 @@
+name: OpenSSF Scorecard
+
+on:
+  schedule:
+    - cron: "20 7 * * 2"
+  push:
+    branches: ["master"]
+
+permissions: read-all
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      contents: read
+      actions: read
+
+    steps:
+      - name: "Checkout code"
+        uses: actions/checkout@v3
+        with:
+          persist-credentials: false
+
+      - name: "Run analysis"
+        uses: ossf/scorecard-action@99c53751e09b9529366343771cc321ec74e9bd3d # v2.0.6
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      # Upload the results as artifacts.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@v3
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: results.sarif
diff --git a/CHANGELOG.md b/CHANGELOG.md
index eaf31ab..09cbc50 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,33 @@
 # Changelog
 
+## [0.48.0](https://github.com/lindell/multi-gitter/compare/v0.47.4...v0.48.0) (2023-10-27)
+
+
+### Features
+
+* added --plain-output flag ([#378](https://github.com/lindell/multi-gitter/issues/378)) ([356f471](https://github.com/lindell/multi-gitter/commit/356f471f720e6efe0146bfabcb99b2c214d9c4db))
+* use repo search to select repositories ([#397](https://github.com/lindell/multi-gitter/issues/397)) ([0f8c2dc](https://github.com/lindell/multi-gitter/commit/0f8c2dcceeb9b635c7405e878df608318b518de4))
+
+
+### Bug Fixes
+
+* **gitlab:** make sure entire project path is shown ([#392](https://github.com/lindell/multi-gitter/issues/392)) ([280dfc7](https://github.com/lindell/multi-gitter/commit/280dfc7b6ed5c8a5345f2207e58e81202a451e33))
+
+
+### Dependencies
+
+* update module code.gitea.io/sdk/gitea to v0.16.0 ([ff04448](https://github.com/lindell/multi-gitter/commit/ff0444885bfbf657b4813efdb53986af67b0ac58))
+* update module github.com/go-git/go-git/v5 to v5.9.0 ([a954c7c](https://github.com/lindell/multi-gitter/commit/a954c7c0c20cb0a930203c92143456c1571d2e2f))
+* update module github.com/google/go-github/v53 to v55 ([#390](https://github.com/lindell/multi-gitter/issues/390)) ([d92cb29](https://github.com/lindell/multi-gitter/commit/d92cb29cc96e8a78d19ccdd1816643510169f6c9))
+* update module github.com/xanzy/go-gitlab to v0.92.1 ([19c2925](https://github.com/lindell/multi-gitter/commit/19c292523f3442766f09d5811ec9b38ecb26c9bf))
+* update module github.com/xanzy/go-gitlab to v0.92.3 ([3e6cd75](https://github.com/lindell/multi-gitter/commit/3e6cd75ad0923ad535f2125f1c94cba6b9072f05))
+* update module golang.org/x/oauth2 to v0.12.0 ([b9c258a](https://github.com/lindell/multi-gitter/commit/b9c258a2b2924ebafa37864159154dc7ed09449c))
+
+
+### Miscellaneous
+
+* update to Go 1.21 ([#402](https://github.com/lindell/multi-gitter/issues/402)) ([d454e5b](https://github.com/lindell/multi-gitter/commit/d454e5b17e90fa2b2d36fa60d15b51df3e7701fa))
+
 ## [0.47.4](https://github.com/lindell/multi-gitter/compare/v0.47.3...v0.47.4) (2023-09-12)
 
 
diff --git a/README.md b/README.md
index 697033b..4721651 100755
--- a/README.md
+++ b/README.md
@@ -211,6 +211,9 @@ repo:
   - my-org/js-repo
   - other-org/python-repo
 
+# Use a repository search to find repositories to target (GitHub only). Forks are NOT included by default, use `fork:true` to include them. See the GitHub documentation for full syntax: https://docs.github.com/en/search-github/searching-on-github/searching-for-repositories
+repo-search:
+
 # The username of the reviewers to be added on the pull request.
 reviewers:
   - example
@@ -309,6 +312,9 @@ repo:
   - my-org/js-repo
   - other-org/python-repo
 
+# Use a repository search to find repositories to target (GitHub only). Forks are NOT included by default, use `fork:true` to include them. See the GitHub documentation for full syntax: https://docs.github.com/en/search-github/searching-on-github/searching-for-repositories
+repo-search:
+
 # Skip repositories which are forks.
 skip-forks: false
 
@@ -389,6 +395,9 @@ repo:
   - my-org/js-repo
   - other-org/python-repo
 
+# Use a repository search to find repositories to target (GitHub only). Forks are NOT included by default, use `fork:true` to include them. See the GitHub documentation for full syntax: https://docs.github.com/en/search-github/searching-on-github/searching-for-repositories
+repo-search:
+
 # Skip repositories which are forks.
 skip-forks: false
 
@@ -466,6 +475,9 @@ repo:
   - my-org/js-repo
   - other-org/python-repo
 
+# Use a repository search to find repositories to target (GitHub only). Forks are NOT included by default, use `fork:true` to include them. See the GitHub documentation for full syntax: https://docs.github.com/en/search-github/searching-on-github/searching-for-repositories
+repo-search:
+
 # Skip repositories which are forks.
 skip-forks: false
 
@@ -552,6 +564,9 @@ repo:
   - my-org/js-repo
   - other-org/python-repo
 
+# Use a repository search to find repositories to target (GitHub only). Forks are NOT included by default, use `fork:true` to include them. See the GitHub documentation for full syntax: https://docs.github.com/en/search-github/searching-on-github/searching-for-repositories
+repo-search:
+
 # Skip repositories which are forks.
 skip-forks: false
 
@@ -639,6 +654,7 @@ Flags:
   -t, --pr-title string            The title of the PR. Will default to the first line of the commit message if none is set.
   -P, --project strings            The name, including owner of a GitLab project in the format "ownerName/repoName".
   -R, --repo strings               The name, including owner of a GitHub repository in the format "ownerName/repoName".
+      --repo-search fork:true      Use a repository search to find repositories to target (GitHub only). Forks are NOT included by default, use fork:true to include them. See the GitHub documentation for full syntax: https://docs.github.com/en/search-github/searching-on-github/searching-for-repositories
   -r, --reviewers strings          The username of the reviewers to be added on the pull request.
       --skip-forks                 Skip repositories which are forks.
       --skip-pr                    Skip pull request and directly push to the branch.
@@ -659,29 +675,30 @@ Usage:
   multi-gitter merge [flags]
 
 Flags:
-  -g, --base-url string      Base URL of the target platform, needs to be changed for GitHub enterprise, a self-hosted GitLab instance, Gitea or BitBucket.
-  -B, --branch string        The name of the branch where changes are committed. (default "multi-gitter-branch")
-      --config string        Path of the config file.
-      --fork                 Use pull requests made from forks instead of from the same repository.
-      --fork-owner string    If set, use forks from the defined value instead of the logged in user.
-  -G, --group strings        The name of a GitLab organization. All repositories in that group will be used.
-      --include-subgroups    Include GitLab subgroups when using the --group flag.
-      --insecure             Insecure controls whether a client verifies the server certificate chain and host name. Used only for Bitbucket server.
-      --log-file string      The file where all logs should be printed to. "-" means stdout. (default "-")
-      --log-format string    The formatting of the logs. Available values: text, json, json-pretty. (default "text")
-  -L, --log-level string     The level of logging that should be made. Available values: trace, debug, info, error. (default "info")
-      --merge-type strings   The type of merge that should be done (GitHub). Multiple types can be used as backup strategies if the first one is not allowed. (default [merge,squash,rebase])
-  -O, --org strings          The name of a GitHub organization. All repositories in that organization will be used.
-      --plain-output         Don't use any terminal formatting when printing the output.
-  -p, --platform string      The platform that is used. Available values: github, gitlab, gitea, bitbucket_server. (default "github")
-  -P, --project strings      The name, including owner of a GitLab project in the format "ownerName/repoName".
-  -R, --repo strings         The name, including owner of a GitHub repository in the format "ownerName/repoName".
-      --skip-forks           Skip repositories which are forks.
-      --ssh-auth             Use SSH cloning URL instead of HTTPS + token. This requires that a setup with ssh keys that have access to all repos and that the server is already in known_hosts.
-  -T, --token string         The personal access token for the targeting platform. Can also be set using the GITHUB_TOKEN/GITLAB_TOKEN/GITEA_TOKEN/BITBUCKET_SERVER_TOKEN environment variable.
-      --topic strings        The topic of a GitHub/GitLab/Gitea repository. All repositories having at least one matching topic are targeted.
-  -U, --user strings         The name of a user. All repositories owned by that user will be used.
-  -u, --username string      The Bitbucket server username.
+  -g, --base-url string         Base URL of the target platform, needs to be changed for GitHub enterprise, a self-hosted GitLab instance, Gitea or BitBucket.
+  -B, --branch string           The name of the branch where changes are committed. (default "multi-gitter-branch")
+      --config string           Path of the config file.
+      --fork                    Use pull requests made from forks instead of from the same repository.
+      --fork-owner string       If set, use forks from the defined value instead of the logged in user.
+  -G, --group strings           The name of a GitLab organization. All repositories in that group will be used.
+      --include-subgroups       Include GitLab subgroups when using the --group flag.
+      --insecure                Insecure controls whether a client verifies the server certificate chain and host name. Used only for Bitbucket server.
+      --log-file string         The file where all logs should be printed to. "-" means stdout. (default "-")
+      --log-format string       The formatting of the logs. Available values: text, json, json-pretty. (default "text")
+  -L, --log-level string        The level of logging that should be made. Available values: trace, debug, info, error. (default "info")
+      --merge-type strings      The type of merge that should be done (GitHub). Multiple types can be used as backup strategies if the first one is not allowed. (default [merge,squash,rebase])
+  -O, --org strings             The name of a GitHub organization. All repositories in that organization will be used.
+      --plain-output            Don't use any terminal formatting when printing the output.
+  -p, --platform string         The platform that is used. Available values: github, gitlab, gitea, bitbucket_server. (default "github")
+  -P, --project strings         The name, including owner of a GitLab project in the format "ownerName/repoName".
+  -R, --repo strings            The name, including owner of a GitHub repository in the format "ownerName/repoName".
+      --repo-search fork:true   Use a repository search to find repositories to target (GitHub only). Forks are NOT included by default, use fork:true to include them. See the GitHub documentation for full syntax: https://docs.github.com/en/search-github/searching-on-github/searching-for-repositories
+      --skip-forks              Skip repositories which are forks.
+      --ssh-auth                Use SSH cloning URL instead of HTTPS + token. This requires that a setup with ssh keys that have access to all repos and that the server is already in known_hosts.
+  -T, --token string            The personal access token for the targeting platform. Can also be set using the GITHUB_TOKEN/GITLAB_TOKEN/GITEA_TOKEN/BITBUCKET_SERVER_TOKEN environment variable.
+      --topic strings           The topic of a GitHub/GitLab/Gitea repository. All repositories having at least one matching topic are targeted.
+  -U, --user strings            The name of a user. All repositories owned by that user will be used.
+  -u, --username string         The Bitbucket server username.
 ```
 
 
@@ -692,29 +709,30 @@ Usage:
   multi-gitter status [flags]
 
 Flags:
-  -g, --base-url string     Base URL of the target platform, needs to be changed for GitHub enterprise, a self-hosted GitLab instance, Gitea or BitBucket.
-  -B, --branch string       The name of the branch where changes are committed. (default "multi-gitter-branch")
-      --config string       Path of the config file.
-      --fork                Use pull requests made from forks instead of from the same repository.
-      --fork-owner string   If set, use forks from the defined value instead of the logged in user.
-  -G, --group strings       The name of a GitLab organization. All repositories in that group will be used.
-      --include-subgroups   Include GitLab subgroups when using the --group flag.
-      --insecure            Insecure controls whether a client verifies the server certificate chain and host name. Used only for Bitbucket server.
-      --log-file string     The file where all logs should be printed to. "-" means stdout. (default "-")
-      --log-format string   The formatting of the logs. Available values: text, json, json-pretty. (default "text")
-  -L, --log-level string    The level of logging that should be made. Available values: trace, debug, info, error. (default "info")
-  -O, --org strings         The name of a GitHub organization. All repositories in that organization will be used.
-  -o, --output string       The file that the output of the script should be outputted to. "-" means stdout. (default "-")
-      --plain-output        Don't use any terminal formatting when printing the output.
-  -p, --platform string     The platform that is used. Available values: github, gitlab, gitea, bitbucket_server. (default "github")
-  -P, --project strings     The name, including owner of a GitLab project in the format "ownerName/repoName".
-  -R, --repo strings        The name, including owner of a GitHub repository in the format "ownerName/repoName".
-      --skip-forks          Skip repositories which are forks.
-      --ssh-auth            Use SSH cloning URL instead of HTTPS + token. This requires that a setup with ssh keys that have access to all repos and that the server is already in known_hosts.
-  -T, --token string        The personal access token for the targeting platform. Can also be set using the GITHUB_TOKEN/GITLAB_TOKEN/GITEA_TOKEN/BITBUCKET_SERVER_TOKEN environment variable.
-      --topic strings       The topic of a GitHub/GitLab/Gitea repository. All repositories having at least one matching topic are targeted.
-  -U, --user strings        The name of a user. All repositories owned by that user will be used.
-  -u, --username string     The Bitbucket server username.
+  -g, --base-url string         Base URL of the target platform, needs to be changed for GitHub enterprise, a self-hosted GitLab instance, Gitea or BitBucket.
+  -B, --branch string           The name of the branch where changes are committed. (default "multi-gitter-branch")
+      --config string           Path of the config file.
+      --fork                    Use pull requests made from forks instead of from the same repository.
+      --fork-owner string       If set, use forks from the defined value instead of the logged in user.
+  -G, --group strings           The name of a GitLab organization. All repositories in that group will be used.
+      --include-subgroups       Include GitLab subgroups when using the --group flag.
+      --insecure                Insecure controls whether a client verifies the server certificate chain and host name. Used only for Bitbucket server.
+      --log-file string         The file where all logs should be printed to. "-" means stdout. (default "-")
+      --log-format string       The formatting of the logs. Available values: text, json, json-pretty. (default "text")
+  -L, --log-level string        The level of logging that should be made. Available values: trace, debug, info, error. (default "info")
+  -O, --org strings             The name of a GitHub organization. All repositories in that organization will be used.
+  -o, --output string           The file that the output of the script should be outputted to. "-" means stdout. (default "-")
+      --plain-output            Don't use any terminal formatting when printing the output.
+  -p, --platform string         The platform that is used. Available values: github, gitlab, gitea, bitbucket_server. (default "github")
+  -P, --project strings         The name, including owner of a GitLab project in the format "ownerName/repoName".
+  -R, --repo strings            The name, including owner of a GitHub repository in the format "ownerName/repoName".
+      --repo-search fork:true   Use a repository search to find repositories to target (GitHub only). Forks are NOT included by default, use fork:true to include them. See the GitHub documentation for full syntax: https://docs.github.com/en/search-github/searching-on-github/searching-for-repositories
+      --skip-forks              Skip repositories which are forks.
+      --ssh-auth                Use SSH cloning URL instead of HTTPS + token. This requires that a setup with ssh keys that have access to all repos and that the server is already in known_hosts.
+  -T, --token string            The personal access token for the targeting platform. Can also be set using the GITHUB_TOKEN/GITLAB_TOKEN/GITEA_TOKEN/BITBUCKET_SERVER_TOKEN environment variable.
+      --topic strings           The topic of a GitHub/GitLab/Gitea repository. All repositories having at least one matching topic are targeted.
+  -U, --user strings            The name of a user. All repositories owned by that user will be used.
+  -u, --username string         The Bitbucket server username.
 ```
 
 
@@ -725,28 +743,29 @@ Usage:
   multi-gitter close [flags]
 
 Flags:
-  -g, --base-url string     Base URL of the target platform, needs to be changed for GitHub enterprise, a self-hosted GitLab instance, Gitea or BitBucket.
-  -B, --branch string       The name of the branch where changes are committed. (default "multi-gitter-branch")
-      --config string       Path of the config file.
-      --fork                Use pull requests made from forks instead of from the same repository.
-      --fork-owner string   If set, use forks from the defined value instead of the logged in user.
-  -G, --group strings       The name of a GitLab organization. All repositories in that group will be used.
-      --include-subgroups   Include GitLab subgroups when using the --group flag.
-      --insecure            Insecure controls whether a client verifies the server certificate chain and host name. Used only for Bitbucket server.
-      --log-file string     The file where all logs should be printed to. "-" means stdout. (default "-")
-      --log-format string   The formatting of the logs. Available values: text, json, json-pretty. (default "text")
-  -L, --log-level string    The level of logging that should be made. Available values: trace, debug, info, error. (default "info")
-  -O, --org strings         The name of a GitHub organization. All repositories in that organization will be used.
-      --plain-output        Don't use any terminal formatting when printing the output.
-  -p, --platform string     The platform that is used. Available values: github, gitlab, gitea, bitbucket_server. (default "github")
-  -P, --project strings     The name, including owner of a GitLab project in the format "ownerName/repoName".
-  -R, --repo strings        The name, including owner of a GitHub repository in the format "ownerName/repoName".
-      --skip-forks          Skip repositories which are forks.
-      --ssh-auth            Use SSH cloning URL instead of HTTPS + token. This requires that a setup with ssh keys that have access to all repos and that the server is already in known_hosts.
-  -T, --token string        The personal access token for the targeting platform. Can also be set using the GITHUB_TOKEN/GITLAB_TOKEN/GITEA_TOKEN/BITBUCKET_SERVER_TOKEN environment variable.
-      --topic strings       The topic of a GitHub/GitLab/Gitea repository. All repositories having at least one matching topic are targeted.
-  -U, --user strings        The name of a user. All repositories owned by that user will be used.
-  -u, --username string     The Bitbucket server username.
+  -g, --base-url string         Base URL of the target platform, needs to be changed for GitHub enterprise, a self-hosted GitLab instance, Gitea or BitBucket.
+  -B, --branch string           The name of the branch where changes are committed. (default "multi-gitter-branch")
+      --config string           Path of the config file.
+      --fork                    Use pull requests made from forks instead of from the same repository.
+      --fork-owner string       If set, use forks from the defined value instead of the logged in user.
+  -G, --group strings           The name of a GitLab organization. All repositories in that group will be used.
+      --include-subgroups       Include GitLab subgroups when using the --group flag.
+      --insecure                Insecure controls whether a client verifies the server certificate chain and host name. Used only for Bitbucket server.
+      --log-file string         The file where all logs should be printed to. "-" means stdout. (default "-")
+      --log-format string       The formatting of the logs. Available values: text, json, json-pretty. (default "text")
+  -L, --log-level string        The level of logging that should be made. Available values: trace, debug, info, error. (default "info")
+  -O, --org strings             The name of a GitHub organization. All repositories in that organization will be used.
+      --plain-output            Don't use any terminal formatting when printing the output.
+  -p, --platform string         The platform that is used. Available values: github, gitlab, gitea, bitbucket_server. (default "github")
+  -P, --project strings         The name, including owner of a GitLab project in the format "ownerName/repoName".
+  -R, --repo strings            The name, including owner of a GitHub repository in the format "ownerName/repoName".
+      --repo-search fork:true   Use a repository search to find repositories to target (GitHub only). Forks are NOT included by default, use fork:true to include them. See the GitHub documentation for full syntax: https://docs.github.com/en/search-github/searching-on-github/searching-for-repositories
+      --skip-forks              Skip repositories which are forks.
+      --ssh-auth                Use SSH cloning URL instead of HTTPS + token. This requires that a setup with ssh keys that have access to all repos and that the server is already in known_hosts.
+  -T, --token string            The personal access token for the targeting platform. Can also be set using the GITHUB_TOKEN/GITLAB_TOKEN/GITEA_TOKEN/BITBUCKET_SERVER_TOKEN environment variable.
+      --topic strings           The topic of a GitHub/GitLab/Gitea repository. All repositories having at least one matching topic are targeted.
+  -U, --user strings            The name of a user. All repositories owned by that user will be used.
+  -u, --username string         The Bitbucket server username.
 ```
 
 
@@ -762,34 +781,35 @@ Usage:
   multi-gitter print [script path] [flags]
 
 Flags:
-  -g, --base-url string       Base URL of the target platform, needs to be changed for GitHub enterprise, a self-hosted GitLab instance, Gitea or BitBucket.
-  -C, --concurrent int        The maximum number of concurrent runs. (default 1)
-      --config string         Path of the config file.
-  -E, --error-output string   The file that the output of the script should be outputted to. "-" means stderr. (default "-")
-  -f, --fetch-depth int       Limit fetching to the specified number of commits. Set to 0 for no limit. (default 1)
-      --git-type string       The type of git implementation to use.
-                              Available values:
-                                go: Uses go-git, a Go native implementation of git. This is compiled with the multi-gitter binary, and no extra dependencies are needed.
-                                cmd: Calls out to the git command. This requires git to be installed and available with by calling "git".
-                               (default "go")
-  -G, --group strings         The name of a GitLab organization. All repositories in that group will be used.
-      --include-subgroups     Include GitLab subgroups when using the --group flag.
-      --insecure              Insecure controls whether a client verifies the server certificate chain and host name. Used only for Bitbucket server.
-      --log-file string       The file where all logs should be printed to. "-" means stdout.
-      --log-format string     The formatting of the logs. Available values: text, json, json-pretty. (default "text")
-  -L, --log-level string      The level of logging that should be made. Available values: trace, debug, info, error. (default "info")
-  -O, --org strings           The name of a GitHub organization. All repositories in that organization will be used.
-  -o, --output string         The file that the output of the script should be outputted to. "-" means stdout. (default "-")
-      --plain-output          Don't use any terminal formatting when printing the output.
-  -p, --platform string       The platform that is used. Available values: github, gitlab, gitea, bitbucket_server. (default "github")
-  -P, --project strings       The name, including owner of a GitLab project in the format "ownerName/repoName".
-  -R, --repo strings          The name, including owner of a GitHub repository in the format "ownerName/repoName".
-      --skip-forks            Skip repositories which are forks.
-      --ssh-auth              Use SSH cloning URL instead of HTTPS + token. This requires that a setup with ssh keys that have access to all repos and that the server is already in known_hosts.
-  -T, --token string          The personal access token for the targeting platform. Can also be set using the GITHUB_TOKEN/GITLAB_TOKEN/GITEA_TOKEN/BITBUCKET_SERVER_TOKEN environment variable.
-      --topic strings         The topic of a GitHub/GitLab/Gitea repository. All repositories having at least one matching topic are targeted.
-  -U, --user strings          The name of a user. All repositories owned by that user will be used.
-  -u, --username string       The Bitbucket server username.
+  -g, --base-url string         Base URL of the target platform, needs to be changed for GitHub enterprise, a self-hosted GitLab instance, Gitea or BitBucket.
+  -C, --concurrent int          The maximum number of concurrent runs. (default 1)
+      --config string           Path of the config file.
+  -E, --error-output string     The file that the output of the script should be outputted to. "-" means stderr. (default "-")
+  -f, --fetch-depth int         Limit fetching to the specified number of commits. Set to 0 for no limit. (default 1)
+      --git-type string         The type of git implementation to use.
+                                Available values:
+                                  go: Uses go-git, a Go native implementation of git. This is compiled with the multi-gitter binary, and no extra dependencies are needed.
+                                  cmd: Calls out to the git command. This requires git to be installed and available with by calling "git".
+                                 (default "go")
+  -G, --group strings           The name of a GitLab organization. All repositories in that group will be used.
+      --include-subgroups       Include GitLab subgroups when using the --group flag.
+      --insecure                Insecure controls whether a client verifies the server certificate chain and host name. Used only for Bitbucket server.
+      --log-file string         The file where all logs should be printed to. "-" means stdout.
+      --log-format string       The formatting of the logs. Available values: text, json, json-pretty. (default "text")
+  -L, --log-level string        The level of logging that should be made. Available values: trace, debug, info, error. (default "info")
+  -O, --org strings             The name of a GitHub organization. All repositories in that organization will be used.
+  -o, --output string           The file that the output of the script should be outputted to. "-" means stdout. (default "-")
+      --plain-output            Don't use any terminal formatting when printing the output.
+  -p, --platform string         The platform that is used. Available values: github, gitlab, gitea, bitbucket_server. (default "github")
+  -P, --project strings         The name, including owner of a GitLab project in the format "ownerName/repoName".
+  -R, --repo strings            The name, including owner of a GitHub repository in the format "ownerName/repoName".
+      --repo-search fork:true   Use a repository search to find repositories to target (GitHub only). Forks are NOT included by default, use fork:true to include them. See the GitHub documentation for full syntax: https://docs.github.com/en/search-github/searching-on-github/searching-for-repositories
+      --skip-forks              Skip repositories which are forks.
+      --ssh-auth                Use SSH cloning URL instead of HTTPS + token. This requires that a setup with ssh keys that have access to all repos and that the server is already in known_hosts.
+  -T, --token string            The personal access token for the targeting platform. Can also be set using the GITHUB_TOKEN/GITLAB_TOKEN/GITEA_TOKEN/BITBUCKET_SERVER_TOKEN environment variable.
+      --topic strings           The topic of a GitHub/GitLab/Gitea repository. All repositories having at least one matching topic are targeted.
+  -U, --user strings            The name of a user. All repositories owned by that user will be used.
+  -u, --username string         The Bitbucket server username.
 ```
 
 
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..6dfa06c
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,10 @@
+# Security Policy
+
+## Supported Versions
+
+Only the last stable version at any given point.
+
+## Reporting a Vulnerability
+
+Vulnerabilities can be disclosed in private using
+[GitHub advisories](https://github.com/lindell/multi-gitter/security/advisories/new).
diff --git a/cmd/platform.go b/cmd/platform.go
index a8018c4..e63824d 100644
--- a/cmd/platform.go
+++ b/cmd/platform.go
@@ -28,6 +28,7 @@ func configurePlatform(cmd *cobra.Command) {
 	flags.StringSliceP("group", "G", nil, "The name of a GitLab organization. All repositories in that group will be used.")
 	flags.StringSliceP("user", "U", nil, "The name of a user. All repositories owned by that user will be used.")
 	flags.StringSliceP("repo", "R", nil, "The name, including owner of a GitHub repository in the format \"ownerName/repoName\".")
+	flags.StringP("repo-search", "", "", "Use a repository search to find repositories to target (GitHub only). Forks are NOT included by default, use `fork:true` to include them. See the GitHub documentation for full syntax: https://docs.github.com/en/search-github/searching-on-github/searching-for-repositories")
 	flags.StringSliceP("topic", "", nil, "The topic of a GitHub/GitLab/Gitea repository. All repositories having at least one matching topic are targeted.")
 	flags.StringSliceP("project", "P", nil, "The name, including owner of a GitLab project in the format \"ownerName/repoName\".")
 	flags.BoolP("include-subgroups", "", false, "Include GitLab subgroups when using the --group flag.")
@@ -122,14 +123,15 @@ func createGithubClient(flag *flag.FlagSet, verifyFlags bool, readOnly bool) (mu
 	orgs, _ := flag.GetStringSlice("org")
 	users, _ := flag.GetStringSlice("user")
 	repos, _ := flag.GetStringSlice("repo")
+	repoSearch, _ := flag.GetString("repo-search")
 	topics, _ := flag.GetStringSlice("topic")
 	forkMode, _ := flag.GetBool("fork")
 	forkOwner, _ := flag.GetString("fork-owner")
 	sshAuth, _ := flag.GetBool("ssh-auth")
 	skipForks, _ := flag.GetBool("skip-forks")
 
-	if verifyFlags && len(orgs) == 0 && len(users) == 0 && len(repos) == 0 {
-		return nil, errors.New("no organization, user or repo set")
+	if verifyFlags && len(orgs) == 0 && len(users) == 0 && len(repos) == 0 && repoSearch == "" {
+		return nil, errors.New("no organization, user, repo or repo-search set")
 	}
 
 	token, err := getToken(flag)
@@ -164,11 +166,12 @@ func createGithubClient(flag *flag.FlagSet, verifyFlags bool, readOnly bool) (mu
 		BaseURL:             gitBaseURL,
 		TransportMiddleware: http.NewLoggingRoundTripper,
 		RepoListing: github.RepositoryListing{
-			Organizations: orgs,
-			Users:         users,
-			Repositories:  repoRefs,
-			Topics:        topics,
-			SkipForks:     skipForks,
+			Organizations:    orgs,
+			Users:            users,
+			Repositories:     repoRefs,
+			RepositorySearch: repoSearch,
+			Topics:           topics,
+			SkipForks:        skipForks,
 		},
 		MergeTypes:       mergeTypes,
 		ForkMode:         forkMode,
diff --git a/go.mod b/go.mod
index 783dda9..e0c3940 100644
--- a/go.mod
+++ b/go.mod
@@ -56,10 +56,10 @@ require (
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
 	github.com/subosito/gotenv v1.4.2 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
-	golang.org/x/crypto v0.13.0 // indirect
+	golang.org/x/crypto v0.14.0 // indirect
 	golang.org/x/mod v0.12.0 // indirect
-	golang.org/x/net v0.15.0 // indirect
-	golang.org/x/sys v0.12.0 // indirect
+	golang.org/x/net v0.17.0 // indirect
+	golang.org/x/sys v0.13.0 // indirect
 	golang.org/x/text v0.13.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
 	golang.org/x/tools v0.13.0 // indirect
diff --git a/go.sum b/go.sum
index 3b2e6f6..e9289b8 100644
--- a/go.sum
+++ b/go.sum
@@ -295,8 +295,8 @@ golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.3.1-0.20221117191849-2c476679df9a/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
-golang.org/x/crypto v0.13.0 h1:mvySKfSWJ+UKUii46M40LOvyWfN0s2U+46/jDd0e6Ck=
-golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
+golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
+golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -371,8 +371,8 @@ golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc=
-golang.org/x/net v0.15.0 h1:ugBLEUaxABaB5AJqW9enI0ACdci2RUd4eP51NTBvuJ8=
-golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
+golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM=
+golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -443,15 +443,15 @@ golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.12.0 h1:CM0HF96J0hcLAwsHPJZjfdNzs0gftsLfgKt57wWHJ0o=
-golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U=
-golang.org/x/term v0.12.0 h1:/ZfYdc3zq+q02Rv9vGqTeSItdzZTSNDmfTi0mBAuidU=
-golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
+golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek=
+golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
diff --git a/internal/scm/github/github.go b/internal/scm/github/github.go
index a2391b0..be47903 100755
--- a/internal/scm/github/github.go
+++ b/internal/scm/github/github.go
@@ -105,11 +105,12 @@ type Github struct {
 
 // RepositoryListing contains information about which repositories that should be fetched
 type RepositoryListing struct {
-	Organizations []string
-	Users         []string
-	Repositories  []RepositoryReference
-	Topics        []string
-	SkipForks     bool
+	Organizations    []string
+	Users            []string
+	Repositories     []RepositoryReference
+	RepositorySearch string
+	Topics           []string
+	SkipForks        bool
 }
 
 // RepositoryReference contains information to be able to reference a repository
@@ -213,6 +214,14 @@ func (g *Github) getRepositories(ctx context.Context) ([]*github.Repository, err
 		allRepos = append(allRepos, repo)
 	}
 
+	if g.RepositorySearch != "" {
+		repos, err := g.getSearchRepositories(ctx, g.RepositorySearch)
+		if err != nil {
+			return nil, errors.Wrapf(err, "could not get repository search results for '%s'", g.RepositorySearch)
+		}
+		allRepos = append(allRepos, repos...)
+	}
+
 	// Remove duplicate repos
 	repoMap := map[string]*github.Repository{}
 	for _, repo := range allRepos {
@@ -282,6 +291,48 @@ func (g *Github) getUserRepositories(ctx context.Context, user string) ([]*githu
 	return repos, nil
 }
 
+func (g *Github) getSearchRepositories(ctx context.Context, search string) ([]*github.Repository, error) {
+	var repos []*github.Repository
+	i := 1
+	for {
+		rr, _, err := retry(ctx, func() ([]*github.Repository, *github.Response, error) {
+			rr, resp, err := g.ghClient.Search.Repositories(ctx, search, &github.SearchOptions{
+				ListOptions: github.ListOptions{
+					Page:    i,
+					PerPage: 100,
+				},
+			})
+
+			if err != nil {
+				return nil, nil, err
+			}
+
+			if rr.GetIncompleteResults() {
+				// can occur when search times out on the server: for now, fail instead
+				// of handling the issue
+				return nil, nil, fmt.Errorf("search timed out on GitHub and was marked incomplete: try refining the search to return fewer results or be less complex")
+			}
+
+			if rr.GetTotal() > 1000 {
+				return nil, nil, fmt.Errorf("%d results for this search, but only the first 1000 results will be returned: try refining your search terms", rr.GetTotal())
+			}
+
+			return rr.Repositories, resp, nil
+		})
+
+		if err != nil {
+			return nil, err
+		}
+		repos = append(repos, rr...)
+		if len(rr) != 100 {
+			break
+		}
+		i++
+	}
+
+	return repos, nil
+}
+
 func (g *Github) getRepository(ctx context.Context, repoRef RepositoryReference) (*github.Repository, error) {
 	repo, _, err := retry(ctx, func() (*github.Repository, *github.Response, error) {
 		return g.ghClient.Repositories.Get(ctx, repoRef.OwnerName, repoRef.Name)
diff --git a/renovate.json b/renovate.json
index 79c2b50..e86d7c7 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,4 +1,6 @@
 {
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "dependencyDashboard": true,
     "enabledManagers": [
         "gomod"
     ],
diff --git a/version.txt b/version.txt
index 1c0069e..a758a09 100644
--- a/version.txt
+++ b/version.txt
@@ -1,1 +1,1 @@
-0.47.4
+0.48.0


Test patch:
diff --git a/.github/workflows/test-install.yaml b/.github/workflows/test-install.yaml
index 612da00..a7c5d17 100644
--- a/.github/workflows/test-install.yaml
+++ b/.github/workflows/test-install.yaml
@@ -7,6 +7,9 @@ on:
       - .github/workflows/test-install.yaml
       - install.sh
 
+permissions:
+  contents: read
+
 jobs:
   test-install-sh:
     name: Test install.sh
@@ -20,9 +23,11 @@ jobs:
       - name: Install multi-gitter
         env:
           BINDIR: ${{ github.workspace }}/bin
+          FULL_NAME: ${{ github.event.pull_request.head.repo.full_name }}
+          REF: ${{ github.head_ref }}
         run: |
-          curl -s https://raw.githubusercontent.com/${{ github.event.pull_request.head.repo.full_name }}/${{ github.head_ref }}/install.sh | sh -s -- -d
-          echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+          curl -s https://raw.githubusercontent.com/$FULL_NAME/$REF/install.sh | sh -s -- -d
+          echo "$BINDIR" >> $GITHUB_PATH
         shell: sh
       - name: Print version
         run: multi-gitter version
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
old mode 100755
new mode 100644
index 42d796e..fbc6c12
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -1,5 +1,8 @@
 name: Testing
 on: [push, pull_request]
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Test
diff --git a/internal/scm/github/github_test.go b/internal/scm/github/github_test.go
index 38f65fa..0be69fc 100644
--- a/internal/scm/github/github_test.go
+++ b/internal/scm/github/github_test.go
@@ -90,7 +90,7 @@ func Test_GetRepositories(t *testing.T) {
 					"push": true,
 					"pull": true
 				},
-				"created_at": "2020-01-02T16:49:16Z"
+				"created_at": "2020-01-02T16:49:17Z"
 			}`,
 			"/users/test-user/repos": `[
 				{
@@ -117,9 +117,41 @@ func Test_GetRepositories(t *testing.T) {
 						"push": true,
 						"pull": true
 					},
-					"created_at": "2020-01-03T16:49:16Z"
+					"created_at": "2020-01-03T16:49:18Z"
 				}
 			]`,
+			"/search/repositories": `{
+					"total_count": 1,
+					"incomplete_results": false,
+					"items": [
+					{
+						"id": 3,
+						"name": "search-repo1",
+						"full_name": "lindell/search-repo1",
+						"private": false,
+						"topics": [
+							"backend",
+							"go"
+						],
+						"owner": {
+							"login": "lindell",
+							"type": "User",
+							"site_admin": false
+						},
+						"html_url": "https://github.com/lindell/search-repo1",
+						"fork": true,
+						"archived": false,
+						"disabled": false,
+						"default_branch": "main",
+						"permissions": {
+							"admin": true,
+							"push": true,
+							"pull": true
+						},
+						"created_at": "2020-01-03T16:49:19Z"
+					}
+				]
+			}`,
 		},
 	}
 
@@ -205,6 +237,25 @@ func Test_GetRepositories(t *testing.T) {
 		}
 	}
 
+	// Repo search
+	{
+		gh, err := github.New(github.Config{
+			TransportMiddleware: transport.Wrapper,
+			RepoListing: github.RepositoryListing{
+				RepositorySearch: "search-string",
+			},
+			MergeTypes: []scm.MergeType{scm.MergeTypeMerge},
+		})
+		require.NoError(t, err)
+
+		repos, err := gh.GetRepositories(context.Background())
+		assert.NoError(t, err)
+		if assert.Len(t, repos, 1) {
+			assert.Equal(t, "main", repos[0].DefaultBranch())
+			assert.Equal(t, "lindell/search-repo1", repos[0].FullName())
+		}
+	}
+
 	// Multiple
 	{
 		gh, err := github.New(github.Config{
@@ -218,6 +269,7 @@ func Test_GetRepositories(t *testing.T) {
 						Name:      "test1",
 					},
 				},
+				RepositorySearch: "test-search",
 			},
 			MergeTypes: []scm.MergeType{scm.MergeTypeMerge},
 		})
@@ -225,11 +277,12 @@ func Test_GetRepositories(t *testing.T) {
 
 		repos, err := gh.GetRepositories(context.Background())
 		assert.NoError(t, err)
-		if assert.Len(t, repos, 2) {
+		if assert.Len(t, repos, 3) {
 			assert.Equal(t, "master", repos[0].DefaultBranch())
 			assert.Equal(t, "test-org/test1", repos[0].FullName())
 			assert.Equal(t, "main", repos[1].DefaultBranch())
 			assert.Equal(t, "lindell/test2", repos[1].FullName())
+			assert.Equal(t, "lindell/search-repo1", repos[2].FullName())
 		}
 	}
 
@@ -259,3 +312,107 @@ func Test_GetRepositories(t *testing.T) {
 		}
 	}
 }
+
+func Test_GetSearchRepository_Incomplete(t *testing.T) {
+	transport := testTransport{
+		pathBodies: map[string]string{
+			"/search/repositories": `{
+					"total_count": 1,
+					"incomplete_results": true,
+					"items": [
+					{
+						"id": 3,
+						"name": "search-repo1",
+						"full_name": "lindell/search-repo1",
+						"private": false,
+						"topics": [
+							"backend",
+							"go"
+						],
+						"owner": {
+							"login": "lindell",
+							"type": "User",
+							"site_admin": false
+						},
+						"html_url": "https://github.com/lindell/search-repo1",
+						"fork": true,
+						"archived": false,
+						"disabled": false,
+						"default_branch": "main",
+						"permissions": {
+							"admin": true,
+							"push": true,
+							"pull": true
+						},
+						"created_at": "2020-01-03T16:49:16Z"
+					}
+				]
+			}`,
+		},
+	}
+
+	gh, err := github.New(github.Config{
+		TransportMiddleware: transport.Wrapper,
+		RepoListing: github.RepositoryListing{
+			RepositorySearch: "search-string",
+		},
+		MergeTypes: []scm.MergeType{scm.MergeTypeMerge},
+	})
+	require.NoError(t, err)
+
+	repos, err := gh.GetRepositories(context.Background())
+	assert.ErrorContains(t, err, "search timed out on GitHub and was marked incomplete")
+	assert.Len(t, repos, 0)
+}
+
+func Test_GetSearchRepository_TooManyResults(t *testing.T) {
+	transport := testTransport{
+		pathBodies: map[string]string{
+			"/search/repositories": `{
+					"total_count": 2054,
+					"incomplete_results": false,
+					"items": [
+					{
+						"id": 3,
+						"name": "search-repo1",
+						"full_name": "lindell/search-repo1",
+						"private": false,
+						"topics": [
+							"backend",
+							"go"
+						],
+						"owner": {
+							"login": "lindell",
+							"type": "User",
+							"site_admin": false
+						},
+						"html_url": "https://github.com/lindell/search-repo1",
+						"fork": true,
+						"archived": false,
+						"disabled": false,
+						"default_branch": "main",
+						"permissions": {
+							"admin": true,
+							"push": true,
+							"pull": true
+						},
+						"created_at": "2020-01-03T16:49:16Z"
+					}
+				]
+			}`,
+		},
+	}
+
+	gh, err := github.New(github.Config{
+		TransportMiddleware: transport.Wrapper,
+		RepoListing: github.RepositoryListing{
+			RepositorySearch: "search-string",
+		},
+		MergeTypes: []scm.MergeType{scm.MergeTypeMerge},
+	})
+	require.NoError(t, err)
+
+	repos, err := gh.GetRepositories(context.Background())
+	assert.ErrorContains(t, err, "only the first 1000 results will be returned")
+	assert.Len(t, repos, 0)
+}