Repository: spotify/backstage
File: plugins/scaffolder-backend-module-github/src/actions/helpers.ts (TypeScript)

Code before:
  topics: string[] | undefined,
  repoVariables: { [key: string]: string } | undefined,
  secrets: { [key: string]: string } | undefined,
  oidcCustomization:
    | {
        useDefault: boolean;
        includeClaimKeys?: string[];
      }
    | undefined,
  customProperties: { [key: string]: string | string[] } | undefined,
  subscribe: boolean | undefined,
  logger: LoggerService,
  autoInit?: boolean | undefined,
) {
  const user = await client.rest.users.getByUsername({
    username: owner,
  });

  if (access?.startsWith(`${owner}/`)) {
    await validateAccessTeam(client, access);
  }

  const [reposMethod, extraParams]: [
    'createInOrg' | 'createForAuthenticatedUser',
    any,
  ] =
    user.data.type === 'Organization'
      ? [
          'createInOrg',
          {
            // Custom properties only available on org repos
            custom_properties: customProperties,
            org: owner,
            // @ts-ignore https://github.com/octokit/types.ts/issues/522
            visibility: repoVisibility,
          },
        ]
      : ['createForAuthenticatedUser', null];
  const repoCreationPromise = client.rest.repos[reposMethod](
    Object.assign(
      {
        allow_auto_merge: allowAutoMerge,
        allow_merge_commit: allowMergeCommit,
        allow_rebase_merge: allowRebaseMerge,
        allow_squash_merge: allowSquashMerge,
        allow_update_branch: allowUpdateBranch,
        auto_init: autoInit,
        delete_branch_on_merge: deleteBranchOnMerge,
        description,
        has_issues: hasIssues,
        has_projects: hasProjects,

Review comment (security):
Can we move this to something like

```
const createParams = {...}

const isOrganization = user.data.type === 'Organization'

if(isOrganization){
   createParams.custom_properties = ...
}

const repoCreationPromise = isOrganization ? client.rest.repos.createInOrg(createParams) : client.rest.repos.createForAuthenticatedUser(createParams);
```

Code after:
  topics: string[] | undefined,
  repoVariables: { [key: string]: string } | undefined,
  secrets: { [key: string]: string } | undefined,
  oidcCustomization:
    | {
        useDefault: boolean;
        includeClaimKeys?: string[];
      }
    | undefined,
  customProperties: { [key: string]: string | string[] } | undefined,
  subscribe: boolean | undefined,
  logger: LoggerService,
  autoInit?: boolean | undefined,
) {
  const user = await client.rest.users.getByUsername({
    username: owner,
  });

  if (access?.startsWith(`${owner}/`)) {
    await validateAccessTeam(client, access);
  }

  const baseRepoParams = {
    allow_auto_merge: allowAutoMerge,
    allow_merge_commit: allowMergeCommit,
    allow_rebase_merge: allowRebaseMerge,
    allow_squash_merge: allowSquashMerge,
    allow_update_branch: allowUpdateBranch,
    auto_init: autoInit,
    delete_branch_on_merge: deleteBranchOnMerge,
    description,
    has_issues: hasIssues,
    has_projects: hasProjects,
    has_wiki: hasWiki,
    homepage,
    name: repo,
    private: repoVisibility === 'private',
    squash_merge_commit_message: squashMergeCommitMessage,
    squash_merge_commit_title: squashMergeCommitTitle,
  };
  const repoCreationPromise =
    user.data.type === 'Organization'
      ? client.rest.repos.createInOrg({
          ...baseRepoParams,
          // Custom properties only available on org repos
          custom_properties: customProperties,
          org: owner,
          // @ts-ignore https://github.com/octokit/types.ts/issues/522
          visibility: repoVisibility,
        })
      : client.rest.repos.createForAuthenticatedUser(baseRepoParams);