From e9a77d1e35b5bda9b3c940a883d62cb1ca51f79e Mon Sep 17 00:00:00 2001
From: Scott McDonald <scott.mcdonald@onixnet.com>
Date: Fri, 28 Aug 2026 17:48:33 +0000
Subject: [PATCH] fix(0-bootstrap): take the organization id explicitly in
 import.sh

import.sh assigned ORG from 'gcloud organizations list', which returns one line
per organization the caller can see. Any deployer with access to more than one
organization (a consultancy account, a shared service account) got a multi-line
value spliced into every policy resource name, and the generated imports.tf
referenced organizations that do not exist.

import.sh now takes the organization id as its first argument or from
ORGANIZATION_ID, and only falls back to gcloud when exactly one organization
is visible; with several it fails with a message naming them instead of
generating bad imports. deploy.sh passes ORGANIZATION_ID, as it already does
for setIAM.sh and enableServices.sh.

Signed-off-by: Scott McDonald <scott.mcdonald@onixnet.com>
---
 fast/stages-aw/0-bootstrap/import.sh | 16 ++++++++++++++--
 scripts/deploy.sh                    |  2 +-
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/fast/stages-aw/0-bootstrap/import.sh b/fast/stages-aw/0-bootstrap/import.sh
index 8e77b1a10..400129b91 100755
--- a/fast/stages-aw/0-bootstrap/import.sh
+++ b/fast/stages-aw/0-bootstrap/import.sh
@@ -13,8 +13,20 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-# Assign Organization ID
-ORG=$(gcloud organizations list --format='value(ID)')
+# Assign Organization ID: first argument, then ORGANIZATION_ID from the
+# environment, then gcloud - but only when exactly one organization is
+# visible. A deployer that can see several organizations gets a multi-line
+# list back, which would otherwise be spliced into every policy resource name
+# below.
+ORG="${1:-${ORGANIZATION_ID:-}}"
+if [[ -z "${ORG}" ]]; then
+  mapfile -t orgs < <(gcloud organizations list --format='value(ID)' | sed '/^[[:space:]]*$/d')
+  if [[ ${#orgs[@]} -gt 1 ]]; then
+    echo "Error: more than one organization is visible (${orgs[*]}). Pass the organization ID as the first argument or set ORGANIZATION_ID." >&2
+    exit 1
+  fi
+  ORG="${orgs[0]:-}"
+fi
 if [[ -z "${ORG}" ]]; then
   echo "Error: Failed to get organization ID." >&2
   exit 1
diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index 8ee8149fa..bbb647471 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -964,7 +964,7 @@ EOF
   fi  # End of state_migrated check
 
   # Import Organization Polcies
-  handle_prompt "Would you like to import recommended org policies?" "${SCRIPT_DIR}/../fast/stages-aw/0-bootstrap/import.sh" || true
+  handle_prompt "Would you like to import recommended org policies?" "${SCRIPT_DIR}/../fast/stages-aw/0-bootstrap/import.sh ${ORGANIZATION_ID}" || true
 
   # Terraform Apply #3 (after state migration, ensuring bootstrap user access)
   cmd=("terraform apply -auto-approve -var bootstrap_user=$(gcloud config list --format 'value(core.account)')")