How Orphaned Neon Preview Branches Quietly Inflated Our Invoice (and the Script We Used to Fix It)

#!/bin/bash

# Cleanup Script for Orphaned Neon Branches # This script deletes Neon branches that no longer exist in GitHub

set -e

# Load environment variables from .env file if it exists if [ -f ".env.neon" ]; then
  source .env.neon
fi

# Configuration
PROTECTED_BRANCHES=("main" "staging" "production")
DRY_RUN=${DRY_RUN:-true}  # Set to false to actually delete
BATCH_SIZE=10  # Number of branches to delete before pausing
DELAY_BETWEEN_BATCHES=2  # Seconds to wait between batches

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Check required environment variables if [ -z "$NEON_API_KEY" ]; then
  echo -e "${RED}❌ Error: NEON_API_KEY environment variable is not set${NC}"
  exit 1
fi

if [ -z "$NEON_PROJECT_ID" ]; then
  echo -e "${RED}❌ Error: NEON_PROJECT_ID environment variable is not set${NC}"
  exit 1
fi

# Check if jq is installed if ! command -v jq &> /dev/null; then
  echo -e "${RED}❌ Error: jq is required but not installed${NC}"
  exit 1
fi

echo -e "${BLUE}🔍 Fetching branches from Neon...${NC}"

NEON_RESPONSE=$(curl -s -X GET \
  -H "Authorization: Bearer $NEON_API_KEY" \
  -H "Accept: application/json" \
  "https://console.neon.tech/api/v2/projects/$NEON_PROJECT_ID/branches")

NEON_BRANCHES=$(echo "$NEON_RESPONSE" | jq -r '.branches[] | "\(.id)|\(.name)"')

echo -e "${BLUE}🔍 Fetching branches from GitHub...${NC}"

GITHUB_BRANCHES=$(git ls-remote --heads origin | awk '{print $2}' | sed 's#refs/heads/##')

is_protected() {
  local branch=$1
  for protected in "${PROTECTED_BRANCHES[@]}"; do
    [[ "$branch" == "$protected" ]] && return 0
  done
  return 1
}

github_branch_exists() {
  local neon_branch=$1
  local branch_without_prefix="${neon_branch#preview/}"
  echo "$GITHUB_BRANCHES" | grep -q "^${branch_without_prefix}$"
}

TO_DELETE=()

while IFS='|' read -r branch_id branch_name; do
  is_protected "$branch_name" && continue
  github_branch_exists "$branch_name" && continue
  TO_DELETE+=("$branch_id|$branch_name")
done <<< "$NEON_BRANCHES"

if [ "${#TO_DELETE[@]}" -eq 0 ]; then
  echo "✅ No orphaned branches found"
  exit 0
fi

if [ "$DRY_RUN" = true ]; then
  echo "🏃 DRY RUN — branches that would be deleted:"
  printf '%s\n' "${TO_DELETE[@]}"
  exit 0
fi

read -p "Type 'DELETE' to confirm: " confirmation
[ "$confirmation" != "DELETE" ] && exit 0

for item in "${TO_DELETE[@]}"; do
  IFS='|' read -r branch_id branch_name <<< "$item"
  curl -s -X DELETE \
    -H "Authorization: Bearer $NEON_API_KEY" \
    "https://console.neon.tech/api/v2/projects/$NEON_PROJECT_ID/branches/$branch_id"
done

echo "✅ Cleanup complete"