What actually broke when I open-sourced my own compliance engine

Description and use

Projecting a private repo to public exposed internal packages and deleted essential files. A verification step now ensures the public repo is clean and functional.

Problem

Projecting a private monorepo to a public repo caused unintended leakage of internal packages, deletion of essential files, and broken references.

Outcome

The added verification steps prevented accidental exposure of private code, ensured clean lockfiles, and maintained functional CI and badge references.

Workflow

• 1. Strip private directories from the public projection.
• 2. Regenerate pnpm-lock.yaml and workspace manifest to exclude private packages.
• 3. Run sync/doctor.py to verify repository structure and contents.
• 4. Execute verify-sbom.sh to check SBOM integrity and reference validity.
• 5. Gate release on successful verification before publishing.

Evidence

First. Stripping a private directory out of the public projection doesn't strip it from pnpm-lock.yaml or the workspace manifest.

Source

Second. My assemble.sh script, built to prune the enterprise-only bits, was aggressive enough to delete the public repo's own .github/ directory on a re-run.

Source

I added that verification pass after this round. sync/doctor.py and verify-sbom.sh check the projected repo's actual state.

Source