What actually broke when I open-sourced my own compliance engine

Описание и применение

Перенос частного репозитория в открытый привёл к утечке внутренних пакетов и удалению важных файлов. Добавлена проверка, которая гарантирует чистоту публичной версии.

Задача

Projecting a private monorepo to a public repo caused unintended leakage of internal packages, deletion of essential files, and broken references.

Результат

The added verification steps prevented accidental exposure of private code, ensured clean lockfiles, and maintained functional CI and badge references.

Рабочий процесс

• 1. Strip private directories from the public projection.
• 2. Regenerate pnpm-lock.yaml and workspace manifest to exclude private packages.
• 3. Run sync/doctor.py to verify repository structure and contents.
• 4. Execute verify-sbom.sh to check SBOM integrity and reference validity.
• 5. Gate release on successful verification before publishing.

Доказательства

First. Stripping a private directory out of the public projection doesn't strip it from pnpm-lock.yaml or the workspace manifest.

Источник

Second. My assemble.sh script, built to prune the enterprise-only bits, was aggressive enough to delete the public repo's own .github/ directory on a re-run.

Источник

I added that verification pass after this round. sync/doctor.py and verify-sbom.sh check the projected repo's actual state.

Источник