What actually broke when I open-sourced my own compliance engine

说明与用途

将私有仓库投影到公开仓库导致内部包泄露和重要文件被删除。现在加入了验证步骤，确保公开仓库干净且功能正常。

问题

Projecting a private monorepo to a public repo caused unintended leakage of internal packages, deletion of essential files, and broken references.

结果

The added verification steps prevented accidental exposure of private code, ensured clean lockfiles, and maintained functional CI and badge references.

工作流

• 1. Strip private directories from the public projection.
• 2. Regenerate pnpm-lock.yaml and workspace manifest to exclude private packages.
• 3. Run sync/doctor.py to verify repository structure and contents.
• 4. Execute verify-sbom.sh to check SBOM integrity and reference validity.
• 5. Gate release on successful verification before publishing.

证据

First. Stripping a private directory out of the public projection doesn't strip it from pnpm-lock.yaml or the workspace manifest.

来源

Second. My assemble.sh script, built to prune the enterprise-only bits, was aggressive enough to delete the public repo's own .github/ directory on a re-run.

来源

I added that verification pass after this round. sync/doctor.py and verify-sbom.sh check the projected repo's actual state.

来源