Guard the public boundary in CI, and add a CHANGELOG - #27
Merged
Merged
Conversation
The repository is public and had no automated check that internal material stays out of it — the grep lived in local notes and ran when someone remembered. By the time a leak is tagged it is already fetchable, and history keeps it there. Three phases, one per way material has escaped or could: - internal needles in any tracked file, via `git grep` so the set scanned is exactly the set that can reach the remote; - every package-lock `resolved` URL pointing at the public registry. The npm registry configured in this dev environment is the internal one and the public one is unreachable, so each `npm install` pulls internal hosts in and the rewrite back out is manual, hence forgettable, hence asserted. The upstream data model is a git dependency and is the one allowed exception; - local-only notes absent from the index. .gitignore does not apply to files already tracked, so one `git add -f` makes CLAUDE.md permanent while .gitignore goes on looking correct. The needle scan is case-sensitive on purpose: `ipws` is four characters and occurs inside ordinary camelCase, so `-i` flags every `skipWs()` call in rowFilter.ts. A check that cries wolf on correct code gets muted. Runs before `npm ci` — it needs no dependencies, and it is the one check whose failure cannot be fixed by retrying.
Eighty releases with no changelog, so the Marketplace page and every GitHub Release showed no history. Reconstructed from the annotated tags: their subject where they have one, then the annotation body, then the commit subjects the tag covers with bump and merge noise dropped. Five of the eighty still say nothing useful — those tags genuinely recorded only a version number. From here the entry is written at bump time, beside the version change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two pieces of maintenance groundwork.
scripts/leak-check.mjs+npm run check:leak, wired into CI. The repo ispublic and had no automated check that internal material stays out of it — core
already has one, this repo did not. Three phases: internal needles in tracked
files, every
package-lockresolvedURL on the public registry (the upstreamgit dependency being the one allowed exception), and local-only notes absent from
the index. Each phase was tested against a planted violation; each fails, and the
lockfile phase also trips the needle phase, which is the intended overlap.
The needle scan is case-sensitive deliberately —
-imatchesipwsinsideskipWs()inrowFilter.ts, and a check that cries wolf gets muted.Runs before
npm ci: no dependencies needed, and a leak should surface in secondsrather than behind a five-minute build.
CHANGELOG.md, backfilled from the 80 annotated release tags, so theMarketplace page and GitHub Releases stop showing no history.
Also adds a
verifyaggregate (typecheck && build && build:web && test && check:leak) as a single local pre-merge gate, mirroring core's.