chore: prepare this repository to be public - #8
Merged
Conversation
These packages are what an app needs in order to build. Keeping them private
means a fork of a public app repo cannot build it, and it forces every
consumer's CI to carry a token just to clone shared libraries. Making the
repository public is what lets someone self-host the free Task Bundle from
public sources alone.
Audited the full history first — 44 commits, 8.5MB. Gitleaks reported two
findings, both false positives:
- a JSDoc line reading "Access Group A: crypto/handshake operations"
- `n={key:t}` inside a minified Storybook bundle
No private keys, tokens, .env files or certificates anywhere in history.
Changes:
- Untracks @nself/ui/storybook-static — 68 files, 6.2MB of generated bundles
that were committed. Regenerable with `pnpm build-storybook`, and the source
of one of the false positives.
- Adds .gitleaks.toml from the org template, with both false positives
allowlisted precisely rather than by loosening the rule. A third surfaced
once the org rules were in place: security-header tables written as
`key: 'Permissions-Policy'`. Allowlisted to the known header set, not to any
`key:` literal.
- Adds MIT LICENSE. The repository had none, which for a public dependency is
a blocker for anyone downstream.
- Adds a README covering layout, the sibling-checkout consumption model, and
the strictness a contributor will meet.
Build clean, typecheck clean, 778 tests pass.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
These packages are what an app needs in order to build. While this repo is private, a fork of a public app repo cannot build it, and every consumer's CI has to carry a token just to clone shared libraries. Going public is what lets someone self-host the free Task Bundle from public sources alone.
History audited first
44 commits, 8.5MB scanned. Gitleaks reported two findings, both false positives:
Access Group A: crypto/handshaken={key:t}No private keys, tokens,
.envfiles, or certificates anywhere in history.Changes
@nself/ui/storybook-static— 68 files, 6.2MB of committed build output. Regenerable viapnpm build-storybook, and the source of one false positive..gitleaks.tomlfrom the org template. Both findings are allowlisted precisely rather than by loosening the rule. A third surfaced once the org rules were in place — security-header tables written askey: 'Permissions-Policy'— allowlisted to the known header set, not to anykey:literal.exactOptionalPropertyTypes,noUncheckedIndexedAccess, type-checked tests).Build clean, typecheck clean, 778 tests pass.