chore: prepare the repository for a public release - #70
Merged
Conversation
Two things a stranger's tooling sees before they read any code. A secret scan of this repository reports twelve findings. All twelve are redaction-test fixtures: strings invented to look exactly like leaked credentials, asserted never to reach output, so that a real leak fails the test rather than passing unnoticed. Two are in internal/compose/redact_test.go today; ten are in internal/onebox/memory_test.go, which was deleted in 7ad7671 but stays reachable in history. Nothing is wrong, but "twelve leaks found" is what anyone pointing a scanner at this repository will see first, and explaining that twelve times is worse than listing them once. .gitleaksignore lists them by fingerprint rather than by path, so it cannot quietly widen: a genuine secret added to either file later produces a new fingerprint and is still reported. Both scan modes are now clean. CONTRIBUTING.md carried a code of conduct with no CODE_OF_CONDUCT.md beside it, which GitHub's community-standards check looks for and contributors look for. The file now exists, carrying the same standard in the same words rather than a second one that can drift, plus how to report conduct and what enforcement means. CONTRIBUTING links to it instead of restating it. `just check` passes. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
vishr
added a commit
that referenced
this pull request
Aug 18, 2026
chore: prepare the repository for a public release
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two things a stranger's tooling sees before they read any code.
Secret scan
gitleaksreports 12 findings. All 12 are redaction-test fixtures — strings invented to look exactly like leaked credentials, asserted never to reach output, so a real leak fails the test rather than passing unnoticed.internal/compose/redact_test.gointernal/onebox/memory_test.go7ad7671Nothing is wrong. But
leaks found: 12is what anyone pointing a scanner at this repo sees first, and explaining it twelve times is worse than listing it once..gitleaksignorelists them by fingerprint, not by path, so it cannot quietly widen into a blanket exemption — a genuine secret added to either file later produces a new fingerprint and is still reported.Code of conduct
CONTRIBUTING.mdhad a code-of-conduct section with noCODE_OF_CONDUCT.mdbeside it — which is what GitHub's community-standards check and most contributors look for.The file now exists carrying the same standard in the same words, rather than a second one that can drift from the first, plus how to report conduct and what enforcement means.
CONTRIBUTING.mdlinks to it instead of restating it.Verified
just checkpasses. Both gitleaks scan modes clean.Part of open-source readiness; the remaining blocker is #58.