Keep CLAUDE.md out of the published pkgdown site - #241
Conversation
CLAUDE.html, a verbatim CLAUDE.md and the search.json index were all publicly readable. The internal-only conventions are not in them here -- the visibility filter worked -- so this is untidy rather than harmful. Fixed anyway because nothing currently stops the harmful version. The filter rests on an assumption pkgdown breaks, that a repo's CLAUDE.md stays where you put it, and a future INTERNAL.md or a visibility change would publish silently. See NewGraphEnvironment/rfp#180, where the SR&ED section did go public. Removal happens before the build; after would leave the verbatim copy and the search.json entry. Fixes #240
With clean: false the deploy action never deletes. Every file ever published stays on gh-pages regardless of whether the source still produces it, which has two consequences: removing a file from the repo does not unpublish it, and a leak cannot be fixed by fixing the build -- the stale copies need a separate purge that is easy to forget. clean: true makes the deployed site equal to what the build produced. Fixing the build is then sufficient, and the site becomes auditable. Checked before flipping, since clean: true deletes anything on gh-pages not present in docs/: no CNAME on any of these repos (the custom domain comes from the org site repo and project sites inherit it as subpaths), no dev/ versioned docs, and the favicon and webmanifest assets are build output from pkgdown/favicon/ rather than hand-added. The gate's allowlist is now declared per repo rather than assumed, so a new root markdown file fails the build until someone decides whether it should be public. NOTICE and RUNBOOK are declared in the allowlist rather than blocked. link is a public repo and both are genuine documentation -- an attribution notice and a technical runbook about public data sources. That is the decision the allowlist exists to record. Convention recorded in soul: conventions/pkgdown-publishing.md
|
Updated: also flips the deploy to With Checked before flipping (it deletes anything on The gate allowlist is now declared per repo, so a new root markdown file fails until someone decides whether it should be public. Convention recorded in soul: |
…erge The job carried if: github.event_name != 'pull_request', so it skipped entirely on PRs -- which meant the leak gate added in this branch would first run on merge to main, after review rather than during it. A gate you cannot see pass is not much better than no gate. Deploying is still refused on pull requests. That condition already lives on the deploy step itself, which is the right place for it: every other step in the job is safe to run on a PR, and gating the whole job only cost the verification. Relates to #240
|
Follow-up: the pkgdown job carried Removed the job-level condition. Deploying is still refused on PRs — that condition already lives on the deploy step, which is the right place for it: every other step is safe to run on a PR, and gating the whole job only cost the verification. link was the only one of the six with this; the others already build on PRs. |
1 participant
Same fix as NewGraphEnvironment/rfp#180.
CLAUDE.html, the rawCLAUDE.mdand thesearch.jsonindex are publicly readable here. The internal-only conventions are not in them — the visibility filter worked, unlike rfp and gq where the SR&ED section went public. So this is untidy rather than harmful.Worth fixing anyway: nothing currently stops the harmful version. The filter rests on an assumption pkgdown breaks, and a future
INTERNAL.mdor a visibility change would publish silently.Removal happens before the build — after would leave the verbatim copy and the search index entry. The gate fails on any unexpected top-level page.
Fixes #240
🤖 Generated with Claude Code
https://claude.ai/code/session_01EQSMwbhZ9SRqQQTrhmBYj7