local-app-github-publishing

Initialize git, tighten .gitignore to exclude node_modules, build outputs, and .env files, then run a source-only secret scan before staging. Create the repo with gh repo create --private --source . --push and verify with git ls-remote and gh repo view.

Scan source files for patterns like sk-, ghp_, github_pat_, AIza, hf_, and private key headers while excluding node_modules and build directories. If a real secret is found, remove and rotate it before committing anything.

This workflow defaults to private unless the user explicitly requests public. Before making a repo public, the README must be understandable without session context and diagrams must be verified as rendered on GitHub.

Run xcodebuild with CODE_SIGNING_ALLOWED=NO and a generic iOS destination to verify compilation without provisioning profiles. If xcode-select points at Command Line Tools, set DEVELOPER_DIR to the Xcode.app path for that command only.

Scanning only current files misses secrets added and later removed, so the workflow scans the full commit range with git log -p over main..HEAD. Found credentials must be rotated, and unpushed branch history can be rewritten after creating a backup ref.