opensource-pipeline

Fork, sanitize, and package private projects for public open-source release on GitHub.

2|Updated Mar 29, 2015
One-click install
npx skills add https://github.com/ovisan/dotfiles --skill opensource-pipeline-ovisan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: opensource-pipeline
Source: https://github.com/ovisan/dotfiles/tree/main/.agents/skills/opensource-pipeline
Command: npx skills add https://github.com/ovisan/dotfiles --skill opensource-pipeline-ovisan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Releasing a private project publicly risks leaking secrets, credentials, PII, and internal references. This Skill automates a three-stage pipeline that forks the project, strips sensitive data, verifies sanitization, and generates release-ready packaging. ## Core Features & Use Cases - Three-Agent Pipeline: Chains a forker (copies files, strips secrets, generates .env.example), a sanitizer (six scan categories with PASS/FAIL verdict), and a packager (CLAUDE.md, setup.sh, README, LICENSE, CONTRIBUTING.md). - Safety Gate with Retry: Blocks publishing on sanitizer FAIL, supports up to three fix-and-rescan attempts, and never pushes to GitHub without explicit user approval. - Staging Management: Tracks staged projects under $HOME/opensource-staging with list and status commands showing FORK_REPORT.md and SANITIZATION_REPORT.md. - Use Case: You have a private internal tool you want to publish. Run the full pipeline to strip API keys, verify no PII remains, generate documentation and a license, then create the public GitHub repo with one approval. ## Quick Start Ask the AI to open source your project by saying "open source this project" and answer the prompts for license, GitHub org, and description.

Frequently Asked Questions about opensource-pipeline

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely open source a private project?▼

Run the full pipeline with /opensource fork PROJECT. It copies the project to a staging directory, strips secrets and credentials, verifies sanitization with a six-category scan, then generates README, LICENSE, and setup files before optionally publishing to GitHub.

How to remove secrets from a repo before making it public?▼

The forker agent strips secrets and credentials, replaces internal references with placeholders, and generates a .env.example file. The sanitizer then runs secrets, PII, and internal-reference scans to confirm nothing sensitive remains.

What happens if the sanitization scan fails?▼

On FAIL, findings are shown and you can fix and re-scan up to three times or abort. The pipeline never proceeds to packaging or GitHub publishing until the sanitizer returns PASS or PASS WITH WARNINGS.

Does this publish to GitHub automatically?▼

No. Publishing requires explicit user approval. After review, it runs gh repo create with the chosen org, repo name, and description, but only after you confirm the final review summary.

Can I run only the sanitization check on an existing repo?▼

Yes. Use /opensource verify PROJECT to run the sanitizer independently against any path. It executes all six scan categories and writes a SANITIZATION_REPORT.md with a PASS/FAIL verdict.