safe-public-release

What problem does it solve?

Prevents accidental leakage of private content and stops unauthorized or mismatched release artifacts from being pushed to public remotes.

Core Features & Use Cases

• History scan for private-content patterns: Scans every commit reachable from any ref (not just the current working tree) to catch leaks hidden in rebased or abandoned history.
• Hash-bound owner upload approval gate: Enforces that an operator’s pre-signed approval matches the exact candidate hash on all required tokens, so the release target cannot be swapped.
• Fail-closed release gating: Blocks the push when any gate fails, and guides remediation through precise findings and allow-list handling for false positives.
• Use cases: Use when preparing to push to main, publish, ship, or tag releases on GitHub (especially when private patterns may exist anywhere in reachable history).

Quick Start

Use safe-public-release to run a full git history private-content scan and an optional owner upload approval check before you push to main or publish a release.