Public Export

The public clanky repository is an iOS-free export of the internal full checkout. Do not make the existing private repository public directly: private clanky-ios/ source exists in the current branch history and in old remote branches.

One-Time Remote Setup

Keep the full repository private under an internal name, then publish a fresh public repository from a sanitized export:

# In GitHub, keep or rename the current private full repo as the internal source.
gh repo rename clanky-internal --repo Volpestyle/clanky

# Create a fresh public destination for the sanitized tree.
gh repo create Volpestyle/clanky --public --disable-wiki --disable-issues

Export

The internal full checkout publishes the public snapshot automatically from the Public Export workflow on master pushes. The workflow uses a write deploy key stored as PUBLIC_EXPORT_DEPLOY_KEY on Volpestyle/clanky-internal, clones the public repository, refreshes it through scripts/prepare-public-export.sh, and pushes only when the sanitized public tree changes. The workflow exports the checked-out commit; manual runs default to the local master ref.

To run the same export manually:

./scripts/prepare-public-export.sh ../clanky-public
cd ../clanky-public
git remote add origin git@github.com:Volpestyle/clanky.git # first run only
git push origin master

The script exports the tracked source ref, removes private iOS source and internal-only release/export automation, and commits a sanitized snapshot in the public checkout. This avoids publishing old private refs or historical objects while still preserving a clean public snapshot history.

Public Docs

The internal full checkout publishes generated public docs to the shared Volpestyle/docs GitHub Pages host from .github/workflows/docs-pages.yml. The current Pages lane builds clankvox/apps/docs and publishes it under https://volpestyle.github.io/docs/clankvox/.

The docs workflow uses the shared Volpestyle/docs renderer and guard scripts: source imports are limited to public ClankVox Markdown, and the generated static artifact is scanned before it is pushed to the gh-pages branch. The private clanky-ios/ docs app is not published. A future public iOS landing page should be a curated public page rather than an export of private app docs or source.

The private repository needs a DOCS_PUBLISH_KEY secret with write access to Volpestyle/docs.

Release Lane

The internal full checkout keeps .github/workflows/ios-testflight.yml. On pull requests and master pushes that touch clanky-ios/, clanky-contract/, or the workflow itself, it runs the fast mobile package gate:

cd clanky-ios && pnpm --filter @clanky/mobile check

Manual workflow_dispatch runs also execute the production TestFlight lane after the fast gate:

cd clanky-ios/apps/mobile
pnpm dlx eas-cli@latest build --platform ios --profile production --auto-submit --non-interactive --wait

The private repository needs an EXPO_TOKEN secret with permission to run EAS builds for the volpestyle/clanky-mobile Expo project. Apple/App Store Connect credentials remain managed by EAS and the production submit profile in clanky-ios/apps/mobile/eas.json.

gh secret set EXPO_TOKEN --repo Volpestyle/clanky-internal

Audit Before Public Push

Before the first public push, inspect the export:

cd ../clanky-public
git ls-files | rg '(^|/)clanky-ios(/|$)|^\.github/workflows/(docs-pages|ios-testflight|public-export)\.yml$'
git log --all -- clanky-ios .github/workflows/docs-pages.yml .github/workflows/ios-testflight.yml .github/workflows/public-export.yml

Both commands should produce no output. Run any secret scanning you want against the exported repository before pushing it to a public remote.