built by aktagon.com

An exclusion list fails in one direction only.

Write down what may leave the private repository. Anything you did not write down fails the check, before it ships.

pubgrd copies a public repository tree from a private one and verifies nothing else got in. Every file that leaves is one you named in pubgrd.toml. Forgetting an entry withholds a file instead of publishing one.

~/myproject — zsh

$ pubgrd verify --public ../myproject-public
==> allow.unlisted: 12 configured, 41 examined, 2 found

FAIL: 2 files match no [allow] entry

  TODO.md
  internal-notes.md
      reason (allow): "everything a reader needs to build and run the tool"

Publish on purpose. · Allowlist, not denylist.

Talk to us

01 For anyone shipping a public mirror

The file that leaks is the file nobody thought to name.

A script copies the private tree to the public one.
It decides what stays private by listing what to leave out.
Forget an entry and nothing stops. It copies the file and reports success.

pubgrd reverses the list. You name what may leave, and anything unnamed fails the check instead of shipping.

~/myproject — pubgrd

$ pubgrd verify --public ../myproject-public
==> allow.unlisted: 12 configured, 41 examined, 2 found

FAIL: 2 files match no [allow] entry

  TODO.md
  internal-notes.md

↳ Neither file was excluded.
  Neither was allowed either —
  which is why they did not ship.

02 One contract, two readers

Built for humans and agents alike.

--format json writes one object to stdout and nothing else, so a pipeline can assert against the report rather than scrape the text. Exit codes do not change with the format.

0 verified1 violation2 config error

~/myproject — verify --format json

$ pubgrd verify --public /tmp/out --format json | jq '.unlisted[0]'
{
  "path": "TODO.md",
  "matched": null,
  "reason": "matches no [allow] entry"
}
$ echo $?
1  # branch on it, no text parsing

03 Every capability

One binary. From config to CI.

init

Scaffold pubgrd.toml with the two blocks it needs.

verify

Check a published tree against the allowlist. Human output, or --format json.

allow

Name what may leave the private repository. Everything else is withheld.

coverage

Report how many files each allow entry actually matched.