Skip to content

chore(repo): keep private repo details out of the public repo - #787

Draft
maoberlehner wants to merge 2 commits into
mainfrom
chore/remove-sibling-repo-references
Draft

maoberlehner wants to merge 2 commits into
mainfrom
chore/remove-sibling-repo-references

Conversation

@maoberlehner

@maoberlehner maoberlehner commented Aug 26, 2026

Copy link
Copy Markdown
Contributor

Why

AGENTS.md had a Sibling repos section that named three private Storyblok repositories, summarized their internals, and pointed at specific paths inside them — in a file that ships in a public repo. Three other public files leaked repository names the same way: a skill instruction, an ADR, and a comment in an overlay spec.

The section also carried the very rule it violated ("never reference these in public-facing text"), which made the contradiction easy to miss.

What changed

  • Removed the Sibling repos section from AGENTS.md, including the private-repo rule itself. Restating the rule here meant restating what it protects — that private repositories exist and are adjacent enough to leak from.
  • Moved the docs-site conventions that were bundled into that section ("user-facing documentation lives on the docs site, package READMEs stay minimal and link to it") into the docs/ list, next to the docs-platform.md entry where the rest of the docs guidance already lives.
  • Rephrased the three remaining leaks to describe the observable behavior instead of the source:
    • .agents/skills/spec/SKILL.md — "verify API contracts against the backend"
    • adr/0011-… — "Verified against the backend"
    • multilink-field-value.yaml — "the editor's anchor modal emits null …"

rg for the four repository names now returns nothing outside .git.

Where the context went

The cross-repo context is now maintained in a private dx-workspace repo that checks all projects out side by side and holds a single CLAUDE.md. Every fact removed here has an equivalent there:

Removed from AGENTS.md Now in dx-workspace
backend — REST/MAPI/CAPI schemas, error shapes, endpoint behavior, source-of-truth path
frontend — visual editor, bridge integration, rendering in the UI
bridge — postMessage protocol, editable-block attributes, overlay/click-to-edit, lifecycle
docs site — reference docs live there, pointer to docs/docs-platform.md
the private-repos rule ✅ — owned solely by the workspace, restated there with IMPORTANT strength and an explicit list of which repos are public
"package READMEs stay minimal and link to the docs site" stayed here — it is a monoblok convention, not cross-repo context
"sibling repos may not be available; ignore them if absent" obsolete — bootstrap.sh checks all of them out

Verification

  • pnpm nx run-many -t generate:openapi → no diff under packages/*/src/generated/. The spec change is a YAML comment, but the repo rule says regenerate every consumer after touching tools/openapi-codegen/, so it was run.
  • pnpm format and the pre-commit lint pass clean.
  • Docs-only otherwise; no behavior change.

The sibling-repo section named the private backend, frontend, and bridge
repositories, described their internal layout, and pointed at specific paths --
in a file that ships publicly. Three other files leaked repository names the
same way.

The cross-repo context now lives in the private dx-workspace repo, which checks
all projects out side by side. What stays here is the rule itself, phrased
without naming anything: keep private repository details out of public-facing
text. The docs-site conventions that were bundled into that section move to the
`docs/` list where the rest of the docs guidance lives.
Restating the rule here meant restating what it protects: that private
repositories exist and are adjacent enough to leak from. The workspace repo that
checks all projects out side by side is the only place that both knows which
repos are private and has any use for the rule, so it owns it outright.
@pkg-pr-new

pkg-pr-new Bot commented Aug 26, 2026

Copy link
Copy Markdown

Open in StackBlitz

@storyblok/angular

npm i https://pkg.pr.new/@storyblok/angular@787

@storyblok/astro

npm i https://pkg.pr.new/@storyblok/astro@787

@storyblok/api-client

npm i https://pkg.pr.new/@storyblok/api-client@787

storyblok

npm i https://pkg.pr.new/storyblok@787

@storyblok/experiments

npm i https://pkg.pr.new/@storyblok/experiments@787

@storyblok/js

npm i https://pkg.pr.new/@storyblok/js@787

storyblok-js-client

npm i https://pkg.pr.new/storyblok-js-client@787

@storyblok/lint-config

npm i https://pkg.pr.new/@storyblok/lint-config@787

@storyblok/live-preview

npm i https://pkg.pr.new/@storyblok/live-preview@787

@storyblok/management-api-client

npm i https://pkg.pr.new/@storyblok/management-api-client@787

@storyblok/migrations

npm i https://pkg.pr.new/@storyblok/migrations@787

@storyblok/nuxt

npm i https://pkg.pr.new/@storyblok/nuxt@787

@storyblok/react

npm i https://pkg.pr.new/@storyblok/react@787

@storyblok/region-helper

npm i https://pkg.pr.new/@storyblok/region-helper@787

@storyblok/richtext

npm i https://pkg.pr.new/@storyblok/richtext@787

@storyblok/schema

npm i https://pkg.pr.new/@storyblok/schema@787

@storyblok/svelte

npm i https://pkg.pr.new/@storyblok/svelte@787

@storyblok/vue

npm i https://pkg.pr.new/@storyblok/vue@787

commit: 5e13f14

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant