gh-launch

GitHub Repo Launch Checklist

8-phase workflow for launching a repo (private->public) or auditing an existing public repo. Hard gate on secrets (Phase 1 blocks everything). Soft checks on everything else.

Phase 0: Repo State Detection

# Visibility + basic stats
gh repo view --json visibility,stargazerCount,forkCount,description,repositoryTopics,url

• If visibility: PUBLIC: skip Phase 6 (Go Public), run all other audits
• If visibility: PRIVATE: full workflow including Phase 6
• Note the owner/repo for all subsequent commands

Phase 1: Security Audit (HARD GATE)

If ANY secrets found: STOP. List them. Do not proceed to Phase 2.

Source code scan

# Common secret patterns
grep -rn --include="*.{js,ts,py,sh,md,json,yml,yaml,toml,env}" \
  -E "(AIza|sk_|ghp_|gho_|vcp_|sbp_|glpat-|xox[bps]-|AKIA|shpat_|phc_|re_[A-Za-z0-9])" . \
  | grep -v node_modules | grep -v .git | head -30

# Passwords and tokens in config
grep -rn --include="*.{js,ts,py,sh,json,yml,yaml,toml,env}" \
  -iE "(password|passwd|secret|token|api_key|apikey|private_key)\s*[:=]" . \
  | grep -v node_modules | grep -v .git | grep -v ".example" | head -20

# Private IPs, emails, phone numbers
grep -rn -E "(10\.\d+\.\d+\.\d+|192\.168\.\d+\.\d+|172\.(1[6-9]|2[0-9]|3[01])\.\d+\.\d+)" . \
  | grep -v node_modules | grep -v .git | head -10

Git history scan (last 50 commits)

git log -50 --all -p | grep -iE "password|api_key|secret|token|private_key" | head -20

Gitleaks (if available)

command -v gitleaks &>/dev/null && gitleaks detect --source . --no-banner

.gitignore coverage

Verify .gitignore includes: .env*, *.pem, *.key, credentials*, node_modules/, .DS_Store, *.sqlite, *.db

If missing entries, add them before proceeding.

HARD GATE: If secrets found, list each one with file:line and stop. User must remediate.

Phase 2: Repository Hygiene

# Repo size and file count
du -sh --exclude=.git . 2>/dev/null || du -sh .
find . -not -path './.git/*' -not -path './node_modules/*' | wc -l

# Bloat check: large files
find . -not -path './.git/*' -not -path './node_modules/*' -size +1M -exec ls -lh {} \;

# TODO/FIXME with internal context
grep -rn "TODO\|FIXME\|HACK\|XXX" --include="*.js" --include="*.ts" --include="*.py" \
  --include="*.sh" --include="*.md" . | grep -v node_modules | head -20

# Files that shouldn't be public
find . -not -path './.git/*' -iname "*draft*" -o -iname "*internal*" -o -iname "*personal*" \
  -o -iname "*workplan*" -o -iname "*notes*" 2>/dev/null | head -10