github-safe-push

name	github-safe-push
description	Ship leak-proof GitHub repos with README and banner.
version	0.2.1
author	Chad Keith
license	MIT
platforms	["linux","macos","windows"]
metadata	{"hermes":{"tags":["GitHub","git","push","secrets","identity","readme"],"related_skills":["github-auth","github-pr-workflow","github-repo-management"]}}

GitHub Safe Push

How every Chad Keith project leaves this machine. Auth is github-auth. PRs are github-pr-workflow. Repo create/settings are github-repo-management. This skill is the ship: secrets stay off git, the remote stays clean, and the public page looks like a real product.

No exceptions. Skills, plugins, apps, scripts — if it is code, it gets a repo.

When to Use

• Any git push, first origin, or "publish this"
• A new skill, plugin, program, or tool exists only on disk
• Public docs are about to be committed

Don't use for: minting a PAT, gh auth login, or reviewing a PR.

Identity

Shipped author fields say Chad Keith. Nothing else.

Field	Value
git user.name	Chad Keith
git user.email	[e-mail]
SKILL.md / plugin.yaml / LICENSE / package.json author	Chad Keith

No Hermes Agent in author fields. No machine hostname. No C:\Users\... or /c/Users/... in README, examples, comments, or commit messages.

Set identity local to the repo unless asked for global:

terminal(command="git config user.name \"Chad Keith\" && git config user.email \"[e-mail]\"")

Secrets — hard fail

These never get git add, never get committed, never get pushed:

• .env, .env.* except .env.example
• local.env, .env.local, *.local, *.pem, id_rsa, id_ed25519, *.key
• Any value matching ghp_, github_pat_, gho_, ghu_, ghs_, sk-, xai-, AKIA

.gitignore must ignore the list above before the first commit. .env.example has empty or placeholder values only (GITHUB_TOKEN=, GITHUB_USERNAME=your-github-username).

Print env keys, never values. Never embed a token in a remote URL. Never write secrets into .git/config.

If the scan finds a secret: stop, unstage, rotate the key if it was ever printed, do not push.

Ship checklist (every new project)

Do this before the first push. Criterion: each box has a file or a live GitHub setting.

1. Ignore file — .gitignore covers env, keys, venv, OS junk. Criterion: git check-ignore -v .env local.env reports ignored.
2. License — MIT, Copyright (c) <year> Chad Keith.
3. Semver package — package.json (and VERSION) at 0.1.0 for new work. Bump: patch = fix, minor = feature, major = break. Tag v<version>.
4. CHANGELOG.md — Keep a Changelog, newest first, ## [0.1.0] - YYYY-MM-DD.
5. Banner — assets/banner.png, landscape. Wordmarks and any banner with readable text must be rendered (PIL, SVG, or a real design tool). Diffusion/image-gen is a hard fail for text. slop-cop any graphic before commit. KILL = do not push.
6. Idiot-proof README — non-technical. Windows + macOS + Linux commands. What it is, install, use, config, troubleshooting. No home-directory paths. Author line: Chad Keith.
7. Star CTA — top and bottom of the README. One click, no guilt trip.
8. Buy Me a Coffee — https://www.buymeacoffee.com/chadpkeith in the README (top and bottom) and .github/FUNDING.yml.
9. GitHub repo — public unless asked otherwise. Enable Issues + Discussions. Disable Wiki unless needed. Description + topics set. Homepage may be the coffee link or the product URL.
10. Release — after push, create v<version> with generated notes. That is the package.

README shape

# <Name>
banner image
badges (license, version, platform)
star CTA + Buy Me a Coffee
What it is (3 sentences)
Requirements
Install (Windows / macOS / Linux)
Use
Config
Troubleshooting
Limits
License — Chad Keith
star CTA + Buy Me a Coffee (again)

Voice: installer docs, third person. Never "already done if I set it up" or a session recap.

Push procedure

1. Confirm repo (git rev-parse --show-toplevel).
2. Set Chad Keith identity if missing.
3. Scan staged + tracked files for secrets, home paths, and non-Chad authors. Criterion: print scan clean or abort.
4. Remote is bare HTTPS or SSH. Add https://github.com/<owner>/<repo>.git from env if needed. Criterion: HTTPS URL has no @ before github.com.
5. Auth: gh if logged in, else GIT_ASKPASS from env, then delete the askpass file. Never remote set-url with a token.
6. Redact tokens from captured output before they hit the transcript.
7. git status -sb; confirm .env / local.env untracked.
8. Enable Discussions (has_discussions: true), set topics, create v<version> release.

On Windows git-bash, pass C:/Users/<user>/... to native git -C, not /c/Users/<user>/....

Pitfalls

• github-auth's "embed token in the remote URL" option is banned. It writes the secret into .git/config.
• credential.helper store writes a plaintext token to disk. Prefer askpass for a one-shot push.
• auto_init: true on repo create fights the first push. Create empty, then push.
• A token-shaped placeholder in .env.example looks like a leak. Use empty values.
• Skipping the banner or the coffee/star CTAs is not a complete ship.

Verification

• git remote get-url origin is credential-free
• git ls-files has no .env, local.env, or key files
• latest commit author is Chad Keith <[e-mail]>
• README has banner, both CTAs, and Win/macOS/Linux install
• GitHub shows Discussions enabled and a v* release