opensource-prep

name	opensource-prep
description	Prepare a repository for open-source release. Scans for hardcoded secrets (private keys, API keys, mnemonics), sensitive deployment artifacts, Chinese text, missing LICENSE, and other non-public content. Generates a report and optionally performs cleanup. Use when preparing to publish a private repo publicly.

Open-Source Preparation Skill

Overview

A systematic workflow to audit and clean a repository before open-source release. Covers security, compliance, and hygiene.

Trigger Words

opensource-prep, open source, prepare for open source, publish repo

Workflow

When invoked, execute the following phases in order:

---

Phase 1: Secret Detection

Scan the entire repository (excluding lib/, node_modules/, .git/) for:

1. Private keys: Pattern 0x[0-9a-fA-F]{64} in non-test files
2. Mnemonic phrases: 12/24 word seed phrases
3. API keys: Alchemy, Infura, Etherscan, and other service keys
4. Environment files: .env, .env.* (check if tracked by git)
5. Passwords/tokens: Any password, secret, token, credential in config files

Actions:

• Report each finding with file path, line number, and risk level
• For test files (test/, *.t.sol): Flag but allow standard Foundry test keys (0xA11CE, 0xB0B, etc.)
• For source/script files: Recommend replacement with environment variable reads
• For .env files tracked in git: Flag as CRITICAL

Output format per finding:

[CRITICAL|HIGH|MEDIUM|LOW] <file>:<line> - <description>

---

Phase 2: Deployment Artifact Audit

Check for files that expose internal infrastructure:

1. broadcast/ - Foundry deployment transaction logs (deployer addresses, tx hashes, calldata)
2. deployments/ - Contract address configurations for internal environments
3. cache/ - Compilation and deployment caches
4. out/ - Compiled contract artifacts

Actions:

• Report which directories exist and their content summary
• Check .gitignore for proper exclusion rules
• Recommend .gitignore updates if needed

---

Phase 3: Content Compliance

1. Non-English text: Scan for CJK characters (Chinese/Japanese/Korean) in source code and configs
   • Pattern: [\x{4e00}-\x{9fff}\x{3000}-\x{303f}\x{ff00}-\x{ffef}]
   • Exclude: lib/, node_modules/, binary files
2. Internal references: Company-internal URLs, Slack channels, internal tool names, employee names/emails
3. TODO/FIXME with sensitive context: Internal task references, Jira tickets with private info

Actions:

• Report all findings
• Offer to remove or translate to English

---

Phase 4: License & Legal

1. Check if LICENSE file exists at repo root
2. Validate LICENSE content is complete and well-formed
3. Check copyright year is current
4. Scan for SPDX license identifiers in source files (SPDX-License-Identifier)
5. Check if third-party dependencies have compatible licenses

Actions:

• If LICENSE missing: Prompt user for license type and create it
• If copyright year outdated: Offer to update
• Report any license compatibility concerns

---

Phase 5: .gitignore Validation

Verify .gitignore properly excludes:

# Required exclusions for open-source repos
.env
.env.*
broadcast/
cache/
out/
deployments/
node_modules/
*.secret
*.key

Actions:

• Report missing exclusion rules
• Offer to update .gitignore

---

Phase 6: Build Verification

Run the project's build and test suite to confirm the repo is in a clean, working state after cleanup:

1. For Foundry projects: forge build && forge test
2. For Node.js projects: npm test or pnpm test
3. For mixed projects: Run all applicable test suites

Actions:

• Report build/test results
• Flag any failures introduced by cleanup

---

Output

Generate a summary report:

## Open-Source Readiness Report

### Secrets: [X found / X fixed]
### Artifacts: [X directories to clean]
### Content: [X non-English items / X internal references]
### License: [Present/Missing] [Year: OK/Outdated]
### .gitignore: [X rules missing]
### Tests: [X passed / X failed]

### Verdict: [READY / NOT READY - X blockers remain]

---

Usage

# Full audit (report only, no changes)
/opensource-prep

# Full audit with auto-fix
/opensource-prep --fix

# Scan specific directory only
/opensource-prep src/

# Skip test verification
/opensource-prep --skip-tests

Notes

• Never auto-delete files without explicit user confirmation
• Always recommend rotating any exposed secrets (even if removed from repo, they may exist in git history)
• Remind user about git filter-repo for cleaning git history if secrets were previously committed
• Standard Foundry test keys (e.g., 0xA11CE, 0xB0B) in test/ files are acceptable