How this changelog stays public-safe
Why the source behind this site stays private, and how only the finished pages ever get published.
How it works, step by step
Two repositories, one direction
There are two repositories behind this site:
changelog-astro(private): the markdown entries, the library docs, and the site’s code.changelog-astro-public(public): only the finished HTML pages, which GitHub Pages serves.
Nothing ever flows from public back to private, and nobody edits the public one by hand.
What happens on every update
When a new entry is saved to the private repository, an automated GitHub Action:
- Builds the site into plain HTML pages.
- Sets those pages aside and deletes the entire source tree, including every markdown file.
- Checks every top-level file and folder against two explicit lists: what may be published and what must stay private. Anything on neither list stops the whole job. A new file can’t sneak out just because nobody thought to hide it.
- Puts the finished pages back and publishes them to the public repository.
Why go to this trouble
A church’s technical notes can brush up against things that are nobody’s business: who’s involved, what was discussed, what’s still undecided. Writing in private and publishing only the finished, reviewed result means a draft or a stray note can’t become public by accident. The rule for what gets an entry at all is simple: if it can’t be described publicly, it doesn’t get one.
Where this pattern comes from
It’s the same pipeline that already runs the PIR® and Holy Earth Foundation changelogs, reused here rather than reinvented.