fix(lychee): drop claude-code-plugins and standards from the private-repo exclusions by kyle-sexton · Pull Request #204 · melodic-software/standards

kyle-sexton · 2026-07-18T21:34:01Z

Summary

claude-code-plugins and standards went public. The private-repo exclusion arms in lychee.toml still listed both, so links into them were skipped by the online link-check across every consuming repository. Drop them per the exclusion block's own keep-in-sync rule; links to the four remaining private repos stay excluded.

Surfaced by a review thread on melodic-software/github-iac#172 — lychee.toml is a managed materialization there, so the fix lands here and syncs down.

No linked issue

Correctness: The two regexes are updated symmetrically — the github.com arm and the raw.githubusercontent.com arm both drop the same two names. The remaining alternation (dotfiles|github-iac|medley|provisioning) correctly represents the four repos that are still private. The file's own inline rule at line 39-40 ("drop an entry when its repo goes public") is exactly what this PR does.

One thing worth calling out: the standards repo is this repo, so its prior self-exclusion silently suppressed link-checking into standards itself across every consuming materialization. Dropping it is the right call and the blast radius is wider than it might look — it restores coverage for all downstream repos, not just this one.

REVIEW.md blocking checks: None of the always-check criteria (object-level authorization, tenant-scoped data access, secrets/credentials, injection, audit logging, atomicity) are implicated by a pure regex-removal in a link-checker config.

No findings. The change is minimal, mechanically correct, and follows the file's own maintenance rule.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bc44f7a9f4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

The exclusion-inventory assertions and dump fixtures still required claude-code-plugins and standards to be excluded; both are public now, so the fixtures assert they stay checked and dotfiles carries the private raw-content case. Co-authored-by: Claude Fable 5 (1M context) <noreply@anthropic.com>

claude · 2026-07-18T21:39:32Z

Claude finished @kyle-sexton's task in 1m 50s —— View job

Review

Gather context
Read changed files
Check REVIEW.md guidelines
Post findings

Scope: Two commits — bc44f7a (drop the two now-public repos from exclusions) and 55aa933 (align the contract test and fixture to match).

lychee.toml (L43–44): Both exclusion arms (github.com and raw.githubusercontent.com) are updated symmetrically. The alternation in each regex now lists exactly the four repos that remain private: dotfiles|github-iac|medley|provisioning. The file's own inline rule ("drop an entry when its repo goes public") is exactly what this change does.

lychee.test.sh (L22–47): All three groups of assertions are updated together:

The two exact-string inventory assertions (L22–28) now carry the updated alternation and will agree with lychee.toml at runtime.
The --dump loop (L36–43) flips: the four private repos assert not_contains; claude-code-plugins and standards assert contains — confirming they appear in lychee's "to-be-checked" set, not the excluded set.
L46–47 adds a matching assertion for the raw.githubusercontent.com URL of claude-code-plugins, which the fixture now lists in the public section.

Exclusions.md fixture (full file): claude-code-plugins and standards are removed from the private section and added to the "public siblings … remain subject to checking" section, along with a raw.githubusercontent.com URL for claude-code-plugins. The fixture is now the authoritative source for the --dump assertions in the test.

Correctness of the Codex flag: The Codex review was filed against commit bc44f7a when the tests had not yet been updated. Commit 55aa933 directly addresses that gap — the assertions, the inventory strings, and the fixture are all reconciled. The CI concern the Codex comment raised no longer applies.

REVIEW.md blocking checks: None of the always-check criteria (object-level authorization, tenant-scoped data access, secrets/credentials, injection, audit logging, atomicity) are implicated by regex removal in a link-checker config and its associated test.

No findings. The change is minimal, internally consistent, and the second commit correctly closes the gap the Codex reviewer identified.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 55aa933ec8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

The component README's inventory sentence still listed the two now-public repositories the rule change removed. Co-authored-by: Claude Fable 5 (1M context) <noreply@anthropic.com>

claude · 2026-07-18T21:43:31Z

Claude finished @kyle-sexton's task in 1m 0s —— View job

Review

Gather context
Read changed files
Check REVIEW.md guidelines
Post findings

Scope: Three commits across four files — lychee.toml, lychee.test.sh, fixtures/good/Exclusions.md, and components/lychee/README.md.

lychee.toml (L43–44): Both exclusion arms (github.com and raw.githubusercontent.com) are updated symmetrically. The alternation now lists exactly the four repos that remain private: dotfiles|github-iac|medley|provisioning. The file's own inline rule ("drop an entry when its repo goes public") is exactly what this change does.

lychee.test.sh (L22–47): All three assertion groups are reconciled:

The two exact-string inventory assertions (L22–28) match the updated alternation.
The --dump loop (L36–43) correctly flips: four private repos assert not_contains; claude-code-plugins and standards assert contains.
L47 adds the matching assertion for the raw.githubusercontent.com URL of claude-code-plugins.

fixtures/good/Exclusions.md (full file): Private section now lists only the four remaining private repos. The "public siblings" section includes claude-code-plugins, standards, and a raw.githubusercontent.com URL for claude-code-plugins — matching the new assert_contains assertions in the test.

components/lychee/README.md (L16–18): The prose inventory is updated to name only the four remaining private repos. This closes the Codex P2 finding filed against 55aa933.

Previous Codex findings: Both are addressed at HEAD. The P1 (missing test update, bc44f7a) was closed by 55aa933. The P2 (README inventory mismatch, 55aa933) was closed by 0413551.

REVIEW.md blocking checks: None of the always-check criteria (object-level authorization, tenant-scoped data access, secrets/credentials, injection, audit logging, atomicity) are implicated by regex removal in a link-checker config and its associated test, fixture, and docs.

No findings. All four changed files are consistent with each other, the change is minimal, and each commit addresses a specific identified gap.

Closes #212 ## Summary The private-repo exclusion list named **4 of the org's 9** private repositories. Missing: `itinerary-planner`, `knowledge-corpus`, `medley-archive`, `melodic-main-archive`, `songwriting`. A link to any of the five 404s in the online link lane for precisely the reason the list exists to prevent — the calling repo's `GITHUB_TOKEN` cannot read another private repo. Latent rather than breaking today, since no tracked file currently links to them. The block's own comment states the rule it drifted from: *"Keep in sync with actual visibility: add newly created private repos here."* `medley-archive` is ordered before `medley` in the alternation so the longer name cannot be shadowed by a prefix match. ## Test plan Verified empirically with `lychee --dump` over a fixture covering all 9 private repos plus `.git` and `raw.githubusercontent.com` variants, comparing old config against new. - [x] **Old config leaked 8 private URLs:** ``` itinerary-planner, knowledge-corpus, medley-archive, melodic-main-archive, songwriting, medley-archive.git, raw.githubusercontent.com/.../medley-archive/..., raw.../songwriting/... ``` - [x] **New config excludes all 9**, including the `.git` and `raw.` variants. - [x] **The 3 public repos still survive exclusion and stay checked** — `standards`, `ci-workflows`, `.github` — confirming the change does not over-exclude. - [x] `medley` vs `medley-archive` disambiguation confirmed by the fixture, not by reasoning about alternation order. - [x] lefthook pre-commit: typos, gitleaks, editorconfig all pass. ## Related - Follows the same maintenance pattern as #204 (`fix(lychee): drop claude-code-plugins and standards from the private-repo exclusions`), which moved entries the other direction when repos went public. - Surfaced by a repo hygiene sweep of `melodic-software/.github` (melodic-software/.github#29). Not fixable there — `lychee` is an upstream-managed component, so the change belongs here and reaches consumers through the reconciliation sync. - Worth considering separately: this list is hand-maintained against a queryable fact (`gh repo list --visibility private`), so it will drift again. A generation or CI-check step would remove the class of problem rather than this instance. Not in scope here.

chatgpt-codex-connector Bot reviewed Jul 18, 2026

View reviewed changes

Comment thread lychee.toml

chatgpt-codex-connector Bot reviewed Jul 18, 2026

View reviewed changes

Comment thread lychee.toml

docs(lychee): reconcile the documented private-repository inventory

0413551

The component README's inventory sentence still listed the two now-public repositories the rule change removed. Co-authored-by: Claude Fable 5 (1M context) <noreply@anthropic.com>

kyle-sexton merged commit 9d173e7 into main Jul 18, 2026
42 checks passed

kyle-sexton deleted the fix/lychee-public-repos branch July 18, 2026 21:45

kyle-sexton mentioned this pull request Jul 20, 2026

fix(lychee): add the five missing private repos to the exclusions #214

Merged

5 tasks

Navigation Menu

Uh oh!

fix(lychee): drop claude-code-plugins and standards from the private-repo exclusions - #204

fix(lychee): drop claude-code-plugins and standards from the private-repo exclusions#204
kyle-sexton merged 3 commits into
mainfrom
fix/lychee-public-repos

kyle-sexton commented Jul 18, 2026

Uh oh!

claude Bot commented Jul 18, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

claude Bot commented Jul 18, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

claude Bot commented Jul 18, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

kyle-sexton commented Jul 18, 2026

Summary

Related

Uh oh!

claude Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

claude Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

claude Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

claude Bot commented Jul 18, 2026 •

edited

Loading

claude Bot commented Jul 18, 2026 •

edited

Loading

claude Bot commented Jul 18, 2026 •

edited

Loading