feat: implement multi-repository privacy setup for web resumes

.claude/agents/react-resume-expert.md

@@ -124,7 +124,7 @@ resumes/web-builder/src/
 
 ### Issue: "Base path incorrect, assets 404"
 **Cause**: Vite base path mismatch
-**Fix**: Ensure `vite.config.ts` has `base: '/CV/'`
+**Fix**: Ensure `vite.config.ts` has `base: '/CV-pages/'`
 
 ### Issue: "Build succeeds but page blank"
 **Cause**: JavaScript error, check browser console
@@ -222,7 +222,7 @@ ls -la ../customized/2025_11_10_quantumbasel_ai_specialist/web/
 
 # Test locally
 npm run preview
-# Open http://localhost:4173/CV/
+# Open http://localhost:4173/CV-pages/
 
 # Clean up
 rm public/resume_content.md

.github/workflows/delete-web-resume.yml

@@ -9,7 +9,7 @@ on:
         type: string
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   delete:
@@ -33,15 +33,18 @@ jobs:
 
           echo "Will delete resume: $id"
 
-      - name: Checkout gh-pages branch
-        uses: actions/checkout@v4
-        with:
-          ref: gh-pages
-          fetch-depth: 0
+      - name: Clone CV-pages repository
+        env:
+          CV_PAGES_TOKEN: ${{ secrets.CV_PAGES_TOKEN }}
+        run: |
+          git clone https://x-access-token:${CV_PAGES_TOKEN}@github.com/datarian/CV-pages.git cv-pages-repo
+          cd cv-pages-repo
+          git checkout gh-pages
 
       - name: Check if resume exists
         id: check
         run: |
+          cd cv-pages-repo
           id="${{ github.event.inputs.resume_id }}"
           target_dir="cv/$id"
 
@@ -61,6 +64,7 @@ jobs:
       - name: Delete resume
         if: steps.check.outputs.exists == 'true'
         run: |
+          cd cv-pages-repo
           id="${{ github.event.inputs.resume_id }}"
           target_dir="cv/$id"
 
@@ -78,18 +82,21 @@ jobs:
 
       - name: Commit and push deletion
         if: steps.check.outputs.exists == 'true'
+        env:
+          CV_PAGES_TOKEN: ${{ secrets.CV_PAGES_TOKEN }}
         run: |
+          cd cv-pages-repo
           id="${{ github.event.inputs.resume_id }}"
 
           git config user.name "GitHub Actions"
           git config user.email "actions@github.com"
           git add .
           git commit -m "chore: delete web resume $id [skip ci]
 
-Manually deleted via workflow.
+Manually deleted via workflow from datarian/CV.
 
 🤖 Triggered by ${{ github.actor }}" || echo "No changes to commit"
-          git push origin gh-pages
+          git push https://x-access-token:${CV_PAGES_TOKEN}@github.com/datarian/CV-pages.git gh-pages
 
       - name: Report deletion
         if: steps.check.outputs.exists == 'true'
@@ -101,13 +108,15 @@ Manually deleted via workflow.
           echo "Deleted resume: **$id**" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "The following URL is now inactive:" >> $GITHUB_STEP_SUMMARY
-          echo "- ~~https://datarian.github.io/CV/cv/$id~~" >> $GITHUB_STEP_SUMMARY
+          echo "- ~~https://datarian.github.io/CV-pages/cv/$id~~" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
-          echo "Deletion committed to gh-pages branch." >> $GITHUB_STEP_SUMMARY
+          echo "Deletion committed to CV-pages repository." >> $GITHUB_STEP_SUMMARY
 
       - name: List remaining resumes
         if: steps.check.outputs.exists == 'true'
         run: |
+          cd cv-pages-repo
+
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "### Remaining Resumes" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
@@ -120,7 +129,7 @@ Manually deleted via workflow.
             for dir in cv/*/; do
               resume_id=$(basename "$dir")
               if [ "$resume_id" != ".*" ]; then
-                echo "- https://datarian.github.io/CV/cv/$resume_id" >> $GITHUB_STEP_SUMMARY
+                echo "- https://datarian.github.io/CV-pages/cv/$resume_id" >> $GITHUB_STEP_SUMMARY
               fi
             done
           else

.github/workflows/deploy-web-resumes.yml

@@ -8,23 +8,39 @@ on:
       - 'resumes/customized/*/web/**'
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   deploy:
     runs-on: ubuntu-latest
 
     steps:
-      - name: Checkout repository
+      - name: Checkout source repository
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
 
-      - name: Checkout gh-pages branch
-        uses: actions/checkout@v4
-        with:
-          ref: gh-pages
-          path: gh-pages-branch
+      - name: Clone CV-pages repository
+        env:
+          CV_PAGES_TOKEN: ${{ secrets.CV_PAGES_TOKEN }}
+        run: |
+          git clone https://x-access-token:${CV_PAGES_TOKEN}@github.com/datarian/CV-pages.git cv-pages-repo
+          cd cv-pages-repo
+
+          # Check if gh-pages branch exists, create if not
+          if git ls-remote --heads origin gh-pages | grep gh-pages; then
+            git checkout gh-pages
+          else
+            echo "Creating new gh-pages branch"
+            git checkout --orphan gh-pages
+            git rm -rf . 2>/dev/null || true
+            echo "<html><body><h1>CV Resumes</h1></body></html>" > index.html
+            git add index.html
+            git config user.name "GitHub Actions"
+            git config user.email "actions@github.com"
+            git commit -m "Initialize gh-pages branch"
+            git push -u origin gh-pages
+          fi
 
       - name: Detect changed web builds
         id: detect
@@ -48,8 +64,8 @@ jobs:
       - name: Deploy web resumes
         if: steps.detect.outputs.has_builds == 'true'
         run: |
-          # Create cv directory in gh-pages if doesn't exist
-          mkdir -p gh-pages-branch/cv
+          # Create cv directory if doesn't exist
+          mkdir -p cv-pages-repo/cv
 
           # Process each build
           while IFS= read -r build_dir; do
@@ -65,11 +81,11 @@ jobs:
               continue
             fi
 
-            # Extract company and role from metadata (simplified)
+            # Extract company and role from metadata
             company=$(grep "targetCompany:" "$content_file" | head -1 | sed 's/.*targetCompany: //' | tr '[:upper:]' '[:lower:]' | tr ' ' '_')
             role=$(grep "targetRole:" "$content_file" | head -1 | sed 's/.*targetRole: //' | tr '[:upper:]' '[:lower:]' | tr ' ' '_')
 
-            # Generate hash from content
+            # Generate hash from content for privacy/security
             hash=$(sha256sum "$content_file" | cut -c1-4)
 
             # Create semantic URL: date_company_hash
@@ -78,20 +94,20 @@ jobs:
 
             echo "Semantic ID: $semantic_id"
 
-            # Copy build to gh-pages
-            target_dir="gh-pages-branch/cv/$semantic_id"
+            # Copy build to CV-pages repo
+            target_dir="cv-pages-repo/cv/$semantic_id"
             mkdir -p "$target_dir"
             cp -r "$build_dir"/* "$target_dir/"
 
             echo "Deployed to: /cv/$semantic_id"
 
             # Update manifest
-            manifest="gh-pages-branch/cv/.manifest.json"
+            manifest="cv-pages-repo/cv/.manifest.json"
             if [ ! -f "$manifest" ]; then
               echo '{"version": "1.0", "deployments": []}' > "$manifest"
             fi
 
-            # Add entry to manifest (simplified - would use jq in production)
+            # Add entry to manifest (simplified)
             timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
             echo "Updated manifest with deployment at $timestamp"
 
@@ -100,37 +116,39 @@ jobs:
       - name: Create robots.txt
         if: steps.detect.outputs.has_builds == 'true'
         run: |
-          cat > gh-pages-branch/cv/robots.txt << 'EOF'
+          cat > cv-pages-repo/cv/robots.txt << 'EOF'
           User-agent: *
           Disallow: /cv/
           EOF
 
-      - name: Commit and push to gh-pages
+      - name: Commit and push to CV-pages
         if: steps.detect.outputs.has_builds == 'true'
+        env:
+          CV_PAGES_TOKEN: ${{ secrets.CV_PAGES_TOKEN }}
         run: |
-          cd gh-pages-branch
+          cd cv-pages-repo
           git config user.name "GitHub Actions"
           git config user.email "actions@github.com"
           git add .
           git commit -m "Deploy web resumes [skip ci]
 
-          Automated deployment from ${{ github.sha }}
+          Automated deployment from datarian/CV@${{ github.sha }}
 
           🤖 Generated with GitHub Actions" || echo "No changes to commit"
-          git push origin gh-pages
+          git push https://x-access-token:${CV_PAGES_TOKEN}@github.com/datarian/CV-pages.git gh-pages
 
       - name: Report deployment URLs
         if: steps.detect.outputs.has_builds == 'true'
         run: |
           echo "## 🚀 Deployment Complete" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
-          echo "Web resumes deployed to GitHub Pages:" >> $GITHUB_STEP_SUMMARY
+          echo "Web resumes deployed to private CV-pages repository:" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
 
-          # List all deployed URLs (simplified)
-          for dir in gh-pages-branch/cv/*/; do
+          # List all deployed URLs
+          for dir in cv-pages-repo/cv/*/; do
             id=$(basename "$dir")
-            if [ "$id" != ".*" ]; then
-              echo "- https://datarian.github.io/CV/cv/$id" >> $GITHUB_STEP_SUMMARY
+            if [ "$id" != ".*" ] && [ "$id" != ".manifest.json" ]; then
+              echo "- https://datarian.github.io/CV-pages/cv/$id" >> $GITHUB_STEP_SUMMARY
             fi
           done

CLAUDE.md

@@ -91,16 +91,16 @@ cp -r dist/* ../customized/{id}/web/
 
 # 4. Preview locally
 npm run preview
-# Open http://localhost:4173/CV/
+# Open http://localhost:4173/CV-pages/
 
 # 5. Commit and let GitHub Actions deploy
 git add resumes/customized/{id}/web/
 git commit -m "feat: add web resume for {company}"
 git push
 ```
 
-After push, GitHub Actions automatically deploys to:
-`https://datarian.github.io/CV/cv/{semantic-id}`
+After push, GitHub Actions automatically deploys to private `CV-pages` repository:
+`https://datarian.github.io/CV-pages/cv/{semantic-id}`
 
 ## LaTeX Dependencies
 
@@ -289,7 +289,7 @@ The CV repository now uses a flexible, data-driven approach with the following s
       ▼
     DONE → Shareable URLs:
     - PDF: resumes/compiled/{timestamp}_{id}_CV_en.pdf
-    - Web: https://datarian.github.io/CV/cv/{semantic-id}
+    - Web: https://datarian.github.io/CV-pages/cv/{semantic-id}
 ```
 
 **Iteration Process**:

README.md

@@ -614,13 +614,27 @@ Agents clean these automatically.
 
 ## Privacy & Security
 
+⚠️ **IMPORTANT: Multi-Repository Privacy Setup**
+
+This repository is **PUBLIC** to showcase the AI agent system. Your actual resumes with personal data are deployed to a **PRIVATE** repository (`datarian/CV-pages`).
+
+**Repository Split:**
+- **`datarian/CV` (PUBLIC)**: System code, agents, templates, documentation - the "how it's built" showcase
+- **`datarian/CV-pages` (PRIVATE)**: Deployed web resumes with your personal information
+
+**Why this matters:**
+- Anyone can explore the system architecture and AI agents (great for showcasing your work!)
+- But your actual resume data remains private in the CV-pages repository
+- Web resumes are accessible via public URLs with random hash IDs (e.g., `https://datarian.github.io/CV-pages/cv/2025_11_10_company_a3f2`)
+- The hash makes URLs not easily discoverable, robots.txt blocks search engines
+
 ### What's Excluded from Git
 
-**NEVER committed to version control**:
+**NEVER committed to version control (in PUBLIC repo)**:
 - `docs/PERSONAL_PROFILE.md` - Your actual personal data
 - All `*.pdf` files - Compiled resumes
-- `resumes/templates/*.tex` (unless `.example.tex`)
-- `resumes/customized/` - Job-specific resumes
+- `resumes/customized/` - Job-specific resumes (including `resume_content.md` and `web/` builds)
+- `resumes/compiled/` - Compiled PDF outputs
 - `resources/*.jpg` - Portrait photos
 
 ### What's Included in Git