skip posts marked draft: true

Lets unpublished posts live in the content repo alongside published ones.
Also documents using a token URL for a private content repo.

Dockerfile

@@ -30,9 +30,8 @@ COPY . .
 # `*.md` files into the image; leave it unset and the /news section simply
 # does not appear. The clone itself is done by the `prebuild` npm script, so
 # that Nixpacks builds (which never read this Dockerfile) behave identically.
-#
-# Use a public repo: build args are recorded in the image history, so a URL
-# carrying an access token would leak to anyone who can pull the image.
+# For a private repo the URL carries a token — see the README for what that
+# means for the built image.
 ARG NEWS_CONTENT_REPO=
 ARG NEWS_CONTENT_REF=main
 ENV NEWS_CONTENT_REPO=$NEWS_CONTENT_REPO

README.md

@@ -38,9 +38,12 @@ which never reads the `Dockerfile`, and `prebuild` is the one hook both build pa
 On Coolify these must be marked as **build variables**, not just runtime env vars, or the
 build will not see them.
 
-Use a **public** repo: with a Docker build these arrive as build args, which are recorded
-in the image history, so a URL carrying an access token would be readable by anyone who
-can pull the image.
+For a **private** content repo, put an access token in the URL
+(`https://<token>@github.com/<org>/<repo>.git`). Note that the token is then recorded in
+the built image. TS-Arena's own deployment accepts that: the images never leave internal
+hosts, and anyone with Docker access there can read the content repo anyway. If you run
+an instance where that is not true, use a public repo or a read-only token you are willing
+to rotate.
 
 A clone failure fails the build rather than silently shipping a site with no
 announcements.
@@ -54,6 +57,7 @@ title: Ranking switches from Elo to Arena Score
 date: 2026-07-23
 summary: Optional one-line teaser shown in the listing.
 author: Optional byline
+draft: true
 ---
 
 Body in Markdown. Headings, lists, links, tables, code and block quotes are styled.
@@ -62,6 +66,12 @@ Body in Markdown. Headings, lists, links, tables, code and block quotes are styl
 `title` and `date` are required; a post missing either is skipped with a build warning.
 Posts are listed newest first by `date`.
 
+`draft: true` keeps a post out of the build entirely — no page, no route, no listing entry
+— so unfinished posts can sit in the content repo next to the published ones. Drop the
+line (or set it to `false`) to publish on the next redeploy. The draft's Markdown file is
+still copied into the image, it is just never rendered or routed; treat drafts as hidden
+from site visitors, not as a secret from anyone who can read the image.
+
 Publishing a post is a push to the content repo followed by a redeploy of the frontend —
 the Markdown is baked into the image, so a rebuild is what makes a new post appear.
 

scripts/fetch-news.mjs

@@ -10,6 +10,10 @@
  *   NEWS_CONTENT_REPO   clone URL of the content repo (unset = no news)
  *   NEWS_CONTENT_REF    branch or tag to clone (default: main)
  *
+ * For a private repo, put the access token in the URL. TS-Arena's own deploys
+ * are internal-only and anyone with Docker access on those hosts can read the
+ * content repo anyway, so the token ending up in the image is acceptable there.
+ *
  * Deliberately lives in npm-script land rather than in the Dockerfile: the
  * Coolify apps build with Nixpacks, which never reads the Dockerfile. Hooking
  * into `prebuild` is the one place both build paths go through.
@@ -30,8 +34,6 @@ if (!repo) {
   process.exit(0);
 }
 
-// Never print `repo` itself: if someone ignores the advice and uses a URL with
-// an embedded token, it must not end up in the build log.
 console.log(`[news] cloning news content (ref: ${ref})`);
 
 // Clone into a staging directory and only swap it in once it succeeds, so a
@@ -44,6 +46,8 @@ fs.mkdirSync(path.dirname(TARGET), { recursive: true });
 try {
   execFileSync('git', ['clone', '--depth', '1', '--branch', ref, repo, staging], {
     stdio: ['ignore', 'inherit', 'pipe'],
+    // Bad credentials should fail the build, not hang it on a username prompt.
+    env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
   });
 } catch (err) {
   // Fail the build loudly. A silent fallback to "no news" would ship a site

src/content/news/index.ts

@@ -57,6 +57,13 @@ function readPosts(): NewsPost[] {
       continue;
     }
 
+    // Drafts stay in the content repo but never reach the site. Not rendered
+    // and not routed, so there is no unlisted URL to stumble onto either.
+    if (data.draft === true) {
+      console.log(`[news] skipping draft content/news/${fileName}`);
+      continue;
+    }
+
     posts.push({
       slug,
       title,

src/content/news/types.ts

@@ -7,13 +7,16 @@
  * date: 2026-07-23
  * summary: One-line teaser shown in the listing.
  * author: TS-Arena Team
+ * draft: true
  * ---
  *
  * Body in Markdown…
  * ```
  *
  * `title` and `date` are required; a post missing either is skipped with a
- * build-time warning rather than breaking the build.
+ * build-time warning rather than breaking the build. `draft: true` keeps a
+ * post out of the build entirely, so unpublished work can live in the content
+ * repo alongside what is live.
  */
 export interface NewsPostMetadata {
   /** URL slug — derived from the file name (sans `.md`). */