diff --git a/internal/ci/github/evict_caches.cue b/internal/ci/github/evict_caches.cue
index f7362e94c62..10254264259 100644
--- a/internal/ci/github/evict_caches.cue
+++ b/internal/ci/github/evict_caches.cue
@@ -21,7 +21,7 @@ import (
 )
 
 // The evict_caches removes "old" GitHub actions caches from the main repo and
-// the accompanying trybot repo. The job is only run in the main repo, because
+// the accompanying trybot _repo. The job is only run in the main repo, because
 // that is the only place where the credentials exist.
 //
 // The GitHub actions caches in the main and trybot repos can get large. So
@@ -40,7 +40,7 @@ import (
 //
 // In testing with @mvdan, this resulted in cache sizes for Linux dropping from
 // ~1GB to ~125MB. This is a considerable saving.
-workflows: evict_caches: repo.bashWorkflow & {
+workflows: evict_caches: _repo.bashWorkflow & {
 	name: "Evict caches"
 
 	on: {
@@ -52,11 +52,11 @@ workflows: evict_caches: repo.bashWorkflow & {
 	jobs: {
 		test: {
 			// We only want to run this in the main repo
-			if:        "${{github.repository == '\(repo.githubRepositoryPath)'}}"
-			"runs-on": repo.linuxMachine
+			if:        "${{github.repository == '\(_repo.githubRepositoryPath)'}}"
+			"runs-on": _repo.linuxMachine
 			steps: [
 				json.#step & {
-					let branchPatterns = strings.Join(repo.protectedBranchPatterns, " ")
+					let branchPatterns = strings.Join(_repo.protectedBranchPatterns, " ")
 
 					// rerunLatestWorkflow runs the latest trybot workflow in the
 					// specified repo for branches that match the specified branch.
@@ -64,8 +64,8 @@ workflows: evict_caches: repo.bashWorkflow & {
 						#repo:   string
 						#branch: string
 						"""
-						id=$(\(repo.curlGitHubAPI) "https://github.com/gitapi/repos/\(#repo)/actions/workflows/trybot.yml/runs?branch=\(#branch)&event=push&per_page=1" | jq '.workflow_runs[] | .id')
-						\(repo.curlGitHubAPI) -X POST https://github.com/gitapi/repos/\(#repo)/actions/runs/$id/rerun
+						id=$(\(_repo.curlGitHubAPI) "https://github.com/gitapi/repos/\(#repo)/actions/workflows/trybot.yml/runs?branch=\(#branch)&event=push&per_page=1" | jq '.workflow_runs[] | .id')
+						\(_repo.curlGitHubAPI) -X POST https://github.com/gitapi/repos/\(#repo)/actions/runs/$id/rerun
 
 						"""
 					}
@@ -75,7 +75,7 @@ workflows: evict_caches: repo.bashWorkflow & {
 
 						echo ${{ secrets.CUECKOO_GITHUB_PAT }} | gh auth login --with-token
 						gh extension install actions/gh-actions-cache
-						for i in \(repo.githubRepositoryURL) \(repo.githubRepositoryURL)-trybot
+						for i in \(_repo.githubRepositoryURL) \(_repo.githubRepositoryURL)-trybot
 						do
 							echo "Evicting caches for $i"
 							cd $(mktemp -d)
@@ -90,7 +90,7 @@ workflows: evict_caches: repo.bashWorkflow & {
 						# Now trigger the most recent workflow run on each of the default branches.
 						# We do this by listing all the branches on the main repo and finding those
 						# which match the protected branch patterns (globs).
-						for j in $(\(repo.curlGitHubAPI) -f https://github.com/gitapi/repos/\(repo.githubRepositoryPath)/branches | jq -r '.[] | .name')
+						for j in $(\(_repo.curlGitHubAPI) -f https://github.com/gitapi/repos/\(_repo.githubRepositoryPath)/branches | jq -r '.[] | .name')
 						do
 							for i in \(branchPatterns)
 							do
@@ -99,8 +99,8 @@ workflows: evict_caches: repo.bashWorkflow & {
 								fi
 
 								echo "$j is a match with $i"
-								\(rerunLatestWorkflow & {#repo: repo.githubRepositoryPath, #branch: "$j", _})
-								\(rerunLatestWorkflow & {#repo: repo.githubRepositoryPath + "-trybot", #branch: "$j", _})
+								\(rerunLatestWorkflow & {#repo: _repo.githubRepositoryPath, #branch: "$j", _})
+								\(rerunLatestWorkflow & {#repo: _repo.githubRepositoryPath + "-trybot", #branch: "$j", _})
 							done
 						done
 						"""
diff --git a/internal/ci/github/push_tip_to_trybot.cue b/internal/ci/github/push_tip_to_trybot.cue
index fceb5ac5073..3773ed65dd5 100644
--- a/internal/ci/github/push_tip_to_trybot.cue
+++ b/internal/ci/github/push_tip_to_trybot.cue
@@ -14,15 +14,15 @@
 
 package github
 
-// push_tip_to_trybot "syncs" active branches to the trybot repo.
+// push_tip_to_trybot "syncs" active branches to the trybot _repo.
 // Since the workflow is triggered by a push to any of the branches,
 // the step only needs to sync the pushed branch.
-workflows: push_tip_to_trybot: repo.pushTipToTrybotWorkflow & {
+workflows: push_tip_to_trybot: _repo.pushTipToTrybotWorkflow & {
 	on: {
-		push: branches: repo.protectedBranchPatterns
+		push: branches: _repo.protectedBranchPatterns
 	}
 	jobs: push: {
-		"runs-on": repo.linuxMachine
-		if:        "${{github.repository == '\(repo.githubRepositoryPath)'}}"
+		"runs-on": _repo.linuxMachine
+		if:        "${{github.repository == '\(_repo.githubRepositoryPath)'}}"
 	}
 }
diff --git a/internal/ci/github/release.cue b/internal/ci/github/release.cue
index 03edb0be0db..41e0797d765 100644
--- a/internal/ci/github/release.cue
+++ b/internal/ci/github/release.cue
@@ -26,7 +26,7 @@ import (
 _cueVersionRef: "${GITHUB_REF##refs/tags/}"
 
 // The release workflow
-workflows: release: repo.bashWorkflow & {
+workflows: release: _repo.bashWorkflow & {
 
 	name: "Release"
 
@@ -36,16 +36,16 @@ workflows: release: repo.bashWorkflow & {
 	concurrency: "release"
 
 	on: push: {
-		tags: [repo.releaseTagPattern, "!" + repo.zeroReleaseTagPattern]
-		branches: list.Concat([[repo.testDefaultBranch], repo.protectedBranchPatterns])
+		tags: [_repo.releaseTagPattern, "!" + _repo.zeroReleaseTagPattern]
+		branches: list.Concat([[_repo.testDefaultBranch], _repo.protectedBranchPatterns])
 	}
 	jobs: goreleaser: {
-		"runs-on": repo.linuxMachine
-		if:        "${{github.repository == '\(repo.githubRepositoryPath)'}}"
+		"runs-on": _repo.linuxMachine
+		if:        "${{github.repository == '\(_repo.githubRepositoryPath)'}}"
 		steps: [
-			for v in repo.checkoutCode {v},
-			repo.installGo & {
-				with: "go-version": repo.pinnedReleaseGo
+			for v in _repo.checkoutCode {v},
+			_repo.installGo & {
+				with: "go-version": _repo.pinnedReleaseGo
 			},
 			json.#step & {
 				name: "Setup qemu"
@@ -73,7 +73,7 @@ workflows: release: repo.bashWorkflow & {
 				uses: "goreleaser/goreleaser-action@v3"
 				with: {
 					"install-only": true
-					version:        repo.goreleaserVersion
+					version:        _repo.goreleaserVersion
 				}
 			},
 			json.#step & {
@@ -84,18 +84,18 @@ workflows: release: repo.bashWorkflow & {
 				run:                 "cue cmd release"
 				"working-directory": "./internal/ci/goreleaser"
 			},
-			repo.repositoryDispatch & {
+			_repo.repositoryDispatch & {
 				name:                  "Re-test cuelang.org"
-				if:                    repo.isReleaseTag
-				#githubRepositoryPath: repo.cuelangRepositoryPath
+				if:                    _repo.isReleaseTag
+				#githubRepositoryPath: _repo.cuelangRepositoryPath
 				#arg: {
 					event_type: "Re-test post release of \(_cueVersionRef)"
 				}
 			},
-			repo.repositoryDispatch & {
+			_repo.repositoryDispatch & {
 				name:                  "Trigger unity build"
-				if:                    repo.isReleaseTag
-				#githubRepositoryPath: repo.unityRepositoryPath
+				if:                    _repo.isReleaseTag
+				#githubRepositoryPath: _repo.unityRepositoryPath
 				#arg: {
 					event_type: "Check against CUE \(_cueVersionRef)"
 					client_payload: {
diff --git a/internal/ci/github/repo.cue b/internal/ci/github/repo.cue
index aeba3b9877a..c9677eef47b 100644
--- a/internal/ci/github/repo.cue
+++ b/internal/ci/github/repo.cue
@@ -23,6 +23,6 @@ package github
 // in a single file, and that keeps the different in import
 // path down to a single file.
 
-import _repo "cuelang.org/go/internal/ci/repo"
+import repo "cuelang.org/go/internal/ci/repo"
 
-repo: _repo
+_repo: repo
diff --git a/internal/ci/github/tip_triggers.cue b/internal/ci/github/tip_triggers.cue
index 3aab7483af4..22b7300821a 100644
--- a/internal/ci/github/tip_triggers.cue
+++ b/internal/ci/github/tip_triggers.cue
@@ -16,17 +16,17 @@ package github
 
 // The tip_triggers workflow. This fires for each new commit that hits the
 // default branch.
-workflows: tip_triggers: repo.bashWorkflow & {
+workflows: tip_triggers: _repo.bashWorkflow & {
 
 	name: "Triggers on push to tip"
-	on: push: branches: [repo.defaultBranch]
+	on: push: branches: [_repo.defaultBranch]
 	jobs: push: {
-		"runs-on": repo.linuxMachine
-		if:        "${{github.repository == '\(repo.githubRepositoryPath)'}}"
+		"runs-on": _repo.linuxMachine
+		if:        "${{github.repository == '\(_repo.githubRepositoryPath)'}}"
 		steps: [
-			repo.repositoryDispatch & {
+			_repo.repositoryDispatch & {
 				name:                  "Trigger tip.cuelang.org deploy"
-				#githubRepositoryPath: repo.cuelangRepositoryPath
+				#githubRepositoryPath: _repo.cuelangRepositoryPath
 				#arg: {
 					event_type: "Rebuild tip against ${GITHUB_SHA}"
 					client_payload: {
@@ -34,9 +34,9 @@ workflows: tip_triggers: repo.bashWorkflow & {
 					}
 				}
 			},
-			repo.repositoryDispatch & {
+			_repo.repositoryDispatch & {
 				name:                  "Trigger unity build"
-				#githubRepositoryPath: repo.unityRepositoryPath
+				#githubRepositoryPath: _repo.unityRepositoryPath
 				#arg: {
 					event_type: "Check against ${GITHUB_SHA}"
 					client_payload: {
diff --git a/internal/ci/github/trybot.cue b/internal/ci/github/trybot.cue
index d3c6372708e..04471c2014f 100644
--- a/internal/ci/github/trybot.cue
+++ b/internal/ci/github/trybot.cue
@@ -21,13 +21,13 @@ import (
 )
 
 // The trybot workflow.
-workflows: trybot: repo.bashWorkflow & {
-	name: repo.trybot.name
+workflows: trybot: _repo.bashWorkflow & {
+	name: _repo.trybot.name
 
 	on: {
 		push: {
-			branches: list.Concat([["trybot/*/*", repo.testDefaultBranch], repo.protectedBranchPatterns]) // do not run PR branches
-			"tags-ignore": [repo.releaseTagPattern]
+			branches: list.Concat([["trybot/*/*", _repo.testDefaultBranch], _repo.protectedBranchPatterns]) // do not run PR branches
+			"tags-ignore": [_repo.releaseTagPattern]
 		}
 		pull_request: {}
 	}
@@ -37,11 +37,11 @@ workflows: trybot: repo.bashWorkflow & {
 			strategy:  _testStrategy
 			"runs-on": "${{ matrix.os }}"
 
-			let goCaches = repo.setupGoActionsCaches & {#protectedBranchExpr: repo.isProtectedBranch, _}
+			let goCaches = _repo.setupGoActionsCaches & {#protectedBranchExpr: _repo.isProtectedBranch, _}
 
 			steps: [
-				for v in repo.checkoutCode {v},
-				repo.installGo,
+				for v in _repo.checkoutCode {v},
+				_repo.installGo,
 
 				// cachePre must come after installing Node and Go, because the cache locations
 				// are established by running each tool.
@@ -53,28 +53,28 @@ workflows: trybot: repo.bashWorkflow & {
 				// subsequent CLs in the trybot repo can leverage the updated
 				// cache. Therefore, we instead perform a clean of the testcache.
 				json.#step & {
-					if:  "github.repository == '\(repo.githubRepositoryPath)' && (\(repo.isProtectedBranch) || github.ref == 'refs/heads/\(repo.testDefaultBranch)')"
+					if:  "github.repository == '\(_repo.githubRepositoryPath)' && (\(_repo.isProtectedBranch) || github.ref == 'refs/heads/\(_repo.testDefaultBranch)')"
 					run: "go clean -testcache"
 				},
 
-				repo.earlyChecks & {
+				_repo.earlyChecks & {
 					// These checks don't vary based on the Go version or OS,
 					// so we only need to run them on one of the matrix jobs.
-					if: repo.isLatestLinux
+					if: _repo.isLatestLinux
 				},
 				json.#step & {
-					if:  "\(repo.isProtectedBranch) || \(repo.isLatestLinux)"
+					if:  "\(_repo.isProtectedBranch) || \(_repo.isLatestLinux)"
 					run: "echo CUE_LONG=true >> $GITHUB_ENV"
 				},
 				_goGenerate,
 				_goTest & {
-					if: "\(repo.isProtectedBranch) || !\(repo.isLatestLinux)"
+					if: "\(_repo.isProtectedBranch) || !\(_repo.isLatestLinux)"
 				},
 				_goTestRace & {
-					if: repo.isLatestLinux
+					if: _repo.isLatestLinux
 				},
 				_goCheck,
-				repo.checkGitClean,
+				_repo.checkGitClean,
 				_pullThroughProxy,
 			]
 		}
@@ -83,13 +83,13 @@ workflows: trybot: repo.bashWorkflow & {
 	_testStrategy: {
 		"fail-fast": false
 		matrix: {
-			"go-version": ["1.19.x", repo.latestStableGo]
-			os: [repo.linuxMachine, repo.macosMachine, repo.windowsMachine]
+			"go-version": ["1.19.x", _repo.latestStableGo]
+			os: [_repo.linuxMachine, _repo.macosMachine, _repo.windowsMachine]
 		}
 	}
 
 	_pullThroughProxy: json.#step & {
-		name: "Pull this commit through the proxy on \(repo.defaultBranch)"
+		name: "Pull this commit through the proxy on \(_repo.defaultBranch)"
 		run: """
 			v=$(git rev-parse HEAD)
 			cd $(mktemp -d)
@@ -121,7 +121,7 @@ workflows: trybot: repo.bashWorkflow & {
 			echo "giving up after a number of retries"
 			exit 1
 			"""
-		if: "\(repo.isProtectedBranch) && \(repo.isLatestLinux)"
+		if: "\(_repo.isProtectedBranch) && \(_repo.isLatestLinux)"
 	}
 
 	_goGenerate: json.#step & {
@@ -129,7 +129,7 @@ workflows: trybot: repo.bashWorkflow & {
 		run:  "go generate ./..."
 		// The Go version corresponds to the precise version specified in
 		// the matrix. Skip windows for now until we work out why re-gen is flaky
-		if: repo.isLatestLinux
+		if: _repo.isLatestLinux
 	}
 
 	_goTest: json.#step & {
@@ -144,7 +144,7 @@ workflows: trybot: repo.bashWorkflow & {
 		// dependencies that vary wildly between platforms.
 		// For now, to save CI resources, just run the checks on one matrix job.
 		// TODO: consider adding more checks as per https://github.com/golang/go/issues/42119.
-		if:   "\(repo.isLatestLinux)"
+		if:   "\(_repo.isLatestLinux)"
 		name: "Check"
 		run:  "go vet ./..."
 	}
diff --git a/internal/ci/github/trybot_dispatch.cue b/internal/ci/github/trybot_dispatch.cue
index b8635d82bbb..1a444ebc0f7 100644
--- a/internal/ci/github/trybot_dispatch.cue
+++ b/internal/ci/github/trybot_dispatch.cue
@@ -15,4 +15,4 @@
 package github
 
 // The trybot_dispatch workflow.
-workflows: trybot_dispatch: repo.bashWorkflow & repo.trybotDispatchWorkflow
+workflows: trybot_dispatch: _repo.bashWorkflow & _repo.trybotDispatchWorkflow
diff --git a/internal/ci/github/workflows.cue b/internal/ci/github/workflows.cue
index 1ed384a5360..d7748ffe363 100644
--- a/internal/ci/github/workflows.cue
+++ b/internal/ci/github/workflows.cue
@@ -40,7 +40,7 @@ import (
 workflows: close({
 	[string]: json.#Workflow
 
-	(repo.trybot.key):  _
+	(_repo.trybot.key):  _
 	trybot_dispatch:    _
 	release:            _
 	tip_triggers:       _