Take the repository private again — what it costs and what must be in place first

[Devski]

Decided by Dawid on 12.09.2026: the repository stays public for now and goes private
later. This records what the switch costs and what has to be in place first, so that it is a
decision and not a surprise. It went public on 10.09.2026; #144 is what that cost us once
already.

Why it is not free

Measured on 12.09.2026 over the previous seven days (05–12.09): 263 workflow runs — 210 CI
and 53 preview cleanups, about 30 CI runs a day. One CI run bills about 11.9 minutes
once each job is rounded up to the minute, the way private repositories are billed: e2e-full
3.4, check 2.6, image 2.2, e2e-smoke 1.9, deploy-config 1.0, preview 0.6, deploy-dev
0.6. That is roughly 11,000 minutes a month.

A public repository pays nothing for those minutes. A private one pays past the plan's
allowance:

• GitHub Free — 2,000 minutes, and no branch protection on private repositories. The
  ruleset main: green before it lands (id 22987528, created 12.09.2026) would stop being
  enforced, which undoes Nothing requires a green pipeline before code reaches main, and main deploys itself #61. Free is therefore not an option, whatever the minutes cost.
• GitHub Pro — 3,000 minutes, then $0.006 a minute. At today's tempo that is ~8,000 minutes
  over the allowance, about $52 a month; at half the tempo about $19.
• Storage — the container images are free while the repository is public. Private, the plan
  includes 2 GB and charges $0.25 per GB a month beyond it. Nothing deletes old images today
  (Dev instance keeps every image it ever pulled: the deploy must drop the old ones #119 is the same habit on the instance's disk), so this figure grows on its own. It is the
  one item that can surprise, and it is not yet measured — the token used on 12.09 had no
  read:packages scope.

Before the switch

• Pro on the account before the visibility changes, so main is never left unguarded.
• A retention policy for the images in the registry — the registry's side of Dev instance keeps every image it ever pulled: the deploy must drop the old ones #119.
• Read the real storage figure (Settings → Billing → storage for Actions and Packages) and
  write it into this issue, so the monthly bill is known and not estimated.
• Decide whether the CI rethink lands first: it is what decides the monthly bill.

What going private does not undo

The history stays as it is. The seed password that was published before 10.09.2026 was rotated
on 11.09 (#144), and whatever was cloned in the meantime stays cloned. Going private is about
what happens next, not about what already happened.

Labels: decision, infra

[Devski]

Read from the billing usage API on 12.09.2026, so the estimate above can be corrected where it
was wrong.

The account is on GitHub Free. September's usage, the whole account:

repository	item	quantity	gross	net
authenticationflow	Actions Linux	2,430 minutes	$14.58	$0
platform-lite	Actions storage	5.43 GB-hours	$0	$0

Three things follow.

1. platform-lite costs nothing today, and its Actions minutes do not appear at all —
   a public repository's minutes are free, so there is nothing to meter.
2. The allowance is not ours alone. authenticationflow is private and already spends
   ~2,430 minutes a month of it. So the sum, not this repository's own ~11,000 minutes, is what
   a private platform-lite would be measured against: about 13,400 minutes a month
   against Pro's 3,000, so ~10,400 over — about $62 a month, not the $52 estimated above.
3. The registry is not being billed, although the package platform-lite is marked
   private while the repository is public. There is no packages-storage line in the usage at
   all. What sits there: 140 versions in six days, one image 107 MB in twelve layers, and
   poor de-duplication — three images compared share only 28 MB, because every build starts
   from a fresh checkout and the COPY layers get new digests even when the content is the
   same. That is roughly 8 GB, growing by more than a gigabyte a day, free only for as long
   as this repository is public.

So the switch is not "pay for the minutes". It is: Pro, about $62 a month at this tempo, and a
retention policy in the registry first — or the 8 GB starts being metered on the day the
repository turns private, and keeps growing at 23 images a day.