Remove the private-repo machinery now that the repo is public (CHOO-2023)

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,69 @@
+name: Bug report
+description: Something in Switch behaves incorrectly.
+labels: ['bug']
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to file this.
+
+        **Do not report security vulnerabilities here.** Use the Security tab →
+        *Report a vulnerability*, as described in [SECURITY.md](../blob/main/SECURITY.md).
+
+  - type: dropdown
+    id: component
+    attributes:
+      label: Component
+      description: Where did you see this?
+      options:
+        - switch-core (control plane)
+        - gateway (operator dashboard)
+        - Switch Console (desktop app)
+        - Connector plugin (Claude Code / Codex)
+        - Collaboration bridge (Slack / Mattermost)
+        - Deployment (Docker Compose / Helm)
+        - Not sure
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Version or commit
+      description: Release version, image tag, or commit SHA.
+      placeholder: 'switch-core 0.13.0 / console 0.20.0 / d8db4e5'
+    validations:
+      required: true
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: What did you observe, and what did you expect instead?
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. ...
+        2. ...
+        3. ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs or error output
+      description: Paste any relevant output. It is rendered as a code block, so no backticks needed.
+      render: shell
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: OS and version, and anything else that might matter.
+      placeholder: 'macOS 15.2 (arm64), Docker 27.0.0'

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/sandbox-quantum/switch/security/advisories/new
+    about: Report privately through a GitHub security advisory — never as a public issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,38 @@
+name: Feature request
+description: Suggest a capability or an improvement.
+labels: ['enhancement']
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem
+      description: What are you trying to do that Switch makes hard or impossible today?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: What you would like to see
+      description: Describe the change. Rough shape is fine.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives you have considered
+      description: Including any workaround you are using now.
+
+  - type: dropdown
+    id: component
+    attributes:
+      label: Component
+      options:
+        - switch-core (control plane)
+        - gateway (operator dashboard)
+        - Switch Console (desktop app)
+        - Connector plugin (Claude Code / Codex)
+        - Collaboration bridge (Slack / Mattermost)
+        - Deployment (Docker Compose / Helm)
+        - Not sure

.github/workflows/switch-agent-runtime-publish.yml

@@ -75,19 +75,19 @@ jobs:
         working-directory: console
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         # Full history + tags so the version guard can resolve the tag pointing
         # at HEAD on a workflow_dispatch (where github.ref is a branch, not the tag).
         with:
           fetch-depth: 0
 
       # Pinned rather than read from packageManager: that field lives in
       # console/package.json, and the action looks at the repo root.
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
         with:
           version: 10.28.2
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: pnpm

.github/workflows/switch-console-release.yml

@@ -1,8 +1,8 @@
 name: Switch Console release
 
 # Builds the Switch Console desktop app and publishes it to a GitHub Release on this
-# (private) repo, so anyone with repo-read access can install it without building
-# from source. Release assets inherit the repo's read access — no separate ACL.
+# repo, so anyone can install it without building from source. The repo is public,
+# so the release assets are too — no token, no ACL.
 #
 # macOS (arm64) is signed + notarized. Linux (x64) builds AppImage, deb and rpm,
 # unsigned. Windows is not built yet (needs an Authenticode / Azure Trusted
@@ -48,7 +48,7 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/')
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Verify tag matches package.json version
         run: |
@@ -96,15 +96,15 @@ jobs:
       APPLE_API_KEY_P8: ${{ secrets.APPLE_API_KEY_P8 }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
         with:
           version: 11.5.3
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: console/.nvmrc
           cache: pnpm
@@ -175,7 +175,7 @@ jobs:
 
       - name: Upload build artifacts (dispatch runs, no Release)
         if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: switch-console-macos-arm64
           path: |
@@ -192,15 +192,15 @@ jobs:
     if: ${{ !cancelled() && needs.create-release.result != 'failure' }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
         with:
           version: 11.5.3
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: console/.nvmrc
           cache: pnpm
@@ -251,7 +251,7 @@ jobs:
 
       - name: Upload build artifacts (dispatch runs, no Release)
         if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: switch-console-linux-x64
           path: |

.github/workflows/switch-release.yml

@@ -9,10 +9,9 @@ name: switch release
 # MUST match pyproject.toml `[project].version`; the prep job verifies this).
 # `workflow_dispatch` builds everything WITHOUT pushing, for verification.
 #
-# Artifacts go to GHCR by default. While this repo is private the packages are
-# private too and flip to public with the repo at the public-repo move
-# (CHOO-1260). REGISTRY / IMAGE_NAMESPACE are the only things to change to
-# retarget another registry (e.g. ECR) — a config flip, not a rewrite.
+# Artifacts go to GHCR by default, and the packages are public alongside the
+# repo. REGISTRY / IMAGE_NAMESPACE are the only things to change to retarget
+# another registry (e.g. ECR) — a config flip, not a rewrite.
 
 on:
   push:
@@ -39,7 +38,7 @@ jobs:
       compose_accepts: ${{ steps.contract.outputs.accepts }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Resolve version
         id: version
@@ -94,25 +93,25 @@ jobs:
             dockerfile: deploy/shared_resources/images/Dockerfile.setup
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up QEMU
         # Enables arm64 emulation so buildx can produce a multi-arch manifest
         # from an amd64 runner.
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           # All three Dockerfiles build with the repo root as context.
           context: .
@@ -134,10 +133,10 @@ jobs:
       packages: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Helm
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
 
       - name: Lint chart
         run: helm lint deploy/remote/helm/switch
@@ -172,10 +171,10 @@ jobs:
       packages: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up ORAS
-        uses: oras-project/setup-oras@v1
+        uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1.2.4
 
       - name: Log in to GHCR (ORAS)
         if: ${{ needs.prep.outputs.push == 'true' }}

.gitignore

@@ -229,4 +229,11 @@ __marimo__/
 .agenthub
 related-projects
 .claude/settings.local.json
-.claude/agents/
+.claude/agents/
+
+# Switch Console working-tree artifacts. Build output and scratch downloads that
+# land at the repo root; ignored so they cannot be committed by accident.
+.switchdash/
+.switchdash-icon-drop/
+download.txt
+download.xml

CONTRIBUTING.md

@@ -5,8 +5,6 @@ get a change merged.
 
 ## Development setup
 
-See [CLAUDE.md](CLAUDE.md) for the full developer guide. In short:
-
 ```bash
 uv sync            # install dependencies
 just up            # start Switch locally (Docker Compose)
@@ -22,10 +20,12 @@ just migrate       # apply database migrations
 
 ## Conventions
 
-[CLAUDE.md](CLAUDE.md) documents the code style, import rules, and the
-error-handling philosophy ("fail loud, never fake") this project follows.
-Please read it before making substantial changes — matching the surrounding
-code and these conventions keeps review fast.
+Code style, import rules, and the error-handling philosophy ("fail loud, never
+fake") are documented in [CLAUDE.md](CLAUDE.md). That file is written as
+instructions for AI coding agents working in this repository, but the
+conventions it describes are the ones the project follows, so it is worth
+reading before making substantial changes — matching the surrounding code keeps
+review fast.
 
 ## License
 

README.md

@@ -11,7 +11,7 @@
 [![License: Apache 2.0 + Commons Clause](https://img.shields.io/badge/license-Apache%202.0%20%2B%20Commons%20Clause-blue)](LICENSE)
 [![Documentation](https://img.shields.io/badge/docs-coming%20soon-FF895E)](#)
 [![Website](https://img.shields.io/badge/website-coming%20soon-FF895E)](#)
-[![PRs welcome](https://img.shields.io/badge/PRs-welcome-brightgreen)](CLAUDE.md)
+[![PRs welcome](https://img.shields.io/badge/PRs-welcome-brightgreen)](CONTRIBUTING.md)
 
 </div>
 
@@ -205,7 +205,4 @@ derives substantially from it); all other Apache 2.0 grants are unchanged.
 
 ## Contributing
 
-See [CONTRIBUTING.md](CONTRIBUTING.md) for how to get a change merged, including
-the required [Contributor License Agreement](CLA.md). [CLAUDE.md](CLAUDE.md)
-covers code style, the error-handling philosophy, and the conventions to follow
-when working in this repository.
+See [CONTRIBUTING.md](CONTRIBUTING.md) for how to get a change merged.

RELEASING.md

@@ -111,11 +111,10 @@ switch-core releases are **not** gated and need no such ping.
 ## Where artifacts are published
 
 The images, the chart, and the standalone compose artifact all go to **GitHub
-Container Registry (GHCR)** by default. While the repository is private the
-packages are private too; they become public automatically when the
-repository/packages are made public at the public-repo move (CHOO-1260). The
-registry and namespace are workflow env vars (`REGISTRY`, `IMAGE_NAMESPACE`) so
-retargeting to another registry (e.g. ECR) is a one-line change, not a rewrite.
+Container Registry (GHCR)** by default, and are public alongside the repository
+— pulling them needs no credential. The registry and namespace are workflow env
+vars (`REGISTRY`, `IMAGE_NAMESPACE`) so retargeting to another registry (e.g.
+ECR) is a one-line change, not a rewrite.
 
 Consuming the published artifacts: