chore: open-source release cleanup #207
Description
Summary
Comprehensive cleanup needed before the repository goes public. This covers secrets removal, internal file cleanup, CI/CD fixes, and branding consistency.
Audit was performed across 4 dimensions: secrets/sensitive data, internal references/branding, directory structure, and configuration files.
Critical — Must fix before release
1. Remove hardcoded Azure Application Insights connection string
- Status: OK as-is. Client-side telemetry instrumentation keys are designed to be public (write-only). Already has an explanatory comment in code.
2. Move production API endpoint to config
- File: `packages/opencode/src/server/server.ts:560`
- Status: Deferred — `app.altimate.ai` is the intended public endpoint for the product. Not a secret.
3. Delete `.github/TEAM_MEMBERS` file
- Status: Done in chore: open-source release cleanup #208
4. Remove or rework PR enforcement workflows
- Status: Done in chore: open-source release cleanup #208
- `pr-standards.yml` kept (gracefully handles missing TEAM_MEMBERS, applies equally to all contributors)
- `pr-management.yml` stripped broken `check-duplicates` job, kept `add-contributor-label`
5. Replace self-hosted runners with GitHub-hosted
- Status: Done in chore: open-source release cleanup #208
- `opencode.yml`: `blacksmith` → `ubuntu-latest`
- `beta.yml`: removed entirely (referenced deleted `script/beta.ts`)
- `stats.yml`: removed entirely (internal PostHog analytics)
6. Remove `experiments/` directory
- Status: Kept — user decided to keep experiments in the repo
High — Should fix before release
7. Standardize internal placeholder URLs
- Status: Done in chore: open-source release cleanup #208 — all `opencode.internal` → `altimate-code.internal`
8. Remove `stats.yml` workflow
- Status: Done in chore: open-source release cleanup #208
9. Review `beta.yml` workflow
- Status: Done in chore: open-source release cleanup #208 — removed (script dependency deleted)
Medium — Should address
10. Decide on `@opencode-ai/*` npm scope
- Status: Keeping as-is — upstream-compatible internal packages, renaming would break imports across codebase
11. Rename root `package.json` name
- Status: Keeping as-is — root is `private: true`, name has no external impact
12. Review and remove internal docs
- Status: Done in chore: open-source release cleanup #208 — `docs/design/ai-teammate-repositioning.md` removed. No `docs/research/` or `docs/strategy/` directories exist.
Completed (pre-PR)
- Squash upstream history (12,800 → 99 commits)
- Delete stale remote branches (329 → 22)
- Remove upstream remote
- Enforce squash-merge-only on main
- Remove internal planning docs (FEATURES_*.md, IMPLEMENTATION_PLAN.md, PLATFORM_ENGINEER_SIMULATION.md, STATS.md)
- Remove internal scripts (stats.ts, beta.ts, duplicate-pr.ts)
- Remove .zed/ (single dev's editor config)
- Move RELEASING.md to docs/
- Push backup branch to remote
Completed (in #208)
- Open-source readiness: engine bootstrap, branding, release infra #3 — Delete `.github/TEAM_MEMBERS`
- chore(deps): Bump @ai-sdk/xai from 2.0.51 to 3.0.60 #4 — Rework PR enforcement workflows
- chore(deps): Bump @gitlab/gitlab-ai-provider from 3.6.0 to 4.1.0 #5 — Replace self-hosted runners / remove broken workflows
- chore(deps-dev): Bump @babel/core from 7.28.4 to 7.29.0 #7 — Standardize internal placeholder URLs
- chore(deps): Bump glob from 13.0.5 to 13.0.6 #8 — Remove `stats.yml` workflow
- chore(deps-dev): Bump @types/yargs from 17.0.33 to 17.0.35 #9 — Remove `beta.yml` workflow
- chore(deps): Bump @ai-sdk/groq from 2.0.34 to 3.0.26 #12 — Remove internal docs (`docs/design/`)
Won't Do / Deferred
chore(deps): Bump minimatch from 10.0.3 to 10.2.3 in /packages/altimate-code #1— Azure App Insights key is public by designchore(deps): Bump @modelcontextprotocol/sdk from 1.25.2 to 1.26.0 in /packages/altimate-code #2— `app.altimate.ai` is the intended product endpointchore(deps): Bump google-auth-library from 10.5.0 to 10.6.1 #6— `experiments/` kept per user decisionchore(deps): Bump @parcel/watcher from 2.5.1 to 2.5.6 #10— `@opencode-ai/*` scope kept for upstream compatibilitychore(deps-dev): Bump @parcel/watcher-darwin-arm64 from 2.5.1 to 2.5.6 #11— Root package name kept (private, no external impact)