Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
Safely toggle a GitHub repository between private and public visibility. Applies the right security and access settings for each state. Public repos become read-only showcases — clone and fork only, no outside contributions.
Designed to work alongside:/github-secure. Detects whether it's been run and adapts (patches security.yml CodeQL job, patches branch protection status checks). Does not invoke github-secure.
# Enable secret scanning + push protection
gh api --method PATCH "/repos/$REPO" --input - <<'EOF'
{
"security_and_analysis": {
"secret_scanning": {"status": "enabled"},
"secret_scanning_push_protection": {"status": "enabled"}
}
}
EOF
# Enable Dependabot alerts + auto-fixes
gh api --method PUT "/repos/$REPO/vulnerability-alerts"
gh api --method PUT "/repos/$REPO/automated-security-fixes"
If security.yml exists:
If CodeQL job has if: github.repository_visibility == 'public' → remove the condition
If CodeQL job is missing → add it
Going private:
Secret scanning auto-disabled by GitHub (no action needed)
If security.yml exists → add condition to CodeQL job: if: github.repository_visibility == 'public'
See reference/github-visibility-reference.md for CodeQL conditional patterns.
Step 7: Branch protection adjustments
Only if branch protection exists (HAS_BRANCH_PROTECTION=true). If no branch protection → skip with warning: "No branch protection found. Skipping adjustments. Consider running /github-secure."
Uses read-modify-write pattern — reads current config, merges changes, writes back. Does not overwrite existing settings.
Going public:
Add push restrictions → only $GH_USER can push directly
Add CodeQL Analysis to required status checks (if security.yml has CodeQL)
Going private:
Remove push restrictions ("restrictions": null)
Remove CodeQL Analysis from required status checks
See reference/github-visibility-reference.md for the read-modify-write scripts.
Step 8: Auto-close external PRs workflow
Going public:
Create .github/workflows/close-external-prs.yml using template from reference file.
Triggers on pull_request_target: [opened]
Closes PRs from forks or non-owner authors
Posts polite message: "This repository is not accepting external contributions. Feel free to fork and modify for your own use."
Going private:
Delete .github/workflows/close-external-prs.yml if it exists.
See reference/github-visibility-reference.md for the full workflow template.
Step 9: LICENSE file (public only)
Going public:
If no LICENSE, LICENSE.md, or LICENSE.txt exists → create LICENSE with MIT template using current year and $GH_USER.
Going private:
Leave LICENSE in place (no harm in keeping it).
See reference/github-visibility-reference.md for the MIT LICENSE template.
Step 10: Commit changes
Stage any created/modified files and commit:
git add -A .github/workflows/close-external-prs.yml LICENSE .github/workflows/security.yml 2>/dev/null || true# Only commit if there are staged changesif ! git diff --cached --quiet; then
git commit -m "chore: configure repo for <target> visibility"fi
