feat(base,app)!: GitHub signs nobody in any more (ADR 0020, D36)

Every account signs in with SimpleLogin or a password now, so GitHub
goes from the module, the shared app package, Learn and Todo, ahead of
ADR 0017's GITHUB_SIGN_IN_ENDS.

- halkyon_base: no `gitHubSignIn` endpoint, GitHub identity provider or
  GitHub refusals; no `githubClientId`/`githubClientSecret`, no
  `GITHUB_SIGN_IN_ENDS` and no `forgetGitHubAccounts`; the register
  loses `account-with-github`. `SignInWays.gitHub`, the basics'
  `gitHubClientId` and `gitHubSignInEnds`, and `PasswordRefusal`'s
  `signInAgain` and `noAddress` go. A first password takes a code
  mailed to the person's own address; an account without one sets none
  (`wrongCredentials`).
- Learn's server: `instance.info()` without `gitHubClientId`, the
  pruning without GitHub, and `minimumAppBuild` 24, as builds up to 23
  (v0.20.0) require `SignInWays.gitHub`: the server deploys with the
  release of build 24.
- halkyon_app: no GitHub button or problems on the start screen, no
  password offered after a GitHub sign-in, and `ServerpodAuthGateway`
  without the browser half only GitHub used (`(client, base:)`). The
  account section offers a first password only to an account with an
  address. `LoopbackWebAuth` and the apps' schemes stay, SimpleLogin's
  ways back.
- Learn's Profile lists no GitHub; the texts go (English, German).
- Serverpod's `serverpod_auth_idp_github_account` stays, as its
  migrations make it; a row goes with its account, and ADR 0020's D36
  gives operators the SQL to delete those left.
- deploy/: compose.yaml and .env.example without GitHub. The READMEs,
  AGENTS.md files and ADR 0017 amended.

BREAKING CHANGE: builds up to 23 can't read the instance's answers
about an account's ways in; minimumAppBuild is 24.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

apps/learn/halkyon_learn_server/Dockerfile

@@ -39,7 +39,7 @@ RUN mkdir -p config migrations
 # Ubuntu 24.04: glibc 2.39 (the bundled binaries need at most 2.34, measured) and
 # libgcc_s (needed by libsqlite3_connection_pool, a Rust library; a server running
 # against Postgres never loads it, but a future code path might). CA certificates
-# for outgoing TLS, e.g. GitHub sign-in. git for the published studysets' releases
+# for outgoing TLS, e.g. SimpleLogin's sign-in. git for the published studysets' releases
 # (ADR 0005, rule 3), which the server writes through the git command.
 FROM ubuntu:24.04
 RUN apt-get update \

apps/learn/halkyon_learn_server/lib/src/auth/device.spy.yaml

@@ -3,7 +3,8 @@ class: Device
 fields:
   ### The session's id; signing the device out takes it.
   sessionId: UuidValue
-  ### How the session was started: "anonymous", "github" or "email".
+  ### How the session was started: "simplelogin" or "password", or for one
+  ### from before "email", "github" or "anonymous".
   method: String
   createdAt: DateTime
   lastUsedAt: DateTime

apps/learn/halkyon_learn_server/lib/src/auth/pruning_future_call.dart

@@ -10,18 +10,14 @@ import 'package:serverpod/serverpod.dart';
 /// and people go through its `deletePerson`, so Learn's own data of theirs
 /// goes too.
 class PruningFutureCall extends FutureCall {
-  /// Prunes one batch of anonymous accounts and logs how many people went;
-  /// 30 days after GitHub sign-in ended (`GITHUB_SIGN_IN_ENDS`), deletes the
-  /// accounts that had no other way in and forgets every GitHub ID too, on
-  /// the register; and forgets the resets that lapsed (ADR 0017).
+  /// Prunes one batch of anonymous accounts and logs how many people went,
+  /// and forgets the resets that lapsed (ADR 0017).
   Future<void> pruneAccounts(Session session) async {
     final now = clock.now();
     final pruned = await pruneAnonymousPeople(session);
-    final gitHub = await forgetGitHubAccounts(session, now: now);
     final resets = await forgetLapsedResets(session, now: now);
     session.log(
-      'Pruned $pruned anonymous people, $gitHub GitHub IDs and '
-      '$resets lapsed resets.',
+      'Pruned $pruned anonymous people and $resets lapsed resets.',
     );
   }
 

apps/learn/halkyon_learn_server/lib/src/generated/auth/device.dart

@@ -52,7 +52,8 @@ abstract class Device
   /// The session's id; signing the device out takes it.
   _is.UuidValue sessionId;
 
-  /// How the session was started: "anonymous", "github" or "email".
+  /// How the session was started: "simplelogin" or "password", or for one
+  /// from before "email", "github" or "anonymous".
   String method;
 
   DateTime createdAt;

apps/learn/halkyon_learn_server/lib/src/generated/future_calls.dart

@@ -282,10 +282,8 @@ class FilePruningPruneFilesFutureCall extends _is.FutureCall
   }
 }
 
-/// Prunes one batch of anonymous accounts and logs how many people went;
-/// 30 days after GitHub sign-in ended (`GITHUB_SIGN_IN_ENDS`), deletes the
-/// accounts that had no other way in and forgets every GitHub ID too, on
-/// the register; and forgets the resets that lapsed (ADR 0017).
+/// Prunes one batch of anonymous accounts and logs how many people went,
+/// and forgets the resets that lapsed (ADR 0017).
 class PruningPruneAccountsFutureCall extends _is.FutureCall
     implements _is.InvokableFutureCall {
   @override

apps/learn/halkyon_learn_server/lib/src/generated/instance/instance_info.dart

@@ -17,7 +17,6 @@ import 'package:serverpod/serverpod.dart' as _is;
 abstract class InstanceInfo
     implements _is.SerializableModel, _is.ProtocolSerialization {
   InstanceInfo._({
-    this.gitHubClientId,
     required this.sourceCodeUrl,
     this.minimumAppBuild,
     this.accountDomain,
@@ -28,7 +27,6 @@ abstract class InstanceInfo
   });
 
   factory InstanceInfo({
-    String? gitHubClientId,
     required String sourceCodeUrl,
     int? minimumAppBuild,
     String? accountDomain,
@@ -40,7 +38,6 @@ abstract class InstanceInfo
 
   factory InstanceInfo.fromJson(Map<String, dynamic> jsonSerialization) {
     return InstanceInfo(
-      gitHubClientId: jsonSerialization['gitHubClientId'] as String?,
       sourceCodeUrl: jsonSerialization['sourceCodeUrl'] as String,
       minimumAppBuild: jsonSerialization['minimumAppBuild'] as int?,
       accountDomain: jsonSerialization['accountDomain'] as String?,
@@ -53,10 +50,6 @@ abstract class InstanceInfo
     );
   }
 
-  /// The client ID of this instance's GitHub OAuth app, or null when GitHub
-  /// sign-in is off here.
-  String? gitHubClientId;
-
   /// Where the source of what this instance runs is; the licences require
   /// offering it to the people who use it.
   String sourceCodeUrl;
@@ -96,7 +89,6 @@ abstract class InstanceInfo
   /// with some or all fields replaced by the given arguments.
   @_is.useResult
   InstanceInfo copyWith({
-    String? gitHubClientId,
     String? sourceCodeUrl,
     int? minimumAppBuild,
     String? accountDomain,
@@ -109,7 +101,6 @@ abstract class InstanceInfo
   Map<String, dynamic> toJson() {
     return {
       '__className__': 'InstanceInfo',
-      if (gitHubClientId != null) 'gitHubClientId': gitHubClientId,
       'sourceCodeUrl': sourceCodeUrl,
       if (minimumAppBuild != null) 'minimumAppBuild': minimumAppBuild,
       if (accountDomain != null) 'accountDomain': accountDomain,
@@ -124,7 +115,6 @@ abstract class InstanceInfo
   Map<String, dynamic> toJsonForProtocol() {
     return {
       '__className__': 'InstanceInfo',
-      if (gitHubClientId != null) 'gitHubClientId': gitHubClientId,
       'sourceCodeUrl': sourceCodeUrl,
       if (minimumAppBuild != null) 'minimumAppBuild': minimumAppBuild,
       if (accountDomain != null) 'accountDomain': accountDomain,
@@ -145,7 +135,6 @@ class _Undefined {}
 
 class _InstanceInfoImpl extends InstanceInfo {
   _InstanceInfoImpl({
-    String? gitHubClientId,
     required String sourceCodeUrl,
     int? minimumAppBuild,
     String? accountDomain,
@@ -154,7 +143,6 @@ class _InstanceInfoImpl extends InstanceInfo {
     String? dataLocation,
     String? backupLocation,
   }) : super._(
-         gitHubClientId: gitHubClientId,
          sourceCodeUrl: sourceCodeUrl,
          minimumAppBuild: minimumAppBuild,
          accountDomain: accountDomain,
@@ -169,7 +157,6 @@ class _InstanceInfoImpl extends InstanceInfo {
   @_is.useResult
   @override
   InstanceInfo copyWith({
-    Object? gitHubClientId = _Undefined,
     String? sourceCodeUrl,
     Object? minimumAppBuild = _Undefined,
     Object? accountDomain = _Undefined,
@@ -179,9 +166,6 @@ class _InstanceInfoImpl extends InstanceInfo {
     Object? backupLocation = _Undefined,
   }) {
     return InstanceInfo(
-      gitHubClientId: gitHubClientId is String?
-          ? gitHubClientId
-          : this.gitHubClientId,
       sourceCodeUrl: sourceCodeUrl ?? this.sourceCodeUrl,
       minimumAppBuild: minimumAppBuild is int?
           ? minimumAppBuild

apps/learn/halkyon_learn_server/lib/src/instance/app_compatibility.dart

@@ -22,4 +22,8 @@
 /// 2026-10-24): builds up to 22 (v0.19.0) start with an anonymous account
 /// (`anonymousIdp.login`) and add GitHub to it (`gitHubUpgrade.upgrade`),
 /// both gone; 23 starts with SimpleLogin or a password.
-const minimumAppBuild = 23;
+///
+/// 24 since GitHub signs nobody in (ADR 0020, D36, decided 2026-10-25):
+/// builds up to 23 (v0.20.0) read whether an account has GitHub
+/// (`SignInWays.gitHub`), which is gone; 24 doesn't.
+const minimumAppBuild = 24;

apps/learn/halkyon_learn_server/lib/src/instance/instance_endpoint.dart

@@ -9,17 +9,13 @@ import 'package:serverpod/serverpod.dart';
 /// shares. A nullable one may go, as an older app reads it as none (the
 /// connector's address, ADR 0022).
 class InstanceEndpoint extends Endpoint {
-  /// This instance's offer: GitHub sign-in only with the operator's OAuth
-  /// app, email sign-in only where it can mail codes, where its source is,
-  /// the oldest app build it works with, the domain its people's handles
-  /// are on, the Jellyfin server it suggests, and
-  /// where it keeps people's data and its backups.
+  /// This instance's offer: email sign-in only where it can mail codes,
+  /// where its source is, the oldest app build it works with, the domain its
+  /// people's handles are on, the Jellyfin server it suggests, and where it
+  /// keeps people's data and its backups.
   Future<InstanceInfo> info(Session session) async {
     final pod = session.serverpod;
     return InstanceInfo(
-      gitHubClientId: gitHubSignInAvailable(pod)
-          ? pod.getPassword('githubClientId')
-          : null,
       sourceCodeUrl: sourceCodeUrl(pod),
       minimumAppBuild: HalkyonBase.of(pod).minimumAppBuild,
       accountDomain: accountDomain(pod),

apps/learn/halkyon_learn_server/lib/src/instance/instance_info.spy.yaml

@@ -2,9 +2,6 @@
 ### someone else, with its own configuration.
 class: InstanceInfo
 fields:
-  ### The client ID of this instance's GitHub OAuth app, or null when GitHub
-  ### sign-in is off here.
-  gitHubClientId: String?
   ### Where the source of what this instance runs is; the licences require
   ### offering it to the people who use it.
   sourceCodeUrl: String