Prepare LearnStack for open source release (AGPL-3.0, CLA)

.editorconfig

@@ -0,0 +1,17 @@
+root = true
+
+[*]
+charset = utf-8
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 4
+
+[*.{cs,razor,cshtml}]
+indent_size = 4
+
+[*.{json,yml,yaml,xml,csproj,props,targets,resx,config}]
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false

.gitattributes

@@ -0,0 +1 @@
+* text=auto

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @kasuken

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,58 @@
+name: 🐛 Bug report
+description: Something isn't working as expected
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to report a bug!
+        **Security vulnerabilities must not be reported here.** Use the repository's Security tab → "Report a vulnerability" instead.
+  - type: dropdown
+    id: deployment
+    attributes:
+      label: Where are you running it?
+      options:
+        - Hosted service
+        - Self-hosted
+        - Local development
+    validations:
+      required: true
+  - type: textarea
+    id: description
+    attributes:
+      label: What happened?
+      description: A clear description of the bug.
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Go to '...'
+        2. Click on '...'
+        3. See error
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version or commit
+      description: Release version, commit SHA, or the version shown in the app.
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Browser, OS, .NET version, database, Docker, etc.
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs or screenshots
+      description: Remove any personal data, tokens or connection strings before pasting.
+      render: shell

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: 🔒 Report a security vulnerability
+    url: https://github.com/kasuken/LearnStack/security/advisories/new
+    about: Please report security issues privately, never in public issues.
+  - name: 💬 Hosted service support (learnstack.cloud)
+    url: https://learnstack.cloud
+    about: Account, billing or subscription questions about the hosted service.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,26 @@
+name: 💡 Feature request
+description: Suggest an idea or improvement
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem are you trying to solve?
+      description: Describe the problem or need before the solution.
+    validations:
+      required: true
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed solution
+      description: How would you like it to work?
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+  - type: checkboxes
+    id: contribute
+    attributes:
+      label: Contribution
+      options:
+        - label: I'd like to work on this myself.

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: nuget
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      nuget:
+        patterns: ["*"]
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/azure-app-service.yml

@@ -22,16 +22,15 @@ env:
   DOTNET_VERSION: '10.0.x'
 
 permissions:
-  contents: write
-  packages: write
+  contents: write  # create tags and GitHub releases
 
 jobs:
   build-and-deploy:
     runs-on: ubuntu-latest
 
     steps:
       - name: 🚀 Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0  # Fetch all history for version calculation
 
@@ -71,7 +70,7 @@ jobs:
           echo "version_number=${MAJOR}.${MINOR}.${PATCH}" >> $GITHUB_OUTPUT
 
       - name: 🔧 Setup .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
         with:
           dotnet-version: ${{ env.DOTNET_VERSION }}
 
@@ -96,7 +95,7 @@ jobs:
 
       - name: 🌐 Deploy to Azure Web App
         id: deploy
-        uses: azure/webapps-deploy@v3
+        uses: azure/webapps-deploy@02a81bead70021f5284939794bcec79c271ab383 # v3.0.8
         with:
           app-name: ${{ env.AZURE_WEBAPP_NAME }}
           publish-profile: ${{ secrets.AZURE_WEBAPP_PUBLISH_PROFILE }}
@@ -129,7 +128,7 @@ jobs:
           echo "Release notes generated"
 
       - name: 🎉 Create GitHub Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         with:
           tag_name: ${{ steps.version.outputs.version }}
           name: Release ${{ steps.version.outputs.version }}

.github/workflows/ci.yml

@@ -0,0 +1,38 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-and-test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
+        with:
+          dotnet-version: '10.0.x'
+
+      - name: Restore .NET tools
+        run: dotnet tool restore
+
+      - name: Build
+        run: dotnet build LearnStack.sln --configuration Release
+
+      - name: Verify database migrations
+        run: dotnet ef migrations has-pending-model-changes --project ./LearnStack/LearnStack.csproj --startup-project ./LearnStack/LearnStack.csproj --configuration Release --no-build
+
+      - name: Test
+        run: dotnet test ./LearnStack.Core.Tests/LearnStack.Core.Tests.csproj --configuration Release --no-build --verbosity normal

.github/workflows/cla.yml

@@ -0,0 +1,28 @@
+name: CLA Assistant
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened, closed, synchronize]
+
+permissions:
+  actions: write
+  contents: write
+  pull-requests: write
+  statuses: write
+
+jobs:
+  cla:
+    runs-on: ubuntu-latest
+    if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
+    steps:
+      - name: CLA Assistant
+        uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          path-to-document: https://github.com/kasuken/.github/blob/main/CLA.md
+          path-to-signatures: signatures/cla.json
+          branch: cla-signatures
+          allowlist: kasuken,dependabot[bot],github-actions[bot],copilot-swe-agent[bot],Copilot

.gitignore

@@ -88,4 +88,8 @@ publish/
 # Application Insights
 ApplicationInsights.config
 
-.playwright-mcp/
+.playwright-mcp/
+# Local tool state
+*.DotSettings.user
+/.claude/worktrees/
+build_err.txt

CHANGELOG.md

@@ -4,9 +4,25 @@ All notable changes to LearnStack will be documented in this file.
 
 ---
 
+## [Unreleased]
+
+### Added
+- Released as open source under the GNU AGPL v3.0 (`AGPL-3.0-only`), with a Contributor License Agreement for contributions
+- "Source code" link in the account menu, configurable with `SourceCodeUrl` (AGPL section 13)
+- Issue forms, CODEOWNERS, Dependabot configuration, `.editorconfig`, `.gitattributes` and third-party notices
+
+### Changed
+- Deployment, release, pipeline and quick-reference guides moved from `.github/` to `docs/`
+
+### Removed
+- Accidentally tracked local files (Claude worktrees, Rider user settings, build error log)
+
+---
+
 ## [1.4.1] - 2026-09-29
 
 ### Fixed
+- `LearnStack.sln` no longer references the private `LearnStack.Admin` project, so `dotnet build LearnStack.sln` works on a fresh clone
 - Billing on a Stripe account shared with another product (such as Brainy)
   - Stripe delivers every event to every endpoint, signed with that endpoint's own secret, so a valid signature alone never proved an event was LearnStack's; events belonging to another product are now acknowledged and ignored
   - Checkout completions identify the user only from LearnStack's own `learnstack_user_id` metadata, never from `client_reference_id` alone, which previously failed the `UserPlan` foreign key for another product's checkout and made Stripe retry the delivery