Add public/private repo visibility to reports and exports

.github-usage/config.example.toml

@@ -27,6 +27,8 @@ warn_over = [
 skip_actions = false
 skip_copilot = false
 skip_lfs = false
+only_public = false
+only_private = false
 
 [schedule]
 weekday = 1

.github/workflows/email-report.yml

@@ -37,6 +37,22 @@ on:
         options:
           - 'false'
           - 'true'
+      only_public:
+        description: Include only public repos in repo-level sections
+        required: false
+        default: 'false'
+        type: choice
+        options:
+          - 'false'
+          - 'true'
+      only_private:
+        description: Include only private and internal repos in repo-level sections
+        required: false
+        default: 'false'
+        type: choice
+        options:
+          - 'false'
+          - 'true'
       report_email:
         description: Override the REPORT_EMAIL secret for this manual run
         required: false
@@ -78,6 +94,12 @@ jobs:
           if [ "${{ inputs.include_forecast || 'true' }}" = "true" ]; then
             args+=(--include-forecast)
           fi
+          if [ "${{ inputs.only_public }}" = "true" ]; then
+            args+=(--only-public)
+          fi
+          if [ "${{ inputs.only_private }}" = "true" ]; then
+            args+=(--only-private)
+          fi
           profile_args=(--max-repos 50 --email-format text --warn-over 25 --warn-over 80%)
           if [ ${#profile_args[@]} -gt 0 ]; then
             args+=("${profile_args[@]}")

.github/workflows/email-report.yml.template

@@ -37,6 +37,22 @@ on:
         options:
           - 'false'
           - 'true'
+      only_public:
+        description: Include only public repos in repo-level sections
+        required: false
+        default: 'false'
+        type: choice
+        options:
+          - 'false'
+          - 'true'
+      only_private:
+        description: Include only private and internal repos in repo-level sections
+        required: false
+        default: 'false'
+        type: choice
+        options:
+          - 'false'
+          - 'true'
       report_email:
         description: Override the REPORT_EMAIL secret for this manual run
         required: false
@@ -78,6 +94,12 @@ jobs:
           if [ "${{ inputs.include_forecast || '__INCLUDE_FORECAST_DEFAULT__' }}" = "true" ]; then
             args+=(--include-forecast)
           fi
+          if [ "${{ inputs.only_public }}" = "true" ]; then
+            args+=(--only-public)
+          fi
+          if [ "${{ inputs.only_private }}" = "true" ]; then
+            args+=(--only-private)
+          fi
           profile_args=(__PROFILE_ARGS__)
           if [ ${#profile_args[@]} -gt 0 ]; then
             args+=("${profile_args[@]}")

CHANGELOG.md

@@ -10,6 +10,7 @@ This project follows the structure from Keep a Changelog and intends to use Sema
 
 ### Added
 
+- **Public/private repo visibility in reports:** Per-repo Actions tables in the legacy Usage Report group rows by visibility (private, internal, public) with subtotals. Repo lists elsewhere annotate non-public repos with `[private]` / `[internal]` tags. CSV/XLSX exports include a `visibility` column; JSON retains the field on repo-level entries. Added `--only-public` and `--only-private` CLI flags (and `only_public` / `only_private` in `[email_report]`) to filter which repositories appear in repo-level sections. Filters apply after the `--max-repos` slice.
 - **Usage forecast for legacy and email reports** ([plan](docs/superpowers/plans/archived/2026-07-03-usage-forecast.md)): render-time end-of-month projections for Actions minutes, artifact storage (average MB), and Copilot premium requests, plus run-out day estimates when limits are known. Computed from current usage values at render/export time so cached reports never show stale projections. Configurable via `include_forecast` and `premium_requests_limit` in `[email_report]`, `--include-forecast` / `--no-include-forecast` and `--premium-requests-limit` CLI flags, and the TUI profile editor / setup wizard. Included in plain-text and HTML email bodies, legacy terminal output, TUI detail rows, and all export formats (JSON, CSV, XLSX, PDF, text).
 - **basedpyright static type checking** ([plan](docs/superpowers/plans/archived/2026-07-04-basedpyright-type-checking.md)): `basedpyright` runs on `src/` and `tests/` via `scripts/typecheck`, included in `scripts/check`, a pre-push hook, and a `typecheck` CI job. Existing codebase errors resolved or suppressed to establish a clean baseline. Configurable via `[tool.basedpyright]` in `pyproject.toml`.
 - **TUI guided setup wizard:** **Start guided setup** on the Setup tab (and an optional first-run prompt) walks through secrets, report options, local and cloud schedules, review, verify, and optional LaunchAgent install for the default profile. CI secrets and dev hooks remain CLI-only (`./start.sh setup`).

README.md

@@ -183,6 +183,7 @@ github-usage email-report \
   [--warn-over 25] \
   [--warn-over 80%] \
   [--skip-actions] [--skip-copilot] [--skip-lfs] \
+  [--only-public | --only-private] \
   [--dry-run] \
   [--export csv|xlsx|pdf|json|text|none] \
   [--output PATH] \
@@ -191,6 +192,8 @@ github-usage email-report \
 
 `--include-consumers`, `--include-artifact-storage`, and `--include-release-assets` add repo-level API calls. They consume GitHub REST API request quota, not Actions minutes, Actions storage, Copilot requests, Git LFS quota, or billable GitHub usage. Use monthly schedules and conservative `--max-repos` values for accounts with many repositories.
 
+Repo-level sections annotate non-public repositories with `[private]` or `[internal]` tags. The legacy Usage Report per-repo Actions table groups rows by visibility with subtotals. `--only-public` and `--only-private` (mutually exclusive) filter which repositories are included in repo-level sections; filtering applies after the `--max-repos` limit. Set `only_public` / `only_private` in `[email_report]` in `config.toml` for scheduled runs.
+
 Release assets are optional inventory, not a billing/quota report. The CLI asks for confirmation in interactive terminals, and CI must pass `--yes-include-release-assets`.
 
 ## Viewing Configured Runs