refactor: remove the public attribute from workflows

app/cli/cmd/referrer_discover.go

@@ -26,7 +26,6 @@ import (
 
 func newReferrerDiscoverCmd() *cobra.Command {
 	var digest, kind string
-	var fromPublicIndex bool
 	paginationOpts := &options.PaginationOpts{DefaultLimit: 20}
 
 	cmd := &cobra.Command{
@@ -38,15 +37,7 @@ func newReferrerDiscoverCmd() *cobra.Command {
 				NextCursor: paginationOpts.NextCursor,
 			}
 
-			var res *action.ReferrerDiscoverResult
-			var err error
-
-			if fromPublicIndex {
-				res, err = action.NewReferrerDiscoverPublicIndex(ActionOpts).Run(context.Background(), digest, kind, pagination)
-			} else {
-				res, err = action.NewReferrerDiscoverPrivate(ActionOpts).Run(context.Background(), digest, kind, pagination)
-			}
-
+			res, err := action.NewReferrerDiscoverPrivate(ActionOpts).Run(context.Background(), digest, kind, pagination)
 			if err != nil {
 				return err
 			}
@@ -61,7 +52,6 @@ func newReferrerDiscoverCmd() *cobra.Command {
 	cobra.CheckErr(err)
 	cmd.Flags().StringVarP(&kind, "kind", "k", "", "optional kind of the referrer, used to disambiguate between multiple referrers with the same digest")
 	cobra.CheckErr(err)
-	cmd.Flags().BoolVar(&fromPublicIndex, "public", false, "discover from public shared index instead of your organizations'")
 	paginationOpts.AddFlags(cmd)
 
 	return cmd

app/cli/cmd/workflow_create.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024-2025 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -27,7 +27,7 @@ import (
 
 func newWorkflowCreateCmd() *cobra.Command {
 	var workflowName, description, project, team, contractRef string
-	var public, skipIfExists bool
+	var skipIfExists bool
 
 	cmd := &cobra.Command{
 		Use:   "create",
@@ -47,7 +47,6 @@ func newWorkflowCreateCmd() *cobra.Command {
 		RunE: func(cmd *cobra.Command, args []string) error {
 			opts := &action.NewWorkflowCreateOpts{
 				Name: workflowName, Team: team, Project: project, Description: description,
-				Public: public,
 			}
 
 			// Try to load it if it's a file or URL otherwise assume it's an existing contract name
@@ -96,7 +95,6 @@ func newWorkflowCreateCmd() *cobra.Command {
 
 	cmd.Flags().StringVar(&team, "team", "", "team name")
 	cmd.Flags().StringVar(&contractRef, "contract", "", "the name of an existing contract or the path/URL to a contract file. If not provided an empty one will be created.")
-	cmd.Flags().BoolVar(&public, "public", false, "is the workflow public")
 	cmd.Flags().BoolVarP(&skipIfExists, "skip-if-exists", "f", false, "do not fail if the workflow with the provided name already exists")
 	cmd.Flags().SortFlags = false
 

app/cli/cmd/workflow_list.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -97,8 +97,8 @@ func WorkflowListTableOutput(workflowListResult *action.WorkflowListResult) erro
 		return nil
 	}
 
-	headerRow := table.Row{"Name", "Project", "Contract", "Public", "Runner", "Last Run status", "Created At"}
-	headerRowFull := table.Row{"Name", "Description", "Project", "Team", "Contract", "Public", "Runner", "Last Run status", "Created At"}
+	headerRow := table.Row{"Name", "Project", "Contract", "Runner", "Last Run status", "Created At"}
+	headerRowFull := table.Row{"Name", "Description", "Project", "Team", "Contract", "Runner", "Last Run status", "Created At"}
 
 	t := output.NewTableWriter()
 	if full {
@@ -117,14 +117,14 @@ func WorkflowListTableOutput(workflowListResult *action.WorkflowListResult) erro
 
 		if !full {
 			row = table.Row{
-				p.Name, p.Project, p.ContractName, p.Public,
+				p.Name, p.Project, p.ContractName,
 				lastRunRunner, lastRunState,
 				p.CreatedAt.Format(time.RFC822),
 			}
 		} else {
 			row = table.Row{
 				p.Name, p.Description, p.Project, p.Team,
-				p.ContractName, p.Public,
+				p.ContractName,
 				lastRunRunner, lastRunState,
 				p.CreatedAt.Format(time.RFC822),
 			}

app/cli/cmd/workflow_update.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -25,7 +25,6 @@ import (
 
 func newWorkflowUpdateCmd() *cobra.Command {
 	var name, description, project, team, contractName string
-	var public bool
 
 	cmd := &cobra.Command{
 		Use:   "update",
@@ -35,9 +34,6 @@ func newWorkflowUpdateCmd() *cobra.Command {
 			if cmd.Flags().Changed("team") {
 				opts.Team = &team
 			}
-			if cmd.Flags().Changed("public") {
-				opts.Public = &public
-			}
 
 			if cmd.Flags().Changed("description") {
 				opts.Description = &description
@@ -64,7 +60,6 @@ func newWorkflowUpdateCmd() *cobra.Command {
 
 	cmd.Flags().StringVar(&description, "description", "", "workflow description")
 	cmd.Flags().StringVar(&team, "team", "", "team name")
-	cmd.Flags().BoolVar(&public, "public", false, "is the workflow public")
 	cmd.Flags().StringVar(&contractName, "contract", "", "the name of an existing contract")
 
 	return cmd

app/cli/documentation/cli-reference.mdx

@@ -1578,7 +1578,6 @@ Options
 -k, --kind string     optional kind of the referrer, used to disambiguate between multiple referrers with the same digest
 --limit int       number of items to show (default 20)
 --next string     cursor to load the next page
---public          discover from public shared index instead of your organizations'
 ```
 
 Options inherited from parent commands
@@ -3719,7 +3718,6 @@ Options
 --project string       project name
 --team string          team name
 --contract string      the name of an existing contract or the path/URL to a contract file. If not provided an empty one will be created.
---public               is the workflow public
 -f, --skip-if-exists       do not fail if the workflow with the provided name already exists
 -h, --help                 help for create
 ```
@@ -3910,7 +3908,6 @@ Options
 -h, --help                 help for update
 --name string          workflow name
 --project string       project name
---public               is the workflow public
 --team string          team name
 ```
 

app/cli/pkg/action/referrer_discover.go

@@ -25,15 +25,11 @@ import (
 type ReferrerDiscover struct {
 	cfg *ActionsOpts
 }
-type ReferrerDiscoverPublic struct {
-	cfg *ActionsOpts
-}
 
 type ReferrerItem struct {
 	Digest       string            `json:"digest"`
 	Kind         string            `json:"kind"`
 	Downloadable bool              `json:"downloadable"`
-	Public       bool              `json:"public"`
 	CreatedAt    *time.Time        `json:"createdAt"`
 	References   []*ReferrerItem   `json:"references"`
 	Metadata     map[string]string `json:"metadata,omitempty"`
@@ -63,27 +59,6 @@ func (action *ReferrerDiscover) Run(ctx context.Context, digest, kind string, p
 	return newReferrerDiscoverResult(resp.Result, resp.GetPagination()), nil
 }
 
-func NewReferrerDiscoverPublicIndex(cfg *ActionsOpts) *ReferrerDiscoverPublic {
-	return &ReferrerDiscoverPublic{cfg}
-}
-
-// Run calls the deprecated public shared index RPC, kept for backwards compatibility.
-//
-//nolint:staticcheck // the RPC is deprecated but still supported
-func (action *ReferrerDiscoverPublic) Run(ctx context.Context, digest, kind string, p *PaginationOpts) (*ReferrerDiscoverResult, error) {
-	client := pb.NewReferrerServiceClient(action.cfg.CPConnection)
-	resp, err := client.DiscoverPublicShared(ctx, &pb.DiscoverPublicSharedRequest{
-		Digest:     digest,
-		Kind:       kind,
-		Pagination: paginationOptsToPb(p),
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	return newReferrerDiscoverResult(resp.Result, resp.GetPagination()), nil
-}
-
 func paginationOptsToPb(p *PaginationOpts) *pb.CursorPaginationRequest {
 	if p == nil {
 		return nil
@@ -109,7 +84,6 @@ func pbReferrerItemToAction(in *pb.ReferrerItem) *ReferrerItem {
 	out := &ReferrerItem{
 		Digest:       in.GetDigest(),
 		Downloadable: in.GetDownloadable(),
-		Public:       in.GetPublic(),
 		Kind:         in.GetKind(),
 		CreatedAt:    toTimePtr(in.GetCreatedAt().AsTime()),
 		References:   make([]*ReferrerItem, 0, len(in.GetReferences())),

app/cli/pkg/action/workflow_create.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -31,7 +31,6 @@ func NewWorkflowCreate(cfg *ActionsOpts) *WorkflowCreate {
 
 type NewWorkflowCreateOpts struct {
 	Name, Description, Project, Team, ContractName string
-	Public                                         bool
 	ContractBytes                                  []byte
 }
 
@@ -40,7 +39,6 @@ func (action *WorkflowCreate) Run(opts *NewWorkflowCreateOpts) (*WorkflowItem, e
 	resp, err := client.Create(context.Background(), &pb.WorkflowServiceCreateRequest{
 		Name: opts.Name, ProjectName: opts.Project, Team: opts.Team, ContractName: opts.ContractName,
 		Description:   opts.Description,
-		Public:        opts.Public,
 		ContractBytes: opts.ContractBytes,
 	})
 	if err != nil {

app/cli/pkg/action/workflow_list.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -38,10 +38,6 @@ type WorkflowItem struct {
 	ContractName           string           `json:"contractName,omitempty"`
 	ContractRevisionLatest int32            `json:"contractRevisionLatest,omitempty"`
 	LastRun                *WorkflowRunItem `json:"lastRun,omitempty"`
-	// A public workflow means that any user can
-	// - access to all its workflow runs
-	// - their attestation and materials
-	Public bool `json:"public"`
 }
 
 // WorkflowListResult holds the output of the workflow list action
@@ -109,7 +105,6 @@ func pbWorkflowItemToAction(wf *pb.WorkflowItem) *WorkflowItem {
 		ContractName:           wf.ContractName,
 		ContractRevisionLatest: wf.ContractRevisionLatest,
 		LastRun:                pbWorkflowRunItemToAction(wf.LastRun),
-		Public:                 wf.Public,
 		Description:            wf.Description,
 	}
 }

app/cli/pkg/action/workflow_update.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2023 The Chainloop Authors.
+// Copyright 2023-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -31,7 +31,6 @@ func NewWorkflowUpdate(cfg *ActionsOpts) *WorkflowUpdate {
 
 type WorkflowUpdateOpts struct {
 	Description, Team, ContractName *string
-	Public                          *bool
 }
 
 func (action *WorkflowUpdate) Run(ctx context.Context, name, project string, opts *WorkflowUpdateOpts) (*WorkflowItem, error) {
@@ -41,7 +40,6 @@ func (action *WorkflowUpdate) Run(ctx context.Context, name, project string, opt
 		ProjectName:  project,
 		Description:  opts.Description,
 		Team:         opts.Team,
-		Public:       opts.Public,
 		ContractName: opts.ContractName,
 	})