ilia
78f7874055
Bring .zshrc up to the current machine config (portable paths), ship homelab/ansible shell helpers, shared Cursor rules/skills, and an install.sh so Irina can clone and run ./install.sh --ira.
45 lines
1.9 KiB
Plaintext
45 lines
1.9 KiB
Plaintext
# New project standards (post 2026-07 hygiene sweep)
|
|
|
|
Hard requirements for any NEW repo, and the bar for existing repos when
|
|
touching them. Skeleton: Gitea `ilia/project-template` — copy it and run
|
|
`bootstrap.sh`.
|
|
|
|
## Day-one requirements for every new repo
|
|
|
|
1. **LICENSE** (MIT), README that explains what/why/how to an outsider.
|
|
2. **CI from the first push**: `.gitea/workflows/ci.yml` with lint + tests +
|
|
gitleaks. Lint/typecheck/test steps are **hard gates — `|| true` on a lint
|
|
or test step is forbidden**. If a gate is red, fix the findings or narrow
|
|
the lint config with an explanatory comment; never mute the step.
|
|
3. **Branch protection on `main`** requiring the CI contexts, plus
|
|
`default_delete_branch_after_merge: true` (bootstrap.sh does both).
|
|
4. **Linter configured**: ruff (`select = ["E4","E7","E9","F","I"]` minimum)
|
|
for Python; Biome or ESLint for JS/TS; `tsc --noEmit` alone is not a linter.
|
|
|
|
## Secrets & data
|
|
|
|
- **Secrets** live in Infisical or Ansible Vault for infra — never in git.
|
|
Local runtime config goes in gitignored `.env`.
|
|
- **Real data never goes in fixtures.** Commit `*.example.json` /
|
|
`*.example.yml` with fake values; real `data/*` is gitignored.
|
|
- **Other people's PII never goes in git**, even in private repos.
|
|
- A global pre-commit hook (`~/.git-hooks/pre-commit`) runs gitleaks.
|
|
Do not bypass with `--no-verify`.
|
|
|
|
## Code portability
|
|
|
|
- **No absolute home paths** (`/Users/...`) — use `Path.home()`, `$HOME`,
|
|
or env vars with sane defaults.
|
|
- **No LAN IPs / homelab topology in public repos.** Use placeholders;
|
|
deploy runbooks live in the private ansible repo.
|
|
|
|
## Repo lifecycle hygiene
|
|
|
|
- New repos start **private**; flip public only after the project-template
|
|
checklist passes.
|
|
- Don't leave work uncommitted for weeks: land it, park it on a pushed
|
|
branch, or delete it.
|
|
- Merged branches are deleted.
|
|
- One-off personal automation goes in `ilia/personal-scripts`, not into
|
|
whatever repo is nearby.
|