Project template: honest CI, gitleaks config, protection bootstrap

README.md

@@ -0,0 +1,56 @@
+# project-template
+
+Clone-and-go skeleton for new projects. Every repo started from this template
+gets, on day one: honest CI (lint + tests are **hard gates**, never `|| true`),
+secret scanning, branch protection, LICENSE, and a gitignore that keeps real
+data out of git.
+
+Born out of the 2026-07 portfolio hygiene sweep — see
+`~/.cursor/rules/new-project-standards.mdc` for the standards this enforces.
+
+## Start a new project
+
+```bash
+# 1. Copy the skeleton (don't clone-fork; you want fresh history)
+cp -R ~/Documents/code/project-template ~/Documents/code/<name>
+cd ~/Documents/code/<name>
+rm -rf .git && git init -b main
+
+# 2. Pick your CI lane and drop the other
+cp ci-templates/ci-python.yml .gitea/workflows/ci.yml   # or ci-node.yml
+rm -rf ci-templates
+
+# 3. Fill in README/LICENSE year, write code, commit
+
+# 4. Create the Gitea repo with protection + settings in one shot
+./bootstrap.sh <name> python   # or: node
+```
+
+`bootstrap.sh` creates the (private by default) repo on `git.levkin.ca`,
+enables delete-branch-after-merge, pushes `main`, and adds branch protection
+requiring the CI contexts. Make a repo public only after it passes the
+public-repo checklist below.
+
+## Rules baked in
+
+- **No `|| true` on lint or test steps.** If a gate is red, fix it or narrow
+  the config with a comment — never mute the gate.
+- **Real data never in fixtures.** Commit `*.example.json` / `*.example.yml`
+  with fake values; real files are gitignored (see `.gitignore`).
+- **No secrets in git, ever.** Secrets live in Infisical
+  (`secrets.levkin.ca`, LevkinOps → `/apps/<repo>`) or local gitignored
+  `.env`. The global pre-commit hook (gitleaks + filename denylist) is the
+  last line of defense, not the first.
+- **No absolute home paths in code.** Use env vars or `Path.home()` /
+  `process.env.HOME`.
+- **No LAN IPs / homelab topology in public docs.** Use placeholders; deploy
+  runbooks live in the private ansible repo.
+
+## Public-repo checklist (before flipping `private: false`)
+
+- [ ] LICENSE present, README explains what/why/how for an outsider
+- [ ] `rg "10\.0\.10\."` returns nothing
+- [ ] `rg "/Users/"` returns nothing
+- [ ] No real names/addresses/phones except your intentional public persona
+- [ ] gitleaks full-history scan clean: `gitleaks detect --source .`
+- [ ] CI green with hard gates