# project-template

Clone-and-go skeleton for new projects. Every repo started from this template
gets, on day one: honest CI (lint + tests are **hard gates**, never `|| true`),
secret scanning, branch protection, LICENSE, and a gitignore that keeps real
data out of git.

Born out of the 2026-07 portfolio hygiene sweep — see
`~/.cursor/rules/new-project-standards.mdc` for the standards this enforces.

## Start a new project

```bash
# 1. Copy the skeleton (don't clone-fork; you want fresh history)
cp -R ~/Documents/code/project-template ~/Documents/code/<name>
cd ~/Documents/code/<name>
rm -rf .git && git init -b main

# 2. Pick your CI lane and drop the other
cp ci-templates/ci-python.yml .gitea/workflows/ci.yml   # or ci-node.yml
rm -rf ci-templates

# 3. Fill in README/LICENSE year, write code, commit

# 4. Create the Gitea repo with protection + settings in one shot
./bootstrap.sh <name> python   # or: node
```

`bootstrap.sh` creates the (private by default) repo on `git.levkin.ca`,
enables delete-branch-after-merge, pushes `main`, and adds branch protection
requiring the CI contexts. Make a repo public only after it passes the
public-repo checklist below.

## Rules baked in

- **No `|| true` on lint or test steps.** If a gate is red, fix it or narrow
  the config with a comment — never mute the gate.
- **Real data never in fixtures.** Commit `*.example.json` / `*.example.yml`
  with fake values; real files are gitignored (see `.gitignore`).
- **No secrets in git, ever.** Secrets live in Infisical
  (`secrets.levkin.ca`, LevkinOps → `/apps/<repo>`) or local gitignored
  `.env`. The global pre-commit hook (gitleaks + filename denylist) is the
  last line of defense, not the first.
- **No absolute home paths in code.** Use env vars or `Path.home()` /
  `process.env.HOME`.
- **No LAN IPs / homelab topology in public docs.** Use placeholders; deploy
  runbooks live in the private ansible repo.

## Public-repo checklist (before flipping `private: false`)

- [ ] LICENSE present, README explains what/why/how for an outsider
- [ ] `rg "10\.0\.10\."` returns nothing
- [ ] `rg "/Users/"` returns nothing
- [ ] No real names/addresses/phones except your intentional public persona
- [ ] gitleaks full-history scan clean: `gitleaks detect --source .`
- [ ] CI green with hard gates