project-template
Clone-and-go skeleton for new projects. Every repo started from this template
gets, on day one: honest CI (lint + tests are hard gates, never || true),
secret scanning, branch protection, LICENSE, and a gitignore that keeps real
data out of git.
Born out of the 2026-07 portfolio hygiene sweep — see
~/.cursor/rules/new-project-standards.mdc for the standards this enforces.
Start a new project
# 1. Copy the skeleton (don't clone-fork; you want fresh history)
cp -R ~/Documents/code/project-template ~/Documents/code/<name>
cd ~/Documents/code/<name>
rm -rf .git && git init -b main
# 2. Pick your CI lane and drop the other
cp ci-templates/ci-python.yml .gitea/workflows/ci.yml # or ci-node.yml
rm -rf ci-templates
# 3. Fill in README/LICENSE year, write code, commit
# 4. Create the Gitea repo with protection + settings in one shot
./bootstrap.sh <name> python # or: node
bootstrap.sh creates the (private by default) repo on git.levkin.ca,
enables delete-branch-after-merge, pushes main, and adds branch protection
requiring the CI contexts. Make a repo public only after it passes the
public-repo checklist below.
Rules baked in
- No
|| trueon lint or test steps. If a gate is red, fix it or narrow the config with a comment — never mute the gate. - Real data never in fixtures. Commit
*.example.json/*.example.ymlwith fake values; real files are gitignored (see.gitignore). - No secrets in git, ever. Secrets live in Infisical
(
secrets.levkin.ca, LevkinOps →/apps/<repo>) or local gitignored.env. The global pre-commit hook (gitleaks + filename denylist) is the last line of defense, not the first. - No absolute home paths in code. Use env vars or
Path.home()/process.env.HOME. - No LAN IPs / homelab topology in public docs. Use placeholders; deploy runbooks live in the private ansible repo.
Docs style
How to write READMEs and guides (voice, headings, no emoji fluff):
docs/writing-docs.md. Cursor agents load the same
bar via docs-writing.mdc in dotfiles.
Public-repo checklist (before flipping private: false)
- LICENSE present, README explains what/why/how for an outsider (see docs style)
rg "10\.0\.10\."returns nothingrg "/Users/"returns nothing- No real names/addresses/phones except your intentional public persona
- gitleaks full-history scan clean:
gitleaks detect --source . - CI green with hard gates