57 lines
2.3 KiB
Markdown
57 lines
2.3 KiB
Markdown
# project-template
|
|
|
|
Clone-and-go skeleton for new projects. Every repo started from this template
|
|
gets, on day one: honest CI (lint + tests are **hard gates**, never `|| true`),
|
|
secret scanning, branch protection, LICENSE, and a gitignore that keeps real
|
|
data out of git.
|
|
|
|
Born out of the 2026-07 portfolio hygiene sweep — see
|
|
`~/.cursor/rules/new-project-standards.mdc` for the standards this enforces.
|
|
|
|
## Start a new project
|
|
|
|
```bash
|
|
# 1. Copy the skeleton (don't clone-fork; you want fresh history)
|
|
cp -R ~/Documents/code/project-template ~/Documents/code/<name>
|
|
cd ~/Documents/code/<name>
|
|
rm -rf .git && git init -b main
|
|
|
|
# 2. Pick your CI lane and drop the other
|
|
cp ci-templates/ci-python.yml .gitea/workflows/ci.yml # or ci-node.yml
|
|
rm -rf ci-templates
|
|
|
|
# 3. Fill in README/LICENSE year, write code, commit
|
|
|
|
# 4. Create the Gitea repo with protection + settings in one shot
|
|
./bootstrap.sh <name> python # or: node
|
|
```
|
|
|
|
`bootstrap.sh` creates the (private by default) repo on `git.levkin.ca`,
|
|
enables delete-branch-after-merge, pushes `main`, and adds branch protection
|
|
requiring the CI contexts. Make a repo public only after it passes the
|
|
public-repo checklist below.
|
|
|
|
## Rules baked in
|
|
|
|
- **No `|| true` on lint or test steps.** If a gate is red, fix it or narrow
|
|
the config with a comment — never mute the gate.
|
|
- **Real data never in fixtures.** Commit `*.example.json` / `*.example.yml`
|
|
with fake values; real files are gitignored (see `.gitignore`).
|
|
- **No secrets in git, ever.** Secrets live in Infisical
|
|
(`secrets.levkin.ca`, LevkinOps → `/apps/<repo>`) or local gitignored
|
|
`.env`. The global pre-commit hook (gitleaks + filename denylist) is the
|
|
last line of defense, not the first.
|
|
- **No absolute home paths in code.** Use env vars or `Path.home()` /
|
|
`process.env.HOME`.
|
|
- **No LAN IPs / homelab topology in public docs.** Use placeholders; deploy
|
|
runbooks live in the private ansible repo.
|
|
|
|
## Public-repo checklist (before flipping `private: false`)
|
|
|
|
- [ ] LICENSE present, README explains what/why/how for an outsider
|
|
- [ ] `rg "10\.0\.10\."` returns nothing
|
|
- [ ] `rg "/Users/"` returns nothing
|
|
- [ ] No real names/addresses/phones except your intentional public persona
|
|
- [ ] gitleaks full-history scan clean: `gitleaks detect --source .`
|
|
- [ ] CI green with hard gates
|