Files

sneak c3a504f647 Keep secrets out of the Docker build context at every depth (closes #29 )

The canonical .dockerignore was three lines while the canonical
Dockerfile does `COPY . .`, so a local .env, *.pem or *.key shipped into
the build context and could land in an image layer, invisible to every
git-based check. Copying .gitignore's patterns across is not the repair:
.dockerignore anchors an unprefixed pattern at the context root, so that
form protects only the repository root while reading as solved. Every
depth-independent pattern here carries `**/`, and secret names are
character ranges because matching is case-sensitive and an ALL-CAPS twin
still misses `Server.Key`. Public certificates are deliberately left in
as a legitimate build input. Verified by enumerating a probe image.

Model: opus-5

2026-09-09 11:44:58 +00:00

5.8 KiB

Raw Blame History

title, last_modified

title	last_modified
New Repo Checklist	2026-09-08

Use this checklist when creating a new repository from scratch. Follow the steps in order. Full policies are at https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/REPO_POLICIES.md.

Template files can be fetched from: https://git.eeqj.de/sneak/prompts/raw/branch/main/<path>

1. Initialize

git init
Ask the user for the license (MIT, GPL, or WTFPL)

2. First Commit (README only)

Create README.md with all required sections:
- Description: name, purpose, category, license, author
- Getting Started: copy-pasteable code block
- Rationale: why does this exist?
- Design: how is it structured?
- TODO: initial task list
- License: matches chosen license
- Author: @sneak
git add README.md && git commit

3. Scaffolding (feature branch)

git checkout -b initial-scaffolding

Fetch Template Files

.gitignore — fetch from https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore, extend for language-specific artifacts
.editorconfig — fetch from https://git.eeqj.de/sneak/prompts/raw/branch/main/.editorconfig
Makefile — fetch from https://git.eeqj.de/sneak/prompts/raw/branch/main/Makefile, adapt targets for the project's language and tools
For JS/docs repos: .prettierrc and .prettierignore — fetch from https://git.eeqj.de/sneak/prompts/raw/branch/main/.prettierrc and https://git.eeqj.de/sneak/prompts/raw/branch/main/.prettierignore

Create Project Files

LICENSE file matching the chosen license
REPO_POLICIES.md — fetch from https://git.eeqj.de/sneak/prompts/raw/branch/main/prompts/REPO_POLICIES.md
Dockerfile and .dockerignore — fetch .dockerignore from https://git.eeqj.de/sneak/prompts/raw/branch/main/.dockerignore
- Extend .dockerignore with the repo's own host-built artifacts, giving every depth-independent pattern a **/ prefix — but write a repo-root binary anchored, /myapp and never **/myapp, which would also match cmd/myapp/ and delete the package directory. Do not transplant .gitignore's patterns: .dockerignore anchors an unprefixed pattern at the context root, so the copied form leaves config/.env in the build context while reading as solved.
- All Dockerfiles must run make check as a build step
- Server: also builds and runs the application
- Non-server: brings up dev environment and runs make check
- Image pinned by sha256 hash with version/date comment
Gitea Actions workflow at .gitea/workflows/check.yml that runs script/cibuild on push — reference https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitea/workflows/check.yml
Language-specific:
- Go: go mod init sneak.berlin/go/<name>, .golangci.yml (fetch from https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml)
- JS: yarn init, yarn add --dev prettier
- Python: pyproject.toml

Configure script/ Entrypoints and Makefile

Implementations live in script/ (scripts-to-rule-them-all); Makefile targets are thin shims calling them. Model scripts: https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>

scripts are POSIX sh (#!/bin/sh, set -eu, no bashisms) so they run on alpine images without bash
script/bootstrap / make bootstrap — installs all dependencies, idempotently, assuming nothing (pkg manager detection nix/apt/brew/apk; node used if present, else pinned version via nvm from a hash-verified archive; pinned yarn via corepack); Dockerfile runs it instead of inline installs
script/setup / make setup — readies a fresh clone: runs bootstrap, then install-precommit, plus repo-specific init
script/test / make test — runs real tests, not a no-op (90-second timeout, 60-second hard cap on wall time)
script/lint / make lint — runs linter
script/fmt / make fmt — formats code (writes)
script/fmt-check / make fmt-check — checks formatting (read-only)
script/check / make check — runs test, lint, fmt-check; must not modify files
script/projectname — outputs the project name (used by script/docker for the image tag)
script/docker / make docker — builds Docker image, tagged via script/projectname (byte-identical across repos); passes --no-cache like script/cibuild
script/cibuild — cd to repo root, docker build --no-cache . (what CI runs; without --no-cache an unchanged tree serves the check layers from cache and the build reports a green it never ran)
script/precommit — called by the pre-commit hook; runs script/check
script/install-precommit — installs the pre-commit hook that runs script/precommit
make hooks — shims to script/install-precommit
README Entrypoints section documents the scripts and links the standard

4. Verify

make check passes
make docker succeeds
script/cibuild succeeds and demonstrably executed the checks — a sub-second build, or CACHED on a check layer, means nothing ran
No secrets in repo, and none in the build context: enumerate a probe image rather than reading .dockerignore
No mutable image/package references
No unnecessary files in repo root
All dates written as YYYY-MM-DD

5. Merge and Set Up

Commit, merge to main
make hooks to install pre-commit hook
Add remote and push
Verify main passes make check

5.8 KiB Raw Blame History