From 846790e5f3dcc8b22fa9c1fba6a53156d8940cee Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Thu, 16 Jul 2026 23:43:18 +0200 Subject: [PATCH] chore(template-sync): stop syncing scaffolding machinery into tenants Ships the scaffolding entries in the default .templatesyncignore so live tenants stop inheriting rename-placeholders + validate-scaffold as dead code, and documents the scaffold-time-only ownership class in the README. Fixes #68 Co-Authored-By: Claude Fable 5 --- .templatesyncignore | 16 +++++++++++++--- README.md | 16 ++++++++++++++-- 2 files changed, 27 insertions(+), 5 deletions(-) diff --git a/.templatesyncignore b/.templatesyncignore index f088faf..1a2e631 100644 --- a/.templatesyncignore +++ b/.templatesyncignore @@ -1,7 +1,7 @@ # .templatesyncignore — files an INSTANCE (tenant) created from this template OWNS. # # Same syntax as .gitignore. The weekly template-sync workflow -# (devantler-tech/reusable-workflows .github/workflows/template-sync.yaml, using +# (devantler-tech/actions .github/workflows/template-sync.yaml, using # AndreasAugustin/actions-template-sync) is skipped in this template repo itself # and runs in every tenant created from it — opening a PR that brings template # changes downstream. It only ever touches files that exist in this template, and @@ -11,8 +11,8 @@ # Everything NOT listed here is TEMPLATE-OWNED shared plumbing kept current in # every tenant by template-sync — change those upstream in # devantler-tech/gitops-tenant-template, never by editing them in a tenant. -# Template-owned files: .github/workflows/{cd,release,template-sync,validate-scaffold,sync-labels}.yaml, -# CLAUDE.md, zizmor.yml, scripts/rename-placeholders.sh. +# Template-owned files: .github/workflows/{cd,release,template-sync,sync-labels}.yaml, +# CLAUDE.md, zizmor.yml. # --- Identity & docs (tenant-specific) --- AGENTS.md @@ -34,5 +34,15 @@ LICENSE deploy/ Dockerfile +# --- Scaffolding machinery (template-only; dead code in a live tenant) --- +# These exist to rename placeholders when a NEW repo is created from this +# template ("use this template" copies everything, so scaffolding still arrives +# at creation time). A scaffolded tenant never runs them again — ignoring them +# stops template-sync (re-)introducing them downstream, so a tenant that still +# carries them can delete them and they stay gone. +scripts/rename-placeholders.sh +scripts/rename-placeholders.test.sh +.github/workflows/validate-scaffold.yaml + # --- This ignore-list itself (the tenant curates its own ownership) --- .templatesyncignore diff --git a/README.md b/README.md index f05f55a..751b5e8 100644 --- a/README.md +++ b/README.md @@ -46,11 +46,17 @@ app code. | `.github/workflows/cd.yaml` | On a `v*` tag, calls `publish-app.yaml` to build, digest-pin, push, and **cosign-sign** the image + manifests OCI artifact | | `.github/workflows/release.yaml` | semantic-release on `main` (cuts the `v*` tags that drive `cd.yaml`) | | `.github/workflows/template-sync.yaml` | Opens the weekly template-sync PR | -| `.github/workflows/validate-scaffold.yaml` | Renders `deploy/` (`kubectl kustomize`) **and schema-validates** every rendered resource with `kubeconform` (`-strict`, built-in schemas + a pinned CRD catalog) to gate template-repo PRs against a broken *or schema-invalid* scaffold; **no-ops in tenants** (you validate your own `deploy/` via `ci.yaml`) | | `.github/workflows/sync-labels.yaml` | Syncs the repo's issue/PR labels from the canonical label set | | `CLAUDE.md` | `@AGENTS.md` shim | | `zizmor.yml` | GitHub Actions pinning policy enforced by the security scan | -| `scripts/rename-placeholders.sh` | One-shot rename of the placeholder app to your tenant name | + +**Scaffold-time only (arrives when the repo is created — never re-synced, so a +tenant still carrying these from an older sync can delete them for good):** + +| File | Purpose | +|---|---| +| `.github/workflows/validate-scaffold.yaml` | Renders `deploy/` (`kubectl kustomize`) **and schema-validates** every rendered resource with `kubeconform` (`-strict`, built-in schemas + a pinned CRD catalog) to gate template-repo PRs against a broken *or schema-invalid* scaffold; no-ops in tenants | +| `scripts/rename-placeholders.sh` (+ its test) | One-shot rename of the placeholder app to your tenant name | **Yours (list these in `.templatesyncignore`):** @@ -68,6 +74,12 @@ README.md LICENSE deploy/ .templatesyncignore + +# Template scaffolding — dead code in a live tenant; keep ignored so a +# template-sync never re-introduces it after you delete it. +scripts/rename-placeholders.sh +scripts/rename-placeholders.test.sh +.github/workflows/validate-scaffold.yaml ``` `AGENTS.md` and the `maintain` skill ship as scaffolding (a starting point for new