universelabSCI · CLI · BIO
ES

EXP-004 · active

ghScaff

A building is only as straight as its scaffold.

ghScaff raises the whole structure in one interactive wizard — and because every operation is idempotent, it can re-level any existing repository without tearing it down.

Star on GitHub ↗Documentation →
Install
curl -fsSL https://install.univerlab.org/ghscaff | sh
Genesis · TERRA 2026 · Sol 93

The same setup, again and again.

New Rust project. Same labels, same branch protection, same CI, same secrets. Again. And again. Replicable work you do by hand isn’t craft — it’s toil. ghScaff runs the whole ritual in one wizard, idempotently, so your conventions hold the line instead of drifting.

7 lifts
  1. 01Repository basics
  2. 02Visibility & ownership
  3. 03Team access
  4. 04Language template
  5. 05Branches
  6. 06Features & license
  7. 07Sponsor button
  8. 08Review & confirm
Structural details
  • Tokens live in an encrypted vault (XSalsa20-Poly1305), bound to your user, host and binary — never in env vars or plain text.
  • One atomic chore: init repository commit carries all boilerplate — no noisy file-by-file history.
  • Seven standard labels enforced on every run; drift is corrected, not accumulated.
  • --dry-run previews every change without a single API call.
  • Branch protection reads the workflow files ghscaff just committed and derives the required status checks from them — a mistyped check name silently guards nothing, and this removes that class of misconfiguration. Run ghscaff doctor to verify the setup.
Subproject

ghscaff-boilerplate ↗

The language boilerplates ghscaff lays down — manifests, entry points, CI/release workflows. Rust today; Python and more on the way.

FAQ

FAQ

How does ghScaff set up a GitHub repository?
Run `ghscaff` — an interactive wizard that creates the repo, commits boilerplate (CI, README, license), sets branch protection, and enforces standard labels. One atomic commit, no manual steps.
Why does ghScaff use an encrypted vault for tokens?
Environment variables with tokens are easily exploitable — any process on your machine can read them. ghScaff encrypts tokens with XSalsa20-Poly1305, bound to your OS user and hostname. The vault prevents ghScaff from becoming an attack vector.
How does ghScaff know which checks are required for branch protection?
ghScaff reads the workflow files it just committed and derives the required status checks from the job names. A mistyped check name creates a protection rule that guards nothing — ghScaff removes that class of silent misconfiguration.