Milestone: publish the public ci-fleet configuration repository template

[Nickfost]

Outcome

Build a safe, documented configuration-repository template that anyone can generate into a private repository, then use the same template for Random Development's private delivery configuration.

flowchart LR
  F[public ci-fleet] --> T[public config template]
  T -->|generate| R[private RD config]
  T -->|generate| U[another user's private config]
  R --> F
  U --> F

Loading

Implementation: draft PR #13
Initial validation: Validate ci-fleet prototype #12
Standalone repository: RandomDevelopment/ci-fleet-config-template
Standalone validation: Validate configuration #1
Private desired-state configuration: evidence retained privately
Private desired-state initialization: evidence retained privately
Generated-config regression fix: ci-fleet PR #17

Public template deliverables

• Versioned JSON Schema for fleet configuration
• Fictional, non-secret reference configuration
• Argument-driven initializer
• Deterministic local validation command
• GitHub-hosted validation workflow with read-only permissions
• Secret-deny patterns and safe .gitignore
• Project, environment, runner-pool, and host-group examples
• Deployment and rollback policy examples
• Unlicense and third-party notices
• Clear instructions to generate a private repository

Dogfood gate

• Public template validation passes
• PR Add public delivery configuration template #13 is merged
• Empty public RandomDevelopment/ci-fleet-config-template repository is created
• Repository is marked as a GitHub template
• Validated schema-v2 scaffold is published there and passes GitHub-hosted validation
• Private desired-state repository is generated from the template
• RD-specific configuration validates without adding secrets

Hard rules

• The template and generated repositories must never contain secret values.
• A private repository is not treated as a secret manager.
• Public examples use fictional organizations, domains, projects, and hosts.
• Real host addresses, installation IDs, App credentials, private keys, and runtime .env files are excluded.
• Reusable workflows are pinned to immutable commits.
• The public template never receives access to self-hosted runners.