Skip to main content

Introduction

Scaffold is a project template for Shell, PHP, NodeJS and Docker projects. Each project you create from it starts with working example code, tests, linters and CI workflows for the stacks you pick. This page is for developers starting a project from Scaffold. Follow it to create your project and push it to GitHub.

Quick start​

The install.sh script turns the template into your project. It replaces yournamespace, yourproject, Your Name and other placeholders with your answers to its prompts. It removes the features you turn down.

The following recording shows a run of install.sh:

To create a project:

  1. Open a terminal in a new empty directory. The script exits with an error if the directory holds anything, even a .git directory.

  2. Run the following command:

    curl -fsSL https://getscaffold.dev/install.sh | bash

    The script downloads the latest Scaffold release into the directory.

  3. Answer each prompt. Confirm that the script ends with Initialization complete.

  4. Commit the files to a new git repository.

  5. Push the repository to GitHub.

To have install.sh do steps 4 and 5, answer y to its last prompt, Create a GitHub repository. That prompt needs GitHub CLI and a token; GitHub repository setup covers both.

Run without prompts​

Any command-line option turns off the prompts. You must then pass --namespace, --name and --author. The script uses the default for every other choice. For automation and AI agents, run the following command in place of the step 2 command:

curl -fsSL https://getscaffold.dev/install.sh | \
  bash -s -- --namespace=AcmeApp --name=acme-app --author="Jane Doe"

Replace the 3 values with a PascalCase namespace, a lowercase hyphenated project name and your name.

To start from a tag, branch or commit in place of the latest release, add --ref to the no-prompt command, such as --ref=1.2.3. To list every option and its default, run curl -fsSL https://getscaffold.dev/install.sh | bash -s -- --help.

Verify the install script​

The install script runs on your machine with your permissions, so you can check it before it runs. getscaffold.dev/install.sh serves the install.sh attached to the latest GitHub release, so the file you check is the file the one-line command runs. Each release attaches 3 files:

  • install.sh, the install script of that release
  • SHA256SUMS, the SHA-256 checksum of install.sh
  • SHA256SUMS.asc, a GPG signature of SHA256SUMS

GitHub Actions also records a build attestation for install.sh and SHA256SUMS. The attestation ties each file to the commit and the workflow run that built it.

To verify the install script with the GitHub CLI, then run it:

  1. Download the install script of the latest release:

    curl -fsSLO https://getscaffold.dev/install.sh

  2. Verify the attestation of the install script:

    gh attestation verify install.sh --repo AlexSkrypnyk/scaffold

    The command fails when the file changed after the build or came from another repository's workflows.

  3. Create an empty project directory and run the verified install script from it:

    mkdir my-project
    cd my-project
    bash ../install.sh

To verify the install script with GPG in place of step 2, run the following commands in the directory that holds install.sh:

BASE=https://github.com/AlexSkrypnyk/scaffold/releases/latest/download
RAW=https://raw.githubusercontent.com/AlexSkrypnyk/scaffold/main

curl -fsSLO $BASE/SHA256SUMS
curl -fsSLO $BASE/SHA256SUMS.asc
curl -fsSLO $RAW/install-key.asc

# Check the fingerprint against the one below before trusting the key.
gpg --show-keys --with-fingerprint install-key.asc

gpg --import install-key.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c SHA256SUMS    # macOS: shasum -a 256 -c SHA256SUMS

The signing key is Scaffold Release Signing, published as install-key.asc in the repository root. Its fingerprint is:

86F0 77A2 E806 67D7 CF4A  3320 EDEA F2FC D434 756C

Confirm that gpg --verify reports a good signature from this key. A good signature from any other key in your keyring proves nothing about Scaffold.

To verify a specific release, download its files from https://github.com/AlexSkrypnyk/scaffold/releases/download/1.5.0/ in place of the latest ones, with your version in place of 1.5.0.

Both checks trust the AlexSkrypnyk/scaffold repository. Anyone who controls the repository or the maintainer's account can rebuild the attestation and replace the key. Record the fingerprint on your first download and compare it on every later one.

Try unreleased changes​

The development site serves the install.sh of the main branch, and that install script downloads main. To create a project from unreleased changes, run the following command in a new empty directory:

curl -fsSL https://scaffold-docs.netlify.app/install.sh | bash

The development install script has no attestation and no signature.

Start from a downloaded release​

To run install.sh from a local copy:

  1. Download the latest release from GitHub.
  2. Extract the archive.
  3. In the extracted directory, run ./install.sh.
  4. Follow steps 3-5 of the quick start.

What's next​