---
title: "Create GitHub repos with conventions enforced — ghScaff"
source: "https://univerlab.org/ghscaff/"
---

[UniverLab · open laboratory](/)EXP-004

# ghScaff

A building is only as straight as its scaffold.

ghScaff raises the whole structure in one interactive **wizard** — and because every operation is **idempotent**, it can re-level any existing repository without tearing it down.

GitHub repositories → an idempotent wizard → conventions enforced

7 lifts

1.  01Repository basics
2.  02Visibility & ownership
3.  03Team access
4.  04Language template
5.  05Branches
6.  06Features & license
7.  07Review & confirm

[Star on GitHub ↗](https://github.com/UniverLab/ghscaff)[Documentation →](/ghscaff/docs/)

Install

macOS / LinuxWindows

`curl -fsSL https://install.univerlab.org/ghscaff | sh``irm https://install.univerlab.org/ghscaff.ps1 | iex`⧉✓

![](/bench/machines/ghscaff-night-450.webp)

EXP-004 · active · Sol 93 (2026-04-03) · [release v0.7.1 · 3 weeks ago](https://github.com/UniverLab/ghscaff/releases/tag/v0.7.1) · roadmap: · · Built with [Canopy](/canopy/) · Repository set up with [ghScaff](/ghscaff/) · Demo recorded with [DemoStage](/demostage/) · Commits checked by [GitKit](/gitkit/)

Latest release: v0.7.1 (2026-10-06)

Genesis · 2026 · Sol 93 (2026-04-03)

## The same setup, again and again.

New Rust project. Same labels, same branch protection, same CI, same secrets. Again. And again. Replicable work you do by hand isn’t craft — it’s toil. ghScaff runs the whole ritual in one wizard, idempotently, so your conventions hold the line instead of drifting.

Fig. 1ghScaff — recorded with DemoStage

Structural details

*   Tokens live in an **encrypted** vault (XSalsa20-Poly1305), bound to your user, host and binary — never in env vars or plain text.
*   One atomic `chore: init repository` commit carries all boilerplate — no noisy file-by-file history.
*   Seven standard labels enforced on every run; drift is corrected, not accumulated.
*   `--dry-run` previews every change without a single API call.
*   Branch protection reads the workflow files ghscaff just committed and derives the required status checks from them — a mistyped check name silently guards nothing, and this removes that class of misconfiguration. Run `ghscaff doctor` to verify the setup.

Boilerplates

### 3 boilerplates the wizard can lay down

| name | language | description | version |
| --- | --- | --- | --- |
| python-fastapi | Python | FastAPI daemon with uvicorn, SQLAlchemy, Pydantic, and SSE support | 1.0.0 |
| python-module | Python | Python scientific module with CLI, tests, and optional publish to PyPI | 1.0.0 |
| rust | Rust | Rust CLI template with cargo, CI/CD, and standard structure | 1.0.0 |

Pick one at the wizard's language step: `ghscaff new`

[ghscaff-boilerplate ↗](https://github.com/UniverLab/ghscaff-boilerplate)

FAQ

## FAQ

How does ghScaff set up a GitHub repository?

Run ghscaff — an interactive wizard that creates the repo, commits boilerplate (CI, README, license), sets branch protection, and enforces standard labels. One atomic commit, no manual steps.

Why does ghScaff use an encrypted vault for tokens?

Environment variables with tokens are easily exploitable — any process on your machine can read them. ghScaff encrypts tokens with XSalsa20-Poly1305, bound to your OS user and hostname. The vault prevents ghScaff from becoming an attack vector.

How does ghScaff know which checks are required for branch protection?

ghScaff reads the workflow files it just committed and derives the required status checks from the job names. A mistyped check name creates a protection rule that guards nothing — ghScaff removes that class of silent misconfiguration.

Field notes