[codex] Harden Django template architecture

.github/pull_request_template.md

@@ -32,6 +32,8 @@
 - [ ] Template generation with various package combinations
 - [ ] Generated project builds successfully
 - [ ] Generated project tests pass
+- [ ] Generated project `make check` passes or skipped with reason
+- [ ] Permission/ownership/failure-path tests added for changed backend behavior
 - [ ] Documentation is up to date
 
 ## Screenshots
@@ -46,6 +48,8 @@
 - [ ] I have tested the changes with different cookiecutter options
 - [ ] All existing tests pass
 - [ ] I have checked for security issues
+- [ ] No secrets, private keys, dumps, `.pyc`, cache, local media, or generated runtime artifacts are included
+- [ ] Optional integrations remain optional and domain-neutral
 
 ## Additional Notes
 <!-- Any additional information for reviewers -->

.github/workflows/template-quality.yml

@@ -0,0 +1,29 @@
+name: Template Quality
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - master
+
+jobs:
+  render-template:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install template tools
+        run: python -m pip install --upgrade pip cookiecutter
+
+      - name: Compile hooks
+        run: python -m compileall hooks
+
+      - name: Validate template renders
+        run: python scripts/validate_template.py

.gitignore

@@ -1,9 +1,16 @@
-node_modules
-django_blueprint/
-core/http/
-git.diff
-# OS ignores
-*.DS_Store
+node_modules/
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+django_blueprint/
+core/http/
+git.diff
+# OS ignores
+*.DS_Store
+.AppleDouble
+.LSOverride
+Thumbs.db
 
 # Byte-compiled / optimized / DLL files
 __pycache__/
@@ -51,9 +58,10 @@ htmlcov/
 .nox/
 .coverage
 .coverage.*
-.cache
-nosetests.xml
-coverage.xml
+.cache
+.ruff_cache/
+nosetests.xml
+coverage.xml
 *.cover
 *.py,cover
 .hypothesis/
@@ -65,10 +73,19 @@ cover/
 *.pot
 
 # Django stuff:
-*.log
-local_settings.py
-db.sqlite3
-db.sqlite3-journal
+*.log
+*.log.*
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+media/
+staticfiles/
+resources/media/*
+!resources/media/.gitignore
+resources/logs/*
+!resources/logs/.gitignore
+core/apps/logs/*
+!core/apps/logs/.gitignore
 
 # Flask stuff:
 instance/
@@ -121,9 +138,11 @@ celerybeat.pid
 *.sage.py
 
 # Environments
-.env
-.venv
-env/
+.env
+.env.*
+!.env.example
+.venv
+env/
 venv/
 ENV/
 env.bak/
@@ -156,5 +175,39 @@ cython_debug/
 # PyCharm
 .idea/
 
-# Visual Studio Code
-.vscode
+# Visual Studio Code
+.vscode
+
+# Secrets / credentials / dumps
+*.pem
+*.key
+*.crt
+*.cer
+*.p12
+*.pfx
+*.jks
+*.keystore
+id_rsa*
+id_ed25519*
+*.sqlite3
+*.dump
+*.sql
+*.sql.gz
+*.backup
+*.bak
+*.enc
+secrets/
+private/
+credentials/
+
+# Runtime artifacts
+celerybeat-schedule.*
+*.pid
+*.sock
+*.tmp
+*.swp
+*.swo
+
+# Generated build outputs
+resources/static/vite/.vite/
+resources/static/vite/assets/*.map

cookiecutter.json

@@ -27,36 +27,36 @@
     "password": "changeme123",
     "max_line_length": "120",
     "silk": [
-        false,
-        true
+        "no",
+        "yes"
     ],
     "storage": [
-        false,
-        true
+        "no",
+        "yes"
     ],
     "channels": [
-        true,
-        false
+        "no",
+        "yes"
     ],
     "rosetta": [
-        true,
-        false
+        "no",
+        "yes"
     ],
     "cacheops": [
-        true,
-        false
+        "no",
+        "yes"
     ],
     "ckeditor": [
-        true,
-        false
+        "no",
+        "yes"
     ],
     "modeltranslation": [
-        true,
-        false
+        "no",
+        "yes"
     ],
     "parler": [
-        false,
-        true
+        "no",
+        "yes"
     ],
     "version": "0.1.1"
-}
+}