veragem 0.1.0

data/template/Rakefile

@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+# `rake` runs the Ruby checks, as ruby-ci.yml does; `rake checks` runs everything CI runs.
+# `rake -T` lists the tasks.
+
+require "bundler/audit/task"
+require "bundler/gem_tasks"
+require "json"
+require "minitest/test_task"
+require "rubocop/rake_task"
+require "steep/rake_task"
+
+Minitest::TestTask.create
+RuboCop::RakeTask.new
+Steep::RakeTask.new
+Bundler::Audit::Task.new
+
+task default: %i[rubocop steep test]
+
+# TypeProf infers; Steep, against sig/, is the gate. TypeProf reads Ruby's core signatures alone,
+# not the standard library's.
+desc "Print the signatures TypeProf infers from lib/, to start sig/ from, and what it finds amiss"
+task :typeprof do
+  sh "typeprof", "--show-errors", "lib"
+end
+
+desc "Update the advisory database, then check Gemfile.lock against it (bundler-audit)"
+task audit: %w[bundle:audit:update bundle:audit:check]
+
+desc "Check the Markdown and TOML format (dprint)"
+task :dprint do
+  sh "dprint", "check"
+end
+
+desc "Check that every commit is a Conventional Commit (cocogitto)"
+task :cog do
+  sh "cog", "check"
+end
+
+# A command's standard output; its failure fails the task, as `sh`'s does.
+def output(*command)
+  IO.popen(command, &:read).tap { raise "#{command.join(" ")} failed" unless Process.last_status.success? }
+end
+
+desc "Lint and check the format of the shell scripts git tracks (shellcheck, shfmt)"
+task :shell do
+  tracked = output("git", "ls-files", "-z").split("\0").select { File.file?(it) }
+  scripts = output("shfmt", "--find", *tracked).lines(chomp: true)
+  sh "shellcheck", *scripts
+  sh "shfmt", "--diff", *scripts
+end
+
+desc "Lint the workflows and audit their security (actionlint, zizmor)"
+task :workflows do
+  sh "actionlint"
+  sh "zizmor", "--offline", "--quiet", "--strict-collection", "."
+end
+
+desc "Run the flake's checks: the Nix format, the shell, the workflows, the package (git's files alone)"
+task :nix do
+  sh "nix", "flake", "check"
+end
+
+desc "Run every check CI runs"
+task checks: %i[default audit dprint cog shell workflows nix]
+
+desc "Format the Ruby, the Markdown and TOML, and the Nix (modifies files)"
+task format: "rubocop:autocorrect" do
+  sh "dprint", "fmt"
+  sh "nix", "fmt"
+end
+
+desc "Use .githooks/: the quick checks before a commit, Conventional Commits for every message"
+task :hooks do
+  sh "git", "config", "core.hooksPath", ".githooks"
+end
+
+gemspec = Bundler::GemHelper.gemspec
+# git-cliff's compare links: the repository, owner/name
+repository = gemspec.metadata.fetch("source_code_uri").delete_prefix("https://github.com/")
+cliff = ["git-cliff", "--offline", "--github-repo", repository]
+
+desc "Preview the changelog's next section"
+task :changelog do
+  sh(*cliff, "--unreleased")
+end
+
+# The version to release: the declared one at the first release (no tag yet), else +level+'s
+# number bumped (0 major, 1 minor, 2 patch), those after it zeroed.
+def next_version(current, level)
+  abort "error: #{current} is not MAJOR.MINOR.PATCH" unless current.match?(/\A\d+\.\d+\.\d+\z/)
+  return current if output("git", "tag", "--list", "v[0-9]*").empty?
+
+  parts = current.split(".").map(&:to_i)
+  parts[level] += 1
+  parts.fill(0, level + 1).join(".")
+end
+
+# The release commit: the version, the lock, the changelog.
+desc "Bump the version (major, minor or patch), write the changelog and commit"
+task :bump, [:level] => "release:guard_clean" do |_, args|
+  level = %w[major minor patch].index(args[:level]) or abort 'usage: rake "bump[major|minor|patch]"'
+  current = gemspec.version.to_s
+  version = next_version(current, level)
+  tagged = system("git", "rev-parse", "--quiet", "--verify", "refs/tags/v#{version}", out: File::NULL)
+  abort "error: v#{version} is already tagged" if tagged
+  entries = JSON.parse(output(*cliff, "--unreleased", "--context")).sum { it["commits"].size }
+  abort "error: nothing to release: no commit since the last tag enters the changelog" if entries.zero?
+
+  file = "lib/#{gemspec.name.tr("-", "/")}/version.rb"
+  abort "error: #{file} declares no \"#{current}\"" unless File.read(file).include?(%("#{current}"))
+  first = !File.exist?("CHANGELOG.md")
+  begin
+    File.write(file, File.read(file).sub(%("#{current}"), %("#{version}")))
+    sh "bundle", "lock"
+    sh(*cliff, "--tag", "v#{version}", "--output", "CHANGELOG.md")
+    sh "git", "add", file, "Gemfile.lock", "CHANGELOG.md"
+    sh "git", "commit", "--message", "chore(release): v#{version}"
+  rescue StandardError, Interrupt
+    # The tracked files were committed (release:guard_clean): put back what this changed.
+    sh "git", "reset", "--hard", "--quiet"
+    rm_f "CHANGELOG.md" if first
+    raise
+  end
+  puts "v#{version} committed: `rake release` tags and pushes it, then release.yml publishes the tag."
+end
+
+# The gem is published by release.yml, on the tag, through RubyGems' Trusted Publishing:
+# `rake release` builds it, tags v<version> and pushes the branch and the tag, and pushes no gem.
+Rake::Task["release"].clear_comments
+Rake::Task["release"].add_description("Tag v#{gemspec.version}, push the branch and the tag: release.yml publishes it")
+Rake::Task["release:rubygem_push"].clear_actions
+desc "Push no gem: release.yml publishes the tag"
+task "release:rubygem_push" do
+  puts "release.yml publishes v#{gemspec.version} to RubyGems."
+end

data/template/SECURITY.md.erb

@@ -0,0 +1,21 @@
+# Security Policy
+
+## Supported Versions
+
+Security updates are applied to the latest `main` branch and the most recent release.
+
+## Reporting a Vulnerability
+
+**Do not open a public issue for security vulnerabilities.** To report one, use the
+[Private Vulnerability Reporting](https://github.com/<%= github %>/<%= name %>/security/advisories/new)
+feature in this repository.
+
+Please include the technical context needed to reproduce it:
+
+- The version or commit affected.
+- The exact input, command line, or API call.
+- Host OS and Ruby version.
+- Exact reproduction steps or a proof-of-concept.
+
+You can expect an initial response within a few days. Please give us a reasonable window to ship
+a fix before disclosing publicly.

data/template/Steepfile.erb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+# Steep checks lib/ against sig/, its strictest diagnostics on: `rake steep`.
+target :lib do
+  signature "sig"
+  check "lib"
+<%- if exe -%>
+  library "optparse"
+<%- end -%>
+  configure_code_diagnostics(Steep::Diagnostic::Ruby.strict)
+end

data/template/bin/console.erb

@@ -0,0 +1,8 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require "bundler/setup"
+require "<%= path %>"
+
+require "irb"
+IRB.start(__FILE__)

data/template/bin/setup

@@ -0,0 +1,5 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# The gems at Gemfile.lock's versions; the first run writes the lock, to commit.
+system("bundle", "install", exception: true)

data/template/cliff.toml

@@ -0,0 +1,70 @@
+# git-cliff: CHANGELOG.md from the Conventional Commits, written by `rake bump` (never by hand).
+# Grouped by commit type, breaking changes first; what changes nothing a user meets (chores, CI,
+# formatting, the release commit itself) is left out.
+#
+# It names no project: the Rakefile passes the repository the headings' compare links need
+# (`--github-repo`, from the gemspec's source_code_uri). Run bare, the headings carry no link.
+
+[changelog]
+header = """
+# Changelog
+
+All notable changes to this project are documented in this file, generated by
+[git-cliff](https://git-cliff.org) from its commits; versions follow
+[Semantic Versioning](https://semver.org).\n
+"""
+body = """
+{% set url = "" -%}
+{% if remote.github.owner -%}
+    {% set url = "https://github.com/" ~ remote.github.owner ~ "/" ~ remote.github.repo -%}
+{% endif -%}
+{% if version -%}
+    {% set number = version | trim_start_matches(pat="v") -%}
+    ## {% if url %}[{{ number }}]({{ url }}/\
+        {%- if previous.version %}compare/{{ previous.version }}..{{ version }}\
+        {%- else %}tree/{{ version }}{% endif %})\
+    {%- else %}{{ number }}{% endif %} - \
+    {{ timestamp | date(format="%Y-%m-%d") }}
+{% elif url and previous.version -%}
+    ## [Unreleased]({{ url }}/compare/{{ previous.version }}..HEAD)
+{% else -%}
+    ## Unreleased
+{% endif -%}
+{% for group, commits in commits | group_by(attribute="group") %}
+    ### {{ group | striptags | trim }}
+    {% for commit in commits %}
+        - {% if commit.scope %}{{ commit.scope }}: {% endif %}\
+          {{ commit.message | split(pat="\n") | first | upper_first | trim }}\
+    {% endfor %}
+{% endfor %}\n
+"""
+trim = true
+
+[git]
+conventional_commits = true
+# a body right under its subject, which cog takes, set apart as git-cliff's parser needs it: its
+# footers (BREAKING CHANGE) read
+commit_preprocessors = [{ pattern = '\A([^\n]*)\n([^\n])', replace = "${1}\n\n${2}" }]
+# what cog lets through unconventional -- a fixup (cog.toml) -- left out
+filter_unconventional = true
+protect_breaking_commits = true # a breaking change is listed whatever its type, first
+# by type, in any case (cog takes `Feat:`), the HTML comments ordering the groups
+commit_parsers = [
+    # a merge, whatever its message: cog checks none (ignore_merge_commits)
+    { field = "merge_commit", pattern = "true", skip = true },
+    { message = "^[a-zA-Z]+(\\([^)]*\\))?!:", group = "<!-- 0 -->Breaking changes" },
+    { footer = "^BREAKING[ -]CHANGE", group = "<!-- 0 -->Breaking changes" },
+    { message = "(?i)^(chore|ci|style)", skip = true },
+    { message = "(?i)^feat", group = "<!-- 1 -->Features" },
+    { message = "(?i)^fix", group = "<!-- 2 -->Fixes" },
+    { message = "(?i)^perf", group = "<!-- 3 -->Performance" },
+    { message = "(?i)^refactor", group = "<!-- 4 -->Refactoring" },
+    { message = "(?i)^build", group = "<!-- 5 -->Build" },
+    { message = "(?i)^doc", group = "<!-- 6 -->Documentation" },
+    { message = "(?i)^test", group = "<!-- 7 -->Tests" },
+    { message = "(?i)^revert", group = "<!-- 8 -->Reverts" },
+    { message = ".*", skip = true },
+]
+sort_commits = "oldest"
+# the release tags, `v0.1.0` on (Bundler's own form, `rake release`)
+tag_pattern = "^v[0-9]"

data/template/cog.toml

@@ -0,0 +1,8 @@
+# cocogitto checks the commits alone (`rake cog`, the commit-msg and pre-push hooks, CI):
+# `rake bump` and `rake release` cut the release, git-cliff writes the changelog (cliff.toml).
+
+# every commit, not from the latest tag: with no tag, cog stops "unable to get any tag"
+from_latest_tag = false
+ignore_merge_commits = true
+ignore_fixup_commits = true
+disable_changelog = true

data/template/dprint.json

@@ -0,0 +1,23 @@
+// Markdown and TOML (`rake dprint`, style-check-dprint.yml). The plugins pinned:
+// `dprint config update` moves them to their latest.
+{
+  "markdown": {
+    "textWrap": "maintain",
+    // the plugin's defaults are underscores
+    "emphasisKind": "asterisks",
+    "strongKind": "asterisks"
+  },
+  // four spaces, as cliff.toml and cog.toml are written
+  "toml": { "indentWidth": 4 },
+  "excludes": [
+    // git-cliff's (cliff.toml): regenerated at each release, never edited
+    "CHANGELOG.md",
+    "coverage/",
+    "pkg/",
+    "vendor/"
+  ],
+  "plugins": [
+    "https://plugins.dprint.dev/markdown-0.26.0.wasm",
+    "https://plugins.dprint.dev/toml-0.9.0.wasm"
+  ]
+}

data/template/exe/%name%.erb

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require "<%= path %>/cli"
+
+exit <%= constant %>::CLI.run(ARGV)

data/template/flake.lock

@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1792773339,
+        "narHash": "sha256-rZLrzrC6i+jnTAlvPZHogKDulY7WWDEv9hJeHieO7Zw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "3ec636362e1816bc2f0888fa0fa2c69f1bc9e504",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

data/template/flake.nix

@@ -0,0 +1,213 @@
+# The development shell, the gem as a package, and the checks that need no gem from the bundle:
+#
+#   nix develop      Ruby 4.0 and every tool `rake checks` runs besides the gems (Bundler's, from
+#                    Gemfile.lock: `bin/setup`): cocogitto, git-cliff, dprint, shellcheck, shfmt,
+#                    actionlint, zizmor, nixfmt
+#   nix build        the gem, built from its gemspec and installed (nixpkgs' buildRubyGem);
+#                    with a command (exe/<name>): `nix run` runs it, and on Linux
+#                    `nix build .#image` builds it as an OCI image (image.yml publishes it)
+#   nix fmt          the Nix, by nixfmt
+#   nix flake check  the Nix format, the shell scripts (shellcheck, shfmt), the workflows
+#                    (actionlint, zizmor), the package and its library loaded -- and the command
+#                    run, and its image -- offline in the sandbox: git's files alone
+#
+# Nothing here names the gem: its name is the gemspec's file; its version, lib/<path>/version.rb's
+# VERSION; its summary, homepage and licences, the gemspec's lines that set them.
+{
+  description = "A Ruby gem's development shell, package and checks";
+
+  # the unstable channel: its tools move with each `nix flake update` (Dependabot's, monthly)
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+
+  outputs =
+    { self, nixpkgs }:
+    let
+      inherit (nixpkgs) lib;
+      # nixpkgs-unstable's platforms: 26.05 was the last release to support x86_64-darwin
+      systems = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "aarch64-darwin"
+      ];
+      forAllSystems = f: lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
+
+      gemspecs = lib.filter (lib.hasSuffix ".gemspec") (lib.attrNames (builtins.readDir ./.));
+      name =
+        if lib.length gemspecs == 1 then
+          lib.removeSuffix ".gemspec" (lib.head gemspecs)
+        else
+          throw "flake.nix: one *.gemspec expected, found ${toString gemspecs}";
+      path = lib.replaceStrings [ "-" ] [ "/" ] name;
+      # the groups of the first of +file+'s lines that +pattern+ matches whole, or null
+      line =
+        pattern: file:
+        lib.findFirst (groups: groups != null) null (
+          map (builtins.match pattern) (lib.splitString "\n" (builtins.readFile file))
+        );
+      # a double-quoted Ruby string's value, its escapes \\, \" and \# read: those veragem writes
+      unquote = lib.replaceStrings [ "\\\\" "\\\"" "\\#" ] [ "\\" "\"" "#" ];
+      # a line's end after its value: `.freeze`, a comment, a carriage return
+      rest = ''(\.freeze)?[[:space:]]*(#.*)?'';
+      # the gemspec's `spec.<attribute> = "<value>"`, its value; "" if no line sets it so
+      field =
+        attribute:
+        let
+          found = line ''[[:space:]]*spec\.${attribute}[[:space:]]*=[[:space:]]*"((\\.|[^"\\])*)"${rest}'' ./${name}.gemspec;
+        in
+        if found == null then "" else unquote (lib.head found);
+      version =
+        let
+          found = line ''[[:space:]]*VERSION[[:space:]]*=[[:space:]]*"([^"]+)"${rest}'' ./lib/${path}/version.rb;
+        in
+        if found == null then
+          throw "flake.nix: no VERSION = \"...\" line in version.rb"
+        else
+          lib.head found;
+      # the SPDX identifiers of `spec.licenses = [...]` or `spec.license = "..."`
+      licences =
+        let
+          found = line ''[[:space:]]*spec\.licenses?[[:space:]]*=[[:space:]]*(\[[^]]*]|"[^"]*")${rest}'' ./${name}.gemspec;
+        in
+        if found == null then
+          [ ]
+        else
+          lib.concatLists (lib.filter lib.isList (builtins.split ''"([^"]*)"'' (lib.head found)));
+      command = builtins.pathExists ./exe/${name};
+
+      check =
+        pkgs: checkName: tools: script:
+        pkgs.runCommand checkName { nativeBuildInputs = tools; } ''
+          cd ${self}
+          ${script}
+          touch $out
+        '';
+
+      perSystem =
+        pkgs:
+        let
+          ruby = pkgs.ruby_4_0;
+          # the gem's runtime dependencies (its gemspec's add_dependency), as nixpkgs packages
+          # them: pkgs.rubyPackages_4_0.<gem>. The `library` check fails on one missing
+          dependencies = [ ];
+          package = pkgs.buildRubyGem {
+            gemName = name;
+            inherit version ruby;
+            src = self;
+            gemPath = dependencies;
+            # no meta.license: nixpkgs refuses to evaluate a package whose licence is unfree or unknown
+            # to it, and the gemspec's is the author's to choose
+            meta = {
+              description = field "summary";
+              homepage = field "homepage";
+            };
+          };
+          # the command as an OCI image: its closure alone -- no base image, no /bin/sh -- run as
+          # nobody. `.#image.stream` streams the archive uncompressed (image.yml's: no second copy
+          # of the closure in the store)
+          image = pkgs.dockerTools.buildLayeredImage {
+            inherit name;
+            tag = version;
+            # Dir.tmpdir's default, and HOME's: the image has no other directory to write
+            extraCommands = "mkdir -m 1777 tmp";
+            config = {
+              Entrypoint = [ (lib.getExe package) ];
+              # nobody: nothing in it needs root, and a numeric user needs no /etc/passwd
+              User = "65534:65534";
+              Env = [
+                # UTF-8 text, ARGV and files alike (glibc's built-in locale)
+                "LANG=C.UTF-8"
+                "HOME=/tmp"
+                # what OpenSSL verifies HTTPS against: the image has no /etc/ssl
+                "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+              ];
+              # what GHCR reads (docs.github.com, "Working with the Container registry"): the
+              # source links the image to its repository
+              Labels = lib.filterAttrs (_: value: value != "") {
+                "org.opencontainers.image.title" = name;
+                "org.opencontainers.image.description" = field "summary";
+                "org.opencontainers.image.version" = version;
+                "org.opencontainers.image.source" = field "homepage";
+                "org.opencontainers.image.licenses" = lib.concatStringsSep " OR " licences;
+              };
+            };
+          };
+          linuxCommand = command && pkgs.stdenv.hostPlatform.isLinux;
+        in
+        {
+          packages = {
+            default = package;
+          }
+          // lib.optionalAttrs linuxCommand { inherit image; };
+
+          checks = {
+            format = check pkgs "format" [ pkgs.nixfmt ] "find . -name '*.nix' -exec nixfmt --check {} +";
+            # shfmt finds the scripts, by extension or shebang, and formats them as .editorconfig says
+            shell = check pkgs "shell" [ pkgs.shellcheck pkgs.shfmt ] ''
+              shfmt --find . | xargs shellcheck
+              shfmt --diff .
+            '';
+            # actionlint runs shellcheck on each `run:` script too; zizmor audits Dependabot's
+            # configuration as well
+            workflows = check pkgs "workflows" [ pkgs.actionlint pkgs.shellcheck pkgs.zizmor ] ''
+              actionlint .github/workflows/*.yml
+              zizmor --offline --quiet --strict-collection .
+            '';
+            inherit package;
+            # the library as a user loads it: the gem activated -- its dependencies with it -- then
+            # required, in an environment of nothing else (env -i). Ruby's setup hook puts each gem of
+            # buildInputs on GEM_PATH, those it propagates too: the dependencies' own dependencies
+            library =
+              pkgs.runCommand "library"
+                {
+                  buildInputs = [
+                    ruby
+                    package
+                  ];
+                }
+                ''
+                  env -i GEM_PATH="$GEM_PATH" ${lib.getExe ruby} -e 'gem "${name}"; require "${path}"'
+                  touch $out
+                '';
+          }
+          // lib.optionalAttrs command {
+            # the command as a user runs it: its wrapper alone gives it its environment (env -i)
+            command =
+              pkgs.runCommand "command"
+                {
+                  exe = lib.getExe package;
+                  expected = "${name} ${version}";
+                }
+                ''
+                  actual=$(env -i "$exe" --version)
+                  if [ "$actual" != "$expected" ]; then
+                    echo "--version gave '$actual', expected '$expected'" >&2
+                    exit 1
+                  fi
+                  touch $out
+                '';
+          }
+          // lib.optionalAttrs linuxCommand { inherit image; };
+
+          devShells.default = pkgs.mkShell {
+            packages = [
+              ruby
+              pkgs.cocogitto
+              pkgs.git-cliff
+              pkgs.dprint
+              pkgs.shellcheck
+              pkgs.shfmt
+              pkgs.actionlint
+              pkgs.zizmor
+              pkgs.nixfmt
+            ];
+          };
+        };
+      output = attribute: forAllSystems (pkgs: (perSystem pkgs).${attribute});
+    in
+    {
+      packages = output "packages";
+      checks = output "checks";
+      devShells = output "devShells";
+      formatter = forAllSystems (pkgs: pkgs.nixfmt-tree);
+    };
+}

data/template/lib/%path%/cli.rb.erb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require "optparse"
+require_relative "../<%= File.basename(path) %>"
+
+<%= nest(<<~RUBY)
+  # The command line: `#{name} [NAME]` prints the greeting.
+  module CLI
+    # Runs the command line with +argv+; returns the exit status.
+    def self.run(argv)
+      options = { help: false, version: false }
+      names = parser.parse(argv, into: options)
+      puts output(options, names.first || "")
+      0
+    rescue ::OptionParser::ParseError => e
+      warn e.message, parser.help
+      2
+    end
+
+    # What +options+ ask for, the help or the version, else the greeting for +name+.
+    def self.output(options, name)
+      if options[:help]
+        parser.help
+      elsif options[:version]
+        parser.ver
+      else
+        #{modules.last}.greeting(name)
+      end
+    end
+    private_class_method :output
+
+    # --help as an option of its own: OptionParser's built-in one exits the process. `::`: a module of
+    # the gem's could be named OptionParser
+    def self.parser
+      ::OptionParser.new("Usage: #{name} [options] [NAME]") do |opts|
+        opts.program_name = "#{name}"
+        opts.version = VERSION
+        opts.on("-h", "--help", "Print this help")
+        opts.on("--version", "Print the version")
+      end
+    end
+    private_class_method :parser
+  end
+RUBY
+-%>

data/template/lib/%path%/version.rb.erb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+<%= nest(%(VERSION = "0.1.0"\n)) -%>

data/template/lib/%path%.rb.erb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require_relative "<%= File.basename(path) %>/version"
+
+<%= nest(<<~RUBY, doc: summary)
+  # A greeting for +name+, its surrounding whitespace stripped; nobody named, the world.
+  def self.greeting(name)
+    who = name.strip
+    who = "world" if who.empty?
+    "Hello, \#{who}!"
+  end
+RUBY
+-%>

data/template/sig/%path%.rbs.erb

@@ -0,0 +1,16 @@
+<%# `::`: a module of the gem's could be named String, or Hash -%>
+<%= nest(<<~RBS + (exe ? <<~CLI : ""))
+  VERSION: ::String
+
+  def self.greeting: (::String name) -> ::String
+RBS
+
+  module CLI
+    def self.run: (::Array[::String] argv) -> ::Integer
+
+    private def self.output: (::Hash[::Symbol, bool] options, ::String name) -> ::String?
+
+    private def self.parser: () -> ::OptionParser
+  end
+CLI
+-%>

data/template/test/test_%underscored%.rb.erb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class Test<%= constant.delete(":") %> < Minitest::Test
+  def test_the_version_is_major_minor_patch
+    assert_match(/\A\d+\.\d+\.\d+\z/, <%= constant %>::VERSION)
+  end
+
+  def test_it_greets_the_name_given
+    assert_equal "Hello, Ada!", <%= constant %>.greeting("Ada")
+  end
+
+  def test_nobody_named_it_greets_the_world
+    assert_equal "Hello, world!", <%= constant %>.greeting(" \n")
+  end
+
+  # A property, checked on many generated names (pbt): surrounding whitespace changes nothing.
+  def test_surrounding_whitespace_changes_nothing
+    gem = <%= constant %>
+    Pbt.assert do
+      Pbt.property(Pbt.printable_string) do |name|
+        assert_equal gem.greeting(name), gem.greeting(" #{name}\n")
+      end
+    end
+  end
+end