One Committed Secret and the Scaffolding Tool That Changed My Workflow

Presented by Matt Parker

If your team has a scripts/ directory — in a CI repo, an infra project, anywhere — this one's for you.

Matt Parker will walk us through Shikomi (仕込み), an open-source CLI scaffolding tool he built after accidentally committing a credential to GitHub and hearing about it from the security team before he noticed himself. The name comes from a Japanese culinary term for mise en place — the preparation that happens before you start cooking. That philosophy is baked right into the tool.

While Shikomi was built with macOS administration in mind, the problem it solves — ungoverned shell scripts with no security tooling — is universal. The talk is framed for a general developer audience.

Shell scripts are everywhere in software teams: deployment hooks, CI setup, infrastructure automation, onboarding utilities. Yet most scripting workflows have none of the guardrails we apply to application code — no linting gates, no secret scanning, no versioning discipline. Shikomi fixes that by wiring the tools together so you don't have to. Think create-react-app, but for shell scripts: one command, answer a few prompts, and walk away with a fully scaffolded project with pre-commit hooks already running.

What Matt will cover:

• The incident — what happened, what it exposed, and why it's more common than people admit
• How Gitleaks, ShellCheck, and semantic versioning each solve one dimension of the problem
• A live demo of Shikomi scaffolding a project with all three tools pre-configured
• The two-tier validation model: local pre-commit hooks as Tier 1, GitHub Actions at the PR level as Tier 2 — and how a merge can trigger automated deployment from there
• How bump-version keeps version headers, READMEs, and CHANGELOGs in sync with one command
• A practical path to apply the same guardrails to your own existing scripts

No Mac admin or MDM experience required. If you write shell scripts, this talk is for you.

Come ready to ask questions. Bring your laptop if you want to follow along.

Important Parking and Directions
The address for the Cabarrus Center is 57 Union St. S Concord, NC 28025. Free parking is available in the Cabarrus County Parking Deck located at 81 Spring St. SW Concord, NC 28025. There is also the 3-hour Bicentennial Lot behind our building. Here is a map of downtown parking options for your reference.

Sponsors

• FocalGroove provides groovy marketing and facilitation.
• Special thanks to Flywheel Coworking for providing our meeting space in their fantastic Concord facility!