Move Drawing Board maintenance out of template

.github/dependabot.yml

@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directories:
+      - /
+      - /drawing-board
+      - /drawing-board/image
+      - /drawing-board/image/verify
+    schedule:
+      interval: weekly
+  - package-ecosystem: devcontainers
+    directory: /drawing-board/image
+    schedule:
+      interval: weekly

.github/workflows/drawing-board.yml

@@ -0,0 +1,48 @@
+name: Drawing Board checks
+
+on:
+  pull_request:
+    paths: [drawing-board/**, .github/workflows/drawing-board.yml]
+  push:
+    branches: [main]
+    paths: [drawing-board/**, .github/workflows/drawing-board.yml]
+  workflow_dispatch:
+    inputs:
+      candidate:
+        description: Exact firstdraft/drawing-board commit to qualify
+        required: true
+        default: 416ed5cbf08b0248f5a43cbe2bfe84c1a730c813
+
+permissions:
+  contents: read
+  packages: read
+
+jobs:
+  contract:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Select the exact template candidate
+        id: candidate
+        env:
+          CANDIDATE: ${{ inputs.candidate || '416ed5cbf08b0248f5a43cbe2bfe84c1a730c813' }}
+        run: |
+          [[ "$CANDIDATE" =~ ^[0-9a-f]{40}$ ]]
+          echo "sha=$CANDIDATE" >> "$GITHUB_OUTPUT"
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          repository: firstdraft/drawing-board
+          ref: ${{ steps.candidate.outputs.sha }}
+          path: board-candidate
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: ./drawing-board
+        with:
+          workspace: board-candidate

.gitignore

@@ -0,0 +1,2 @@
+/board-candidate/
+/tmp/

README.md

@@ -1,3 +1,6 @@
 # dockerfiles
 
 Storage for `Dockerfile`'s that are used for different student projects.
+
+[Drawing Board maintenance](drawing-board/README.md) owns its image source, template checks, and retained
+qualification reports. The student workspace remains in [firstdraft/drawing-board](https://github.com/firstdraft/drawing-board).

drawing-board/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 firstdraft
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

drawing-board/action.yml

@@ -0,0 +1,44 @@
+name: Check Drawing Board
+description: Check the caller's exact Drawing Board checkout in its own Dev Container
+inputs:
+  workspace:
+    description: Relative path to the Drawing Board candidate checkout
+    default: .
+runs:
+  using: composite
+  steps:
+    - name: Stage external checks in the disposable checkout
+      id: checks
+      shell: bash
+      working-directory: ${{ inputs.workspace }}
+      env:
+        CHECKS_SOURCE: ${{ github.action_path }}
+      run: |
+        set -euo pipefail
+        mkdir -p tmp
+        directory="$(mktemp -d tmp/drawing-board-checks.XXXXXX)"
+        cp -R "$CHECKS_SOURCE/script" "$CHECKS_SOURCE/image" "$directory/"
+        echo "directory=$directory" >> "$GITHUB_OUTPUT"
+    - uses: devcontainers/ci@513af61f4de4f75d37e4438f184ba4358f0fc1ca # v0.3.1900000450
+      with:
+        subFolder: ${{ inputs.workspace }}
+        push: never
+        runCmd: |
+          set -euo pipefail
+          export DRAWING_BOARD_PATH="$PWD"
+          checks="${{ steps.checks.outputs.directory }}/script"
+          FIRSTDRAFT_REQUIRE_IMAGE_SOURCE_COMMIT=1 "$checks/check" "$PWD"
+          "$checks/devcontainer-smoke"
+          "$checks/devcontainer-smoke"
+    - name: Remove the staged checks
+      if: always()
+      shell: bash
+      working-directory: ${{ inputs.workspace }}
+      env:
+        CHECK_DIRECTORY: ${{ steps.checks.outputs.directory }}
+      run: |
+        case "$CHECK_DIRECTORY" in
+          tmp/drawing-board-checks.*) rm -rf -- "$CHECK_DIRECTORY" ;;
+          "") ;;
+          *) echo "Unexpected check directory: $CHECK_DIRECTORY" >&2; exit 1 ;;
+        esac