A software template should create a repository that already calls the shared pipeline, has a CODEOWNERS file, a read only workflow token, branch rules and a dependency update config. If a new service starts secure, nobody has to retrofit it later.
What a software template does
In Backstage, Software Templates are the tool for creating components. They load a code skeleton, fill in variables from user inputs, and publish the result to a place such as GitHub or GitLab. Each template is made of steps, users review inputs before running, and each run is tracked as a task. The same idea exists in other portals and in plain repository templates.
The Backstage page does not cover authorization of scaffolder tasks, so check its separate guidance on that before you let templates run with broad credentials.
The secure skeleton checklist
| Item | Why |
|---|---|
| Workflow file calling the shared pipeline at a pinned version | Scans and gates from the first commit |
permissions block set to read only | Least privilege token by default |
| CODEOWNERS with the owning team | Review accountability, including for workflow files |
| Dependency update config pointing to your shared preset | Updates from day one |
| Security policy file with a contact | Researchers know where to report |
.gitignore covering env files and key material | Fewer accidental secrets |
| Lockfile committed | Reproducible builds and accurate scanning |
Publish step settings
After the repo is created, the template can call your source host API to apply settings: a ruleset requiring the scan check, protected default branch, and a custom property marking criticality. If the template cannot set these, use an org level ruleset that targets new repos by pattern.
Keep the template honest
Templates age. Run the template in CI weekly into a scratch location, scan the output, and fail if the result has findings or the pipeline call is out of date. That is a golden path test for the golden path.
Do not over collect inputs
Every extra field slows people down. Ask for name, owner team, language and criticality. Derive everything else.
Avoid copy drift
Existing services made from an old template will not update themselves. Pair the template with a bot that proposes changes to the shared files, or with an inventory that shows which services run an old template version.
Quick check
Does a template replace org level controls?
No. Templates help new repos. Org rulesets and policies protect all repos, including ones that skipped the template.
Who should own the templates?
The platform team, with security review and a clear issue process for requests.
Safeguard can scan the repos these templates create, produce SBOMs and enforce policy gates, and you can try the free scan at gold.safeguard.sh/scan.
Sources
- Backstage: Software Templates, fetched 19 October 2026
- GitHub Docs: About code owners, fetched 19 October 2026
Last reviewed: 19 October 2026.
