@biffo/cli 0.244.8 → 0.244.10

package/_skeletons/plugin-template/.github/workflows/codeql.yml

@@ -0,0 +1,65 @@
+name: 'CodeQL'
+
+on:
+  push:
+    branches: [dev, staging, main]
+  pull_request:
+    branches: [dev, staging, main]
+  schedule:
+    # Weekly catch-up scan (Tuesday 05:17 UTC) for issues that land outside
+    # PR review (e.g. direct merges onto a branch).
+    - cron: '17 5 * * 2'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
+    # CodeQL code scanning requires GitHub Advanced Security (GHAS) on private
+    # repos — the analysis runs but the SARIF upload fails without it. So this
+    # is opt-in: enable GHAS on the repo, then set the repo variable
+    # ENABLE_CODE_SCANNING=true. Left dormant (not failing) otherwise.
+    # See biffo-template's codeql.yml for the full reasoning (#1214): a public
+    # repo can scan for free, so it does; a private one still needs the opt-in.
+    # Both existing plugin repos are public, so this scans them for nothing —
+    # which is exactly why their never having been scanned was worth fixing
+    # (#1224).
+    if: github.event.repository.private == false || vars.ENABLE_CODE_SCANNING == 'true'
+    timeout-minutes: 15
+    permissions:
+      # Required for CodeQL to upload SARIF results.
+      security-events: write
+      contents: read
+      actions: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: javascript-typescript
+            build-mode: none
+          - language: python
+            build-mode: none
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          queries: security-extended
+
+      # autobuild intentionally omitted (build-mode 'none'):
+      # - the plugin's Python (src/, tests/) has no build step CodeQL needs.
+      # - javascript-typescript is declared even though a fresh plugin ships no
+      #   web/ directory: the skeleton itself carries scripts/*.mjs, and every
+      #   real plugin grows web/ and web-admin/ (both existing ones have them).
+      #   Declaring it only once a plugin gains a frontend would mean the scan
+      #   silently covers less than it appears to — the shape #1270 records for
+      #   the dependency audits.
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: '/language:${{ matrix.language }}'

package/_skeletons/sibling-template/README.md

@@ -34,9 +34,10 @@ anywhere in `services/api/`, on purpose.
 
 ```
 apps/frontend/            # Next.js 15 static export. `/` is the SSO demo ("<name> - Hello <username>",
-                           #   proving the shared-session SSO works); src/lib/auth-gate.tsx + the
-                           #   src/app/example/ routes show the public-default / opt-in-auth pattern
-                           #   ("Your app goes here" below). src/lib/auth.ts reads the shared session.
+                           #   proving the shared-session SSO works end to end, gate included);
+                           #   src/lib/auth-gate.tsx is the reusable wrapper for any OTHER page that
+                           #   needs the same gate ("Your app goes here" below). src/lib/auth.ts reads
+                           #   the shared session.
 services/api/              # FastAPI + Mangum backend. Verifies the core project's Cognito JWT itself
                            #   (defense in depth — API Gateway's own JWT authorizer is the first layer).
                            #   core_client.py is the ONLY sanctioned way to reach core-owned data.
@@ -81,12 +82,10 @@ else depends on it.
 This is a Next.js **App Router** app with `output: 'export'` (a static site).
 A route is just a folder with a `page.tsx` under `apps/frontend/src/app/`:
 
-| File                            | URL served                          |
-| ------------------------------- | ----------------------------------- |
-| `src/app/page.tsx`              | `/` (the demo — replace or keep)    |
-| `src/app/pricing/page.tsx`      | `/pricing/`                         |
-| `src/app/example/page.tsx`      | `/example/` (public example, below) |
-| `src/app/example/members/page.tsx` | `/example/members/` (gated example) |
+| File                        | URL served                       |
+| --------------------------- | --------------------------------- |
+| `src/app/page.tsx`          | `/` (the demo — replace or keep) |
+| `src/app/pricing/page.tsx`  | `/pricing/`                       |
 
 **The `basePath` / `PATH_PREFIX` wiring is automatic — don't hand-write it.**
 The core project's CloudFront routes `baseurl.com/<name>/*` to this sibling and
@@ -116,8 +115,7 @@ browser never holds a core credential.
 
 The go-live state for most products is a **public** app. That is the easy path
 here: any `page.tsx` you add is served **unauthenticated** the moment it
-deploys — no auth code, no bounce. `src/app/example/page.tsx` is a one-screen
-demonstration of exactly that; copy it or delete it.
+deploys — no auth code, no bounce, nothing to opt out of.
 
 When a page _does_ need a signed-in user, opt in with the `<AuthGate>` helper
 (`src/lib/auth-gate.tsx`) — one wrapper, and only that page becomes private:
@@ -142,15 +140,18 @@ export default function Dashboard() {
 A signed-out visitor is redirected to the core portal's login and returned to
 that exact route afterwards; a signed-in visitor sees the content. `AuthGate`
 builds on `getCurrentSession`/`auth.ts` and never signs anyone in itself
-(ADR-0007). `src/app/example/members/page.tsx` is the runnable version of the
-snippet above. Wrap only what must be private — never gate the whole app.
+(ADR-0007) — it is the same round-trip `/` already runs, packaged as a
+one-line wrapper for any page besides `/`. Wrap only what must be private —
+never gate the whole app. There is no separate demo route for this: `/`
+already proves the mechanism works end to end, and the snippet above is the
+runnable form.
 
 ### The path a founder actually walks
 
 1. Run locally (`pnpm dev`, below) and open `/` — watch the SSO demo work.
 2. Replace `src/app/page.tsx` with your own public home page (or add
    `src/app/<something>/page.tsx`). It's public by default — that's your
-   go-live state. Delete the `example/` routes once you've read them.
+   go-live state.
 3. For any area that needs a login, wrap its `page.tsx` in `<AuthGate>`.
 4. Push to `main`; `deploy.yml` builds the static export with the right
    `NEXT_PUBLIC_BASE_PATH` and syncs it to S3 behind the core CloudFront —

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.244.8",
+  "version": "0.244.10",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",

package/_skeletons/sibling-template/apps/frontend/src/app/example/members/page.tsx

@@ -1,31 +0,0 @@
-'use client'
-
-import { AuthGate } from '@/lib/auth-gate'
-
-// The SAME page, made private by a single wrapper. Opting into auth is one
-// deliberate line — <AuthGate> — not the default. A signed-out visitor is
-// bounced to the core portal's login (ADR-0007) and returned here afterwards;
-// a signed-in visitor sees the content below.
-//
-// The render-prop form hands you the session, whose ID token you pass to THIS
-// sibling's own backend via createApiClient (never the core API directly,
-// ADR-0002). This example doesn't call the backend, but shows where the token
-// comes from.
-export default function ExampleMembersPage() {
-  return (
-    <AuthGate>
-      {(session) => (
-        <main className="center-screen">
-          <div>
-            <h1>Members only</h1>
-            <p>You&apos;re signed in — this rendered because a valid session exists.</p>
-            <p>
-              Your ID token (for calls to this sibling&apos;s backend) is{' '}
-              {session.getIdToken().getJwtToken().slice(0, 8)}…
-            </p>
-          </div>
-        </main>
-      )}
-    </AuthGate>
-  )
-}

package/_skeletons/sibling-template/apps/frontend/src/app/example/page.tsx

@@ -1,24 +0,0 @@
-import Link from 'next/link'
-
-// A minimal PUBLIC page — the go-live default.
-//
-// There is no auth code here, and that is the whole point: anything you drop
-// under src/app/ is served unauthenticated the moment it deploys. Delete this
-// route once you've seen how it works, or copy it as the starting point for
-// your own public content. To make a page private instead, wrap it in
-// <AuthGate> — see ./members/page.tsx.
-export default function ExamplePublicPage() {
-  return (
-    <main className="center-screen">
-      <div>
-        <h1>This page is public</h1>
-        <p>
-          Anyone can see it — no login, no redirect. This is how most of your app ships at go-live.
-        </p>
-        <p>
-          <Link href="/example/members/">See the same pattern, but auth-gated →</Link>
-        </p>
-      </div>
-    </main>
-  )
-}