@getarbiter/cli 0.5.0

package/dist/templates/github/workflows/10-deploy-prod.yml.ejs

@@ -0,0 +1,144 @@
+# 10-deploy-prod.yml — generated by arbiter — Deploy to PROD via GitHub Environment gate
+# Trigger: release published
+# Status: SCAFFOLD — environment 'production' not configured by default.
+#   Workflow triggers on release:published but immediately enters
+#   "Waiting for review" indefinitely until the GitHub Environment is configured.
+#
+# Security:
+#   PROD deploy gated by GitHub Environment 'production' required-reviewer (FREE feature).
+#   NOT gated by a bypassable vars flag — environment gate is the only control.
+#
+# Timeout: 43200 min = 30 days waiting for approval (H2-S5).
+# Activation checklist: docs/ci/gate-tier-policy.md#prod-deploy-activation
+#
+# Ref: docs/SYSTEM/CI-TIER-MODEL.md §2 (slot 10, deploy-prod)
+
+name: Deploy Prod
+
+on:
+  release:
+    types: [published]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  id-token: write
+  packages: write
+  issues: write
+
+jobs:
+  # === GROUP: gate + deploy ===
+
+  deploy-prod:
+    name: Deploy to PROD (environment-gated)
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_DEPLOY || '["ubuntu-latest"]') }}
+    timeout-minutes: 43200
+    environment:
+      name: production
+      url: ${{ vars.PROD_URL || 'https://example.com' }}
+    # NOTE: When environment 'production' is not configured in Settings → Environments,
+    # this job enters "Waiting for review" indefinitely — no bypass, no auto-approve.
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+
+      - name: Guard — SCAFFOLD activation checklist
+        run: |
+          echo "=== PROD Deploy SCAFFOLD — Activation Guard ==="
+          echo "Reviewer approved. Verifying activation prerequisites..."
+          echo ""
+          echo "Activation checklist (docs/ci/gate-tier-policy.md#prod-deploy-activation):"
+          echo "  1. PROD registry credentials configured in environment 'production'"
+          echo "  2. PROD deployment target provisioned (cluster, container app, etc.)"
+          echo "  3. Required reviewer assigned in GitHub Environments settings"
+          echo "  4. PROD_BASE_URL secret set for smoke test"
+          echo "  5. Environment 'production' configured in GitHub repo Settings"
+          if [ "${SCAFFOLD_DRY_RUN:-false}" = "true" ]; then
+            echo "DRY-RUN mode (SCAFFOLD_DRY_RUN=true). Skipping actual deploy."
+            exit 0
+          fi
+
+      - name: Resolve release tag
+        run: echo "RELEASE_TAG=${{ github.event.release.tag_name }}" >> "$GITHUB_ENV"
+
+<%
+// RT-2: coalesce undefined (absent from legacy configs) to 'none' before comparison
+// RT-7: whitelist — prevent path traversal if deployTarget is hand-edited
+const _dt = ({
+  'ghcr': 'ghcr',
+  'azure-container-app': 'azure-container-app',
+  'aws-ecs': 'aws-ecs',
+  'gcp-cloud-run': 'gcp-cloud-run',
+  'nas-compose': 'nas-compose'
+})[typeof deployTarget !== 'undefined' ? deployTarget : 'none'] ?? 'none';
+%>
+<% if (_dt !== 'none') { %>
+<%- include('_partials/sigstore-preflight.ejs') %>
+<%- include('_cosign-copy/' + _dt + '.ejs') %>
+
+      # PORT A2 (#1502): provenance admission gate — fail-closed verification of the
+      # signature arbiter itself produces in 05-release, at the single deploy chokepoint,
+      # immediately before deploy. The per-target cosign-copy partial verifies the
+      # promoted PROD image right after promotion; this re-asserts the keyless signature
+      # on the EXACT digest-pinned ref about to be deployed (${IMAGE_TAG}) at the deploy
+      # boundary, so an unverified image can never reach the deploy step — regardless of
+      # which deploy-target partial ran (a uniform, target-agnostic admission gate, not a
+      # per-branch obligation). cosign is already installed by the cosign-copy partial.
+      - name: Provenance admission gate — verify image before deploy (fail-closed)
+        run: |
+          set -euo pipefail
+          if [ -z "${IMAGE_TAG:-}" ]; then
+            echo "::error::IMAGE_TAG is not set — the cosign-copy step must export the pinned image ref before the admission gate"
+            exit 1
+          fi
+          cosign verify \
+            --certificate-identity-regexp 'https://github\.com/<%= githubOwner %>/<%= githubRepo %>/\.github/workflows/05-release\.yml@refs/tags/v.*' \
+            --certificate-oidc-issuer https://token.actions.githubusercontent.com \
+            "${IMAGE_TAG}"
+
+<%- include('_deploy/' + _dt + '.ejs') %>
+<% } %>
+
+      # === GROUP: smoke ===
+
+      - name: PROD smoke — k6 LT1 (scaffold)
+        env:
+          # Sanctioned opt-out: set repo/org variable SKIP_SMOKE_PROD=true to deliberately skip this
+          # gate. With it unset, an empty PROD_BASE_URL secret FAILS loud — never a silent green.
+          SKIP_SMOKE_PROD: ${{ vars.SKIP_SMOKE_PROD }}
+        run: |
+          PROD_URL="${{ secrets.PROD_BASE_URL }}"
+          if [ -z "${PROD_URL}" ]; then
+            if [ "${SKIP_SMOKE_PROD}" = "true" ]; then
+              echo "::notice::SKIP_SMOKE_PROD=true — PROD smoke explicitly skipped"
+              exit 0
+            fi
+            echo "::error::PROD_BASE_URL secret is empty and SKIP_SMOKE_PROD is not 'true'"
+            exit 1
+          fi
+          k6 run tests/load/smoke.js \
+            --env BASE_URL="${PROD_URL}" \
+            --env VUS=1 \
+            --env DURATION=30s
+
+  # === GROUP: notify ===
+
+  notify-failure:
+    name: Notify PROD deploy failure
+    needs: [deploy-prod]
+    if: failure()
+    uses: ./.github/workflows/_notify.yml
+    permissions:
+      contents: read
+      issues: write
+    with:
+      workflow_name: "Deploy to PROD"
+      area: "deploy"
+      severity: "P0"
+      branch: ${{ github.ref_name }}
+      run_url: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+      failure_summary: "PROD deploy failed for release ${{ github.ref_name }}"
+      status: "failure"

package/dist/templates/github/workflows/11-k6-on-demand.yml.ejs

@@ -0,0 +1,43 @@
+name: k6 Load Tests (on-demand)
+
+on:
+  workflow_dispatch:
+    inputs:
+      scenario:
+        description: 'Scenario to run (leave blank to run all)'
+        required: false
+        default: ''
+        type: string
+      target_url:
+        description: 'Base URL of the service under test'
+        required: false
+        default: 'http://localhost:8080'
+        type: string
+      vus:
+        description: 'Override virtual users (leave blank for scenario default)'
+        required: false
+        default: ''
+        type: string
+      duration:
+        description: 'Override duration e.g. 30s, 5m (leave blank for scenario default)'
+        required: false
+        default: ''
+        type: string
+
+permissions:
+  contents: read
+  actions: read
+
+concurrency:
+  group: k6-on-demand-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  k6-load:
+    name: k6 — ${{ inputs.scenario || 'all scenarios' }}
+    uses: ./.github/workflows/_k6-runner.yml
+    with:
+      scenario: ${{ inputs.scenario }}
+      target_url: ${{ inputs.target_url }}
+      vus: ${{ inputs.vus }}
+      duration: ${{ inputs.duration }}

package/dist/templates/github/workflows/12-mutation-scheduled.yml.ejs

@@ -0,0 +1,100 @@
+name: Mutation Testing — Scheduled (T5)
+
+on:
+  schedule:
+    - cron: '0 3 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: mutation-scheduled
+  # Audit run: a cancelled mutation run silently loses its required result (a false-green).
+  cancel-in-progress: false
+
+jobs:
+<% if (locals.language === 'java' || locals.language === 'multi') { %>
+  java-mutation:
+    name: PITest mutation run
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95  # v5.6.0
+        with:
+          distribution: temurin
+          java-version: '21'
+<% if (locals.buildTool === 'gradle') { %>
+      - uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a  # v4
+      - name: PITest mutation (full suite)
+        run: ./gradlew pitest
+<% } else { %>
+      - name: PITest mutation (full suite)
+        run: mvn test-compile org.pitest:pitest-maven:mutationCoverage
+<% } %>
+<% } %>
+<% if (locals.language === 'typescript' || locals.language === 'multi') { %>
+  typescript-mutation:
+    name: Stryker mutation run
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./.github/actions/setup-node-pnpm
+      - name: Stryker mutation (full suite)
+        run: npx stryker run
+<% } %>
+<% if (locals.language === 'rust') { %>
+  rust-mutation:
+    name: cargo-mutants mutation run
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
+      - name: cargo-mutants (full suite)
+        run: |
+          cargo install cargo-mutants --locked
+          cargo mutants --all-features
+<% } %>
+<% if (locals.language === 'python') { %>
+  python-mutation:
+    name: mutmut mutation run
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version-file: .python-version
+      - name: mutmut (full suite)
+        run: |
+          pip install -e ".[dev]" mutmut
+          mutmut run
+          mutmut results
+<% } %>
+<% if (locals.language === 'go') { %>
+  go-mutation:
+    name: go-mutesting mutation run
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
+        with:
+          go-version-file: go.mod
+      - name: go-mutesting (full suite)
+        run: |
+          go install github.com/zimmski/go-mutesting/cmd/go-mutesting@latest
+          go-mutesting ./...
+<% } %>
+<%
+  // Any language without a wired mutation tool above (kept in sync with
+  // src/generators/mutation.ts's supported set). Emits a valid no-op job
+  // rather than an empty `jobs:` map, which GitHub Actions rejects outright.
+  const MUTATION_SUPPORTED_LANGUAGES = ['java', 'typescript', 'rust', 'python', 'go', 'multi']
+%>
+<% if (!MUTATION_SUPPORTED_LANGUAGES.includes(locals.language)) { %>
+  mutation-unsupported:
+    name: Mutation testing not available for this stack
+    runs-on: ubuntu-latest
+    steps:
+      - name: No mutation-testing tool wired for <%= locals.language %>
+        run: echo "arbiter does not yet wire mutation testing for '<%= locals.language %>'"
+<% } %>

package/dist/templates/github/workflows/13-archunit-extended.yml.ejs

@@ -0,0 +1,33 @@
+name: ArchUnit Extended (T5)
+
+on:
+  schedule:
+    - cron: '0 4 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: archunit-extended
+  # Audit run: a cancelled architecture audit silently loses its required result (a false-green).
+  cancel-in-progress: false
+
+jobs:
+  archunit-extended:
+    name: Extended ArchUnit + Modulith verification
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95  # v5.6.0
+        with:
+          distribution: temurin
+          java-version: '21'
+<% if (locals.buildTool === 'gradle') { %>
+      - uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a  # v4
+      - name: Run all architecture tests
+        run: ./gradlew test --tests "*ArchTest" --tests "*ModulesTest"
+<% } else { %>
+      - name: Run all architecture tests
+        run: mvn test -pl . -Dtest="*ArchTest,*ModulesTest"
+<% } %>

package/dist/templates/github/workflows/14-license-scan.yml.ejs

@@ -0,0 +1,45 @@
+name: License Scan (T5)
+
+on:
+  schedule:
+    - cron: '0 5 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: license-scan
+  # Audit run: a cancelled license/compliance scan silently loses its required result (a false-green).
+  cancel-in-progress: false
+
+jobs:
+  license-scan:
+    name: Dependency license compliance scan
+    runs-on: ${{ fromJSON(vars.RUNNER_LABELS_TEST || '["ubuntu-latest"]') }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+<%# #1803: kotlin fell through this strict-equality java/multi check — no
+    dedicated arm, job rendered checkout-only, silently producing no license
+    report. Gradle/Maven license-report plugins operate on the build's
+    dependency graph, not the source language, so kotlin shares this arm
+    (same fix shape as the #1803 fuzz job). -%>
+<% if (locals.language === 'java' || locals.language === 'kotlin' || locals.language === 'multi') { %>
+      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95  # v5.6.0
+        with:
+          distribution: temurin
+          java-version: '21'
+<% if (locals.buildTool === 'gradle') { %>
+      - uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a  # v4
+      - name: License report (Gradle)
+        run: ./gradlew generateLicenseReport
+<% } else { %>
+      - name: License report (Maven)
+        run: mvn license:aggregate-add-third-party
+<% } %>
+<% } %>
+<% if (locals.language === 'typescript' || locals.language === 'multi') { %>
+      - uses: ./.github/actions/setup-node-pnpm
+      - name: License check (license-checker)
+        run: npx license-checker --onlyAllow 'MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD;CC0-1.0;Unlicense'
+<% } %>

package/dist/templates/github/workflows/15-codeql.yml.ejs

@@ -0,0 +1,117 @@
+<%
+const _cm = (typeof collaborationMode !== 'undefined' ? collaborationMode : 'peer-review');
+const _runner = (_cm === 'gated-review' && isL3Plus)
+  ? "${{ vars.CI_BUILD_RUNNER_LABEL || 'ubuntu-latest' }}"
+  : "${{ fromJSON(vars.RUNNER_LABELS_TEST || '[\"ubuntu-latest\"]') }}";
+// #1624: a single immutable language string defaulting to 'javascript-typescript' false-greens
+// the entire compiled-language backend of a polyglot (language === 'multi') repo - CodeQL would
+// scan only the TS frontend while the JVM backend goes unscanned behind a passing check. Resolve
+// the FULL set of CodeQL languages the detected stack contains and analyze each as its own matrix
+// leg, so every language present is actually scanned. `multi` is the TS-frontend + JVM-backend
+// monorepo (src/detectors/language.ts) - treat it as the superset of its parts, never a single
+// interpreted language. `kotlin` maps to CodeQL's java-kotlin pack (a bare 'kotlin' fell through
+// to the TS default before, scanning a Kotlin codebase as TypeScript).
+const _codeqlLangMap = {
+  typescript: ['javascript-typescript'],
+  java: ['java-kotlin'],
+  kotlin: ['java-kotlin'],
+  go: ['go'],
+  python: ['python'],
+  multi: ['java-kotlin', 'javascript-typescript'],
+};
+const _codeqlLangs = _codeqlLangMap[language] || ['javascript-typescript'];
+// For `multi` the JVM build lives under backend/ (not the repo root); single-language JVM stacks
+// build at the root. CodeQL must compile the JVM leg to trace it, so point the build there.
+const _jvmDir = (language === 'multi') ? 'backend' : null;
+-%>
+name: CodeQL SAST (T1)
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 4 * * 1'
+
+permissions:
+  contents: read
+  security-events: write
+
+concurrency:
+  group: codeql-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: CodeQL analysis (${{ matrix.language }})
+    runs-on: <%- _runner %>
+    timeout-minutes: 30
+    strategy:
+      # One leg per CodeQL language present in the stack. fail-fast: false so a build break in
+      # one language leg does not mask (cancel) the SAST of the others (#1624).
+      fail-fast: false
+      matrix:
+        language: <%- JSON.stringify(_codeqlLangs) %>
+    steps:
+      # #1311: self-hosted persistent workspaces can keep a stale
+      # .git/refs/**/*.lock from an interrupted run, which makes the
+      # deep checkout below fail with "cannot lock ref". No-op on
+      # ephemeral runners.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@4f3212b61783c3c68e8309a0f18a699764811cda # v3.28.8
+        with:
+          languages: ${{ matrix.language }}
+<% if (_codeqlLangs.includes('java-kotlin')) { -%>
+
+      - name: Set up Java
+        if: matrix.language == 'java-kotlin'
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        with:
+          distribution: temurin
+          java-version: '21'
+<% if (buildTool === 'gradle') { -%>
+      - name: Set up Gradle
+        if: matrix.language == 'java-kotlin'
+        uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4
+      - name: Build (Gradle)
+        if: matrix.language == 'java-kotlin'
+<% if (_jvmDir) { -%>
+        working-directory: <%- _jvmDir %>
+<% } -%>
+        run: ./gradlew classes testClasses
+<% } else { -%>
+      - name: Build (Maven)
+        if: matrix.language == 'java-kotlin'
+<% if (_jvmDir) { -%>
+        working-directory: <%- _jvmDir %>
+<% } -%>
+        run: mvn compile test-compile -DskipTests
+<% } -%>
+<% } -%>
+<% if (_codeqlLangs.includes('go')) { -%>
+
+      - name: Set up Go
+        if: matrix.language == 'go'
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+      - name: Build (Go)
+        if: matrix.language == 'go'
+        run: go build ./...
+<% } -%>
+<% if (_codeqlLangs.includes('javascript-typescript')) { -%>
+
+      - name: Set up Node
+        if: matrix.language == 'javascript-typescript'
+        uses: ./.github/actions/setup-node-pnpm
+<% } -%>
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@4f3212b61783c3c68e8309a0f18a699764811cda # v3.28.8
+        with:
+          category: '/language:${{ matrix.language }}'

package/dist/templates/github/workflows/16-frontend-quality.yml.ejs

@@ -0,0 +1,154 @@
+<%
+const _cm = (typeof collaborationMode !== 'undefined' ? collaborationMode : 'peer-review');
+const _runner = (_cm === 'gated-review' && isL3Plus)
+  ? "${{ vars.CI_BUILD_RUNNER_LABEL || 'ubuntu-latest' }}"
+  : "${{ fromJSON(vars.RUNNER_LABELS_TEST || '[\"ubuntu-latest\"]') }}";
+%>name: Frontend Quality (T1)
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - 'src/**'
+      - 'public/**'
+      - '*.html'
+      - '*.css'
+      - 'package.json'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: frontend-quality-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  lighthouse:
+    name: Lighthouse CI
+    runs-on: <%- _runner %>
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+<% if (language === 'typescript') { -%>
+          node-version-file: .nvmrc
+          cache: npm
+<% } else { -%>
+          node-version-file: .nvmrc
+          package-manager-cache: false
+<% } -%>
+
+      - run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Lighthouse CI (lhci)
+        uses: treosh/lighthouse-ci-action@1b2e9e309eb8f43e89dc9f6ee37ab38f449e47ef # v12.1.0
+        with:
+          configPath: '.lighthouserc.json'
+          uploadArtifacts: true
+          temporaryPublicStorage: false
+
+  axe-accessibility:
+    name: axe accessibility (WCAG 2.2, INV-61)
+    runs-on: <%- _runner %>
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+<% if (language === 'typescript') { -%>
+          node-version-file: .nvmrc
+          cache: npm
+<% } else { -%>
+          node-version-file: .nvmrc
+          package-manager-cache: false
+<% } -%>
+
+      - run: npm ci
+
+      - name: Install Playwright browsers
+        run: npx playwright install --with-deps chromium
+
+      - name: Build
+        run: npm run build
+
+      - name: Resolve E2E start command
+        id: axe-e2e-start
+        run: |
+          if [[ -n "${E2E_START_CMD:-}" ]] || node -e "const fs = require('node:fs'); try { const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8')); process.exit(typeof pkg.scripts?.['start:test'] === 'string' && pkg.scripts['start:test'].trim() ? 0 : 1); } catch { process.exit(1); }"; then
+            echo "available=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "available=false" >> "$GITHUB_OUTPUT"
+            echo "SKIP: E2E_START_CMD unset and package.json has no start:test script"
+          fi
+
+      - name: axe accessibility (Playwright E2E, WCAG 2.2 AA, INV-61)
+        # Routes through the Playwright a11y spec which uses the generated
+        # run-axe.ts wrapper with wcag2a+wcag2aa+wcag21a+wcag21aa+wcag22aa tags.
+        # ephemeral-server starts the app, polls port readiness, runs spec, tears down.
+        # Hard gate: a11y failures block the PR (INV-61). No soft-fail permitted.
+        if: steps.axe-e2e-start.outputs.available == 'true'
+        run: |
+          node scripts/lib/ephemeral-server.mjs \
+            --start "${E2E_START_CMD:-npm run start:test}" \
+            --test "npx playwright test tests/e2e/a11y.spec.ts" \
+            --port "${E2E_PORT:-4173}"
+        env:
+          E2E_BASE_URL: "http://localhost:${{ vars.E2E_PORT || '4173' }}"
+
+  render-smoke:
+    name: render smoke (behavioural gate, INV-127)
+    runs-on: <%- _runner %>
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+<% if (language === 'typescript') { -%>
+          node-version-file: .nvmrc
+          cache: npm
+<% } else { -%>
+          node-version-file: .nvmrc
+          package-manager-cache: false
+<% } -%>
+
+      - run: npm ci
+
+      # Presence gate first: a frontend project with no render-smoke spec FAILs
+      # here (fail-closed) before we build — catches a known failure mode from a prior internal project.
+      - name: render-smoke presence (INV-127)
+        run: node scripts/check-render-smoke.mjs
+
+      - name: Install Playwright browsers
+        run: npx playwright install --with-deps chromium
+
+      - name: Build
+        run: npm run build
+
+      - name: Resolve E2E start command
+        id: render-smoke-e2e-start
+        run: |
+          if [[ -n "${E2E_START_CMD:-}" ]] || node -e "const fs = require('node:fs'); try { const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8')); process.exit(typeof pkg.scripts?.['start:test'] === 'string' && pkg.scripts['start:test'].trim() ? 0 : 1); } catch { process.exit(1); }"; then
+            echo "available=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "available=false" >> "$GITHUB_OUTPUT"
+            echo "SKIP: E2E_START_CMD unset and package.json has no start:test script"
+          fi
+
+      - name: render smoke (Playwright E2E — app shell mounts, no console errors)
+        # Boots the BUILT SPA via ephemeral-server, runs the render-smoke spec.
+        # Hard gate: a broken-layout / console-error render blocks the PR (INV-127).
+        if: steps.render-smoke-e2e-start.outputs.available == 'true'
+        run: |
+          node scripts/lib/ephemeral-server.mjs \
+            --start "${E2E_START_CMD:-npm run start:test}" \
+            --test "npx playwright test tests/e2e/render-smoke.spec.ts" \
+            --port "${E2E_PORT:-4173}"
+        env:
+          E2E_BASE_URL: "http://localhost:${{ vars.E2E_PORT || '4173' }}"

package/dist/templates/github/workflows/17-ossf-scorecard.yml.ejs

@@ -0,0 +1,46 @@
+<%
+const _cm = (typeof collaborationMode !== 'undefined' ? collaborationMode : 'gated-review');
+const _runner = (_cm === 'gated-review' && isL3Plus)
+  ? "${{ vars.CI_BUILD_RUNNER_LABEL || 'ubuntu-latest' }}"
+  : "${{ fromJSON(vars.RUNNER_LABELS_TEST || '[\"ubuntu-latest\"]') }}";
+%>name: OSSF Scorecard
+
+on:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '0 5 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+  id-token: write
+
+concurrency:
+  group: scorecard
+  cancel-in-progress: false
+
+jobs:
+  analyze:
+    name: Scorecard analysis
+    runs-on: <%- _runner %>
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run OSSF Scorecard
+        uses: ossf/scorecard-action@ff5dd8929f96a8a4dc67d13f32b8c75057829621 # v2.4.0
+        with:
+          results_file: scorecard-results.sarif
+          results_format: sarif
+          publish_results: false
+
+      - name: Upload Scorecard results to code-scanning
+        uses: github/codeql-action/upload-sarif@4f3212b61783c3c68e8309a0f18a699764811cda # v3.28.8
+        with:
+          sarif_file: scorecard-results.sarif
+          category: ossf-scorecard