@mouryaamit/nx-polystack 0.0.0-stage → 1.0.1

package/dist/src/generators/infra/files/ci/common/tools/scripts/check-cycles.js__template__

@@ -0,0 +1,201 @@
+#!/usr/bin/env node
+/**
+ * tools/scripts/check-cycles.js — generated by nx-polystack (pstack infra).
+ *
+ * Fails when the Nx project graph has a dependency cycle that is not in
+ * tools/config/allowed-cycles.json. Plain Node, no dependencies.
+ *
+ *   npm run check:cycles          reads the graph with `npx nx graph --file=<tmp>.json`
+ *   node tools/scripts/check-cycles.js --graph=<file.json>
+ *                                 reads an existing graph file instead
+ *
+ * A cycle is a group of projects that all depend on each other, directly or indirectly (a strongly
+ * connected component), or a project that depends on itself. The allowlist holds one array of
+ * project names per known cycle, in any order: [["app-a", "lib-b"], ...]. External npm packages
+ * ("npm:" nodes) are ignored.
+ */
+'use strict';
+
+const { execSync } = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const ALLOWLIST = path.join('tools', 'config', 'allowed-cycles.json');
+
+/**
+ * Project-to-project edges from `nx graph --file` output (Nx 17:
+ * { graph: { nodes, dependencies: { [project]: [{ source, target, type }] } } }).
+ * Only edges between workspace projects are kept.
+ */
+function readProjectGraph(json) {
+  const graph = (json && json.graph) || json || {};
+  const nodes = Object.keys(graph.nodes || {});
+  const known = new Set(nodes);
+  const deps = graph.dependencies || {};
+  const edges = {};
+  for (const name of nodes) {
+    const targets = (deps[name] || [])
+      .map((d) => d && d.target)
+      .filter((t) => typeof t === 'string' && !t.startsWith('npm:') && known.has(t));
+    edges[name] = [...new Set(targets)].sort();
+  }
+  return edges;
+}
+
+/**
+ * Cycles in the graph (Tarjan's strongly connected components): every component with more than
+ * one project, plus single projects that depend on themselves. Members sorted; cycles sorted.
+ */
+function findCycles(edges) {
+  let index = 0;
+  const indexOf = new Map();
+  const low = new Map();
+  const stack = [];
+  const onStack = new Set();
+  const found = [];
+
+  const connect = (v) => {
+    indexOf.set(v, index);
+    low.set(v, index);
+    index += 1;
+    stack.push(v);
+    onStack.add(v);
+    for (const w of edges[v] || []) {
+      if (!indexOf.has(w)) {
+        connect(w);
+        low.set(v, Math.min(low.get(v), low.get(w)));
+      } else if (onStack.has(w)) {
+        low.set(v, Math.min(low.get(v), indexOf.get(w)));
+      }
+    }
+    if (low.get(v) === indexOf.get(v)) {
+      const component = [];
+      let w;
+      do {
+        w = stack.pop();
+        onStack.delete(w);
+        component.push(w);
+      } while (w !== v);
+      if (component.length > 1 || (edges[v] || []).includes(v)) found.push(component.sort());
+    }
+  };
+
+  for (const v of Object.keys(edges).sort()) {
+    if (!indexOf.has(v)) connect(v);
+  }
+  return found.sort((a, b) => key(a).localeCompare(key(b)));
+}
+
+function key(members) {
+  return [...members].sort().join('\u0000');
+}
+
+/** Cycles that are not in the allowlist (compared as sets of project names). */
+function newCycles(found, allowed) {
+  const ok = new Set(allowed.map(key));
+  return found.filter((c) => !ok.has(key(c)));
+}
+
+/** Allowlist entries that no longer match a cycle. */
+function staleAllowed(found, allowed) {
+  const present = new Set(found.map(key));
+  return allowed.filter((c) => !present.has(key(c)));
+}
+
+/** One concrete loop through a cycle's members, for printing: a -> b -> c -> a. */
+function cyclePath(edges, members) {
+  const inCycle = new Set(members);
+  const start = members[0];
+  if ((edges[start] || []).includes(start)) return [start, start];
+  const prev = new Map();
+  const queue = [start];
+  while (queue.length > 0) {
+    const v = queue.shift();
+    for (const w of edges[v] || []) {
+      if (!inCycle.has(w)) continue;
+      if (w === start) {
+        const loop = [start];
+        for (let x = v; x !== start; x = prev.get(x)) loop.splice(1, 0, x);
+        return [...loop, start];
+      }
+      if (!prev.has(w)) {
+        prev.set(w, v);
+        queue.push(w);
+      }
+    }
+  }
+  return [...members, start];
+}
+
+function readAllowlist(root) {
+  const file = path.join(root, ALLOWLIST);
+  if (!fs.existsSync(file)) return [];
+  const value = JSON.parse(fs.readFileSync(file, 'utf8'));
+  const valid =
+    Array.isArray(value) &&
+    value.every((c) => Array.isArray(c) && c.length > 0 && c.every((p) => typeof p === 'string'));
+  if (!valid) {
+    throw new Error(
+      `${ALLOWLIST} must be an array of arrays of project names, e.g. [["app-a", "lib-b"]].`,
+    );
+  }
+  return value;
+}
+
+function readGraphFromNx() {
+  const file = path.join(os.tmpdir(), `nx-graph-${process.pid}-${Date.now()}.json`);
+  try {
+    execSync(`npx nx graph --file="${file}"`, { stdio: ['ignore', 'pipe', 'pipe'] });
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+  } catch (err) {
+    const out = [err.stdout, err.stderr].filter(Boolean).join('\n');
+    throw new Error(`"nx graph" failed.${out ? `\n${out}` : ''}`);
+  } finally {
+    fs.rmSync(file, { force: true });
+  }
+}
+
+function main(argv) {
+  const graphArg = argv.find((a) => a.startsWith('--graph='));
+  let edges;
+  let allowed;
+  try {
+    const json = graphArg
+      ? JSON.parse(fs.readFileSync(graphArg.slice('--graph='.length), 'utf8'))
+      : readGraphFromNx();
+    edges = readProjectGraph(json);
+    allowed = readAllowlist(process.cwd());
+  } catch (err) {
+    console.error(`check-cycles: ${err.message}`);
+    return 2;
+  }
+
+  const found = findCycles(edges);
+  const fresh = newCycles(found, allowed);
+  for (const c of staleAllowed(found, allowed)) {
+    const entry = JSON.stringify(c);
+    console.log(`check-cycles: ${entry} is no longer a cycle; remove it from ${ALLOWLIST}.`);
+  }
+  if (fresh.length === 0) {
+    const known = found.length - fresh.length;
+    console.log(
+      `check-cycles: No new dependency cycles (${Object.keys(edges).length} projects` +
+        `${known > 0 ? `, ${known} allowed cycle(s)` : ''}).`,
+    );
+    return 0;
+  }
+  console.error(`check-cycles: ${fresh.length} new dependency cycle(s):`);
+  for (const c of fresh) console.error(`  ${cyclePath(edges, c).join(' -> ')}`);
+  const example = JSON.stringify(fresh[0]);
+  console.error(
+    `\nBreak the cycle, or add a known, accepted one (e.g. ${example}) to ${ALLOWLIST}.`,
+  );
+  return 1;
+}
+
+module.exports = { readProjectGraph, findCycles, newCycles, staleAllowed, cyclePath };
+
+if (require.main === module) {
+  process.exitCode = main(process.argv.slice(2));
+}

package/dist/src/generators/infra/files/ci/github-actions/.github/workflows/ci.yml__template__

@@ -0,0 +1,68 @@
+# Generated by nx-polystack (pstack infra). Lint, test and build what changed, then check for
+# new project dependency cycles.
+<%_ if (flutter) { _%>
+# The workspace has Flutter projects, so the Flutter SDK (stable channel) is set up as well.
+<%_ } else { _%>
+# No Flutter projects when this was generated: after adding one, run `pstack infra --with=ci --force`
+# (or `--flutter=on`) to add the Flutter setup step.
+<%_ } _%>
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [<%= baseBranch %>]
+
+permissions:
+  actions: read
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  main:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+<%_ if (flutter) { _%>
+      - uses: subosito/flutter-action@v2
+        with:
+          channel: stable
+          cache: true
+<%_ } _%>
+<%_ if (pluginFromGithub) { _%>
+      # The nx-polystack plugin is installed from a private GitHub repo. Add a repository secret
+      # PSTACK_REPO_TOKEN (a token that can read that repo) so npm ci can fetch it.
+      - name: Allow npm to fetch the private nx-polystack plugin
+        env:
+          PSTACK_REPO_TOKEN: ${{ secrets.PSTACK_REPO_TOKEN }}
+        run: |
+          if [ -n "$PSTACK_REPO_TOKEN" ]; then
+            git config --global url."https://x-access-token:${PSTACK_REPO_TOKEN}@github.com/".insteadOf "ssh://git@github.com/"
+            git config --global --add url."https://x-access-token:${PSTACK_REPO_TOKEN}@github.com/".insteadOf "git@github.com:"
+          fi
+<%_ } _%>
+      - run: npm ci
+<%_ if (ciCache) { _%>
+      - name: Nx cache
+        uses: actions/cache@v4
+        with:
+          path: <%= cacheDirectory %>
+          key: nx-${{ runner.os }}-${{ hashFiles('package-lock.json') }}-${{ github.sha }}
+          restore-keys: |
+            nx-${{ runner.os }}-${{ hashFiles('package-lock.json') }}-
+            nx-${{ runner.os }}-
+<%_ } _%>
+      - uses: nrwl/nx-set-shas@v4
+        with:
+          main-branch-name: <%= baseBranch %>
+      - run: npx nx affected -t lint typecheck test build --parallel=3
+      - run: npm run check:cycles

package/dist/src/generators/infra/files/ci/github-actions/.github/workflows/pr-title.yml__template__

@@ -0,0 +1,36 @@
+# Generated by nx-polystack (pstack infra). The pull request title becomes the squash-merge
+# commit message, so it must pass the same commitlint rules as every commit.
+name: PR title
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize]
+
+permissions:
+  contents: read
+
+jobs:
+  commitlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+<%_ if (pluginFromGithub) { _%>
+      # See ci.yml: PSTACK_REPO_TOKEN lets npm ci fetch the private nx-polystack plugin.
+      - name: Allow npm to fetch the private nx-polystack plugin
+        env:
+          PSTACK_REPO_TOKEN: ${{ secrets.PSTACK_REPO_TOKEN }}
+        run: |
+          if [ -n "$PSTACK_REPO_TOKEN" ]; then
+            git config --global url."https://x-access-token:${PSTACK_REPO_TOKEN}@github.com/".insteadOf "ssh://git@github.com/"
+            git config --global --add url."https://x-access-token:${PSTACK_REPO_TOKEN}@github.com/".insteadOf "git@github.com:"
+          fi
+<%_ } _%>
+      - run: npm ci
+      - name: Check the title with commitlint
+        env:
+          TITLE: ${{ github.event.pull_request.title }}
+        run: echo "$TITLE" | npx --no-install commitlint

package/dist/src/generators/infra/files/ci/jenkins/Jenkinsfile__template__

@@ -0,0 +1,45 @@
+// Generated by nx-polystack (pstack infra).
+// Lints, tests and builds the projects affected by the change, then checks for new project
+// dependency cycles. Pull requests compare against their target branch (CHANGE_TARGET); builds of
+// <%= baseBranch %> compare against the previous commit; other branches against <%= baseBranch %>.
+<%_ if (flutter) { _%>
+// The workspace has Flutter projects: Flutter must be on the agent's PATH.
+<%_ } _%>
+pipeline {
+  agent any
+
+  options {
+    timestamps()
+    timeout(time: 60, unit: 'MINUTES')
+    buildDiscarder(logRotator(numToKeepStr: '20'))
+  }
+
+  environment {
+    BASE_BRANCH = "${env.CHANGE_TARGET ?: '<%= baseBranch %>'}"
+    NX_BASE = "${env.CHANGE_TARGET ? 'origin/' + env.CHANGE_TARGET : (env.BRANCH_NAME == '<%= baseBranch %>' ? 'HEAD~1' : 'origin/<%= baseBranch %>')}"
+  }
+
+  stages {
+    stage('Install') {
+      steps {
+<%_ if (flutter) { _%>
+        sh 'flutter --version'
+<%_ } _%>
+        sh 'npm ci'
+      }
+    }
+
+    stage('Lint, test, build (affected)') {
+      steps {
+        sh 'git fetch --no-tags origin "+refs/heads/${BASE_BRANCH}:refs/remotes/origin/${BASE_BRANCH}"'
+        sh 'npx nx affected -t lint typecheck test build --parallel=3 --base="${NX_BASE}" --head=HEAD'
+      }
+    }
+
+    stage('Dependency cycles') {
+      steps {
+        sh 'npm run check:cycles'
+      }
+    }
+  }
+}

package/dist/src/generators/infra/files/docs/.github/ISSUE_TEMPLATE/bug.yml__template__

@@ -0,0 +1,39 @@
+name: Bug report
+description: Something does not work as expected.
+title: 'bug: '
+labels: ['bug']
+body:
+  - type: input
+    id: affected
+    attributes:
+      label: Affected app or library
+      description: The Nx project name, for example the app or lib folder name.
+    validations:
+      required: true
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: What did you see, and what did you expect instead?
+    validations:
+      required: true
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Go to …
+        2. Click …
+        3. See …
+    validations:
+      required: true
+  - type: input
+    id: environment
+    attributes:
+      label: Environment
+      description: Environment, browser or device, and version or commit.
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs or screenshots
+      description: Remove any secrets or personal data first.

package/dist/src/generators/infra/files/docs/.github/ISSUE_TEMPLATE/config.yml__template__

@@ -0,0 +1 @@
+blank_issues_enabled: false

package/dist/src/generators/infra/files/docs/.github/ISSUE_TEMPLATE/feature.yml__template__

@@ -0,0 +1,23 @@
+name: Feature request
+description: Suggest a change or a new capability.
+title: 'feat: '
+labels: ['enhancement']
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What problem would this solve, and for whom?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: What should change? Include any apps or libraries affected.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered

package/dist/src/generators/infra/files/docs/.github/PULL_REQUEST_TEMPLATE.md__template__

@@ -0,0 +1,23 @@
+## Summary
+
+<!-- What does this change and why? -->
+
+## Ticket
+
+<!-- Ticket ID or link -->
+
+## Type
+
+- [ ] Feature
+- [ ] Fix
+- [ ] Refactor
+- [ ] Docs
+- [ ] Chore / CI
+
+## Checklist
+
+- [ ] The title follows Conventional Commits, with the ticket as the scope (`feat(<ticket>): …`)
+- [ ] `npx nx affected -t lint typecheck test build` passes
+- [ ] No secrets, keys or plaintext environment values are committed
+- [ ] Docs are updated
+- [ ] Screenshots attached for UI changes

package/dist/src/generators/infra/files/docs/CODE_OF_CONDUCT.md__template__

@@ -0,0 +1,18 @@
+# Code of Conduct
+
+## Our pledge
+
+We want this project to be a harassment-free experience for everyone. We act and speak in ways
+that keep our community open, welcoming, diverse, inclusive and healthy.
+
+## Our standard
+
+This project adopts the
+[Contributor Covenant, version 2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/)
+as its code of conduct. The full text, including the standards of behaviour, the enforcement
+responsibilities and the enforcement guidelines, applies here.
+
+## Reporting
+
+Report unacceptable behaviour to <conduct-contact>. All reports are reviewed promptly and fairly,
+and the privacy and security of the reporter are respected.

package/dist/src/generators/infra/files/docs/CONTRIBUTING.md__template__

@@ -0,0 +1,61 @@
+# Contributing
+
+Thanks for helping. This workspace is an Nx monorepo built with nx-polystack; the steps below keep
+every app and library consistent.
+
+## Branches and pull requests
+
+1. Branch from `<%= baseBranch %>`: `feature-<ticket>` (for example `feature-ABC-123`).
+2. Keep each pull request small and focused on one ticket.
+3. Open the pull request against `<%= baseBranch %>`. CI must pass and a reviewer must approve
+   before it is merged.
+
+## Commit messages
+
+Use [Conventional Commits](https://www.conventionalcommits.org/) with the ticket as the scope:
+
+```text
+feat(<ticket>): add the order summary page
+fix(<ticket>): keep the session after a token refresh
+docs(<ticket>): explain the release steps
+```
+
+Common types: `feat`, `fix`, `docs`, `refactor`, `test`, `chore`, `ci`, `perf`. Commit messages
+are checked by commitlint on commit, and pull request titles are checked in CI.
+
+## Adding apps, libraries and environments
+
+Use the generators so tags, tsconfig paths and npm scripts stay consistent:
+
+```bash
+pstack app --type=<angular|ionic|flutter> --name=<name>
+pstack lib --type=<type> --name=<name>
+pstack env --name=<env>
+pstack llm      # refresh the generated block in the AI-assistant files
+```
+
+## Before you push
+
+```bash
+npm run lint                               # lint the workspace
+npx nx affected -t lint typecheck test build   # lint, type-check, test and build what changed
+npm run check:cycles                       # fail on new project dependency cycles
+npm run stale-code                         # report unused files, exports and dependencies
+```
+
+The pre-push hook runs `npm run check:prepush`: a secret scan that blocks the push, then a
+dependency audit that only warns. Run `npm run check:audit` for the strict audit (it fails on
+high or critical advisories).
+
+## Pull request checklist
+
+- [ ] The title follows Conventional Commits, with the ticket as the scope.
+- [ ] Lint, tests and build pass.
+- [ ] No secrets, keys or plaintext environment values are committed.
+- [ ] Docs are updated when behaviour changes.
+- [ ] UI changes include screenshots.
+
+## Code of conduct and security
+
+Read the [Code of Conduct](CODE_OF_CONDUCT.md). Report vulnerabilities as described in
+[SECURITY.md](SECURITY.md), never in a public issue.

package/dist/src/generators/infra/files/docs/SECURITY.md__template__

@@ -0,0 +1,25 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Do not open a public issue for a security problem. Report it privately to <security-contact>
+with:
+
+- what is affected (app, library, version or commit),
+- how to reproduce it,
+- the impact you expect.
+
+You will get an acknowledgement, and updates until the issue is resolved.
+
+## Supported versions
+
+Only the latest release of each app, built from `<%= baseBranch %>`, receives security fixes.
+
+## Secrets
+
+- Environment files are encrypted at build time; never commit plaintext secrets, keys or
+  tokens.
+- `.env` files are never committed.
+- The pre-push hook (`npm run check:prepush`) runs a secret scan, which blocks the push, and a
+  warn-only `npm audit`. Do not skip it. `npm run check:audit` is the strict audit.
+- If a secret is committed, treat it as leaked: revoke and rotate it, then remove it from history.

package/dist/src/generators/infra/files/quality/.husky/pre-push__template__

@@ -0,0 +1,2 @@
+<%= prepushMarker %>
+npm run check:prepush

package/dist/src/generators/infra/files/quality/.secretlintignore__template__

@@ -0,0 +1,7 @@
+node_modules
+dist
+.nx
+.angular
+coverage
+tmp
+package-lock.json

package/dist/src/generators/infra/files/quality/.secretlintrc.json__template__

@@ -0,0 +1,7 @@
+{
+  "rules": [
+    {
+      "id": "@secretlint/secretlint-rule-preset-recommend"
+    }
+  ]
+}

package/dist/src/generators/infra/files/quality/knip.json__template__

@@ -0,0 +1,9 @@
+{
+  "$schema": "https://unpkg.com/knip@5/schema.json",
+  "entry": ["apps/**/src/main.ts", "libs/**/src/index.ts", "tools/**/*.js"],
+  "project": ["apps/**/*.{js,ts}", "libs/**/*.{js,ts}", "tools/**/*.js"],
+<%_ if (flutter) { _%>
+  "ignoreBinaries": ["flutter", "dart"],
+<%_ } _%>
+  "ignoreDependencies": ["<%= pluginName %>"]
+}

package/dist/src/generators/infra/files/upgrades/.github/workflows/dependency-upgrade.yml__template__

@@ -0,0 +1,80 @@
+# Generated by nx-polystack (pstack infra). Upgrades dependencies on a schedule and opens (or
+# updates) a pull request with the result.
+#
+# Needs:
+<%_ if (pluginFromGithub) { _%>
+# - Repository secret PSTACK_REPO_TOKEN: a token that can read <%= pluginRepo %> (the plugin
+#   repo is private). Used by npm to install the plugin and by gh to find its latest release.
+<%_ } _%>
+# - Settings > Actions > General > "Allow GitHub Actions to create and approve pull requests".
+# Pull requests opened with the default GITHUB_TOKEN do not start other workflows; close and
+# reopen the pull request (or push to its branch) to run CI on it.
+name: Dependency upgrade
+
+on:
+  schedule:
+    - cron: '<%= upgradeCron %>' # <%= upgradeSchedule %>, UTC
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  upgrade:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: <%= baseBranch %>
+      - uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+<%_ if (pluginFromGithub) { _%>
+      - name: Allow npm to fetch the private nx-polystack plugin
+        env:
+          PSTACK_REPO_TOKEN: ${{ secrets.PSTACK_REPO_TOKEN }}
+        run: |
+          if [ -z "$PSTACK_REPO_TOKEN" ]; then
+            echo "::error::Add the PSTACK_REPO_TOKEN repository secret (read access to <%= pluginRepo %>)."
+            exit 1
+          fi
+          git config --global url."https://x-access-token:${PSTACK_REPO_TOKEN}@github.com/".insteadOf "ssh://git@github.com/"
+          git config --global --add url."https://x-access-token:${PSTACK_REPO_TOKEN}@github.com/".insteadOf "git@github.com:"
+<%_ } _%>
+      - run: npm ci
+      - name: Upgrade nx-polystack to its latest release
+<%_ if (pluginFromGithub) { _%>
+        env:
+          GH_TOKEN: ${{ secrets.PSTACK_REPO_TOKEN }}
+        run: |
+          latest=$(gh release view --repo <%= pluginRepo %> --json tagName --jq .tagName)
+          npx --no-install pstack update --to="${latest#v}" --allow-dirty
+<%_ } else { _%>
+        run: |
+          latest=$(npm view <%= pluginName %> version)
+          npx --no-install pstack update --to="${latest}" --allow-dirty
+<%_ } _%>
+<%_ if (upgradeScope === 'nx-minor') { _%>
+      - name: Upgrade Nx within its current major
+        run: |
+          major=$(node -p "require('nx/package.json').version.split('.')[0]")
+          npx nx migrate "nx@${major}"
+          npm install
+          if [ -f migrations.json ]; then
+            npx nx migrate --run-migrations
+            rm migrations.json
+          fi
+<%_ } _%>
+      - uses: peter-evans/create-pull-request@v6
+        with:
+          branch: chore/dependency-upgrade
+          base: <%= baseBranch %>
+          title: 'chore(deps): scheduled dependency upgrade'
+          commit-message: 'chore(deps): scheduled dependency upgrade'
+          body: |
+            Scheduled dependency upgrade (<%= upgradeScope %>), opened by the dependency-upgrade workflow.
+
+            Review the changes and the CI result before merging.
+          delete-branch: true