@next-friday/create-app 0.0.0-stage → 1.0.0

package/templates/nodejs/src/server.ts

@@ -0,0 +1,37 @@
+import {createServer} from "node:http";
+import type {Server} from "node:http";
+
+/**
+ * Create the HTTP server. `GET` or `HEAD` `/health` reports that the process is up; every other request gets 404.
+ * @returns A server that is not listening yet.
+ */
+export function createAppServer(): Server {
+  return createServer((request, response) => {
+    const {pathname} = new URL(request.url ?? "/", "http://localhost");
+
+    if (pathname === "/health" && (request.method === "GET" || request.method === "HEAD")) {
+      response.writeHead(200, {
+        "Cache-Control": "no-store",
+        "Content-Type": "application/json",
+      });
+
+      response.end(
+        JSON.stringify({
+          status: "ok",
+        }),
+      );
+
+      return;
+    }
+
+    response.writeHead(404, {
+      "Content-Type": "application/json",
+    });
+
+    response.end(
+      JSON.stringify({
+        status: "not found",
+      }),
+    );
+  });
+}

package/templates/nodejs/tsconfig.build.json

@@ -0,0 +1,9 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "rootDir": "./src",
+    "types": ["node"]
+  },
+  "include": ["src"],
+  "exclude": ["node_modules", "test", "dist", "**/*.test.ts"]
+}

package/templates/nodejs/tsconfig.json

@@ -0,0 +1,19 @@
+{
+  "compilerOptions": {
+    "target": "ES2023",
+    "module": "nodenext",
+    "isolatedModules": true,
+    "removeComments": true,
+    "incremental": true,
+    "resolveJsonModule": true,
+    "skipLibCheck": true,
+    "sourceMap": true,
+    "outDir": "./dist",
+    "rootDir": ".",
+    "types": ["node"],
+    "strict": true,
+    "rewriteRelativeImportExtensions": true
+  },
+  "include": ["**/*.ts"],
+  "exclude": ["node_modules", "dist"]
+}

package/templates/nodejs/vitest.config.ts

@@ -0,0 +1,12 @@
+import {defineConfig} from "vitest/config";
+
+export default defineConfig({
+  test: {
+    coverage: {
+      reporter: ["text", "html", "cobertura"],
+      include: ["src/**/*.ts"],
+      exclude: ["src/**/*.test.ts", "src/main.ts"],
+    },
+    include: ["src/**/*.test.ts"],
+  },
+});

package/templates/payload/.agents/rules/typescript-first.md

@@ -0,0 +1,7 @@
+# TypeScript-First
+
+In a TypeScript-capable app or package, write source, tests, and scripts as `.ts`, and JSX as `.tsx`. Use that extension for new work and for any JavaScript file whose implementation this change already touches, then update its imports, scripts, tests, and configuration in the same change.
+
+Keep other languages in separately maintained components. Use a non-TypeScript extension when the runtime, tool, or public contract requires it.
+
+_Completion criterion_: Every file this change created or materially rewrote in a TypeScript-capable project uses the TypeScript extension the runtime accepts, and its imports and scripts resolve.

package/templates/payload/.agents/rules.json

@@ -0,0 +1,41 @@
+{
+  "automation-owned-checks": {
+    "description": "Owned checks: hooks and CI define what must pass; run checks by hand to verify"
+  },
+  "code-comments": {
+    "description": "Required comments: comment only where a tool or rule needs it, or for a reason the code cannot show"
+  },
+  "current-state-authority": {
+    "description": "Current state: implement from user requirements and the working tree"
+  },
+  "demand-driven-configuration": {
+    "description": "Demand-driven configuration: add a setting only for an active requirement"
+  },
+  "dependency-security": {
+    "description": "Dependencies: add a package only when code or a contract uses it",
+    "globs": ["package.json", "pnpm-lock.yaml", "pnpm-workspace.yaml"]
+  },
+  "deterministic-testing": {
+    "description": "Test admission: add a case only when it catches a defect current tests miss",
+    "globs": ["**/*.test.ts", "**/*.test.tsx"]
+  },
+  "diagnostics-and-error-handling": {
+    "description": "Diagnostics: fix runtime failures at the source and keep the root cause"
+  },
+  "git-workflow": {
+    "description": "Git workflow: trunk-based branches, commits, and pull requests"
+  },
+  "no-suppression": {
+    "description": "Findings: fix scanner and linter reports without inline suppressions"
+  },
+  "script-driven-changes": {
+    "description": "Scripts: apply a repeated edit across many files with a script"
+  },
+  "single-author-style": {
+    "description": "Sibling style: match layout, naming, and composition in the same project"
+  },
+  "typescript-first": {
+    "description": "TypeScript-first: write source, tests, and scripts as .ts or .tsx",
+    "globs": ["**/*.ts", "**/*.tsx", "**/*.js", "**/*.jsx"]
+  }
+}

package/templates/payload/.claude/rules/deterministic-testing.md

@@ -0,0 +1,21 @@
+---
+paths:
+  - "**/*.test.ts"
+  - "**/*.test.tsx"
+---
+
+# Test Admission
+
+Keep tests as small, deterministic protections for observable contracts.
+
+Name the contract and the distinct defect a proposed test can detect before writing it. Admit a test for externally observable behavior, a public contract, a demonstrated regression, a non-trivial invariant, a meaningful failure mode, or an explicit repository verification requirement.
+
+Choose the narrowest existing layer that owns that contract. Give each test one defect to detect. Add a case only when it catches a defect remaining cases miss. Treat coverage percentage as a measurement.
+
+Search existing coverage first. Extend the file that already owns the contract. Create a file only when the contract has no owner or needs a different harness. Follow the nearest directory and naming pattern. Keep setup local until multiple tests share live runtime logic, then extract one helper.
+
+Use the framework's standard assertions. Use an inline snippet unless filesystem paths, module resolution, or compiler services are the contract. Keep fixtures declarative and read-only.
+
+When the user asks to run tests, run the narrowest owning file or filter.
+
+_Completion criterion_: Every added or modified case maps to an admitted contract and a defect current cases would miss. Tests stay unchanged when no proposed case survives admission.

package/templates/payload/.claude/rules/typescript-first.md

@@ -0,0 +1,15 @@
+---
+paths:
+  - "**/*.ts"
+  - "**/*.tsx"
+  - "**/*.js"
+  - "**/*.jsx"
+---
+
+# TypeScript-First
+
+In a TypeScript-capable app or package, write source, tests, and scripts as `.ts`, and JSX as `.tsx`. Use that extension for new work and for any JavaScript file whose implementation this change already touches, then update its imports, scripts, tests, and configuration in the same change.
+
+Keep other languages in separately maintained components. Use a non-TypeScript extension when the runtime, tool, or public contract requires it.
+
+_Completion criterion_: Every file this change created or materially rewrote in a TypeScript-capable project uses the TypeScript extension the runtime accepts, and its imports and scripts resolve.

package/templates/payload/.cursor/rules/deterministic-testing.mdc

@@ -0,0 +1,21 @@
+---
+description: "Test admission: add a case only when it catches a defect current tests miss"
+globs: "**/*.test.ts,**/*.test.tsx"
+alwaysApply: false
+---
+
+# Test Admission
+
+Keep tests as small, deterministic protections for observable contracts.
+
+Name the contract and the distinct defect a proposed test can detect before writing it. Admit a test for externally observable behavior, a public contract, a demonstrated regression, a non-trivial invariant, a meaningful failure mode, or an explicit repository verification requirement.
+
+Choose the narrowest existing layer that owns that contract. Give each test one defect to detect. Add a case only when it catches a defect remaining cases miss. Treat coverage percentage as a measurement.
+
+Search existing coverage first. Extend the file that already owns the contract. Create a file only when the contract has no owner or needs a different harness. Follow the nearest directory and naming pattern. Keep setup local until multiple tests share live runtime logic, then extract one helper.
+
+Use the framework's standard assertions. Use an inline snippet unless filesystem paths, module resolution, or compiler services are the contract. Keep fixtures declarative and read-only.
+
+When the user asks to run tests, run the narrowest owning file or filter.
+
+_Completion criterion_: Every added or modified case maps to an admitted contract and a defect current cases would miss. Tests stay unchanged when no proposed case survives admission.

package/templates/payload/.cursor/rules/typescript-first.mdc

@@ -0,0 +1,13 @@
+---
+description: "TypeScript-first: write source, tests, and scripts as .ts or .tsx"
+globs: "**/*.ts,**/*.tsx,**/*.js,**/*.jsx"
+alwaysApply: false
+---
+
+# TypeScript-First
+
+In a TypeScript-capable app or package, write source, tests, and scripts as `.ts`, and JSX as `.tsx`. Use that extension for new work and for any JavaScript file whose implementation this change already touches, then update its imports, scripts, tests, and configuration in the same change.
+
+Keep other languages in separately maintained components. Use a non-TypeScript extension when the runtime, tool, or public contract requires it.
+
+_Completion criterion_: Every file this change created or materially rewrote in a TypeScript-capable project uses the TypeScript extension the runtime accepts, and its imports and scripts resolve.

package/templates/payload/.dependency-cruiser.json

@@ -0,0 +1,34 @@
+{
+  "extends": "dependency-cruiser/configs/recommended-strict",
+  "forbidden": [
+    {
+      "name": "no-orphans",
+      "to": {},
+      "from": {
+        "orphan": true,
+        "pathNot": [
+          "(^|/)tsconfig\\.json$",
+          "(^|/)eslint\\.config\\.ts$",
+          "(^|/)next\\.config\\.ts$",
+          "(^|/)vitest[.]config[.]ts$",
+          "(^|/)playwright[.]config[.]ts$",
+          "^test/.*[.]e2e[.]test[.]ts$",
+          "^src/app/.*(page|layout|template|loading|error|not-found|default|route)[.]tsx?$",
+          "^src/payload-types[.]ts$"
+        ]
+      }
+    }
+  ],
+  "options": {
+    "skipAnalysisNotInRules": true,
+    "tsPreCompilationDeps": true,
+    "enhancedResolveOptions": {
+      "conditionNames": ["import", "require", "node", "default", "types"],
+      "exportsFields": ["exports"]
+    },
+    "exclude": "(^|/)(?:\\.next|coverage|node_modules)/|^src/app/[(]payload[)]/",
+    "tsConfig": {
+      "fileName": "tsconfig.json"
+    }
+  }
+}

package/templates/payload/.dockerignore

@@ -0,0 +1,9 @@
+*
+!package.json
+!pnpm-lock.yaml
+!pnpm-workspace.yaml
+!next.config.ts
+!tsconfig.json
+!src/
+src/**/*.test.ts
+src/**/*.test.tsx

package/templates/payload/.editorconfig-checker.json

@@ -0,0 +1,3 @@
+{
+  "Exclude": ["^src/migrations/", "^src/payload-types\\.ts$"]
+}

package/templates/payload/.env.example

@@ -0,0 +1,4 @@
+# Copy to .env and fill in. List every environment variable the app reads, with a safe example value.
+DATABASE_URL=postgres://postgres:postgres@127.0.0.1:5432/payload
+PAYLOAD_SECRET=
+APP_URL=http://localhost:3000

package/templates/payload/.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,66 @@
+name: Bug report
+description: Report crashes, incorrect behavior, or setup problems.
+labels: ["bug", "needs triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Reproduce the issue with the supported Node.js version.
+        Remove credentials, secrets, personal or customer data, and proprietary source code before submitting.
+  - type: checkboxes
+    id: preflight
+    attributes:
+      label: Before you submit
+      description: Confirm these items before submitting the report.
+      options:
+        - label: I searched existing issues and didn't find a matching report.
+          required: true
+        - label: I can reproduce this issue on the latest commit of the default branch.
+          required: true
+  - type: input
+    id: version
+    attributes:
+      label: Commit
+      placeholder: 769e0ef
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: List Node.js, operating system, package manager, browser, and device.
+      placeholder: |
+        Node.js: 24.22.1
+        OS: Ubuntu 24.04 / macOS
+        Package manager: pnpm 12.6.0
+        Browser: Chrome on Android
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+      description: Link to a minimal public reproduction or provide sanitized code and configuration that reproduce the issue.
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: Describe the behavior you expected.
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: Describe what happened, including errors and logs.
+    validations:
+      required: true
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Sensitive information
+      options:
+        - label: I removed credentials, secrets, personal or customer data, and proprietary code from this report.
+          required: true

package/templates/payload/.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,50 @@
+name: Feature request
+description: Suggest a specific change to next-friday-template-payload.
+labels: ["enhancement", "needs triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this form for changes that are ready to evaluate.
+  - type: dropdown
+    id: scope
+    attributes:
+      label: Affected area
+      description: Select the area this request affects.
+      options:
+        - Pages and routes
+        - Collections and admin panel
+        - Configuration and environment
+        - Tooling / CI
+        - Documentation
+        - Repository governance
+    validations:
+      required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: Describe the problem or use case.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed change
+      description: Describe the smallest change that solves the problem.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: List existing options you considered.
+    validations:
+      required: false
+  - type: checkboxes
+    id: breaking
+    attributes:
+      label: Breaking change
+      description: Indicate whether this request changes behavior for existing users.
+      options:
+        - label: This request changes an existing page route, collection, API, or public contract.

package/templates/payload/.github/pull_request_template.md

@@ -0,0 +1,25 @@
+<!-- Title: `<type>(<scope>): <subject>` with a lowercase scope and a subject of 50 characters or fewer. Repository workflows validate it. The squash merge puts the title on `main`. Delete a section that has nothing to say, except Scope. -->
+
+## Why
+
+<!-- The problem and the approach in 1-3 short sentences. No SHAs or rebase history. Link a related issue with `Closes #123`. -->
+
+## What changed
+
+<!-- 1-3 short bullets. Name a symbol or path only when it carries the change, and both sides of a rename. Name every added, changed, or removed page, collection or field, migration, and environment variable. Document new variables in `.env.example`. -->
+
+## Scope
+
+<!-- 1-3 short items: what this covers and what it deliberately leaves out. -->
+
+## Tradeoffs
+
+<!-- Only rejected alternatives a reviewer would ask about. -->
+
+## Blast Radius
+
+<!-- 1-2 sentences on who or what this touches and why that is safe or risky. If main is red, state the cost of leaving it red. -->
+
+## Verification
+
+<!-- 1-3 bullets, each a check you ran and its outcome. For a perf change, one number as before -> after. After this section, attach videos or screenshots that prove a claim. -->

package/templates/payload/.github/workflows/ci.yml

@@ -0,0 +1,204 @@
+name: Verify
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft]
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: "0 3 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  changes:
+    name: Detect Changes
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: read # Needed by paths-filter to inspect pull request changes.
+    outputs:
+      heavy: ${{ steps.filter.outputs.heavy }}
+      ci_policy: ${{ steps.filter.outputs.ci_policy }}
+      full_verification: ${{ steps.mode.outputs.full_verification }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Detect relevant changes
+        id: filter
+        if: github.event_name == 'pull_request'
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        with:
+          predicate-quantifier: some-with-excludes
+          filters: .github/file-filters.yml
+      - name: Select verification mode
+        id: mode
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          DRAFT: ${{ github.event.pull_request.draft }}
+          HEAVY: ${{ steps.filter.outputs.heavy }}
+          CI_POLICY: ${{ steps.filter.outputs.ci_policy }}
+        run: |
+          full_verification=false
+          if [[ "$EVENT_NAME" == "push" || ( "$EVENT_NAME" == "pull_request" && "$DRAFT" != "true" && ( "$HEAVY" == "true" || "$CI_POLICY" == "true" ) ) ]]; then
+            full_verification=true
+          fi
+
+          echo "full_verification=$full_verification" >> "$GITHUB_OUTPUT"
+
+  checks:
+    name: Static Checks, Tests & Build
+    needs: changes
+    if: needs.changes.outputs.full_verification == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    services:
+      postgres:
+        image: postgres:17.11-alpine@sha256:266d3c257594e195b309ae9d1805e54c788f1d7b375f56bf6c367aac6c917e7b
+        env:
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: payload
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready --username postgres"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      DATABASE_URL: postgres://postgres:postgres@localhost:5432/payload
+      PAYLOAD_SECRET: ci-only-secret
+      APP_URL: http://localhost:3000
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Set up Node.js and pnpm
+        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+        with:
+          cache: true
+          require-lockfile: true
+      - name: Reject suppression directives
+        run: pnpm suppressions:check
+      - name: Check Cursor rules match .agents/rules
+        run: pnpm rules:check
+      - name: Check agent gates
+        run: pnpm gates:check
+      - name: Check lint
+        run: pnpm lint:check
+      - name: Check formatting
+        run: pnpm format:check
+        env:
+          GITHUB_TOKEN: ${{ github.token }} # editorconfig-checker downloads its binary from GitHub releases; the token avoids the anonymous rate limit.
+      - name: Check package.json ordering
+        run: pnpm sort-package-json:check
+      - name: Validate peer dependency contracts
+        run: pnpm peers:check
+      - name: Check types
+        run: pnpm typecheck
+      - name: Run Knip
+        run: pnpm knip
+      - name: Check dependency graph
+        run: pnpm depcruise
+      - name: Run tests with coverage
+        run: pnpm test:coverage
+      - name: Build
+        run: pnpm build
+        env:
+          NEXT_TELEMETRY_DISABLED: "1"
+      - name: Install Playwright browser
+        run: pnpm exec playwright install --with-deps chromium
+      - name: Run end-to-end tests
+        run: pnpm test:e2e
+        env:
+          NEXT_TELEMETRY_DISABLED: "1"
+      - name: Check patch coverage
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          python3 -m venv "$RUNNER_TEMP/diff-cover"
+          "$RUNNER_TEMP/diff-cover/bin/pip" install --quiet --require-hashes --only-binary=:all: -r .github/requirements/diff-cover.txt
+          "$RUNNER_TEMP/diff-cover/bin/diff-cover" coverage/cobertura-coverage.xml --compare-branch "origin/$BASE_REF" --fail-under 95 --branch-coverage
+
+  image:
+    name: Container Image
+    needs: changes
+    if: needs.changes.outputs.full_verification == 'true' || github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    env:
+      HADOLINT_VERSION: 2.15.1
+      HADOLINT_SHA256: c7187db94eeeeca956519a6af171adc31453941a1e777961f6e680f697c8c507
+      TRIVY_VERSION: 0.76.1
+      TRIVY_SHA256: c7cbe3137fb8a48a17574bede3dd6beb16742d1e9772929940fc90082c39d9c0
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Lint Dockerfile
+        run: |
+          curl --silent --show-error --fail --location --output hadolint \
+            "https://github.com/hadolint/hadolint/releases/download/v${HADOLINT_VERSION}/hadolint-linux-x86_64"
+          echo "${HADOLINT_SHA256}  hadolint" | sha256sum --check --strict
+          chmod +x hadolint
+          ./hadolint Dockerfile
+      - name: Build image
+        run: docker build --tag app:ci .
+      - name: Smoke test image
+        id: smoke
+        run: |
+          docker run --detach --name app --env PORT=3000 --publish 3000:3000 app:ci
+          curl --silent --show-error --fail --retry 15 --retry-delay 1 --retry-all-errors --output /dev/null http://localhost:3000/health
+      - name: Show container logs
+        if: failure() && steps.smoke.outcome == 'failure'
+        run: docker logs app
+      - name: Scan image for vulnerabilities
+        run: |
+          archive="trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
+          curl --silent --show-error --fail --location --output "$archive" \
+            "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/${archive}"
+          echo "${TRIVY_SHA256}  ${archive}" | sha256sum --check --strict
+          tar --extract --gzip --file "$archive" trivy
+          ./trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --no-progress app:ci
+
+  deploy-dev:
+    name: Deploy to dev
+    needs:
+      - checks
+      - image
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && vars.DEPLOY_ENABLED == 'true'
+    permissions:
+      contents: read
+      actions: read # Needed by deploy.yml to find the CI run of the deployed commit.
+    uses: ./.github/workflows/deploy.yml
+    with:
+      environment: dev
+      commit_sha: ${{ github.sha }}
+
+  ci:
+    name: All Checks
+    if: always()
+    timeout-minutes: 5
+    needs:
+      - changes
+      - checks
+      - image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require all verification jobs
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: exit 1

package/templates/payload/.github/workflows/sast.yml

@@ -0,0 +1,46 @@
+name: SAST
+
+on:
+  pull_request: {}
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - "**/*.md"
+      - ".agents/**"
+      - ".claude/**"
+      - ".cursor/**"
+  schedule:
+    - cron: "17 2 * * 1"
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  semgrep:
+    name: Semgrep (OWASP)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    container:
+      image: semgrep/semgrep:1.179.0@sha256:93963d9295a366f59e4850127b1550400ee7b388f04fe144e4a1f6325d96e01b
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Scan source
+        run: >-
+          semgrep scan
+          --config p/owasp-top-ten
+          --config p/typescript
+          --config p/nodejsscan
+          --config p/react
+          --severity ERROR --severity WARNING
+          --error --metrics=off
+          --timeout 60 --timeout-threshold 0
+          .

package/templates/payload/.lintstagedrc.json

@@ -0,0 +1,10 @@
+{
+  "*.{ts,tsx,js,jsx,mjs,cjs}": [
+    "pnpm exec eslint --fix --cache --max-warnings=0 --no-warn-ignored --no-inline-config",
+    "prettier --write --cache"
+  ],
+  "!(package).json": ["prettier --write --cache"],
+  "*.{css,scss,md,yml,yaml}": ["prettier --write --cache"],
+  "package.json": ["sort-package-json", "prettier --write --cache"],
+  ".husky/{commit-msg,pre-commit,pre-merge-commit,pre-push}": ["prettier --write --cache"]
+}