@next-friday/create-app 0.0.0-stage → 1.0.0

package/templates/base/.github/workflows/deploy.yml

@@ -0,0 +1,124 @@
+name: Deploy
+run-name: Deploy ${{ inputs.commit_sha }} to ${{ inputs.environment }}
+
+on:
+  workflow_call:
+    inputs:
+      environment:
+        required: true
+        type: string
+      commit_sha:
+        required: true
+        type: string
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: Railway environment to promote to
+        required: true
+        type: choice
+        options:
+          - uat
+          - prod
+      commit_sha:
+        description: Full commit SHA on main that passed CI
+        required: true
+        type: string
+
+permissions: {}
+
+concurrency:
+  group: deploy-${{ inputs.environment }}
+  cancel-in-progress: false
+
+jobs:
+  verify:
+    name: Verify the requested commit
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: read # Needed to find the CI and deploy runs of the requested commit.
+    env:
+      COMMIT_SHA: ${{ inputs.commit_sha }}
+      TARGET: ${{ inputs.environment }}
+    steps:
+      - name: Checkout the requested revision
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ inputs.commit_sha }}
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Require the commit on main with passing CI and a deployment to the previous environment
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          [[ "$COMMIT_SHA" =~ ^[0-9a-f]{40}$ ]] || { echo "::error::Expected a full lowercase commit SHA"; exit 1; }
+          git merge-base --is-ancestor "$COMMIT_SHA" origin/main || { echo "::error::$COMMIT_SHA is not on main"; exit 1; }
+          ci_run="$(gh api "repos/$REPOSITORY/actions/workflows/ci.yml/runs?head_sha=$COMMIT_SHA&event=push&branch=main&status=success" --jq '.workflow_runs[0].id // empty')"
+          [[ -n "$ci_run" ]] || { echo "::error::No successful CI run on main for $COMMIT_SHA"; exit 1; }
+          case "$TARGET" in
+            uat)
+              previous=dev
+              deployed="$(gh api "repos/$REPOSITORY/actions/runs/$ci_run/jobs" --jq '[.jobs[] | select(.name == "Deploy to dev / Deploy to dev" and .conclusion == "success")] | length')"
+              ;;
+            prod)
+              previous=uat
+              export EXPECTED_TITLE="Deploy $COMMIT_SHA to uat"
+              deployed="$(gh api --paginate "repos/$REPOSITORY/actions/workflows/deploy.yml/runs?event=workflow_dispatch&status=success&per_page=100" --jq '.workflow_runs[] | select(.display_title == env.EXPECTED_TITLE) | .id' | wc -l)"
+              ;;
+          esac
+          [[ "$deployed" -gt 0 ]] || { echo "::error::$COMMIT_SHA has no successful $previous deployment; promote through $previous first"; exit 1; }
+
+  deploy:
+    name: Deploy to ${{ inputs.environment }}
+    needs: verify
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    environment:
+      name: ${{ inputs.environment }}
+      url: ${{ vars.APP_URL }}
+    permissions:
+      contents: read
+    env:
+      APP_URL: ${{ vars.APP_URL }}
+      RAILWAY_CLI_SHA256: 2e682fd2ddf8d6fdf9e46d9d99d99646ff0022a6abb0c2bca93011348a269fb9
+      RAILWAY_CLI_VERSION: 5.71.0
+      RAILWAY_ENVIRONMENT: ${{ inputs.environment }}
+      RAILWAY_SERVICE: ${{ vars.RAILWAY_SERVICE }}
+    steps:
+      - name: Require environment settings
+        env:
+          RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
+        run: |
+          [[ -n "$RAILWAY_TOKEN" ]] || { echo "::error::Set the RAILWAY_TOKEN secret in the $RAILWAY_ENVIRONMENT environment"; exit 1; }
+          [[ -n "$RAILWAY_SERVICE" ]] || { echo "::error::Set the RAILWAY_SERVICE variable in the $RAILWAY_ENVIRONMENT environment"; exit 1; }
+          [[ "$APP_URL" == https://* ]] || { echo "::error::Set the APP_URL variable to an https URL in the $RAILWAY_ENVIRONMENT environment"; exit 1; }
+      - name: Checkout the requested revision
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ inputs.commit_sha }}
+          persist-credentials: false
+      - name: Install verified Railway CLI
+        run: |
+          archive="railway-v${RAILWAY_CLI_VERSION}-x86_64-unknown-linux-musl.tar.gz"
+          curl --silent --show-error --fail --location --retry 3 --output "$RUNNER_TEMP/$archive" \
+            "https://github.com/railwayapp/cli/releases/download/v${RAILWAY_CLI_VERSION}/${archive}"
+          echo "${RAILWAY_CLI_SHA256}  $RUNNER_TEMP/$archive" | sha256sum --check --strict
+          tar --extract --gzip --file "$RUNNER_TEMP/$archive" --directory "$RUNNER_TEMP"
+          echo "$RUNNER_TEMP" >> "$GITHUB_PATH"
+      - name: Deploy
+        env:
+          RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
+        run: railway up --ci --service "$RAILWAY_SERVICE" --environment "$RAILWAY_ENVIRONMENT"
+      - name: Require a healthy deployment
+        run: |
+          for _ in $(seq 30); do
+            if curl --silent --fail --output /dev/null "$APP_URL/health"; then
+              exit 0
+            fi
+            sleep 10
+          done
+          echo "::error::$APP_URL/health did not respond"
+          exit 1

package/templates/base/.github/workflows/osv-scanner.yml

@@ -0,0 +1,34 @@
+name: OSV-Scanner
+
+on:
+  pull_request: {}
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - "**/*.md"
+      - ".agents/**"
+      - ".claude/**"
+      - ".cursor/**"
+  schedule:
+    - cron: "37 2 * * 1"
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    name: Scan
+    permissions:
+      actions: read # Needed by the reusable workflow to read workflow run metadata.
+      contents: read
+      security-events: write # Required by the reusable workflow's declared permissions; unused without SARIF upload.
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36 # v2.7.0
+    with:
+      upload-sarif: false
+      scan-args: |-
+        --lockfile=pnpm-lock.yaml
+        --lockfile=requirements.txt:.github/requirements/diff-cover.txt

package/templates/base/.github/workflows/pr-triage.yml

@@ -0,0 +1,29 @@
+name: PR Labeler
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  label:
+    name: Label
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: write # Needed by actions/labeler to update pull request labels.
+    steps:
+      - name: Label pull request
+        uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
+        with:
+          sync-labels: true

package/templates/base/.github/workflows/secret-scan.yml

@@ -0,0 +1,50 @@
+name: Secret Scan
+
+on:
+  pull_request: {}
+  push:
+    branches:
+      - main
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    name: TruffleHog and Gitleaks (secrets and PAN)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    env:
+      GITLEAKS_VERSION: 8.30.1
+      PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+      PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+      GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Scan commits for secrets
+        uses: trufflesecurity/trufflehog@e76dff8a7e57d6df0c60ad8cbf5d5cba505a8fc9 # v3.99.2
+        with:
+          extra_args: --results=verified,unknown
+      - name: Install verified gitleaks
+        run: |
+          archive="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          curl --silent --show-error --fail --location --output "$archive" \
+            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${archive}"
+          echo "${GITLEAKS_SHA256}  ${archive}" | sha256sum --check --strict
+          tar --extract --gzip --file "$archive" gitleaks
+      - name: Scan history with repository rules
+        run: |
+          log_opts=()
+          if [[ -n "$PR_BASE_SHA" ]]; then
+            log_opts=(--log-opts="${PR_BASE_SHA}..${PR_HEAD_SHA}")
+          fi
+          ./gitleaks git --redact --config .gitleaks.toml --no-banner "${log_opts[@]}" .

package/templates/base/.github/workflows/validate-pr-title.yml

@@ -0,0 +1,48 @@
+name: Validate Pull Request Titles
+
+on:
+  pull_request:
+    types:
+      - opened
+      - edited
+      - reopened
+      - synchronize
+
+permissions:
+  pull-requests: read # Needed to read the pull request title for semantic validation.
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  validate-title:
+    name: Validate pull request title
+    if: github.event.pull_request.user.login != 'dependabot[bot]'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Validate pull request title
+        uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          types: |
+            build
+            chore
+            ci
+            docs
+            feat
+            fix
+            perf
+            refactor
+            revert
+            style
+            test
+          requireScope: true
+          disallowScopes: |
+            .*[A-Z].*
+          subjectPattern: ^.{1,50}$
+          subjectPatternError: >-
+            The subject "{subject}" in pull request title "{title}" must be between
+            1 and 50 characters.

package/templates/base/.github/workflows/zizmor.yml

@@ -0,0 +1,62 @@
+name: Workflow Lint
+
+on:
+  workflow_dispatch: {}
+  pull_request:
+    paths:
+      - ".github/**"
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/**"
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  zizmor:
+    name: Zizmor
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Analyze GitHub Actions security
+        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
+        with:
+          inputs: .github
+          version: 1.30.1
+          persona: pedantic
+          advanced-security: false
+
+  actionlint:
+    name: Actionlint
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    env:
+      ACTIONLINT_VERSION: 1.7.12
+      ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Install verified actionlint
+        run: |
+          archive="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
+          curl --silent --show-error --fail --location --output "$archive" \
+            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/${archive}"
+          echo "${ACTIONLINT_SHA256}  ${archive}" | sha256sum --check --strict
+          tar --extract --gzip --file "$archive" actionlint
+      - name: Lint workflows
+        run: ./actionlint -color

package/templates/base/.github/zizmor.yml

@@ -0,0 +1,4 @@
+# Owner: @your-org/your-team. Reason: Semgrep rejects the `$/` self-repository syntax, so local actions use `./`. Expires: 2027-04-29.
+rules:
+  self-repository:
+    disable: true

package/templates/base/.gitleaks.toml

@@ -0,0 +1,14 @@
+[extend]
+useDefault = true
+
+[[rules]]
+id = "primary-account-number"
+description = "Payment card PAN (Visa, Mastercard, Amex, Discover, JCB)"
+regex = '''\b(?:4\d{12}(?:\d{3})?|5[1-5]\d{14}|2(?:2[2-9]\d|[3-6]\d{2}|7[01]\d|720)\d{12}|3[47]\d{13}|6(?:011|5\d{2})\d{12}|35(?:2[89]|[3-8]\d)\d{12})\b'''
+keywords = ["2", "3", "4", "5", "6"]
+
+[[rules.allowlists]]
+description = "Published processor test PANs"
+regexes = [
+  '''\b(?:4111111111111111|4242424242424242|4000056655665556|5555555555554444|5105105105105100|2223003122003222|378282246310005|371449635398431|6011111111111117|3530111333300000)\b''',
+]

package/templates/base/.husky/commit-msg

@@ -0,0 +1,3 @@
+#!/usr/bin/env sh
+
+pnpm exec commitlint --edit "$1"

package/templates/base/.husky/pre-commit

@@ -0,0 +1,17 @@
+#!/usr/bin/env sh
+set -e
+
+# The first commit of a new repository creates main, so it is the only commit allowed there.
+if [ "$(git branch --show-current)" = main ] && git rev-parse --quiet --verify HEAD > /dev/null; then
+  echo "pre-commit: do not commit on main. Create a branch: git switch --create <type>/<short-description>" >&2
+  exit 1
+fi
+
+command -v gitleaks > /dev/null 2>&1 || {
+  echo "pre-commit: gitleaks is required. Install it (see CONTRIBUTING.md), then commit again." >&2
+  exit 1
+}
+
+gitleaks git --pre-commit --redact --staged --no-banner --config .gitleaks.toml
+pnpm rules:check
+pnpm exec lint-staged

package/templates/base/.husky/pre-merge-commit

@@ -0,0 +1,7 @@
+#!/usr/bin/env sh
+set -e
+
+if [ "$(git branch --show-current)" = main ]; then
+  echo "pre-merge-commit: do not merge into main locally. Merge through a pull request." >&2
+  exit 1
+fi

package/templates/base/.husky/pre-push

@@ -0,0 +1,15 @@
+#!/usr/bin/env sh
+set -e
+
+# The first push of a new repository creates main on the remote, so it is the only push allowed there.
+while read -r _ _ remote_ref remote_oid; do
+  if [ "$remote_ref" = refs/heads/main ] && [ -n "$(printf '%s' "$remote_oid" | tr -d 0)" ]; then
+    echo "pre-push: do not push to main. Push your branch and open a pull request." >&2
+    exit 1
+  fi
+done
+
+pnpm check || {
+  echo "pre-push: pnpm check failed. Fix the failures above, commit, then push again." >&2
+  exit 1
+}

package/templates/base/.nvmrc

@@ -0,0 +1 @@
+24.22.1

package/templates/base/SECURITY.md

@@ -0,0 +1,15 @@
+# Security Policy
+
+## Supported versions
+
+Only the latest commit on the `main` branch receives security fixes.
+
+## Reporting a vulnerability
+
+Report vulnerabilities privately through **Security → Report a vulnerability** in this repository. Describe the issue, the affected files or versions, and steps to reproduce it.
+
+Do not open a public issue, pull request, or discussion for a vulnerability.
+
+## What to expect
+
+A maintainer acknowledges the report, confirms or rejects the finding, and coordinates a fix and disclosure date with you.

package/templates/base/knip.json

@@ -0,0 +1,3 @@
+{
+  "$schema": "https://unpkg.com/knip@6/schema.json"
+}

package/templates/base/pnpm-workspace.yaml

@@ -0,0 +1,18 @@
+engineStrict: true
+savePrefix: ""
+allowBuilds:
+  esbuild: true
+  unrs-resolver: true
+overrides:
+  "katex@<0.18.2": ^0.18.2
+  "fast-uri@<3.1.9": ^3.1.9
+  "dompurify@<3.4.17": ^3.4.17
+  "esbuild@<0.27.0": ^0.28.2
+  "graphql-scalars@<2.0.1": ^2.0.1
+  "happy-dom@<21.0.4": ^21.0.4
+minimumReleaseAgeExclude:
+  - "@next-friday/commitlint-config-friday@4.0.0"
+  - "@next-friday/eslint-config-friday@5.0.0"
+  - "@next-friday/eslint-config-friday@5.1.0"
+  - "@next-friday/prettier-config-friday@4.0.0"
+  - "@next-friday/eslint-plugin-friday@1.1.3"

package/templates/base/railway.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "https://railway.com/railway.schema.json",
+  "build": {
+    "builder": "DOCKERFILE"
+  },
+  "deploy": {
+    "healthcheckPath": "/health"
+  }
+}