@next-friday/create-app 2.0.0 → 2.1.1

package/templates/turborepo/.github/workflows/ci.yml

@@ -0,0 +1,300 @@
+name: Verify
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review, converted_to_draft]
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: "0 3 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  changes:
+    name: Detect Changes
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: read # Needed by paths-filter to inspect pull request changes.
+    outputs:
+      heavy: ${{ steps.filter.outputs.heavy }}
+      ci_policy: ${{ steps.filter.outputs.ci_policy }}
+      full_verification: ${{ steps.mode.outputs.full_verification }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Detect relevant changes
+        id: filter
+        if: github.event_name == 'pull_request'
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
+        with:
+          predicate-quantifier: some-with-excludes
+          filters: .github/file-filters.yml
+      - name: Select verification mode
+        id: mode
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          DRAFT: ${{ github.event.pull_request.draft }}
+          HEAVY: ${{ steps.filter.outputs.heavy }}
+          CI_POLICY: ${{ steps.filter.outputs.ci_policy }}
+        run: |
+          full_verification=false
+          if [[ "$EVENT_NAME" == "push" || ( "$EVENT_NAME" == "pull_request" && "$DRAFT" != "true" && ( "$HEAVY" == "true" || "$CI_POLICY" == "true" ) ) ]]; then
+            full_verification=true
+          fi
+
+          echo "full_verification=$full_verification" >> "$GITHUB_OUTPUT"
+
+  checks:
+    name: Static Checks, Tests & Build
+    needs: changes
+    if: needs.changes.outputs.full_verification == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      id-token: write # Needed to exchange GitHub OIDC for a Turborepo Remote Cache token.
+    services:
+      postgres:
+        image: postgres:17.11-alpine@sha256:266d3c257594e195b309ae9d1805e54c788f1d7b375f56bf6c367aac6c917e7b
+        env:
+          POSTGRES_PASSWORD: postgres
+          POSTGRES_DB: payload
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready --username postgres"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    env:
+      DATABASE_URL: postgres://postgres:postgres@localhost:5432/payload
+      PAYLOAD_SECRET: ci-only-secret
+      APP_URL: http://localhost:3001
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+      TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Fetch the pull request base
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: git fetch --no-tags origin "$BASE_REF"
+      - name: Set up Node.js and pnpm
+        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+        with:
+          cache: true
+          require-lockfile: true
+      - name: Set up Turborepo Remote Cache
+        if: vars.TURBO_TEAM != ''
+        uses: vercel/setup-turborepo-remote-cache-action@49d7b1b46ba4c9251e1977986bfe18336feabc8f # v1.1.0
+        with:
+          team: ${{ vars.TURBO_TEAM }}
+      - name: Scope Turborepo to affected packages
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          echo "TURBO_FILTER=--affected" >> "$GITHUB_ENV"
+          echo "TURBO_SCM_BASE=origin/$BASE_REF" >> "$GITHUB_ENV"
+      - name: Reject suppression directives
+        run: pnpm suppressions:check
+      - name: Check Cursor rules match .agents/rules
+        run: pnpm rules:check
+      - name: Check agent gates
+        run: pnpm gates:check
+      - name: Check lint
+        run: pnpm lint:check
+      - name: Check formatting
+        run: pnpm format:check
+        env:
+          GITHUB_TOKEN: ${{ github.token }} # editorconfig-checker downloads its binary from GitHub releases; the token avoids the anonymous rate limit.
+      - name: Check package.json ordering
+        run: pnpm sort-package-json:check
+      - name: Validate peer dependency contracts
+        run: pnpm peers:check
+      - name: Check types
+        run: pnpm typecheck
+      - name: Run Knip
+        run: pnpm knip
+      - name: Check dependency graph
+        run: pnpm depcruise
+      - name: Run tests with coverage
+        run: pnpm test:coverage
+      - name: Build
+        run: pnpm build
+        env:
+          NEXT_TELEMETRY_DISABLED: "1"
+      - name: Install Playwright browsers
+        run: |
+          if [[ -n "${TURBO_FILTER-}" ]]; then
+            mapfile -t apps < <(bash .github/scripts/affected-apps.sh "$TURBO_SCM_BASE" HEAD)
+          else
+            mapfile -t apps < <(bash .github/scripts/affected-apps.sh)
+          fi
+          for app in "${apps[@]}"; do
+            pnpm --filter "./apps/$app" exec playwright install --with-deps chromium
+          done
+      - name: Run end-to-end tests
+        run: pnpm test:e2e
+        env:
+          NEXT_TELEMETRY_DISABLED: "1"
+      - name: Check patch coverage
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          python3 -m venv "$RUNNER_TEMP/diff-cover"
+          "$RUNNER_TEMP/diff-cover/bin/pip" install --quiet --require-hashes --only-binary=:all: -r .github/requirements/diff-cover.txt
+          if [[ -f apps/app/coverage/cobertura-coverage.xml ]]; then
+            "$RUNNER_TEMP/diff-cover/bin/diff-cover" apps/app/coverage/cobertura-coverage.xml --compare-branch "origin/$BASE_REF" --fail-under 95 --branch-coverage
+          fi
+          if [[ -f apps/backoffice/coverage/cobertura-coverage.xml ]]; then
+            "$RUNNER_TEMP/diff-cover/bin/diff-cover" apps/backoffice/coverage/cobertura-coverage.xml --compare-branch "origin/$BASE_REF" --fail-under 95 --branch-coverage
+          fi
+
+  image:
+    name: Container Image
+    needs: changes
+    if: needs.changes.outputs.full_verification == 'true' || github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      HADOLINT_VERSION: 2.15.1
+      HADOLINT_SHA256: c7187db94eeeeca956519a6af171adc31453941a1e777961f6e680f697c8c507
+      TRIVY_VERSION: 0.76.1
+      TRIVY_SHA256: c7cbe3137fb8a48a17574bede3dd6beb16742d1e9772929940fc90082c39d9c0
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Fetch the pull request base
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: git fetch --no-tags origin "$BASE_REF"
+      - name: Set up Node.js and pnpm
+        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+        with:
+          cache: true
+          require-lockfile: true
+      - name: List affected apps
+        id: affected
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          if [[ "$EVENT_NAME" == "pull_request" ]]; then
+            mapfile -t apps < <(bash .github/scripts/affected-apps.sh "origin/$BASE_REF" HEAD)
+          else
+            mapfile -t apps < <(bash .github/scripts/affected-apps.sh)
+          fi
+          {
+            echo "app=false"
+            echo "backoffice=false"
+            for app in "${apps[@]}"; do
+              echo "$app=true"
+            done
+          } >> "$GITHUB_OUTPUT"
+      - name: Lint Dockerfile
+        run: |
+          curl --silent --show-error --fail --location --output hadolint \
+            "https://github.com/hadolint/hadolint/releases/download/v${HADOLINT_VERSION}/hadolint-linux-x86_64"
+          echo "${HADOLINT_SHA256}  hadolint" | sha256sum --check --strict
+          chmod +x hadolint
+          files=()
+          if [[ "${{ steps.affected.outputs.app }}" == "true" ]]; then
+            files+=(apps/app/Dockerfile)
+          fi
+          if [[ "${{ steps.affected.outputs.backoffice }}" == "true" ]]; then
+            files+=(apps/backoffice/Dockerfile)
+          fi
+          if [[ "${#files[@]}" -gt 0 ]]; then
+            ./hadolint "${files[@]}"
+          fi
+      - name: Build images
+        run: |
+          if [[ "${{ steps.affected.outputs.app }}" == "true" ]]; then
+            docker build --file apps/app/Dockerfile --tag app:ci .
+          fi
+          if [[ "${{ steps.affected.outputs.backoffice }}" == "true" ]]; then
+            docker build --file apps/backoffice/Dockerfile --tag backoffice:ci .
+          fi
+      - name: Smoke test images
+        id: smoke
+        run: |
+          if [[ "${{ steps.affected.outputs.app }}" == "true" ]]; then
+            docker run --detach --name app --env PORT=3000 --publish 3000:3000 app:ci
+            curl --silent --show-error --fail --retry 15 --retry-delay 1 --retry-all-errors --output /dev/null http://localhost:3000/health
+          fi
+          if [[ "${{ steps.affected.outputs.backoffice }}" == "true" ]]; then
+            docker run --detach --name backoffice --env PORT=3001 --env DATABASE_URL=postgres://build-only@localhost/build-only --env PAYLOAD_SECRET=ci-only-secret --env APP_URL=http://localhost:3001 --publish 3001:3001 backoffice:ci
+            curl --silent --show-error --fail --retry 15 --retry-delay 1 --retry-all-errors --output /dev/null http://localhost:3001/health
+          fi
+      - name: Show container logs
+        if: failure() && steps.smoke.outcome == 'failure'
+        run: |
+          if docker container inspect app >/dev/null 2>&1; then
+            docker logs app
+          fi
+          if docker container inspect backoffice >/dev/null 2>&1; then
+            docker logs backoffice
+          fi
+      - name: Scan images for vulnerabilities
+        run: |
+          archive="trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
+          curl --silent --show-error --fail --location --output "$archive" \
+            "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/${archive}"
+          echo "${TRIVY_SHA256}  ${archive}" | sha256sum --check --strict
+          tar --extract --gzip --file "$archive" trivy
+          if [[ "${{ steps.affected.outputs.app }}" == "true" ]]; then
+            ./trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --no-progress app:ci
+          fi
+          if [[ "${{ steps.affected.outputs.backoffice }}" == "true" ]]; then
+            ./trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --no-progress backoffice:ci
+          fi
+
+  deploy-dev:
+    name: Deploy to dev
+    needs:
+      - checks
+      - image
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main' && vars.DEPLOY_ENABLED == 'true'
+    permissions:
+      contents: read
+      actions: read # Needed by deploy.yml to find the CI run of the deployed commit.
+    uses: ./.github/workflows/deploy.yml
+    with:
+      environment: dev
+      commit_sha: ${{ github.sha }}
+
+  ci:
+    name: All Checks
+    if: always()
+    timeout-minutes: 5
+    needs:
+      - changes
+      - checks
+      - image
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require all verification jobs
+        if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+        run: exit 1

package/templates/turborepo/.github/workflows/deploy.yml

@@ -0,0 +1,200 @@
+name: Deploy
+run-name: Deploy ${{ inputs.commit_sha }} to ${{ inputs.environment }}
+
+on:
+  workflow_call:
+    inputs:
+      environment:
+        required: true
+        type: string
+      commit_sha:
+        required: true
+        type: string
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: Railway environment to promote to
+        required: true
+        type: choice
+        options:
+          - uat
+          - prod
+      commit_sha:
+        description: Full commit SHA on main that passed CI
+        required: true
+        type: string
+
+permissions: {}
+
+concurrency:
+  group: deploy-${{ inputs.environment }}
+  cancel-in-progress: false
+
+jobs:
+  verify:
+    name: Verify the requested commit
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: read # Needed to find the CI and deploy runs of the requested commit.
+    env:
+      COMMIT_SHA: ${{ inputs.commit_sha }}
+      TARGET: ${{ inputs.environment }}
+    steps:
+      - name: Checkout the requested revision
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ inputs.commit_sha }}
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Require the commit on main with passing CI and a deployment to the previous environment
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          [[ "$COMMIT_SHA" =~ ^[0-9a-f]{40}$ ]] || { echo "::error::Expected a full lowercase commit SHA"; exit 1; }
+          git merge-base --is-ancestor "$COMMIT_SHA" origin/main || { echo "::error::$COMMIT_SHA is not on main"; exit 1; }
+          ci_run="$(gh api "repos/$REPOSITORY/actions/workflows/ci.yml/runs?head_sha=$COMMIT_SHA&event=push&branch=main&status=success" --jq '.workflow_runs[0].id // empty')"
+          [[ -n "$ci_run" ]] || { echo "::error::No successful CI run on main for $COMMIT_SHA"; exit 1; }
+          case "$TARGET" in
+            uat)
+              previous=dev
+              deployed="$(gh api "repos/$REPOSITORY/actions/runs/$ci_run/jobs" --jq '[.jobs[] | select(.name == "Deploy to dev / Deploy to dev" and .conclusion == "success")] | length')"
+              ;;
+            prod)
+              previous=uat
+              export EXPECTED_TITLE="Deploy $COMMIT_SHA to uat"
+              deployed="$(gh api --paginate "repos/$REPOSITORY/actions/workflows/deploy.yml/runs?event=workflow_dispatch&status=success&per_page=100" --jq '.workflow_runs[] | select(.display_title == env.EXPECTED_TITLE) | .id' | wc -l)"
+              ;;
+          esac
+          [[ "$deployed" -gt 0 ]] || { echo "::error::$COMMIT_SHA has no successful $previous deployment; promote through $previous first"; exit 1; }
+
+  deploy:
+    name: Deploy to ${{ inputs.environment }}
+    needs: verify
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    environment:
+      name: ${{ inputs.environment }}
+      url: ${{ vars.APP_URL }}
+    permissions:
+      contents: read
+      actions: read # Needed to find the last successful deploy of this environment.
+    env:
+      APP_URL: ${{ vars.APP_URL }}
+      BACKOFFICE_URL: ${{ vars.BACKOFFICE_URL }}
+      RAILWAY_CLI_SHA256: 2e682fd2ddf8d6fdf9e46d9d99d99646ff0022a6abb0c2bca93011348a269fb9
+      RAILWAY_CLI_VERSION: 5.71.0
+      RAILWAY_ENVIRONMENT: ${{ inputs.environment }}
+      RAILWAY_SERVICE_APP: ${{ vars.RAILWAY_SERVICE_APP }}
+      RAILWAY_SERVICE_BACKOFFICE: ${{ vars.RAILWAY_SERVICE_BACKOFFICE }}
+    steps:
+      - name: Require environment settings
+        env:
+          RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
+        run: |
+          [[ -n "$RAILWAY_TOKEN" ]] || { echo "::error::Set the RAILWAY_TOKEN secret in the $RAILWAY_ENVIRONMENT environment"; exit 1; }
+          [[ -n "$RAILWAY_SERVICE_APP" ]] || { echo "::error::Set the RAILWAY_SERVICE_APP variable in the $RAILWAY_ENVIRONMENT environment"; exit 1; }
+          [[ -n "$RAILWAY_SERVICE_BACKOFFICE" ]] || { echo "::error::Set the RAILWAY_SERVICE_BACKOFFICE variable in the $RAILWAY_ENVIRONMENT environment"; exit 1; }
+          [[ "$APP_URL" == https://* ]] || { echo "::error::Set the APP_URL variable to an https URL in the $RAILWAY_ENVIRONMENT environment"; exit 1; }
+          [[ "$BACKOFFICE_URL" == https://* ]] || { echo "::error::Set the BACKOFFICE_URL variable to an https URL in the $RAILWAY_ENVIRONMENT environment"; exit 1; }
+      - name: Checkout the requested revision
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ inputs.commit_sha }}
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Set up Node.js and pnpm
+        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+        with:
+          cache: true
+          require-lockfile: true
+      - name: List affected apps
+        id: affected
+        env:
+          COMMIT_SHA: ${{ inputs.commit_sha }}
+          GH_TOKEN: ${{ github.token }}
+          RAILWAY_ENVIRONMENT: ${{ inputs.environment }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          previous=""
+          latest=""
+          while IFS=$'\t' read -r run_id title; do
+            [[ -z "$run_id" ]] && continue
+            if [[ "$title" =~ ^Deploy\ ([0-9a-f]{40})\ to\ ${RAILWAY_ENVIRONMENT}$ ]]; then
+              candidate="${BASH_REMATCH[1]}"
+            else
+              continue
+            fi
+            [[ "$candidate" == "$COMMIT_SHA" ]] && continue
+            completed="$(gh api "repos/$REPOSITORY/actions/runs/$run_id/jobs" | jq -r --arg env "$RAILWAY_ENVIRONMENT" '[.jobs[] | select(.conclusion == "success" and (.name == "Deploy to \($env)" or .name == "Deploy to \($env) / Deploy to \($env)")) | .completed_at] | max // empty')"
+            if [[ -n "$completed" && ( -z "$latest" || "$completed" > "$latest" ) ]]; then
+              latest="$completed"
+              previous="$candidate"
+            fi
+          done < <(gh api --paginate "repos/$REPOSITORY/actions/workflows/deploy.yml/runs?status=success&per_page=50" --jq '.workflow_runs[] | [.id, .display_title] | @tsv')
+          while IFS=$'\t' read -r run_id head_sha; do
+            [[ -z "$run_id" || "$head_sha" == "$COMMIT_SHA" ]] && continue
+            completed="$(gh api "repos/$REPOSITORY/actions/runs/$run_id/jobs" | jq -r --arg env "$RAILWAY_ENVIRONMENT" '[.jobs[] | select(.conclusion == "success" and .name == "Deploy to \($env) / Deploy to \($env)") | .completed_at] | max // empty')"
+            if [[ -n "$completed" && ( -z "$latest" || "$completed" > "$latest" ) ]]; then
+              latest="$completed"
+              previous="$head_sha"
+            fi
+          done < <(gh api "repos/$REPOSITORY/actions/workflows/ci.yml/runs?event=push&branch=main&status=success&per_page=50" --jq '.workflow_runs[] | [.id, .head_sha] | @tsv')
+          if [[ -n "$previous" ]]; then
+            git cat-file -e "$previous^{commit}" 2>/dev/null || git fetch --no-tags origin "$previous"
+            mapfile -t apps < <(bash .github/scripts/affected-apps.sh "$previous" "$COMMIT_SHA")
+          else
+            mapfile -t apps < <(bash .github/scripts/affected-apps.sh)
+          fi
+          {
+            echo "app=false"
+            echo "backoffice=false"
+            for app in "${apps[@]}"; do
+              echo "$app=true"
+            done
+          } >> "$GITHUB_OUTPUT"
+      - name: Install verified Railway CLI
+        run: |
+          archive="railway-v${RAILWAY_CLI_VERSION}-x86_64-unknown-linux-musl.tar.gz"
+          curl --silent --show-error --fail --location --retry 3 --output "$RUNNER_TEMP/$archive" \
+            "https://github.com/railwayapp/cli/releases/download/v${RAILWAY_CLI_VERSION}/${archive}"
+          echo "${RAILWAY_CLI_SHA256}  $RUNNER_TEMP/$archive" | sha256sum --check --strict
+          tar --extract --gzip --file "$RUNNER_TEMP/$archive" --directory "$RUNNER_TEMP"
+          echo "$RUNNER_TEMP" >> "$GITHUB_PATH"
+      - name: Deploy
+        env:
+          RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
+          DEPLOY_APP: ${{ steps.affected.outputs.app }}
+          DEPLOY_BACKOFFICE: ${{ steps.affected.outputs.backoffice }}
+        run: |
+          if [[ "$DEPLOY_APP" == "true" ]]; then
+            railway up --ci --service "$RAILWAY_SERVICE_APP" --environment "$RAILWAY_ENVIRONMENT"
+          fi
+          if [[ "$DEPLOY_BACKOFFICE" == "true" ]]; then
+            railway up --ci --service "$RAILWAY_SERVICE_BACKOFFICE" --environment "$RAILWAY_ENVIRONMENT"
+          fi
+      - name: Require a healthy deployment
+        env:
+          DEPLOY_APP: ${{ steps.affected.outputs.app }}
+          DEPLOY_BACKOFFICE: ${{ steps.affected.outputs.backoffice }}
+        run: |
+          wait_health() {
+            url="$1"
+            for _ in $(seq 30); do
+              if curl --silent --fail --output /dev/null "$url/health"; then
+                return 0
+              fi
+              sleep 10
+            done
+            echo "::error::$url/health did not respond"
+            return 1
+          }
+          if [[ "$DEPLOY_APP" == "true" ]]; then
+            wait_health "$APP_URL"
+          fi
+          if [[ "$DEPLOY_BACKOFFICE" == "true" ]]; then
+            wait_health "$BACKOFFICE_URL"
+          fi

package/templates/turborepo/.github/workflows/sast.yml

@@ -0,0 +1,46 @@
+name: SAST
+
+on:
+  pull_request: {}
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - "**/*.md"
+      - ".agents/**"
+      - ".claude/**"
+      - ".cursor/**"
+  schedule:
+    - cron: "17 2 * * 1"
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  semgrep:
+    name: Semgrep (OWASP)
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    container:
+      image: semgrep/semgrep:1.179.0@sha256:93963d9295a366f59e4850127b1550400ee7b388f04fe144e4a1f6325d96e01b
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Scan source
+        run: >-
+          semgrep scan
+          --config p/owasp-top-ten
+          --config p/typescript
+          --config p/nodejsscan
+          --config p/react
+          --severity ERROR --severity WARNING
+          --error --metrics=off
+          --timeout 60 --timeout-threshold 0
+          .

package/templates/turborepo/.lintstagedrc.json

@@ -0,0 +1,11 @@
+{
+  "*.{ts,tsx,js,jsx,mjs,cjs}": [
+    "pnpm exec eslint --fix --cache --max-warnings=0 --no-warn-ignored --no-inline-config",
+    "prettier --write --cache"
+  ],
+  "!(package).json": ["prettier --write --cache"],
+  "*.{css,scss,md,yml,yaml}": ["prettier --write --cache"],
+  "package.json": ["sort-package-json", "prettier --write --cache"],
+  ".husky/{commit-msg,pre-commit,pre-merge-commit,pre-push}": ["prettier --write --cache"],
+  "*.sh": ["prettier --write --cache"]
+}

package/templates/turborepo/.prettierignore

@@ -0,0 +1,5 @@
+.husky/_
+pnpm-lock.yaml
+apps/backoffice/src/app/(payload)/
+apps/backoffice/src/migrations/
+apps/backoffice/src/payload-types.ts

package/templates/turborepo/AGENTS.md

@@ -0,0 +1,20 @@
+# Agent guide
+
+Turborepo workspace on pnpm. `apps/app` is the Next.js site. `apps/backoffice` is the Payload CMS. Root scripts run the same checks as the other Next Friday templates and delegate framework commands with Turborepo.
+
+- Follow the rules in `.agents/rules/`; `.agents/rules.json` gives each rule's scope. Claude Code and Cursor load them automatically.
+- Rule files, agent hooks, and agent settings are company policy: propose a change to the user, who edits them.
+- Put unit tests next to the code as `*.test.ts`. Put Playwright end-to-end tests in `apps/app/test/` and `apps/backoffice/test/` as `*.e2e.test.ts`. Component tests need a DOM test environment, which is not set up yet; ask the user before adding one.
+- The Next.js site lives in `apps/app/app/`. The backoffice site lives in `apps/backoffice/src/app/(frontend)/`, collections in `apps/backoffice/src/collections/`, and the Payload config in `apps/backoffice/src/payload.config.ts`.
+- Payload generates `apps/backoffice/src/app/(payload)/`, `apps/backoffice/src/payload-types.ts`, and `apps/backoffice/src/migrations/`. After changing a collection, regenerate them with `pnpm generate:types`, `pnpm generate:importmap`, and `pnpm migrate:create <name>`, and commit the results.
+- Read backoffice configuration through `requireEnvironment` in `apps/backoffice/src/environment.ts`. Document each variable in `.env.example`.
+
+<!-- BEGIN:nextjs-agent-rules -->
+
+## This is NOT the Next.js you know
+
+This version has breaking changes — APIs, conventions, and file structure may all differ from your training data. Read the relevant guide in `node_modules/next/dist/docs/` (resolved from this file's directory; in monorepos the `next` package may not be visible from the repo root) before writing any code. Heed deprecation notices.
+
+This block is written and re-added by `next dev` — verify at `node_modules/next/dist/server/lib/generate-agent-files.js`. Removing it from a diff only re-creates the uncommitted change; committing it with your work keeps the tree clean.
+
+<!-- END:nextjs-agent-rules -->

package/templates/turborepo/CONTRIBUTING.md

@@ -0,0 +1,58 @@
+# Contributing
+
+Use this guide to prepare changes to this repository.
+
+## Prerequisites
+
+- Use the Node.js version declared by `.nvmrc` and `package.json#engines`.
+- Change the Node.js version in `.nvmrc` and both Dockerfiles together. Dependabot updates only the Dockerfiles.
+- Install pnpm once with `npm install --global pnpm`. It switches to the version declared by `package.json#packageManager` automatically.
+- Use Claude Code v2.1.295 or later. It reads `AGENTS.md` directly and supports the `onFailure` field the agent hooks use.
+- Install gitleaks 8.19 or later, which the `pre-commit` hook runs, and jq, which the agent hooks and the `pre-push` hook (`pnpm gates:check`) need: `brew install gitleaks jq` on macOS, or install them from each project's releases on Linux.
+
+From the repository root:
+
+```sh
+npm install --global pnpm
+pnpm install
+```
+
+## Quality standards
+
+- Fix lint, type, and test failures at their root cause.
+- Put unit tests next to the code as `*.test.ts` and Playwright end-to-end tests in each app's `test/` as `*.e2e.test.ts`.
+- Change the database schema only through collections, then run `pnpm generate:types`, `pnpm generate:importmap`, and `pnpm migrate:create <name>` and commit the generated files. Production applies pending migrations when the server starts.
+- Treat `coverage/` as generated output.
+- Do not commit `.env` files or credentials.
+
+## Verification
+
+Run the narrowest check that covers the change while you work. Git hooks run these checks:
+
+| Hook               | Checks                                                                                                                                                |
+| :----------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `pre-commit`       | blocks commits on `main` except the first commit of a new repository, gitleaks on staged changes, `pnpm rules:check`, and lint-staged on staged files |
+| `commit-msg`       | commitlint                                                                                                                                            |
+| `pre-merge-commit` | blocks merge commits on `main`                                                                                                                        |
+| `pre-push`         | blocks pushes to `main` except the push that creates it, then `pnpm check`: the static checks and the unit tests related to your changes              |
+
+- **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, and OSV scans. Dependabot and OSV-Scanner report vulnerable dependencies.
+- **End-to-end tests:** run `pnpm test:e2e` when you change pages or the admin panel. It starts both development servers unless they are already running, and the backoffice needs `DATABASE_URL` and `PAYLOAD_SECRET` from `.env`. Run `pnpm --filter ./apps/app exec playwright install chromium` once before the first run. CI runs it against the production build and a PostgreSQL service on every pull request that is ready for review and changes code.
+- **Coverage:** CI requires 95% branch coverage on changed lines in `apps/app/app/` and `apps/backoffice/src/`, except layouts, the Payload config, and generated files.
+
+Run `pnpm verify` for repository changes.
+
+Agent rules live in `.agents/rules/` with their scope in `.agents/rules.json`. After you change either, run `pnpm rules:sync` to regenerate `.claude/rules/` and `.cursor/rules/`.
+
+## Pull requests
+
+We use trunk-based development. `main` is the only long-lived branch, and every deploy promotes a commit from `main` (see the Deploy section in the README).
+
+- Branch from `main` and merge back within a day or two. Do not create `develop` or release branches.
+- Merge unfinished work behind a feature flag or keep it unreachable instead of holding a long-lived branch.
+- Pull requests are squash-merged, so the pull request title becomes the commit on `main`.
+- Write commit messages in the format that `@next-friday/commitlint-config-friday` defines. Pull request titles use `<type>(<scope>): <subject>`, which `.github/workflows/validate-pr-title.yml` checks.
+- Keep each pull request focused on one cohesive change.
+- Describe observable page, collection, API, or configuration effects.
+- Report only checks that actually ran and include their results.
+- Add or update tests only when they protect a distinct observable contract.