@next-friday/create-app 2.1.0 → 2.1.2

package/README.md

@@ -30,7 +30,7 @@ Every stack is built from [`templates/base`](templates/base), which holds the sh
 
 - **Code quality:** TypeScript, ESLint and Prettier with the Next Friday configs, Vitest with coverage, fast-check, Knip, dependency-cruiser, editorconfig-checker, and sort-package-json.
 - **Git hooks:** Husky runs gitleaks and lint-staged before each commit, commitlint on each message, and `pnpm check` before each push. Commits and pushes to `main` are blocked after the first one.
-- **CI:** GitHub Actions run the static checks, tests with patch coverage, the build, end-to-end tests for Next.js and Payload, a container build and vulnerability scan, Semgrep, OSV-Scanner, gitleaks, TruffleHog, zizmor, and pull request title validation. Dependabot keeps dependencies current.
+- **CI:** GitHub Actions run the static checks, tests with patch coverage, the build, end-to-end tests for Next.js and Payload, a container build and vulnerability scan, Semgrep, OSV-Scanner, CodeQL, dependency review, OpenSSF Scorecard, gitleaks, TruffleHog, zizmor, and pull request title validation. Dependabot keeps dependencies current.
 - **Deployment:** a `Dockerfile` that runs as the `node` user, and a Railway workflow that promotes one commit through `dev`, `uat`, and `prod`.
 - **Agent rules:** shared rules in `.agents/rules`, with hooks that enforce them in Claude Code and Cursor, and a Cursor Bugbot configuration.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@next-friday/create-app",
-  "version": "2.1.0",
+  "version": "2.1.2",
   "description": "Create a Next Friday project from a template.",
   "keywords": [
     "create",
@@ -48,11 +48,11 @@
     "jiti": "2.7.0",
     "knip": "6.43.0",
     "lint-staged": "17.6.0",
-    "pkg-pr-new": "0.0.91",
+    "pkg-pr-new": "0.0.92",
     "prettier": "3.9.10",
     "publint": "0.3.25",
     "sort-package-json": "4.1.0",
-    "tsdown": "0.23.1",
+    "tsdown": "0.23.2",
     "typescript": "6.0.3",
     "vitest": "5.0.5"
   },

package/templates/base/.github/labeler.yml

@@ -18,8 +18,8 @@ ci:
 dependencies:
   - changed-files:
       - any-glob-to-any-file:
-          - "package.json"
-          - "pnpm-lock.yaml"
+          - "**/package.json"
+          - "**/pnpm-lock.yaml"
           - "pnpm-workspace.yaml"
-          - "Dockerfile"
+          - "**/Dockerfile"
           - ".github/requirements/**"

package/templates/base/.github/workflows/codeql.yml

@@ -0,0 +1,47 @@
+name: CodeQL
+
+on:
+  pull_request: {}
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: "18 4 * * 1"
+
+permissions: {} # No token beyond the job grants below.
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    if: github.event.repository.visibility == 'public' || vars.CODE_SCANNING == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      actions: read # Needed to fetch CodeQL packs used by this workflow.
+      contents: read # Needed to check out the repository.
+      packages: read # Needed to fetch internal or private CodeQL packs.
+      security-events: write # Needed to upload SARIF results to GitHub code scanning.
+    strategy:
+      fail-fast: false
+      matrix:
+        language:
+          - actions
+          - javascript-typescript
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
+        with:
+          category: "/language:${{ matrix.language }}"

package/templates/base/.github/workflows/dependency-review.yml

@@ -0,0 +1,25 @@
+name: Dependency Review
+
+on:
+  pull_request: {}
+
+permissions: {} # No token beyond the job grants below.
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  dependency-review:
+    name: Dependency Review
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read # Needed to check out the repository.
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

package/templates/base/.github/workflows/scorecard.yml

@@ -0,0 +1,42 @@
+name: Scorecard
+
+on:
+  branch_protection_rule: {}
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: "27 4 * * 1"
+
+permissions: {} # No token beyond the job grants below.
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    if: (github.event.repository.visibility == 'public' || vars.CODE_SCANNING == 'true') && (github.event.repository.default_branch == github.ref_name || github.event_name == 'branch_protection_rule')
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      actions: read # Needed to inspect workflow history for Scorecard checks.
+      contents: read # Needed to check out the repository.
+      id-token: write # Needed to publish Scorecard results with OIDC.
+      security-events: write # Needed to upload SARIF results to GitHub code scanning.
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Run analysis
+        uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+      - name: Upload to code scanning
+        uses: github/codeql-action/upload-sarif@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
+        with:
+          sarif_file: results.sarif

package/templates/base/.github/workflows/secret-scan.yml

@@ -31,7 +31,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Scan commits for secrets
-        uses: trufflesecurity/trufflehog@e76dff8a7e57d6df0c60ad8cbf5d5cba505a8fc9 # v3.99.2
+        uses: trufflesecurity/trufflehog@31ce31ee1abbcc7dc8eee5764c17121c3044c8b2 # v3.99.7
         with:
           extra_args: --results=verified,unknown
       - name: Install verified gitleaks

package/templates/base/.github/workflows/zizmor.yml

@@ -11,7 +11,7 @@ on:
     paths:
       - ".github/**"
 
-permissions: {}
+permissions: {} # No token beyond the job grants below.
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
@@ -23,17 +23,16 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
-      contents: read
+      contents: read # Needed to check out the repository.
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
       - name: Analyze GitHub Actions security
-        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
+        uses: zizmorcore/zizmor-action@45d7276c9ca790aabd705e31ca99c6185c3e76dd # v0.8.1
         with:
           inputs: .github
-          version: 1.30.1
           persona: pedantic
           advanced-security: false
 
@@ -42,7 +41,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
-      contents: read
+      contents: read # Needed to check out the repository.
     env:
       ACTIONLINT_VERSION: 1.7.12
       ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8

package/templates/nestjs/CONTRIBUTING.md

@@ -28,14 +28,14 @@ pnpm install
 
 Run the narrowest check that covers the change while you work. Git hooks run these checks:
 
-| Hook               | Checks                                                                                                                                                |
-| :----------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `pre-commit`       | blocks commits on `main` except the first commit of a new repository, gitleaks on staged changes, `pnpm rules:check`, and lint-staged on staged files |
-| `commit-msg`       | commitlint                                                                                                                                            |
-| `pre-merge-commit` | blocks merge commits on `main`                                                                                                                        |
-| `pre-push`         | blocks pushes to `main` except the push that creates it, then `pnpm check`: the static checks and the unit tests related to your changes              |
-
-- **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, and OSV scans. Dependabot and OSV-Scanner report vulnerable dependencies.
+| Hook               | Checks                                                                                                                                                          |
+| :----------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `pre-commit`       | blocks commits on `main` except the first commit of a new repository, gitleaks on staged changes, `pnpm rules:check`, and lint-staged on staged files           |
+| `commit-msg`       | commitlint                                                                                                                                                      |
+| `pre-merge-commit` | blocks merge commits on `main`                                                                                                                                  |
+| `pre-push`         | blocks pushes to `main` except the push that creates it, then `pnpm check`: the static checks, the unit tests related to your changes, and the production build |
+
+- **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, OSV, CodeQL, dependency-review, and OpenSSF Scorecard scans. Dependabot and OSV-Scanner report vulnerable dependencies.
 - **End-to-end tests:** run `pnpm test:e2e` when you change endpoints. CI runs it on every pull request that is ready for review and changes code.
 - **Coverage:** CI requires 95% line coverage on changed lines in `src/`, except `main.ts` and `*.module.ts`, which hold only wiring. Keep logic out of them, as `src/port.ts` does for `main.ts`. CI does not gate branch coverage, because NestJS decorators emit metadata branches that never run.
 

package/templates/nestjs/README.md

@@ -33,19 +33,19 @@ The server listens on the port set by `PORT` in `.env`, which the CLI created fr
 
 ## Scripts
 
-| Script             | Purpose                                                                         |
-| :----------------- | :------------------------------------------------------------------------------ |
-| `pnpm start`       | Start once, without watch mode; loads `.env` when present                       |
-| `pnpm start:dev`   | Start in watch mode; loads `.env` when present                                  |
-| `pnpm start:debug` | Start in watch mode with the Node.js inspector; loads `.env` when present       |
-| `pnpm build`       | Compile to `dist/`                                                              |
-| `pnpm start:prod`  | Run `dist/main.js`; the environment sets `PORT`                                 |
-| `pnpm test`        | Run unit tests (`src/**/*.test.ts`)                                             |
-| `pnpm test:e2e`    | Run end-to-end tests (`test/**/*.e2e.test.ts`)                                  |
-| `pnpm check`       | Run the static checks and the unit tests for changed code (the `pre-push` hook) |
-| `pnpm verify`      | Run the static checks and all unit tests with coverage                          |
-
-CI also runs the build, the end-to-end tests, the container image scan, and the security scans.
+| Script             | Purpose                                                                                                |
+| :----------------- | :----------------------------------------------------------------------------------------------------- |
+| `pnpm start`       | Start once, without watch mode; loads `.env` when present                                              |
+| `pnpm start:dev`   | Start in watch mode; loads `.env` when present                                                         |
+| `pnpm start:debug` | Start in watch mode with the Node.js inspector; loads `.env` when present                              |
+| `pnpm build`       | Compile to `dist/`                                                                                     |
+| `pnpm start:prod`  | Run `dist/main.js`; the environment sets `PORT`                                                        |
+| `pnpm test`        | Run unit tests (`src/**/*.test.ts`)                                                                    |
+| `pnpm test:e2e`    | Run end-to-end tests (`test/**/*.e2e.test.ts`)                                                         |
+| `pnpm check`       | Run the static checks, the unit tests for changed code, and the production build (the `pre-push` hook) |
+| `pnpm verify`      | Run the static checks, all unit tests with coverage, and the production build                          |
+
+CI also runs the build, the end-to-end tests, the container image scan, and the security scans, including CodeQL, dependency review, and OpenSSF Scorecard. CodeQL and Scorecard run on public repositories, and on private ones when the `CODE_SCANNING` repository variable is `true`.
 
 ## Container
 

package/templates/nestjs/package.json

@@ -12,7 +12,7 @@
   "type": "module",
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
-    "check": "pnpm verify:static && pnpm test:changed",
+    "check": "pnpm verify:static && pnpm test:changed && pnpm build",
     "clean": "rm -rf dist coverage *.tsbuildinfo .eslintcache node_modules/.cache",
     "debug:build": "tsc -p tsconfig.build.json --watch --preserveWatchOutput",
     "debug:serve": "node --env-file-if-exists=.env --inspect --watch dist/main",
@@ -42,7 +42,7 @@
     "test:e2e": "vitest run --config vitest.e2e.config.ts",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit -p tsconfig.json",
-    "verify": "pnpm verify:static && pnpm test:coverage",
+    "verify": "pnpm verify:static && pnpm test:coverage && pnpm build",
     "verify:static": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm peers:check && pnpm typecheck && pnpm knip && pnpm depcruise"
   },
   "dependencies": {

package/templates/nextjs/CONTRIBUTING.md

@@ -28,14 +28,14 @@ pnpm install
 
 Run the narrowest check that covers the change while you work. Git hooks run these checks:
 
-| Hook               | Checks                                                                                                                                                |
-| :----------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `pre-commit`       | blocks commits on `main` except the first commit of a new repository, gitleaks on staged changes, `pnpm rules:check`, and lint-staged on staged files |
-| `commit-msg`       | commitlint                                                                                                                                            |
-| `pre-merge-commit` | blocks merge commits on `main`                                                                                                                        |
-| `pre-push`         | blocks pushes to `main` except the push that creates it, then `pnpm check`: the static checks and the unit tests related to your changes              |
-
-- **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, and OSV scans. Dependabot and OSV-Scanner report vulnerable dependencies.
+| Hook               | Checks                                                                                                                                                          |
+| :----------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `pre-commit`       | blocks commits on `main` except the first commit of a new repository, gitleaks on staged changes, `pnpm rules:check`, and lint-staged on staged files           |
+| `commit-msg`       | commitlint                                                                                                                                                      |
+| `pre-merge-commit` | blocks merge commits on `main`                                                                                                                                  |
+| `pre-push`         | blocks pushes to `main` except the push that creates it, then `pnpm check`: the static checks, the unit tests related to your changes, and the production build |
+
+- **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, OSV, CodeQL, dependency-review, and OpenSSF Scorecard scans. Dependabot and OSV-Scanner report vulnerable dependencies.
 - **End-to-end tests:** run `pnpm test:e2e` when you change pages. It starts the development server unless one is already running. Run `pnpm exec playwright install chromium` once before the first run. CI runs it against the production build on every pull request that is ready for review and changes code.
 - **Coverage:** CI requires 95% branch coverage on changed lines in `app/`, except `layout.tsx`.
 

package/templates/nextjs/README.md

@@ -38,10 +38,10 @@ pnpm dev
 | `pnpm start`    | Serve the standalone production build after `pnpm build`. The build copies `.env`, so rebuild after you change it |
 | `pnpm test`     | Run unit tests                                                                                                    |
 | `pnpm test:e2e` | Run Playwright end-to-end tests (`test/**/*.e2e.test.ts`)                                                         |
-| `pnpm check`    | Run the static checks and the unit tests for changed code (the `pre-push` hook)                                   |
-| `pnpm verify`   | Run the static checks and all unit tests with coverage                                                            |
+| `pnpm check`    | Run the static checks, the unit tests for changed code, and the production build (the `pre-push` hook)            |
+| `pnpm verify`   | Run the static checks, all unit tests with coverage, and the production build                                     |
 
-CI also runs the build, the end-to-end tests, the container image scan, and the security scans.
+CI also runs the build, the end-to-end tests, the container image scan, and the security scans, including CodeQL, dependency review, and OpenSSF Scorecard. CodeQL and Scorecard run on public repositories, and on private ones when the `CODE_SCANNING` repository variable is `true`.
 
 ## Container
 

package/templates/nextjs/package.json

@@ -12,7 +12,7 @@
   "type": "module",
   "scripts": {
     "build": "next build",
-    "check": "pnpm verify:static && pnpm test:changed",
+    "check": "pnpm verify:static && pnpm test:changed && pnpm build",
     "clean": "rm -rf .next coverage *.tsbuildinfo .eslintcache node_modules/.cache",
     "depcruise": "depcruise --config .dependency-cruiser.json app test eslint.config.ts next.config.ts playwright.config.ts postcss.config.mjs vitest.config.ts",
     "dev": "next dev",
@@ -36,7 +36,7 @@
     "test:e2e": "playwright test",
     "test:watch": "vitest",
     "typecheck": "next typegen && tsc --noEmit -p tsconfig.json",
-    "verify": "pnpm verify:static && pnpm test:coverage",
+    "verify": "pnpm verify:static && pnpm test:coverage && pnpm build",
     "verify:static": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm peers:check && pnpm typecheck && pnpm knip && pnpm depcruise"
   },
   "dependencies": {

package/templates/nodejs/CONTRIBUTING.md

@@ -28,14 +28,14 @@ pnpm install
 
 Run the narrowest check that covers the change while you work. Git hooks run these checks:
 
-| Hook               | Checks                                                                                                                                                |
-| :----------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `pre-commit`       | blocks commits on `main` except the first commit of a new repository, gitleaks on staged changes, `pnpm rules:check`, and lint-staged on staged files |
-| `commit-msg`       | commitlint                                                                                                                                            |
-| `pre-merge-commit` | blocks merge commits on `main`                                                                                                                        |
-| `pre-push`         | blocks pushes to `main` except the push that creates it, then `pnpm check`: the static checks and the unit tests related to your changes              |
-
-- **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, and OSV scans. Dependabot and OSV-Scanner report vulnerable dependencies.
+| Hook               | Checks                                                                                                                                                          |
+| :----------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `pre-commit`       | blocks commits on `main` except the first commit of a new repository, gitleaks on staged changes, `pnpm rules:check`, and lint-staged on staged files           |
+| `commit-msg`       | commitlint                                                                                                                                                      |
+| `pre-merge-commit` | blocks merge commits on `main`                                                                                                                                  |
+| `pre-push`         | blocks pushes to `main` except the push that creates it, then `pnpm check`: the static checks, the unit tests related to your changes, and the production build |
+
+- **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, OSV, CodeQL, dependency-review, and OpenSSF Scorecard scans. Dependabot and OSV-Scanner report vulnerable dependencies.
 - **Coverage:** CI requires 95% line coverage on changed lines in `src/`, except `main.ts`, which holds only wiring. Keep logic out of it, as `src/port.ts` and `src/server.ts` do.
 
 Run `pnpm verify` for repository changes.

package/templates/nodejs/README.md

@@ -33,17 +33,17 @@ The server listens on the port set by `PORT` in `.env`, which the CLI created fr
 
 ## Scripts
 
-| Script            | Purpose                                                                    |
-| :---------------- | :------------------------------------------------------------------------- |
-| `pnpm start:dev`  | Start in watch mode from `src/main.ts`; loads `.env` when present          |
-| `pnpm build`      | Compile to `dist/`                                                         |
-| `pnpm start`      | Run `dist/main.js`; loads `.env` when present                              |
-| `pnpm start:prod` | Run `dist/main.js`; the environment sets `PORT`                            |
-| `pnpm test`       | Run tests (`src/**/*.test.ts`)                                             |
-| `pnpm check`      | Run the static checks and the tests for changed code (the `pre-push` hook) |
-| `pnpm verify`     | Run the static checks and all tests with coverage                          |
-
-CI also runs the build, the container image scan, and the security scans.
+| Script            | Purpose                                                                                           |
+| :---------------- | :------------------------------------------------------------------------------------------------ |
+| `pnpm start:dev`  | Start in watch mode from `src/main.ts`; loads `.env` when present                                 |
+| `pnpm build`      | Compile to `dist/`                                                                                |
+| `pnpm start`      | Run `dist/main.js`; loads `.env` when present                                                     |
+| `pnpm start:prod` | Run `dist/main.js`; the environment sets `PORT`                                                   |
+| `pnpm test`       | Run tests (`src/**/*.test.ts`)                                                                    |
+| `pnpm check`      | Run the static checks, the tests for changed code, and the production build (the `pre-push` hook) |
+| `pnpm verify`     | Run the static checks, all tests with coverage, and the production build                          |
+
+CI also runs the build, the container image scan, and the security scans, including CodeQL, dependency review, and OpenSSF Scorecard. CodeQL and Scorecard run on public repositories, and on private ones when the `CODE_SCANNING` repository variable is `true`.
 
 ## Container
 

package/templates/nodejs/package.json

@@ -12,7 +12,7 @@
   "type": "module",
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
-    "check": "pnpm verify:static && pnpm test:changed",
+    "check": "pnpm verify:static && pnpm test:changed && pnpm build",
     "clean": "rm -rf dist coverage *.tsbuildinfo .eslintcache node_modules/.cache",
     "depcruise": "depcruise --config .dependency-cruiser.json src eslint.config.ts vitest.config.ts",
     "format": "prettier --write --cache .",
@@ -36,7 +36,7 @@
     "test:coverage": "vitest run --coverage --passWithNoTests",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit -p tsconfig.json",
-    "verify": "pnpm verify:static && pnpm test:coverage",
+    "verify": "pnpm verify:static && pnpm test:coverage && pnpm build",
     "verify:static": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm peers:check && pnpm typecheck && pnpm knip && pnpm depcruise"
   },
   "devDependencies": {

package/templates/payload/CONTRIBUTING.md

@@ -29,14 +29,14 @@ pnpm install
 
 Run the narrowest check that covers the change while you work. Git hooks run these checks:
 
-| Hook               | Checks                                                                                                                                                |
-| :----------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `pre-commit`       | blocks commits on `main` except the first commit of a new repository, gitleaks on staged changes, `pnpm rules:check`, and lint-staged on staged files |
-| `commit-msg`       | commitlint                                                                                                                                            |
-| `pre-merge-commit` | blocks merge commits on `main`                                                                                                                        |
-| `pre-push`         | blocks pushes to `main` except the push that creates it, then `pnpm check`: the static checks and the unit tests related to your changes              |
-
-- **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, and OSV scans. Dependabot and OSV-Scanner report vulnerable dependencies.
+| Hook               | Checks                                                                                                                                                          |
+| :----------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `pre-commit`       | blocks commits on `main` except the first commit of a new repository, gitleaks on staged changes, `pnpm rules:check`, and lint-staged on staged files           |
+| `commit-msg`       | commitlint                                                                                                                                                      |
+| `pre-merge-commit` | blocks merge commits on `main`                                                                                                                                  |
+| `pre-push`         | blocks pushes to `main` except the push that creates it, then `pnpm check`: the static checks, the unit tests related to your changes, and the production build |
+
+- **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, OSV, CodeQL, dependency-review, and OpenSSF Scorecard scans. Dependabot and OSV-Scanner report vulnerable dependencies.
 - **End-to-end tests:** run `pnpm test:e2e` when you change pages or the admin panel. It starts the development server unless one is already running, and needs `DATABASE_URL` and `PAYLOAD_SECRET` from `.env`. Run `pnpm exec playwright install chromium` once before the first run. CI runs it against the production build and a PostgreSQL service on every pull request that is ready for review and changes code.
 - **Coverage:** CI requires 95% branch coverage on changed lines in `src/`, except layouts, the Payload config, and generated files.
 

package/templates/payload/README.md

@@ -54,10 +54,10 @@ In development, Payload applies collection changes to the database directly. In
 | `pnpm generate:importmap` | Regenerate the admin import map after adding a custom component                                                   |
 | `pnpm migrate:create`     | Create a migration from collection changes, for example `pnpm migrate:create add-posts`                           |
 | `pnpm migrate`            | Apply pending migrations to the database in `DATABASE_URL`                                                        |
-| `pnpm check`              | Run the static checks and the unit tests for changed code (the `pre-push` hook)                                   |
-| `pnpm verify`             | Run the static checks and all unit tests with coverage                                                            |
+| `pnpm check`              | Run the static checks, the unit tests for changed code, and the production build (the `pre-push` hook)            |
+| `pnpm verify`             | Run the static checks, all unit tests with coverage, and the production build                                     |
 
-CI also runs the build, the end-to-end tests, the container image scan, and the security scans.
+CI also runs the build, the end-to-end tests, the container image scan, and the security scans, including CodeQL, dependency review, and OpenSSF Scorecard. CodeQL and Scorecard run on public repositories, and on private ones when the `CODE_SCANNING` repository variable is `true`.
 
 ## Container
 

package/templates/payload/package.json

@@ -12,7 +12,7 @@
   "type": "module",
   "scripts": {
     "build": "next build",
-    "check": "pnpm verify:static && pnpm test:changed",
+    "check": "pnpm verify:static && pnpm test:changed && pnpm build",
     "clean": "rm -rf .next coverage *.tsbuildinfo .eslintcache node_modules/.cache",
     "depcruise": "depcruise --config .dependency-cruiser.json src test eslint.config.ts next.config.ts playwright.config.ts vitest.config.ts",
     "dev": "next dev",
@@ -41,7 +41,7 @@
     "test:e2e": "playwright test",
     "test:watch": "vitest",
     "typecheck": "next typegen && tsc --noEmit -p tsconfig.json",
-    "verify": "pnpm verify:static && pnpm test:coverage",
+    "verify": "pnpm verify:static && pnpm test:coverage && pnpm build",
     "verify:static": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm peers:check && pnpm typecheck && pnpm knip && pnpm depcruise"
   },
   "dependencies": {

package/templates/turborepo/.github/scripts/affected-apps.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+base="${1-}"
+head="${2:-HEAD}"
+
+if [[ -z "$base" ]]; then
+  printf '%s\n' app backoffice
+  exit 0
+fi
+
+query="$(pnpm exec turbo query affected --packages --base "$base" --head "$head")"
+paths="$(printf '%s' "$query" | jq -r '.data.affectedPackages.items[].path // empty')"
+
+app=false
+backoffice=false
+
+while IFS= read -r path; do
+  case "$path" in
+    apps/app) app=true ;;
+    apps/backoffice) backoffice=true ;;
+  esac
+done <<< "$paths"
+
+if [[ "$app" == true ]]; then
+  printf '%s\n' app
+fi
+
+if [[ "$backoffice" == true ]]; then
+  printf '%s\n' backoffice
+fi

package/templates/turborepo/.github/workflows/ci.yml

@@ -62,6 +62,9 @@ jobs:
     if: needs.changes.outputs.full_verification == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    permissions:
+      contents: read
+      id-token: write # Needed to exchange GitHub OIDC for a Turborepo Remote Cache token.
     services:
       postgres:
         image: postgres:17.11-alpine@sha256:266d3c257594e195b309ae9d1805e54c788f1d7b375f56bf6c367aac6c917e7b
@@ -79,17 +82,36 @@ jobs:
       DATABASE_URL: postgres://postgres:postgres@localhost:5432/payload
       PAYLOAD_SECRET: ci-only-secret
       APP_URL: http://localhost:3001
+      TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+      TURBO_TEAM: ${{ vars.TURBO_TEAM }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
           persist-credentials: false
+      - name: Fetch the pull request base
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: git fetch --no-tags origin "$BASE_REF"
       - name: Set up Node.js and pnpm
         uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
         with:
           cache: true
           require-lockfile: true
+      - name: Set up Turborepo Remote Cache
+        if: vars.TURBO_TEAM != ''
+        uses: vercel/setup-turborepo-remote-cache-action@49d7b1b46ba4c9251e1977986bfe18336feabc8f # v1.1.0
+        with:
+          team: ${{ vars.TURBO_TEAM }}
+      - name: Scope Turborepo to affected packages
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          echo "TURBO_FILTER=--affected" >> "$GITHUB_ENV"
+          echo "TURBO_SCM_BASE=origin/$BASE_REF" >> "$GITHUB_ENV"
       - name: Reject suppression directives
         run: pnpm suppressions:check
       - name: Check Cursor rules match .agents/rules
@@ -118,8 +140,16 @@ jobs:
         run: pnpm build
         env:
           NEXT_TELEMETRY_DISABLED: "1"
-      - name: Install Playwright browser
-        run: pnpm --filter ./apps/app exec playwright install --with-deps chromium
+      - name: Install Playwright browsers
+        run: |
+          if [[ -n "${TURBO_FILTER-}" ]]; then
+            mapfile -t apps < <(bash .github/scripts/affected-apps.sh "$TURBO_SCM_BASE" HEAD)
+          else
+            mapfile -t apps < <(bash .github/scripts/affected-apps.sh)
+          fi
+          for app in "${apps[@]}"; do
+            pnpm --filter "./apps/$app" exec playwright install --with-deps chromium
+          done
       - name: Run end-to-end tests
         run: pnpm test:e2e
         env:
@@ -131,15 +161,19 @@ jobs:
         run: |
           python3 -m venv "$RUNNER_TEMP/diff-cover"
           "$RUNNER_TEMP/diff-cover/bin/pip" install --quiet --require-hashes --only-binary=:all: -r .github/requirements/diff-cover.txt
-          "$RUNNER_TEMP/diff-cover/bin/diff-cover" apps/app/coverage/cobertura-coverage.xml --compare-branch "origin/$BASE_REF" --fail-under 95 --branch-coverage
-          "$RUNNER_TEMP/diff-cover/bin/diff-cover" apps/backoffice/coverage/cobertura-coverage.xml --compare-branch "origin/$BASE_REF" --fail-under 95 --branch-coverage
+          if [[ -f apps/app/coverage/cobertura-coverage.xml ]]; then
+            "$RUNNER_TEMP/diff-cover/bin/diff-cover" apps/app/coverage/cobertura-coverage.xml --compare-branch "origin/$BASE_REF" --fail-under 95 --branch-coverage
+          fi
+          if [[ -f apps/backoffice/coverage/cobertura-coverage.xml ]]; then
+            "$RUNNER_TEMP/diff-cover/bin/diff-cover" apps/backoffice/coverage/cobertura-coverage.xml --compare-branch "origin/$BASE_REF" --fail-under 95 --branch-coverage
+          fi
 
   image:
     name: Container Image
     needs: changes
     if: needs.changes.outputs.full_verification == 'true' || github.event_name == 'schedule'
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 20
     env:
       HADOLINT_VERSION: 2.15.1
       HADOLINT_SHA256: c7187db94eeeeca956519a6af171adc31453941a1e777961f6e680f697c8c507
@@ -149,30 +183,80 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          fetch-depth: 0
           persist-credentials: false
+      - name: Fetch the pull request base
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: git fetch --no-tags origin "$BASE_REF"
+      - name: Set up Node.js and pnpm
+        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+        with:
+          cache: true
+          require-lockfile: true
+      - name: List affected apps
+        id: affected
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          if [[ "$EVENT_NAME" == "pull_request" ]]; then
+            mapfile -t apps < <(bash .github/scripts/affected-apps.sh "origin/$BASE_REF" HEAD)
+          else
+            mapfile -t apps < <(bash .github/scripts/affected-apps.sh)
+          fi
+          {
+            echo "app=false"
+            echo "backoffice=false"
+            for app in "${apps[@]}"; do
+              echo "$app=true"
+            done
+          } >> "$GITHUB_OUTPUT"
       - name: Lint Dockerfile
         run: |
           curl --silent --show-error --fail --location --output hadolint \
             "https://github.com/hadolint/hadolint/releases/download/v${HADOLINT_VERSION}/hadolint-linux-x86_64"
           echo "${HADOLINT_SHA256}  hadolint" | sha256sum --check --strict
           chmod +x hadolint
-          ./hadolint apps/app/Dockerfile apps/backoffice/Dockerfile
+          files=()
+          if [[ "${{ steps.affected.outputs.app }}" == "true" ]]; then
+            files+=(apps/app/Dockerfile)
+          fi
+          if [[ "${{ steps.affected.outputs.backoffice }}" == "true" ]]; then
+            files+=(apps/backoffice/Dockerfile)
+          fi
+          if [[ "${#files[@]}" -gt 0 ]]; then
+            ./hadolint "${files[@]}"
+          fi
       - name: Build images
         run: |
-          docker build --file apps/app/Dockerfile --tag app:ci .
-          docker build --file apps/backoffice/Dockerfile --tag backoffice:ci .
+          if [[ "${{ steps.affected.outputs.app }}" == "true" ]]; then
+            docker build --file apps/app/Dockerfile --tag app:ci .
+          fi
+          if [[ "${{ steps.affected.outputs.backoffice }}" == "true" ]]; then
+            docker build --file apps/backoffice/Dockerfile --tag backoffice:ci .
+          fi
       - name: Smoke test images
         id: smoke
         run: |
-          docker run --detach --name app --env PORT=3000 --publish 3000:3000 app:ci
-          docker run --detach --name backoffice --env PORT=3001 --env DATABASE_URL=postgres://build-only@localhost/build-only --env PAYLOAD_SECRET=ci-only-secret --env APP_URL=http://localhost:3001 --publish 3001:3001 backoffice:ci
-          curl --silent --show-error --fail --retry 15 --retry-delay 1 --retry-all-errors --output /dev/null http://localhost:3000/health
-          curl --silent --show-error --fail --retry 15 --retry-delay 1 --retry-all-errors --output /dev/null http://localhost:3001/health
+          if [[ "${{ steps.affected.outputs.app }}" == "true" ]]; then
+            docker run --detach --name app --env PORT=3000 --publish 3000:3000 app:ci
+            curl --silent --show-error --fail --retry 15 --retry-delay 1 --retry-all-errors --output /dev/null http://localhost:3000/health
+          fi
+          if [[ "${{ steps.affected.outputs.backoffice }}" == "true" ]]; then
+            docker run --detach --name backoffice --env PORT=3001 --env DATABASE_URL=postgres://build-only@localhost/build-only --env PAYLOAD_SECRET=ci-only-secret --env APP_URL=http://localhost:3001 --publish 3001:3001 backoffice:ci
+            curl --silent --show-error --fail --retry 15 --retry-delay 1 --retry-all-errors --output /dev/null http://localhost:3001/health
+          fi
       - name: Show container logs
         if: failure() && steps.smoke.outcome == 'failure'
         run: |
-          docker logs app
-          docker logs backoffice
+          if docker container inspect app >/dev/null 2>&1; then
+            docker logs app
+          fi
+          if docker container inspect backoffice >/dev/null 2>&1; then
+            docker logs backoffice
+          fi
       - name: Scan images for vulnerabilities
         run: |
           archive="trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
@@ -180,8 +264,12 @@ jobs:
             "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/${archive}"
           echo "${TRIVY_SHA256}  ${archive}" | sha256sum --check --strict
           tar --extract --gzip --file "$archive" trivy
-          ./trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --no-progress app:ci
-          ./trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --no-progress backoffice:ci
+          if [[ "${{ steps.affected.outputs.app }}" == "true" ]]; then
+            ./trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --no-progress app:ci
+          fi
+          if [[ "${{ steps.affected.outputs.backoffice }}" == "true" ]]; then
+            ./trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --no-progress backoffice:ci
+          fi
 
   deploy-dev:
     name: Deploy to dev

package/templates/turborepo/.github/workflows/deploy.yml

@@ -81,6 +81,7 @@ jobs:
       url: ${{ vars.APP_URL }}
     permissions:
       contents: read
+      actions: read # Needed to find the last successful deploy of this environment.
     env:
       APP_URL: ${{ vars.APP_URL }}
       BACKOFFICE_URL: ${{ vars.BACKOFFICE_URL }}
@@ -103,7 +104,58 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ inputs.commit_sha }}
+          fetch-depth: 0
           persist-credentials: false
+      - name: Set up Node.js and pnpm
+        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+        with:
+          cache: true
+          require-lockfile: true
+      - name: List affected apps
+        id: affected
+        env:
+          COMMIT_SHA: ${{ inputs.commit_sha }}
+          GH_TOKEN: ${{ github.token }}
+          RAILWAY_ENVIRONMENT: ${{ inputs.environment }}
+          REPOSITORY: ${{ github.repository }}
+        run: |
+          previous=""
+          latest=""
+          while IFS=$'\t' read -r run_id title; do
+            [[ -z "$run_id" ]] && continue
+            if [[ "$title" =~ ^Deploy\ ([0-9a-f]{40})\ to\ ${RAILWAY_ENVIRONMENT}$ ]]; then
+              candidate="${BASH_REMATCH[1]}"
+            else
+              continue
+            fi
+            [[ "$candidate" == "$COMMIT_SHA" ]] && continue
+            completed="$(gh api "repos/$REPOSITORY/actions/runs/$run_id/jobs" | jq -r --arg env "$RAILWAY_ENVIRONMENT" '[.jobs[] | select(.conclusion == "success" and (.name == "Deploy to \($env)" or .name == "Deploy to \($env) / Deploy to \($env)")) | .completed_at] | max // empty')"
+            if [[ -n "$completed" && ( -z "$latest" || "$completed" > "$latest" ) ]]; then
+              latest="$completed"
+              previous="$candidate"
+            fi
+          done < <(gh api --paginate "repos/$REPOSITORY/actions/workflows/deploy.yml/runs?status=success&per_page=50" --jq '.workflow_runs[] | [.id, .display_title] | @tsv')
+          while IFS=$'\t' read -r run_id head_sha; do
+            [[ -z "$run_id" || "$head_sha" == "$COMMIT_SHA" ]] && continue
+            completed="$(gh api "repos/$REPOSITORY/actions/runs/$run_id/jobs" | jq -r --arg env "$RAILWAY_ENVIRONMENT" '[.jobs[] | select(.conclusion == "success" and .name == "Deploy to \($env) / Deploy to \($env)") | .completed_at] | max // empty')"
+            if [[ -n "$completed" && ( -z "$latest" || "$completed" > "$latest" ) ]]; then
+              latest="$completed"
+              previous="$head_sha"
+            fi
+          done < <(gh api "repos/$REPOSITORY/actions/workflows/ci.yml/runs?event=push&branch=main&status=success&per_page=50" --jq '.workflow_runs[] | [.id, .head_sha] | @tsv')
+          if [[ -n "$previous" ]]; then
+            git cat-file -e "$previous^{commit}" 2>/dev/null || git fetch --no-tags origin "$previous"
+            mapfile -t apps < <(bash .github/scripts/affected-apps.sh "$previous" "$COMMIT_SHA")
+          else
+            mapfile -t apps < <(bash .github/scripts/affected-apps.sh)
+          fi
+          {
+            echo "app=false"
+            echo "backoffice=false"
+            for app in "${apps[@]}"; do
+              echo "$app=true"
+            done
+          } >> "$GITHUB_OUTPUT"
       - name: Install verified Railway CLI
         run: |
           archive="railway-v${RAILWAY_CLI_VERSION}-x86_64-unknown-linux-musl.tar.gz"
@@ -115,10 +167,19 @@ jobs:
       - name: Deploy
         env:
           RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
+          DEPLOY_APP: ${{ steps.affected.outputs.app }}
+          DEPLOY_BACKOFFICE: ${{ steps.affected.outputs.backoffice }}
         run: |
-          railway up --ci --service "$RAILWAY_SERVICE_APP" --environment "$RAILWAY_ENVIRONMENT"
-          railway up --ci --service "$RAILWAY_SERVICE_BACKOFFICE" --environment "$RAILWAY_ENVIRONMENT"
+          if [[ "$DEPLOY_APP" == "true" ]]; then
+            railway up --ci --service "$RAILWAY_SERVICE_APP" --environment "$RAILWAY_ENVIRONMENT"
+          fi
+          if [[ "$DEPLOY_BACKOFFICE" == "true" ]]; then
+            railway up --ci --service "$RAILWAY_SERVICE_BACKOFFICE" --environment "$RAILWAY_ENVIRONMENT"
+          fi
       - name: Require a healthy deployment
+        env:
+          DEPLOY_APP: ${{ steps.affected.outputs.app }}
+          DEPLOY_BACKOFFICE: ${{ steps.affected.outputs.backoffice }}
         run: |
           wait_health() {
             url="$1"
@@ -131,5 +192,9 @@ jobs:
             echo "::error::$url/health did not respond"
             return 1
           }
-          wait_health "$APP_URL"
-          wait_health "$BACKOFFICE_URL"
+          if [[ "$DEPLOY_APP" == "true" ]]; then
+            wait_health "$APP_URL"
+          fi
+          if [[ "$DEPLOY_BACKOFFICE" == "true" ]]; then
+            wait_health "$BACKOFFICE_URL"
+          fi

package/templates/turborepo/.lintstagedrc.json

@@ -6,5 +6,6 @@
   "!(package).json": ["prettier --write --cache"],
   "*.{css,scss,md,yml,yaml}": ["prettier --write --cache"],
   "package.json": ["sort-package-json", "prettier --write --cache"],
-  ".husky/{commit-msg,pre-commit,pre-merge-commit,pre-push}": ["prettier --write --cache"]
+  ".husky/{commit-msg,pre-commit,pre-merge-commit,pre-push}": ["prettier --write --cache"],
+  "*.sh": ["prettier --write --cache"]
 }

package/templates/turborepo/CONTRIBUTING.md

@@ -29,14 +29,14 @@ pnpm install
 
 Run the narrowest check that covers the change while you work. Git hooks run these checks:
 
-| Hook               | Checks                                                                                                                                                |
-| :----------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `pre-commit`       | blocks commits on `main` except the first commit of a new repository, gitleaks on staged changes, `pnpm rules:check`, and lint-staged on staged files |
-| `commit-msg`       | commitlint                                                                                                                                            |
-| `pre-merge-commit` | blocks merge commits on `main`                                                                                                                        |
-| `pre-push`         | blocks pushes to `main` except the push that creates it, then `pnpm check`: the static checks and the unit tests related to your changes              |
-
-- **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, and OSV scans. Dependabot and OSV-Scanner report vulnerable dependencies.
+| Hook               | Checks                                                                                                                                                          |
+| :----------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `pre-commit`       | blocks commits on `main` except the first commit of a new repository, gitleaks on staged changes, `pnpm rules:check`, and lint-staged on staged files           |
+| `commit-msg`       | commitlint                                                                                                                                                      |
+| `pre-merge-commit` | blocks merge commits on `main`                                                                                                                                  |
+| `pre-push`         | blocks pushes to `main` except the push that creates it, then `pnpm check`: the static checks, the unit tests related to your changes, and the production build |
+
+- **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, OSV, CodeQL, dependency-review, and OpenSSF Scorecard scans. Dependabot and OSV-Scanner report vulnerable dependencies.
 - **End-to-end tests:** run `pnpm test:e2e` when you change pages or the admin panel. It starts both development servers unless they are already running, and the backoffice needs `DATABASE_URL` and `PAYLOAD_SECRET` from `.env`. Run `pnpm --filter ./apps/app exec playwright install chromium` once before the first run. CI runs it against the production build and a PostgreSQL service on every pull request that is ready for review and changes code.
 - **Coverage:** CI requires 95% branch coverage on changed lines in `apps/app/app/` and `apps/backoffice/src/`, except layouts, the Payload config, and generated files.
 

package/templates/turborepo/README.md

@@ -43,21 +43,23 @@ In development, Payload applies collection changes to the database directly. In
 
 ## Scripts
 
-| Script                    | Purpose                                                                                          |
-| :------------------------ | :----------------------------------------------------------------------------------------------- |
-| `pnpm dev`                | Start the Next.js app on port 3000 and the Payload backoffice on port 3001                       |
-| `pnpm build`              | Build both apps for production                                                                   |
-| `pnpm start`              | Serve both standalone production builds after `pnpm build`                                       |
-| `pnpm test`               | Run unit tests in both apps                                                                      |
-| `pnpm test:e2e`           | Run Playwright end-to-end tests in both apps. The backoffice uses the database in `DATABASE_URL` |
-| `pnpm generate:types`     | Regenerate `apps/backoffice/src/payload-types.ts` after a collection change                      |
-| `pnpm generate:importmap` | Regenerate the admin import map after adding a custom component                                  |
-| `pnpm migrate:create`     | Create a migration from collection changes, for example `pnpm migrate:create add-posts`          |
-| `pnpm migrate`            | Apply pending migrations to the database in `DATABASE_URL`                                       |
-| `pnpm check`              | Run the static checks and the unit tests for changed code (the `pre-push` hook)                  |
-| `pnpm verify`             | Run the static checks and all unit tests with coverage                                           |
-
-CI also runs the build, the end-to-end tests, the container image scans, and the security scans.
+| Script                    | Purpose                                                                                                |
+| :------------------------ | :----------------------------------------------------------------------------------------------------- |
+| `pnpm dev`                | Start the Next.js app on port 3000 and the Payload backoffice on port 3001                             |
+| `pnpm build`              | Build both apps for production                                                                         |
+| `pnpm start`              | Serve both standalone production builds after `pnpm build`                                             |
+| `pnpm test`               | Run unit tests in both apps                                                                            |
+| `pnpm test:e2e`           | Run Playwright end-to-end tests in both apps. The backoffice uses the database in `DATABASE_URL`       |
+| `pnpm generate:types`     | Regenerate `apps/backoffice/src/payload-types.ts` after a collection change                            |
+| `pnpm generate:importmap` | Regenerate the admin import map after adding a custom component                                        |
+| `pnpm migrate:create`     | Create a migration from collection changes, for example `pnpm migrate:create add-posts`                |
+| `pnpm migrate`            | Apply pending migrations to the database in `DATABASE_URL`                                             |
+| `pnpm check`              | Run the static checks, the unit tests for changed code, and the production build (the `pre-push` hook) |
+| `pnpm verify`             | Run the static checks, all unit tests with coverage, and the production build                          |
+
+CI also runs the build, the end-to-end tests, the container image scans, and the security scans, including CodeQL, dependency review, and OpenSSF Scorecard. CodeQL and Scorecard run on public repositories, and on private ones when the `CODE_SCANNING` repository variable is `true`. Pull requests run Turborepo with `--affected` against the base branch, so only packages that changed are typed, tested, built, and scanned. Pushes to `main` and the weekly schedule still run every app. Patch coverage runs only for apps that produced a coverage file.
+
+To reuse task output across CI runs, create a Vercel team, add the repository variable `TURBO_TEAM`, and follow [Turborepo on GitHub Actions](https://turborepo.dev/docs/guides/ci-vendors/github-actions) to allow OIDC. The workflow exchanges GitHub OIDC for a short-lived Remote Cache token. If OIDC is unavailable, set the `TURBO_TOKEN` secret instead. Leave both unset to run without a Remote Cache.
 
 ## Container
 
@@ -94,9 +96,19 @@ On Vercel, deploy an app without its image. The Next.js preset takes precedence
 
    Limit `prod` to the `main` branch and add required reviewers. Environment secrets and variables in a private repository need GitHub Pro, Team, or Enterprise; required reviewers in a private repository need GitHub Enterprise.
 
-3. Set the repository variable `DEPLOY_ENABLED` to `true`. Each push to `main` that passes CI then deploys to `dev`.
-4. Promote with **Actions → Deploy → Run workflow**, giving the environment and the full commit SHA. The workflow requires a successful CI run on `main` for that commit and a successful deployment to the previous environment, then waits for `/health`.
+3. Set the repository variable `DEPLOY_ENABLED` to `true`. Each push to `main` that passes CI then deploys to `dev`. The workflow compares the commit with the last GitHub deployment to that environment and runs `railway up` only for services whose packages changed. A promotion through `uat` or `prod` uses the same comparison against the commit last deployed there, so several commits still ship every changed service. The first deploy to an environment ships both services.
+4. Promote with **Actions → Deploy → Run workflow**, giving the environment and the full commit SHA. The workflow requires a successful CI run on `main` for that commit and a successful deployment to the previous environment, then waits for `/health` on each service it uploaded.
 
 Remove the workflow, `railway.json`, and the `deploy-dev` job in `ci.yml` if the project deploys elsewhere.
 
+## Mobile app
+
+The template does not ship an Expo app. Add one under `apps/mobile` when you need it:
+
+1. Create the app from the workspace root with `pnpm create expo-app@latest apps/mobile`, then add `packages/*` workspace packages as you share code. Keep `eas.json` and `credentials.json` inside `apps/mobile` and run the EAS CLI from that directory ([Expo: Build with monorepos](https://docs.expo.dev/build-reference/build-with-monorepos/)).
+2. Use `@expo/fingerprint` with `expo-github-action/fingerprint` so a pull request requests a native build only when the native layer changed ([Expo fingerprint](https://docs.expo.dev/versions/latest/sdk/fingerprint/)).
+3. Keep a single `react-native` version in the workspace. Duplicate React Native versions in one monorepo are not supported ([Expo: Monorepos](https://docs.expo.dev/guides/monorepos/)).
+
+EAS Build and Submit replace Railway for that app. CI `--affected` already includes `apps/*` and `packages/*`, so an Expo app is skipped when it did not change.
+
 See [CONTRIBUTING.md](CONTRIBUTING.md) for the contribution workflow.

package/templates/turborepo/package.json

@@ -11,10 +11,10 @@
   "author": "Next Friday",
   "type": "module",
   "scripts": {
-    "build": "turbo run build --filter=./apps/*",
-    "check": "pnpm verify:static && pnpm test:changed",
+    "build": "turbo run build ${TURBO_FILTER:-\"--filter=./apps/*\"}",
+    "check": "pnpm verify:static && pnpm test:changed && pnpm build",
     "clean": "rm -rf apps/app/.next apps/app/coverage apps/backoffice/.next apps/backoffice/coverage .turbo coverage *.tsbuildinfo .eslintcache node_modules/.cache",
-    "depcruise": "turbo run depcruise --filter=./apps/*",
+    "depcruise": "turbo run depcruise ${TURBO_FILTER:-\"--filter=./apps/*\"}",
     "dev": "turbo run dev --filter=./apps/*",
     "format": "prettier --write --cache .",
     "format:check": "prettier --check --cache . && editorconfig-checker",
@@ -34,13 +34,13 @@
     "sort-package-json:check": "sort-package-json --check package.json apps/app/package.json apps/backoffice/package.json",
     "start": "turbo run start --filter=./apps/*",
     "suppressions:check": "bash .agents/hooks/agent-suppression-gate.sh --repo",
-    "test": "turbo run test --filter=./apps/*",
-    "test:changed": "turbo run test:changed --filter=./apps/*",
-    "test:coverage": "turbo run test:coverage --filter=./apps/*",
-    "test:e2e": "turbo run test:e2e --filter=./apps/*",
+    "test": "turbo run test ${TURBO_FILTER:-\"--filter=./apps/*\"}",
+    "test:changed": "turbo run test:changed ${TURBO_FILTER:-\"--filter=./apps/*\"}",
+    "test:coverage": "turbo run test:coverage ${TURBO_FILTER:-\"--filter=./apps/*\"}",
+    "test:e2e": "turbo run test:e2e ${TURBO_FILTER:-\"--filter=./apps/*\"}",
     "test:watch": "turbo run test:watch --filter=./apps/*",
-    "typecheck": "tsc --noEmit -p tsconfig.json && turbo run typecheck --filter=./apps/*",
-    "verify": "pnpm verify:static && pnpm test:coverage",
+    "typecheck": "tsc --noEmit -p tsconfig.json && turbo run typecheck ${TURBO_FILTER:-\"--filter=./apps/*\"}",
+    "verify": "pnpm verify:static && pnpm test:coverage && pnpm build",
     "verify:static": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm peers:check && pnpm typecheck && pnpm knip && pnpm depcruise"
   },
   "devDependencies": {

package/templates/turborepo/pnpm-workspace.yaml

@@ -1,5 +1,6 @@
 packages:
   - "apps/*"
+  - "packages/*"
 engineStrict: true
 savePrefix: ""
 allowBuilds:

package/templates/turborepo/turbo.json

@@ -13,9 +13,7 @@
       "dependsOn": ["^build"],
       "outputs": [".next/**", "!.next/cache/**"]
     },
-    "depcruise": {
-      "cache": false
-    },
+    "depcruise": {},
     "dev": {
       "cache": false,
       "persistent": true
@@ -24,14 +22,11 @@
       "cache": false,
       "persistent": true
     },
-    "test": {
-      "cache": false
-    },
+    "test": {},
     "test:changed": {
       "cache": false
     },
     "test:coverage": {
-      "cache": false,
       "outputs": ["coverage/**"]
     },
     "test:e2e": {

package/templates/turborepo/.github/labeler.yml

@@ -1,25 +0,0 @@
-documentation:
-  - changed-files:
-      - any-glob-to-any-file:
-          - "**/*.md"
-
-ci:
-  - changed-files:
-      - any-glob-to-any-file:
-          - ".github/workflows/**"
-          - ".github/file-filters.yml"
-          - ".github/dependabot.yml"
-          - ".github/labeler.yml"
-          - ".github/zizmor.yml"
-          - ".github/requirements/**"
-          - ".github/CODEOWNERS"
-          - ".husky/**"
-
-dependencies:
-  - changed-files:
-      - any-glob-to-any-file:
-          - "**/package.json"
-          - "**/pnpm-lock.yaml"
-          - "pnpm-workspace.yaml"
-          - "**/Dockerfile"
-          - ".github/requirements/**"