@next-friday/create-app 2.1.1 → 2.1.3

package/README.md

@@ -30,9 +30,9 @@ Every stack is built from [`templates/base`](templates/base), which holds the sh
 
 - **Code quality:** TypeScript, ESLint and Prettier with the Next Friday configs, Vitest with coverage, fast-check, Knip, dependency-cruiser, editorconfig-checker, and sort-package-json.
 - **Git hooks:** Husky runs gitleaks and lint-staged before each commit, commitlint on each message, and `pnpm check` before each push. Commits and pushes to `main` are blocked after the first one.
-- **CI:** GitHub Actions run the static checks, tests with patch coverage, the build, end-to-end tests for Next.js and Payload, a container build and vulnerability scan, Semgrep, OSV-Scanner, gitleaks, TruffleHog, zizmor, and pull request title validation. Dependabot keeps dependencies current.
+- **CI:** GitHub Actions run the static checks, tests with patch coverage, the build, end-to-end tests for Next.js and Payload, a container build and vulnerability scan, Semgrep, OSV-Scanner, CodeQL, dependency review, OpenSSF Scorecard, gitleaks, TruffleHog, zizmor, and pull request title validation. Dependabot keeps dependencies current.
 - **Deployment:** a `Dockerfile` that runs as the `node` user, and a Railway workflow that promotes one commit through `dev`, `uat`, and `prod`.
-- **Agent rules:** shared rules in `.agents/rules`, with hooks that enforce them in Claude Code and Cursor, and a Cursor Bugbot configuration.
+- **Agent rules:** `CLAUDE.md` imports `AGENTS.md`. Shared rules live in `.agents/rules`, with hooks that enforce them in Claude Code and Cursor, and a Cursor Bugbot configuration.
 
 ## Requirements
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@next-friday/create-app",
-  "version": "2.1.1",
+  "version": "2.1.3",
   "description": "Create a Next Friday project from a template.",
   "keywords": [
     "create",
@@ -48,7 +48,7 @@
     "jiti": "2.7.0",
     "knip": "6.43.0",
     "lint-staged": "17.6.0",
-    "pkg-pr-new": "0.0.91",
+    "pkg-pr-new": "0.0.92",
     "prettier": "3.9.10",
     "publint": "0.3.25",
     "sort-package-json": "4.1.0",

package/templates/base/.github/file-filters.yml

@@ -7,6 +7,7 @@ heavy:
   - "!.github/pull_request_template.md"
   - "!.github/dependabot.yml"
   - "!AGENTS.md"
+  - "!CLAUDE.md"
 
 ci_policy:
   - ".github/file-filters.yml"

package/templates/base/.github/labeler.yml

@@ -18,8 +18,8 @@ ci:
 dependencies:
   - changed-files:
       - any-glob-to-any-file:
-          - "package.json"
-          - "pnpm-lock.yaml"
+          - "**/package.json"
+          - "**/pnpm-lock.yaml"
           - "pnpm-workspace.yaml"
-          - "Dockerfile"
+          - "**/Dockerfile"
           - ".github/requirements/**"

package/templates/base/.github/workflows/codeql.yml

@@ -0,0 +1,47 @@
+name: CodeQL
+
+on:
+  pull_request: {}
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: "18 4 * * 1"
+
+permissions: {} # No token beyond the job grants below.
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    if: github.event.repository.visibility == 'public' || vars.CODE_SCANNING == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      actions: read # Needed to fetch CodeQL packs used by this workflow.
+      contents: read # Needed to check out the repository.
+      packages: read # Needed to fetch internal or private CodeQL packs.
+      security-events: write # Needed to upload SARIF results to GitHub code scanning.
+    strategy:
+      fail-fast: false
+      matrix:
+        language:
+          - actions
+          - javascript-typescript
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
+        with:
+          category: "/language:${{ matrix.language }}"

package/templates/base/.github/workflows/dependency-review.yml

@@ -0,0 +1,25 @@
+name: Dependency Review
+
+on:
+  pull_request: {}
+
+permissions: {} # No token beyond the job grants below.
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  dependency-review:
+    name: Dependency Review
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read # Needed to check out the repository.
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

package/templates/base/.github/workflows/scorecard.yml

@@ -0,0 +1,42 @@
+name: Scorecard
+
+on:
+  branch_protection_rule: {}
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: "27 4 * * 1"
+
+permissions: {} # No token beyond the job grants below.
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    if: (github.event.repository.visibility == 'public' || vars.CODE_SCANNING == 'true') && (github.event.repository.default_branch == github.ref_name || github.event_name == 'branch_protection_rule')
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      actions: read # Needed to inspect workflow history for Scorecard checks.
+      contents: read # Needed to check out the repository.
+      id-token: write # Needed to publish Scorecard results with OIDC.
+      security-events: write # Needed to upload SARIF results to GitHub code scanning.
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Run analysis
+        uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+      - name: Upload to code scanning
+        uses: github/codeql-action/upload-sarif@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
+        with:
+          sarif_file: results.sarif

package/templates/base/.github/workflows/secret-scan.yml

@@ -31,7 +31,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Scan commits for secrets
-        uses: trufflesecurity/trufflehog@e76dff8a7e57d6df0c60ad8cbf5d5cba505a8fc9 # v3.99.2
+        uses: trufflesecurity/trufflehog@31ce31ee1abbcc7dc8eee5764c17121c3044c8b2 # v3.99.7
         with:
           extra_args: --results=verified,unknown
       - name: Install verified gitleaks

package/templates/base/.github/workflows/zizmor.yml

@@ -11,7 +11,7 @@ on:
     paths:
       - ".github/**"
 
-permissions: {}
+permissions: {} # No token beyond the job grants below.
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
@@ -23,17 +23,16 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
-      contents: read
+      contents: read # Needed to check out the repository.
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
       - name: Analyze GitHub Actions security
-        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
+        uses: zizmorcore/zizmor-action@45d7276c9ca790aabd705e31ca99c6185c3e76dd # v0.8.1
         with:
           inputs: .github
-          version: 1.30.1
           persona: pedantic
           advanced-security: false
 
@@ -42,7 +41,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
-      contents: read
+      contents: read # Needed to check out the repository.
     env:
       ACTIONLINT_VERSION: 1.7.12
       ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8

package/templates/base/CLAUDE.md

@@ -0,0 +1 @@
+@AGENTS.md

package/templates/nestjs/CONTRIBUTING.md

@@ -7,7 +7,7 @@ Use this guide to prepare changes to this repository.
 - Use the Node.js version declared by `.nvmrc` and `package.json#engines`.
 - Change the Node.js version in `.nvmrc` and the `Dockerfile` together. Dependabot updates only the `Dockerfile`.
 - Install pnpm once with `npm install --global pnpm`. It switches to the version declared by `package.json#packageManager` automatically.
-- Use Claude Code v2.1.295 or later. It reads `AGENTS.md` directly and supports the `onFailure` field the agent hooks use.
+- Use Claude Code v2.1.295 or later. It reads `CLAUDE.md`, which imports `AGENTS.md`, and supports the `onFailure` field the agent hooks use.
 - Install gitleaks 8.19 or later, which the `pre-commit` hook runs, and jq, which the agent hooks and the `pre-push` hook (`pnpm gates:check`) need: `brew install gitleaks jq` on macOS, or install them from each project's releases on Linux.
 
 From the repository root:
@@ -28,14 +28,14 @@ pnpm install
 
 Run the narrowest check that covers the change while you work. Git hooks run these checks:
 
-| Hook               | Checks                                                                                                                                                |
-| :----------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `pre-commit`       | blocks commits on `main` except the first commit of a new repository, gitleaks on staged changes, `pnpm rules:check`, and lint-staged on staged files |
-| `commit-msg`       | commitlint                                                                                                                                            |
-| `pre-merge-commit` | blocks merge commits on `main`                                                                                                                        |
-| `pre-push`         | blocks pushes to `main` except the push that creates it, then `pnpm check`: the static checks and the unit tests related to your changes              |
+| Hook               | Checks                                                                                                                                                          |
+| :----------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `pre-commit`       | blocks commits on `main` except the first commit of a new repository, gitleaks on staged changes, `pnpm rules:check`, and lint-staged on staged files           |
+| `commit-msg`       | commitlint                                                                                                                                                      |
+| `pre-merge-commit` | blocks merge commits on `main`                                                                                                                                  |
+| `pre-push`         | blocks pushes to `main` except the push that creates it, then `pnpm check`: the static checks, the unit tests related to your changes, and the production build |
 
-- **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, and OSV scans. Dependabot and OSV-Scanner report vulnerable dependencies.
+- **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, OSV, CodeQL, dependency-review, and OpenSSF Scorecard scans. Dependabot and OSV-Scanner report vulnerable dependencies.
 - **End-to-end tests:** run `pnpm test:e2e` when you change endpoints. CI runs it on every pull request that is ready for review and changes code.
 - **Coverage:** CI requires 95% line coverage on changed lines in `src/`, except `main.ts` and `*.module.ts`, which hold only wiring. Keep logic out of them, as `src/port.ts` does for `main.ts`. CI does not gate branch coverage, because NestJS decorators emit metadata branches that never run.
 

package/templates/nestjs/README.md

@@ -33,19 +33,19 @@ The server listens on the port set by `PORT` in `.env`, which the CLI created fr
 
 ## Scripts
 
-| Script             | Purpose                                                                         |
-| :----------------- | :------------------------------------------------------------------------------ |
-| `pnpm start`       | Start once, without watch mode; loads `.env` when present                       |
-| `pnpm start:dev`   | Start in watch mode; loads `.env` when present                                  |
-| `pnpm start:debug` | Start in watch mode with the Node.js inspector; loads `.env` when present       |
-| `pnpm build`       | Compile to `dist/`                                                              |
-| `pnpm start:prod`  | Run `dist/main.js`; the environment sets `PORT`                                 |
-| `pnpm test`        | Run unit tests (`src/**/*.test.ts`)                                             |
-| `pnpm test:e2e`    | Run end-to-end tests (`test/**/*.e2e.test.ts`)                                  |
-| `pnpm check`       | Run the static checks and the unit tests for changed code (the `pre-push` hook) |
-| `pnpm verify`      | Run the static checks and all unit tests with coverage                          |
-
-CI also runs the build, the end-to-end tests, the container image scan, and the security scans.
+| Script             | Purpose                                                                                                |
+| :----------------- | :----------------------------------------------------------------------------------------------------- |
+| `pnpm start`       | Start once, without watch mode; loads `.env` when present                                              |
+| `pnpm start:dev`   | Start in watch mode; loads `.env` when present                                                         |
+| `pnpm start:debug` | Start in watch mode with the Node.js inspector; loads `.env` when present                              |
+| `pnpm build`       | Compile to `dist/`                                                                                     |
+| `pnpm start:prod`  | Run `dist/main.js`; the environment sets `PORT`                                                        |
+| `pnpm test`        | Run unit tests (`src/**/*.test.ts`)                                                                    |
+| `pnpm test:e2e`    | Run end-to-end tests (`test/**/*.e2e.test.ts`)                                                         |
+| `pnpm check`       | Run the static checks, the unit tests for changed code, and the production build (the `pre-push` hook) |
+| `pnpm verify`      | Run the static checks, all unit tests with coverage, and the production build                          |
+
+CI also runs the build, the end-to-end tests, the container image scan, and the security scans, including CodeQL, dependency review, and OpenSSF Scorecard. CodeQL and Scorecard run on public repositories, and on private ones when the `CODE_SCANNING` repository variable is `true`.
 
 ## Container
 

package/templates/nestjs/package.json

@@ -12,7 +12,7 @@
   "type": "module",
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
-    "check": "pnpm verify:static && pnpm test:changed",
+    "check": "pnpm verify:static && pnpm test:changed && pnpm build",
     "clean": "rm -rf dist coverage *.tsbuildinfo .eslintcache node_modules/.cache",
     "debug:build": "tsc -p tsconfig.build.json --watch --preserveWatchOutput",
     "debug:serve": "node --env-file-if-exists=.env --inspect --watch dist/main",
@@ -42,7 +42,7 @@
     "test:e2e": "vitest run --config vitest.e2e.config.ts",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit -p tsconfig.json",
-    "verify": "pnpm verify:static && pnpm test:coverage",
+    "verify": "pnpm verify:static && pnpm test:coverage && pnpm build",
     "verify:static": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm peers:check && pnpm typecheck && pnpm knip && pnpm depcruise"
   },
   "dependencies": {

package/templates/nextjs/CONTRIBUTING.md

@@ -7,7 +7,7 @@ Use this guide to prepare changes to this repository.
 - Use the Node.js version declared by `.nvmrc` and `package.json#engines`.
 - Change the Node.js version in `.nvmrc` and the `Dockerfile` together. Dependabot updates only the `Dockerfile`.
 - Install pnpm once with `npm install --global pnpm`. It switches to the version declared by `package.json#packageManager` automatically.
-- Use Claude Code v2.1.295 or later. It reads `AGENTS.md` directly and supports the `onFailure` field the agent hooks use.
+- Use Claude Code v2.1.295 or later. It reads `CLAUDE.md`, which imports `AGENTS.md`, and supports the `onFailure` field the agent hooks use.
 - Install gitleaks 8.19 or later, which the `pre-commit` hook runs, and jq, which the agent hooks and the `pre-push` hook (`pnpm gates:check`) need: `brew install gitleaks jq` on macOS, or install them from each project's releases on Linux.
 
 From the repository root:
@@ -28,14 +28,14 @@ pnpm install
 
 Run the narrowest check that covers the change while you work. Git hooks run these checks:
 
-| Hook               | Checks                                                                                                                                                |
-| :----------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `pre-commit`       | blocks commits on `main` except the first commit of a new repository, gitleaks on staged changes, `pnpm rules:check`, and lint-staged on staged files |
-| `commit-msg`       | commitlint                                                                                                                                            |
-| `pre-merge-commit` | blocks merge commits on `main`                                                                                                                        |
-| `pre-push`         | blocks pushes to `main` except the push that creates it, then `pnpm check`: the static checks and the unit tests related to your changes              |
+| Hook               | Checks                                                                                                                                                          |
+| :----------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `pre-commit`       | blocks commits on `main` except the first commit of a new repository, gitleaks on staged changes, `pnpm rules:check`, and lint-staged on staged files           |
+| `commit-msg`       | commitlint                                                                                                                                                      |
+| `pre-merge-commit` | blocks merge commits on `main`                                                                                                                                  |
+| `pre-push`         | blocks pushes to `main` except the push that creates it, then `pnpm check`: the static checks, the unit tests related to your changes, and the production build |
 
-- **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, and OSV scans. Dependabot and OSV-Scanner report vulnerable dependencies.
+- **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, OSV, CodeQL, dependency-review, and OpenSSF Scorecard scans. Dependabot and OSV-Scanner report vulnerable dependencies.
 - **End-to-end tests:** run `pnpm test:e2e` when you change pages. It starts the development server unless one is already running. Run `pnpm exec playwright install chromium` once before the first run. CI runs it against the production build on every pull request that is ready for review and changes code.
 - **Coverage:** CI requires 95% branch coverage on changed lines in `app/`, except `layout.tsx`.
 

package/templates/nextjs/README.md

@@ -38,10 +38,10 @@ pnpm dev
 | `pnpm start`    | Serve the standalone production build after `pnpm build`. The build copies `.env`, so rebuild after you change it |
 | `pnpm test`     | Run unit tests                                                                                                    |
 | `pnpm test:e2e` | Run Playwright end-to-end tests (`test/**/*.e2e.test.ts`)                                                         |
-| `pnpm check`    | Run the static checks and the unit tests for changed code (the `pre-push` hook)                                   |
-| `pnpm verify`   | Run the static checks and all unit tests with coverage                                                            |
+| `pnpm check`    | Run the static checks, the unit tests for changed code, and the production build (the `pre-push` hook)            |
+| `pnpm verify`   | Run the static checks, all unit tests with coverage, and the production build                                     |
 
-CI also runs the build, the end-to-end tests, the container image scan, and the security scans.
+CI also runs the build, the end-to-end tests, the container image scan, and the security scans, including CodeQL, dependency review, and OpenSSF Scorecard. CodeQL and Scorecard run on public repositories, and on private ones when the `CODE_SCANNING` repository variable is `true`.
 
 ## Container
 

package/templates/nextjs/package.json

@@ -12,7 +12,7 @@
   "type": "module",
   "scripts": {
     "build": "next build",
-    "check": "pnpm verify:static && pnpm test:changed",
+    "check": "pnpm verify:static && pnpm test:changed && pnpm build",
     "clean": "rm -rf .next coverage *.tsbuildinfo .eslintcache node_modules/.cache",
     "depcruise": "depcruise --config .dependency-cruiser.json app test eslint.config.ts next.config.ts playwright.config.ts postcss.config.mjs vitest.config.ts",
     "dev": "next dev",
@@ -36,7 +36,7 @@
     "test:e2e": "playwright test",
     "test:watch": "vitest",
     "typecheck": "next typegen && tsc --noEmit -p tsconfig.json",
-    "verify": "pnpm verify:static && pnpm test:coverage",
+    "verify": "pnpm verify:static && pnpm test:coverage && pnpm build",
     "verify:static": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm peers:check && pnpm typecheck && pnpm knip && pnpm depcruise"
   },
   "dependencies": {

package/templates/nodejs/CONTRIBUTING.md

@@ -7,7 +7,7 @@ Use this guide to prepare changes to this repository.
 - Use the Node.js version declared by `.nvmrc` and `package.json#engines`.
 - Change the Node.js version in `.nvmrc` and the `Dockerfile` together. Dependabot updates only the `Dockerfile`.
 - Install pnpm once with `npm install --global pnpm`. It switches to the version declared by `package.json#packageManager` automatically.
-- Use Claude Code v2.1.295 or later. It reads `AGENTS.md` directly and supports the `onFailure` field the agent hooks use.
+- Use Claude Code v2.1.295 or later. It reads `CLAUDE.md`, which imports `AGENTS.md`, and supports the `onFailure` field the agent hooks use.
 - Install gitleaks 8.19 or later, which the `pre-commit` hook runs, and jq, which the agent hooks and the `pre-push` hook (`pnpm gates:check`) need: `brew install gitleaks jq` on macOS, or install them from each project's releases on Linux.
 
 From the repository root:
@@ -28,14 +28,14 @@ pnpm install
 
 Run the narrowest check that covers the change while you work. Git hooks run these checks:
 
-| Hook               | Checks                                                                                                                                                |
-| :----------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `pre-commit`       | blocks commits on `main` except the first commit of a new repository, gitleaks on staged changes, `pnpm rules:check`, and lint-staged on staged files |
-| `commit-msg`       | commitlint                                                                                                                                            |
-| `pre-merge-commit` | blocks merge commits on `main`                                                                                                                        |
-| `pre-push`         | blocks pushes to `main` except the push that creates it, then `pnpm check`: the static checks and the unit tests related to your changes              |
+| Hook               | Checks                                                                                                                                                          |
+| :----------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `pre-commit`       | blocks commits on `main` except the first commit of a new repository, gitleaks on staged changes, `pnpm rules:check`, and lint-staged on staged files           |
+| `commit-msg`       | commitlint                                                                                                                                                      |
+| `pre-merge-commit` | blocks merge commits on `main`                                                                                                                                  |
+| `pre-push`         | blocks pushes to `main` except the push that creates it, then `pnpm check`: the static checks, the unit tests related to your changes, and the production build |
 
-- **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, and OSV scans. Dependabot and OSV-Scanner report vulnerable dependencies.
+- **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, OSV, CodeQL, dependency-review, and OpenSSF Scorecard scans. Dependabot and OSV-Scanner report vulnerable dependencies.
 - **Coverage:** CI requires 95% line coverage on changed lines in `src/`, except `main.ts`, which holds only wiring. Keep logic out of it, as `src/port.ts` and `src/server.ts` do.
 
 Run `pnpm verify` for repository changes.

package/templates/nodejs/README.md

@@ -33,17 +33,17 @@ The server listens on the port set by `PORT` in `.env`, which the CLI created fr
 
 ## Scripts
 
-| Script            | Purpose                                                                    |
-| :---------------- | :------------------------------------------------------------------------- |
-| `pnpm start:dev`  | Start in watch mode from `src/main.ts`; loads `.env` when present          |
-| `pnpm build`      | Compile to `dist/`                                                         |
-| `pnpm start`      | Run `dist/main.js`; loads `.env` when present                              |
-| `pnpm start:prod` | Run `dist/main.js`; the environment sets `PORT`                            |
-| `pnpm test`       | Run tests (`src/**/*.test.ts`)                                             |
-| `pnpm check`      | Run the static checks and the tests for changed code (the `pre-push` hook) |
-| `pnpm verify`     | Run the static checks and all tests with coverage                          |
-
-CI also runs the build, the container image scan, and the security scans.
+| Script            | Purpose                                                                                           |
+| :---------------- | :------------------------------------------------------------------------------------------------ |
+| `pnpm start:dev`  | Start in watch mode from `src/main.ts`; loads `.env` when present                                 |
+| `pnpm build`      | Compile to `dist/`                                                                                |
+| `pnpm start`      | Run `dist/main.js`; loads `.env` when present                                                     |
+| `pnpm start:prod` | Run `dist/main.js`; the environment sets `PORT`                                                   |
+| `pnpm test`       | Run tests (`src/**/*.test.ts`)                                                                    |
+| `pnpm check`      | Run the static checks, the tests for changed code, and the production build (the `pre-push` hook) |
+| `pnpm verify`     | Run the static checks, all tests with coverage, and the production build                          |
+
+CI also runs the build, the container image scan, and the security scans, including CodeQL, dependency review, and OpenSSF Scorecard. CodeQL and Scorecard run on public repositories, and on private ones when the `CODE_SCANNING` repository variable is `true`.
 
 ## Container
 

package/templates/nodejs/package.json

@@ -12,7 +12,7 @@
   "type": "module",
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
-    "check": "pnpm verify:static && pnpm test:changed",
+    "check": "pnpm verify:static && pnpm test:changed && pnpm build",
     "clean": "rm -rf dist coverage *.tsbuildinfo .eslintcache node_modules/.cache",
     "depcruise": "depcruise --config .dependency-cruiser.json src eslint.config.ts vitest.config.ts",
     "format": "prettier --write --cache .",
@@ -36,7 +36,7 @@
     "test:coverage": "vitest run --coverage --passWithNoTests",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit -p tsconfig.json",
-    "verify": "pnpm verify:static && pnpm test:coverage",
+    "verify": "pnpm verify:static && pnpm test:coverage && pnpm build",
     "verify:static": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm peers:check && pnpm typecheck && pnpm knip && pnpm depcruise"
   },
   "devDependencies": {

package/templates/payload/CONTRIBUTING.md

@@ -7,7 +7,7 @@ Use this guide to prepare changes to this repository.
 - Use the Node.js version declared by `.nvmrc` and `package.json#engines`.
 - Change the Node.js version in `.nvmrc` and the `Dockerfile` together. Dependabot updates only the `Dockerfile`.
 - Install pnpm once with `npm install --global pnpm`. It switches to the version declared by `package.json#packageManager` automatically.
-- Use Claude Code v2.1.295 or later. It reads `AGENTS.md` directly and supports the `onFailure` field the agent hooks use.
+- Use Claude Code v2.1.295 or later. It reads `CLAUDE.md`, which imports `AGENTS.md`, and supports the `onFailure` field the agent hooks use.
 - Install gitleaks 8.19 or later, which the `pre-commit` hook runs, and jq, which the agent hooks and the `pre-push` hook (`pnpm gates:check`) need: `brew install gitleaks jq` on macOS, or install them from each project's releases on Linux.
 
 From the repository root:
@@ -29,14 +29,14 @@ pnpm install
 
 Run the narrowest check that covers the change while you work. Git hooks run these checks:
 
-| Hook               | Checks                                                                                                                                                |
-| :----------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `pre-commit`       | blocks commits on `main` except the first commit of a new repository, gitleaks on staged changes, `pnpm rules:check`, and lint-staged on staged files |
-| `commit-msg`       | commitlint                                                                                                                                            |
-| `pre-merge-commit` | blocks merge commits on `main`                                                                                                                        |
-| `pre-push`         | blocks pushes to `main` except the push that creates it, then `pnpm check`: the static checks and the unit tests related to your changes              |
+| Hook               | Checks                                                                                                                                                          |
+| :----------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `pre-commit`       | blocks commits on `main` except the first commit of a new repository, gitleaks on staged changes, `pnpm rules:check`, and lint-staged on staged files           |
+| `commit-msg`       | commitlint                                                                                                                                                      |
+| `pre-merge-commit` | blocks merge commits on `main`                                                                                                                                  |
+| `pre-push`         | blocks pushes to `main` except the push that creates it, then `pnpm check`: the static checks, the unit tests related to your changes, and the production build |
 
-- **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, and OSV scans. Dependabot and OSV-Scanner report vulnerable dependencies.
+- **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, OSV, CodeQL, dependency-review, and OpenSSF Scorecard scans. Dependabot and OSV-Scanner report vulnerable dependencies.
 - **End-to-end tests:** run `pnpm test:e2e` when you change pages or the admin panel. It starts the development server unless one is already running, and needs `DATABASE_URL` and `PAYLOAD_SECRET` from `.env`. Run `pnpm exec playwright install chromium` once before the first run. CI runs it against the production build and a PostgreSQL service on every pull request that is ready for review and changes code.
 - **Coverage:** CI requires 95% branch coverage on changed lines in `src/`, except layouts, the Payload config, and generated files.
 

package/templates/payload/README.md

@@ -54,10 +54,10 @@ In development, Payload applies collection changes to the database directly. In
 | `pnpm generate:importmap` | Regenerate the admin import map after adding a custom component                                                   |
 | `pnpm migrate:create`     | Create a migration from collection changes, for example `pnpm migrate:create add-posts`                           |
 | `pnpm migrate`            | Apply pending migrations to the database in `DATABASE_URL`                                                        |
-| `pnpm check`              | Run the static checks and the unit tests for changed code (the `pre-push` hook)                                   |
-| `pnpm verify`             | Run the static checks and all unit tests with coverage                                                            |
+| `pnpm check`              | Run the static checks, the unit tests for changed code, and the production build (the `pre-push` hook)            |
+| `pnpm verify`             | Run the static checks, all unit tests with coverage, and the production build                                     |
 
-CI also runs the build, the end-to-end tests, the container image scan, and the security scans.
+CI also runs the build, the end-to-end tests, the container image scan, and the security scans, including CodeQL, dependency review, and OpenSSF Scorecard. CodeQL and Scorecard run on public repositories, and on private ones when the `CODE_SCANNING` repository variable is `true`.
 
 ## Container
 

package/templates/payload/package.json

@@ -12,7 +12,7 @@
   "type": "module",
   "scripts": {
     "build": "next build",
-    "check": "pnpm verify:static && pnpm test:changed",
+    "check": "pnpm verify:static && pnpm test:changed && pnpm build",
     "clean": "rm -rf .next coverage *.tsbuildinfo .eslintcache node_modules/.cache",
     "depcruise": "depcruise --config .dependency-cruiser.json src test eslint.config.ts next.config.ts playwright.config.ts vitest.config.ts",
     "dev": "next dev",
@@ -41,7 +41,7 @@
     "test:e2e": "playwright test",
     "test:watch": "vitest",
     "typecheck": "next typegen && tsc --noEmit -p tsconfig.json",
-    "verify": "pnpm verify:static && pnpm test:coverage",
+    "verify": "pnpm verify:static && pnpm test:coverage && pnpm build",
     "verify:static": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm peers:check && pnpm typecheck && pnpm knip && pnpm depcruise"
   },
   "dependencies": {

package/templates/turborepo/CONTRIBUTING.md

@@ -7,7 +7,7 @@ Use this guide to prepare changes to this repository.
 - Use the Node.js version declared by `.nvmrc` and `package.json#engines`.
 - Change the Node.js version in `.nvmrc` and both Dockerfiles together. Dependabot updates only the Dockerfiles.
 - Install pnpm once with `npm install --global pnpm`. It switches to the version declared by `package.json#packageManager` automatically.
-- Use Claude Code v2.1.295 or later. It reads `AGENTS.md` directly and supports the `onFailure` field the agent hooks use.
+- Use Claude Code v2.1.295 or later. It reads `CLAUDE.md`, which imports `AGENTS.md`, and supports the `onFailure` field the agent hooks use.
 - Install gitleaks 8.19 or later, which the `pre-commit` hook runs, and jq, which the agent hooks and the `pre-push` hook (`pnpm gates:check`) need: `brew install gitleaks jq` on macOS, or install them from each project's releases on Linux.
 
 From the repository root:
@@ -29,14 +29,14 @@ pnpm install
 
 Run the narrowest check that covers the change while you work. Git hooks run these checks:
 
-| Hook               | Checks                                                                                                                                                |
-| :----------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `pre-commit`       | blocks commits on `main` except the first commit of a new repository, gitleaks on staged changes, `pnpm rules:check`, and lint-staged on staged files |
-| `commit-msg`       | commitlint                                                                                                                                            |
-| `pre-merge-commit` | blocks merge commits on `main`                                                                                                                        |
-| `pre-push`         | blocks pushes to `main` except the push that creates it, then `pnpm check`: the static checks and the unit tests related to your changes              |
+| Hook               | Checks                                                                                                                                                          |
+| :----------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `pre-commit`       | blocks commits on `main` except the first commit of a new repository, gitleaks on staged changes, `pnpm rules:check`, and lint-staged on staged files           |
+| `commit-msg`       | commitlint                                                                                                                                                      |
+| `pre-merge-commit` | blocks merge commits on `main`                                                                                                                                  |
+| `pre-push`         | blocks pushes to `main` except the push that creates it, then `pnpm check`: the static checks, the unit tests related to your changes, and the production build |
 
-- **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, and OSV scans. Dependabot and OSV-Scanner report vulnerable dependencies.
+- **Scans:** CI also runs coverage, the build, the container image, and the secret, SAST, OSV, CodeQL, dependency-review, and OpenSSF Scorecard scans. Dependabot and OSV-Scanner report vulnerable dependencies.
 - **End-to-end tests:** run `pnpm test:e2e` when you change pages or the admin panel. It starts both development servers unless they are already running, and the backoffice needs `DATABASE_URL` and `PAYLOAD_SECRET` from `.env`. Run `pnpm --filter ./apps/app exec playwright install chromium` once before the first run. CI runs it against the production build and a PostgreSQL service on every pull request that is ready for review and changes code.
 - **Coverage:** CI requires 95% branch coverage on changed lines in `apps/app/app/` and `apps/backoffice/src/`, except layouts, the Payload config, and generated files.
 

package/templates/turborepo/README.md

@@ -43,21 +43,21 @@ In development, Payload applies collection changes to the database directly. In
 
 ## Scripts
 
-| Script                    | Purpose                                                                                          |
-| :------------------------ | :----------------------------------------------------------------------------------------------- |
-| `pnpm dev`                | Start the Next.js app on port 3000 and the Payload backoffice on port 3001                       |
-| `pnpm build`              | Build both apps for production                                                                   |
-| `pnpm start`              | Serve both standalone production builds after `pnpm build`                                       |
-| `pnpm test`               | Run unit tests in both apps                                                                      |
-| `pnpm test:e2e`           | Run Playwright end-to-end tests in both apps. The backoffice uses the database in `DATABASE_URL` |
-| `pnpm generate:types`     | Regenerate `apps/backoffice/src/payload-types.ts` after a collection change                      |
-| `pnpm generate:importmap` | Regenerate the admin import map after adding a custom component                                  |
-| `pnpm migrate:create`     | Create a migration from collection changes, for example `pnpm migrate:create add-posts`          |
-| `pnpm migrate`            | Apply pending migrations to the database in `DATABASE_URL`                                       |
-| `pnpm check`              | Run the static checks and the unit tests for changed code (the `pre-push` hook)                  |
-| `pnpm verify`             | Run the static checks and all unit tests with coverage                                           |
-
-CI also runs the build, the end-to-end tests, the container image scans, and the security scans. Pull requests run Turborepo with `--affected` against the base branch, so only packages that changed are typed, tested, built, and scanned. Pushes to `main` and the weekly schedule still run every app. Patch coverage runs only for apps that produced a coverage file.
+| Script                    | Purpose                                                                                                |
+| :------------------------ | :----------------------------------------------------------------------------------------------------- |
+| `pnpm dev`                | Start the Next.js app on port 3000 and the Payload backoffice on port 3001                             |
+| `pnpm build`              | Build both apps for production                                                                         |
+| `pnpm start`              | Serve both standalone production builds after `pnpm build`                                             |
+| `pnpm test`               | Run unit tests in both apps                                                                            |
+| `pnpm test:e2e`           | Run Playwright end-to-end tests in both apps. The backoffice uses the database in `DATABASE_URL`       |
+| `pnpm generate:types`     | Regenerate `apps/backoffice/src/payload-types.ts` after a collection change                            |
+| `pnpm generate:importmap` | Regenerate the admin import map after adding a custom component                                        |
+| `pnpm migrate:create`     | Create a migration from collection changes, for example `pnpm migrate:create add-posts`                |
+| `pnpm migrate`            | Apply pending migrations to the database in `DATABASE_URL`                                             |
+| `pnpm check`              | Run the static checks, the unit tests for changed code, and the production build (the `pre-push` hook) |
+| `pnpm verify`             | Run the static checks, all unit tests with coverage, and the production build                          |
+
+CI also runs the build, the end-to-end tests, the container image scans, and the security scans, including CodeQL, dependency review, and OpenSSF Scorecard. CodeQL and Scorecard run on public repositories, and on private ones when the `CODE_SCANNING` repository variable is `true`. Pull requests run Turborepo with `--affected` against the base branch, so only packages that changed are typed, tested, built, and scanned. Pushes to `main` and the weekly schedule still run every app. Patch coverage runs only for apps that produced a coverage file.
 
 To reuse task output across CI runs, create a Vercel team, add the repository variable `TURBO_TEAM`, and follow [Turborepo on GitHub Actions](https://turborepo.dev/docs/guides/ci-vendors/github-actions) to allow OIDC. The workflow exchanges GitHub OIDC for a short-lived Remote Cache token. If OIDC is unavailable, set the `TURBO_TOKEN` secret instead. Leave both unset to run without a Remote Cache.
 

package/templates/turborepo/package.json

@@ -12,7 +12,7 @@
   "type": "module",
   "scripts": {
     "build": "turbo run build ${TURBO_FILTER:-\"--filter=./apps/*\"}",
-    "check": "pnpm verify:static && pnpm test:changed",
+    "check": "pnpm verify:static && pnpm test:changed && pnpm build",
     "clean": "rm -rf apps/app/.next apps/app/coverage apps/backoffice/.next apps/backoffice/coverage .turbo coverage *.tsbuildinfo .eslintcache node_modules/.cache",
     "depcruise": "turbo run depcruise ${TURBO_FILTER:-\"--filter=./apps/*\"}",
     "dev": "turbo run dev --filter=./apps/*",
@@ -40,7 +40,7 @@
     "test:e2e": "turbo run test:e2e ${TURBO_FILTER:-\"--filter=./apps/*\"}",
     "test:watch": "turbo run test:watch --filter=./apps/*",
     "typecheck": "tsc --noEmit -p tsconfig.json && turbo run typecheck ${TURBO_FILTER:-\"--filter=./apps/*\"}",
-    "verify": "pnpm verify:static && pnpm test:coverage",
+    "verify": "pnpm verify:static && pnpm test:coverage && pnpm build",
     "verify:static": "pnpm suppressions:check && pnpm rules:check && pnpm gates:check && pnpm lint:check && pnpm format:check && pnpm sort-package-json:check && pnpm peers:check && pnpm typecheck && pnpm knip && pnpm depcruise"
   },
   "devDependencies": {

package/templates/turborepo/.github/labeler.yml

@@ -1,25 +0,0 @@
-documentation:
-  - changed-files:
-      - any-glob-to-any-file:
-          - "**/*.md"
-
-ci:
-  - changed-files:
-      - any-glob-to-any-file:
-          - ".github/workflows/**"
-          - ".github/file-filters.yml"
-          - ".github/dependabot.yml"
-          - ".github/labeler.yml"
-          - ".github/zizmor.yml"
-          - ".github/requirements/**"
-          - ".github/CODEOWNERS"
-          - ".husky/**"
-
-dependencies:
-  - changed-files:
-      - any-glob-to-any-file:
-          - "**/package.json"
-          - "**/pnpm-lock.yaml"
-          - "pnpm-workspace.yaml"
-          - "**/Dockerfile"
-          - ".github/requirements/**"