@next-friday/create-app 2.1.7 → 2.1.8

package/README.md

@@ -65,7 +65,7 @@ The name must:
 ## What the CLI does
 
 1. Copies the template into the project directory and replaces the template's package name with the project name.
-2. Writes `.env` from `.env.example`. For Payload, it sets `PAYLOAD_SECRET` to a random secret.
+2. Writes `.env` from `.env.example`. For Payload and Turborepo, it sets `PAYLOAD_SECRET` to a random secret.
 3. Runs `git init --initial-branch=main`, unless the directory is already in a Git repository.
 4. Runs `pnpm install`, which also installs the Git hooks.
 5. Prints the next steps, for example:
@@ -75,7 +75,7 @@ The name must:
    pnpm start:dev
    ```
 
-   The development script is `pnpm dev` for Next.js and Payload, and `pnpm start:dev` for Node.js and NestJS.
+   The development script is `pnpm dev` for Next.js, Payload, and Turborepo, and `pnpm start:dev` for Node.js and NestJS.
 
 Then follow **After creating a project from this template** in the project's `README.md` to make the first commit and set up the repository.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@next-friday/create-app",
-  "version": "2.1.7",
+  "version": "2.1.8",
   "description": "Create a Next Friday project from a template.",
   "keywords": [
     "create",

package/templates/base/.claude/settings.json

@@ -49,7 +49,7 @@
         ]
       },
       {
-        "matcher": "Bash",
+        "matcher": "Bash|PowerShell|Monitor",
         "hooks": [
           {
             "type": "command",

package/templates/base/.github/workflows/deploy.yml

@@ -33,6 +33,7 @@ concurrency:
 jobs:
   verify:
     name: Verify the requested commit
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:
@@ -66,13 +67,14 @@ jobs:
             prod)
               previous=uat
               export EXPECTED_TITLE="Deploy $COMMIT_SHA to uat"
-              deployed="$(gh api --paginate "repos/$REPOSITORY/actions/workflows/deploy.yml/runs?event=workflow_dispatch&status=success&per_page=100" --jq '.workflow_runs[] | select(.display_title == env.EXPECTED_TITLE) | .id' | wc -l)"
+              deployed="$(gh api --paginate "repos/$REPOSITORY/actions/workflows/deploy.yml/runs?event=workflow_dispatch&status=success&branch=main&per_page=100" --jq '.workflow_runs[] | select(.display_title == env.EXPECTED_TITLE) | .id' | wc -l)"
               ;;
           esac
           [[ "$deployed" -gt 0 ]] || { echo "::error::$COMMIT_SHA has no successful $previous deployment; promote through $previous first"; exit 1; }
 
   deploy:
     name: Deploy to ${{ inputs.environment }}
+    if: github.ref == 'refs/heads/main'
     needs: verify
     runs-on: ubuntu-latest
     timeout-minutes: 30

package/templates/nestjs/AGENTS.md

@@ -28,7 +28,7 @@ NestJS HTTP API in TypeScript on pnpm and Node.js `>=24.15.0 <25`.
 
 ## Known pitfalls
 
-- **Agent shell gate**: `.agents/hooks/agent-shell-gate.sh` blocks a shell command that names a protected path such as `.agents`, `.cursor`, `.claude/rules`, or `.husky`, even when it only reads.
+- **Agent shell gate**: `.agents/hooks/agent-shell-gate.sh` blocks a shell command that writes to a protected path such as `.agents`, `.cursor`, `.claude/rules`, or `.husky`. It is a convenience, not a security boundary: CI and code-owner review are the boundary.
 
 ## Related documentation
 

package/templates/nestjs/README.md

@@ -68,7 +68,7 @@ On Vercel, the zero-configuration NestJS preset takes precedence over the `Docke
    - the `RAILWAY_SERVICE` variable: the service name;
    - the `APP_URL` variable: the public `https://` URL.
 
-   Limit `prod` to the `main` branch and add required reviewers. Environment secrets and variables in a private repository need GitHub Pro, Team, or Enterprise; required reviewers in a private repository need GitHub Enterprise.
+   Limit `dev`, `uat`, and `prod` to the `main` branch and add required reviewers. Environment secrets and variables in a private repository need GitHub Pro, Team, or Enterprise; required reviewers in a private repository need GitHub Enterprise.
 
 3. Set the repository variable `DEPLOY_ENABLED` to `true`. Each push to `main` that passes CI then deploys to `dev`.
 4. Promote with **Actions → Deploy → Run workflow**, giving the environment and the full commit SHA. The workflow requires a successful CI run on `main` for that commit and a successful deployment to the previous environment, then waits for `/health`.

package/templates/nextjs/AGENTS.md

@@ -29,7 +29,7 @@ Next.js App Router web app with React and Tailwind CSS, in TypeScript on pnpm an
 ## Known pitfalls
 
 - **First end-to-end run**: run `pnpm exec playwright install chromium` once. `pnpm test:e2e` starts the development server unless one is already running.
-- **Agent shell gate**: `.agents/hooks/agent-shell-gate.sh` blocks a shell command that names a protected path such as `.agents`, `.cursor`, `.claude/rules`, or `.husky`, even when it only reads.
+- **Agent shell gate**: `.agents/hooks/agent-shell-gate.sh` blocks a shell command that writes to a protected path such as `.agents`, `.cursor`, `.claude/rules`, or `.husky`. It is a convenience, not a security boundary: CI and code-owner review are the boundary.
 
 ## Related documentation
 

package/templates/nextjs/README.md

@@ -64,7 +64,7 @@ On Vercel, deploy without the image; the Next.js preset takes precedence over th
    - the `RAILWAY_SERVICE` variable: the service name;
    - the `APP_URL` variable: the public `https://` URL.
 
-   Limit `prod` to the `main` branch and add required reviewers. Environment secrets and variables in a private repository need GitHub Pro, Team, or Enterprise; required reviewers in a private repository need GitHub Enterprise.
+   Limit `dev`, `uat`, and `prod` to the `main` branch and add required reviewers. Environment secrets and variables in a private repository need GitHub Pro, Team, or Enterprise; required reviewers in a private repository need GitHub Enterprise.
 
 3. Set the repository variable `DEPLOY_ENABLED` to `true`. Each push to `main` that passes CI then deploys to `dev`.
 4. Promote with **Actions → Deploy → Run workflow**, giving the environment and the full commit SHA. The workflow requires a successful CI run on `main` for that commit and a successful deployment to the previous environment, then waits for `/health`.

package/templates/nodejs/AGENTS.md

@@ -26,7 +26,7 @@ TypeScript HTTP service on `node:http`, without a framework, on pnpm and Node.js
 
 ## Known pitfalls
 
-- **Agent shell gate**: `.agents/hooks/agent-shell-gate.sh` blocks a shell command that names a protected path such as `.agents`, `.cursor`, `.claude/rules`, or `.husky`, even when it only reads.
+- **Agent shell gate**: `.agents/hooks/agent-shell-gate.sh` blocks a shell command that writes to a protected path such as `.agents`, `.cursor`, `.claude/rules`, or `.husky`. It is a convenience, not a security boundary: CI and code-owner review are the boundary.
 
 ## Related documentation
 

package/templates/nodejs/README.md

@@ -64,7 +64,7 @@ docker run --env PORT=3000 --publish 3000:3000 app
    - the `RAILWAY_SERVICE` variable: the service name;
    - the `APP_URL` variable: the public `https://` URL.
 
-   Limit `prod` to the `main` branch and add required reviewers. Environment secrets and variables in a private repository need GitHub Pro, Team, or Enterprise; required reviewers in a private repository need GitHub Enterprise.
+   Limit `dev`, `uat`, and `prod` to the `main` branch and add required reviewers. Environment secrets and variables in a private repository need GitHub Pro, Team, or Enterprise; required reviewers in a private repository need GitHub Enterprise.
 
 3. Set the repository variable `DEPLOY_ENABLED` to `true`. Each push to `main` that passes CI then deploys to `dev`.
 4. Promote with **Actions → Deploy → Run workflow**, giving the environment and the full commit SHA. The workflow requires a successful CI run on `main` for that commit and a successful deployment to the previous environment, then waits for `/health`.

package/templates/payload/AGENTS.md

@@ -32,7 +32,7 @@ Payload CMS on Next.js App Router and PostgreSQL, in TypeScript on pnpm and Node
 ## Known pitfalls
 
 - **Database for `pnpm dev` and end-to-end tests**: both need a PostgreSQL database in `DATABASE_URL` and `PAYLOAD_SECRET` in `.env`; the README lists every variable. Run `pnpm exec playwright install chromium` once before the first `pnpm test:e2e`.
-- **Agent shell gate**: `.agents/hooks/agent-shell-gate.sh` blocks a shell command that names a protected path such as `.agents`, `.cursor`, `.claude/rules`, or `.husky`, even when it only reads.
+- **Agent shell gate**: `.agents/hooks/agent-shell-gate.sh` blocks a shell command that writes to a protected path such as `.agents`, `.cursor`, `.claude/rules`, or `.husky`. It is a convenience, not a security boundary: CI and code-owner review are the boundary.
 
 ## Related documentation
 

package/templates/payload/README.md

@@ -88,7 +88,7 @@ On Vercel, deploy without the image; the Next.js preset takes precedence over th
    - the `RAILWAY_SERVICE` variable: the service name;
    - the `APP_URL` variable: the public `https://` URL.
 
-   Limit `prod` to the `main` branch and add required reviewers. Environment secrets and variables in a private repository need GitHub Pro, Team, or Enterprise; required reviewers in a private repository need GitHub Enterprise.
+   Limit `dev`, `uat`, and `prod` to the `main` branch and add required reviewers. Environment secrets and variables in a private repository need GitHub Pro, Team, or Enterprise; required reviewers in a private repository need GitHub Enterprise.
 
 3. Set the repository variable `DEPLOY_ENABLED` to `true`. Each push to `main` that passes CI then deploys to `dev`.
 4. Promote with **Actions → Deploy → Run workflow**, giving the environment and the full commit SHA. The workflow requires a successful CI run on `main` for that commit and a successful deployment to the previous environment, then waits for `/health`.

package/templates/turborepo/.github/workflows/ci.yml

@@ -214,37 +214,46 @@ jobs:
             done
           } >> "$GITHUB_OUTPUT"
       - name: Lint Dockerfile
+        env:
+          AFFECTED_APP: ${{ steps.affected.outputs.app }}
+          AFFECTED_BACKOFFICE: ${{ steps.affected.outputs.backoffice }}
         run: |
           curl --silent --show-error --fail --location --output hadolint \
             "https://github.com/hadolint/hadolint/releases/download/v${HADOLINT_VERSION}/hadolint-linux-x86_64"
           echo "${HADOLINT_SHA256}  hadolint" | sha256sum --check --strict
           chmod +x hadolint
           files=()
-          if [[ "${{ steps.affected.outputs.app }}" == "true" ]]; then
+          if [[ "$AFFECTED_APP" == "true" ]]; then
             files+=(apps/app/Dockerfile)
           fi
-          if [[ "${{ steps.affected.outputs.backoffice }}" == "true" ]]; then
+          if [[ "$AFFECTED_BACKOFFICE" == "true" ]]; then
             files+=(apps/backoffice/Dockerfile)
           fi
           if [[ "${#files[@]}" -gt 0 ]]; then
             ./hadolint "${files[@]}"
           fi
       - name: Build images
+        env:
+          AFFECTED_APP: ${{ steps.affected.outputs.app }}
+          AFFECTED_BACKOFFICE: ${{ steps.affected.outputs.backoffice }}
         run: |
-          if [[ "${{ steps.affected.outputs.app }}" == "true" ]]; then
+          if [[ "$AFFECTED_APP" == "true" ]]; then
             docker build --file apps/app/Dockerfile --tag app:ci .
           fi
-          if [[ "${{ steps.affected.outputs.backoffice }}" == "true" ]]; then
+          if [[ "$AFFECTED_BACKOFFICE" == "true" ]]; then
             docker build --file apps/backoffice/Dockerfile --tag backoffice:ci .
           fi
       - name: Smoke test images
+        env:
+          AFFECTED_APP: ${{ steps.affected.outputs.app }}
+          AFFECTED_BACKOFFICE: ${{ steps.affected.outputs.backoffice }}
         id: smoke
         run: |
-          if [[ "${{ steps.affected.outputs.app }}" == "true" ]]; then
+          if [[ "$AFFECTED_APP" == "true" ]]; then
             docker run --detach --name app --env PORT=3000 --publish 3000:3000 app:ci
             curl --silent --show-error --fail --retry 15 --retry-delay 1 --retry-all-errors --output /dev/null http://localhost:3000/health
           fi
-          if [[ "${{ steps.affected.outputs.backoffice }}" == "true" ]]; then
+          if [[ "$AFFECTED_BACKOFFICE" == "true" ]]; then
             docker run --detach --name backoffice --env PORT=3001 --env DATABASE_URL=postgres://build-only@localhost/build-only --env PAYLOAD_SECRET=ci-only-secret --env APP_URL=http://localhost:3001 --publish 3001:3001 backoffice:ci
             curl --silent --show-error --fail --retry 15 --retry-delay 1 --retry-all-errors --output /dev/null http://localhost:3001/health
           fi
@@ -258,16 +267,19 @@ jobs:
             docker logs backoffice
           fi
       - name: Scan images for vulnerabilities
+        env:
+          AFFECTED_APP: ${{ steps.affected.outputs.app }}
+          AFFECTED_BACKOFFICE: ${{ steps.affected.outputs.backoffice }}
         run: |
           archive="trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
           curl --silent --show-error --fail --location --output "$archive" \
             "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/${archive}"
           echo "${TRIVY_SHA256}  ${archive}" | sha256sum --check --strict
           tar --extract --gzip --file "$archive" trivy
-          if [[ "${{ steps.affected.outputs.app }}" == "true" ]]; then
+          if [[ "$AFFECTED_APP" == "true" ]]; then
             ./trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --no-progress app:ci
           fi
-          if [[ "${{ steps.affected.outputs.backoffice }}" == "true" ]]; then
+          if [[ "$AFFECTED_BACKOFFICE" == "true" ]]; then
             ./trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --no-progress backoffice:ci
           fi
 

package/templates/turborepo/.github/workflows/deploy.yml

@@ -33,6 +33,7 @@ concurrency:
 jobs:
   verify:
     name: Verify the requested commit
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     timeout-minutes: 5
     permissions:
@@ -66,13 +67,14 @@ jobs:
             prod)
               previous=uat
               export EXPECTED_TITLE="Deploy $COMMIT_SHA to uat"
-              deployed="$(gh api --paginate "repos/$REPOSITORY/actions/workflows/deploy.yml/runs?event=workflow_dispatch&status=success&per_page=100" --jq '.workflow_runs[] | select(.display_title == env.EXPECTED_TITLE) | .id' | wc -l)"
+              deployed="$(gh api --paginate "repos/$REPOSITORY/actions/workflows/deploy.yml/runs?event=workflow_dispatch&status=success&branch=main&per_page=100" --jq '.workflow_runs[] | select(.display_title == env.EXPECTED_TITLE) | .id' | wc -l)"
               ;;
           esac
           [[ "$deployed" -gt 0 ]] || { echo "::error::$COMMIT_SHA has no successful $previous deployment; promote through $previous first"; exit 1; }
 
   deploy:
     name: Deploy to ${{ inputs.environment }}
+    if: github.ref == 'refs/heads/main'
     needs: verify
     runs-on: ubuntu-latest
     timeout-minutes: 40
@@ -134,7 +136,7 @@ jobs:
               latest="$completed"
               previous="$candidate"
             fi
-          done < <(gh api --paginate "repos/$REPOSITORY/actions/workflows/deploy.yml/runs?status=success&per_page=50" --jq '.workflow_runs[] | [.id, .display_title] | @tsv')
+          done < <(gh api --paginate "repos/$REPOSITORY/actions/workflows/deploy.yml/runs?status=success&branch=main&per_page=50" --jq '.workflow_runs[] | [.id, .display_title] | @tsv')
           while IFS=$'\t' read -r run_id head_sha; do
             [[ -z "$run_id" || "$head_sha" == "$COMMIT_SHA" ]] && continue
             completed="$(gh api "repos/$REPOSITORY/actions/runs/$run_id/jobs" | jq -r --arg env "$RAILWAY_ENVIRONMENT" '[.jobs[] | select(.conclusion == "success" and .name == "Deploy to \($env) / Deploy to \($env)") | .completed_at] | max // empty')"

package/templates/turborepo/AGENTS.md

@@ -34,8 +34,8 @@ Turborepo workspace in TypeScript on pnpm and Node.js `>=24.22.1 <25`. `apps/app
 ## Known pitfalls
 
 - **Next.js docs live per app**: this Next.js version differs from your training data. Read the guide in `apps/app/node_modules/next/dist/docs/` or `apps/backoffice/node_modules/next/dist/docs/` before writing Next.js code; the workspace root has no `next` package.
-- **Database for `pnpm dev` and end-to-end tests**: the backoffice needs a PostgreSQL database in `DATABASE_URL` and `PAYLOAD_SECRET` in `.env`; the README lists every variable. Run `pnpm exec playwright install chromium` once before the first `pnpm test:e2e`.
-- **Agent shell gate**: `.agents/hooks/agent-shell-gate.sh` blocks a shell command that names a protected path such as `.agents`, `.cursor`, `.claude/rules`, or `.husky`, even when it only reads.
+- **Database for `pnpm dev` and end-to-end tests**: the backoffice needs a PostgreSQL database in `DATABASE_URL` and `PAYLOAD_SECRET` in `.env`; the README lists every variable. Run `pnpm --filter ./apps/app exec playwright install chromium` once before the first `pnpm test:e2e`.
+- **Agent shell gate**: `.agents/hooks/agent-shell-gate.sh` blocks a shell command that writes to a protected path such as `.agents`, `.cursor`, `.claude/rules`, or `.husky`. It is a convenience, not a security boundary: CI and code-owner review are the boundary.
 
 ## Related documentation
 

package/templates/turborepo/README.md

@@ -94,7 +94,7 @@ On Vercel, deploy an app without its image. The Next.js preset takes precedence
    - the `APP_URL` variable: the public Next.js `https://` URL;
    - the `BACKOFFICE_URL` variable: the public backoffice `https://` URL.
 
-   Limit `prod` to the `main` branch and add required reviewers. Environment secrets and variables in a private repository need GitHub Pro, Team, or Enterprise; required reviewers in a private repository need GitHub Enterprise.
+   Limit `dev`, `uat`, and `prod` to the `main` branch and add required reviewers. Environment secrets and variables in a private repository need GitHub Pro, Team, or Enterprise; required reviewers in a private repository need GitHub Enterprise.
 
 3. Set the repository variable `DEPLOY_ENABLED` to `true`. Each push to `main` that passes CI then deploys to `dev`. The workflow compares the commit with the last GitHub deployment to that environment and runs `railway up` only for services whose packages changed. A promotion through `uat` or `prod` uses the same comparison against the commit last deployed there, so several commits still ship every changed service. The first deploy to an environment ships both services.
 4. Promote with **Actions → Deploy → Run workflow**, giving the environment and the full commit SHA. The workflow requires a successful CI run on `main` for that commit and a successful deployment to the previous environment, then waits for `/health` on each service it uploaded.