@next-friday/create-app 4.0.0 → 5.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@next-friday/create-app",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "Create a Next Friday project from a template.",
   "keywords": [
     "create",

package/templates/base/SETUP.md

@@ -7,10 +7,10 @@ This project follows Anthropic's [AI-native SDLC Playbook](https://claude.com/re
 1. **Plan:** an idea, a ticket, or an incident becomes `intent/<change>/intent.md` (`write-intent` skill). The product owner merges or closes it.
 2. **Design:** `spec.md` is written from the accepted intent with the policy skills loaded (`write-spec` skill). The product owner resolves concerns with the policy owners.
 3. **Build:** the engineer starts in plan mode, approves the plan, and commits it as `plan.md`. A tech lead approves higher-risk plans.
-4. **Test:** the session runs **Verifying your work** in `AGENTS.md`; `evals/` tests the agent configuration.
-5. **Review:** Claude Code Review and Bugbot review by `REVIEW.md`; `@claude` on a review comment makes Claude push a fix. A code owner approves; the agent never does.
-6. **Deploy:** a failed build gets a triage summary on the pull request; `agent-production-gate.sh` gates production.
-7. **Maintain:** each incident gets a post-mortem in `lessons/` and an eval; larger work becomes a new `intent.md`.
+4. **Test:** the session runs **Verifying your work** in `AGENTS.md`.
+5. **Review:** Claude Code Review and Bugbot review by `REVIEW.md`. A code owner approves; the agent never does.
+6. **Deploy:** `agent-production-gate.sh` gates production.
+7. **Maintain:** larger work becomes a new `intent.md`.
 
 ## 1. First commit and push
 
@@ -55,30 +55,26 @@ Also replace the owner placeholder in `.github/zizmor.yml`.
 
 - **Actions → General → Workflow permissions:** select **Read repository contents and packages permissions**. Every workflow requests the extra permissions it needs.
 - **Advanced Security:** enable private vulnerability reporting, Dependabot alerts, Dependabot security updates, secret scanning, and push protection. `SECURITY.md` sends reporters to private vulnerability reporting.
-- **Secrets and variables → Actions:**
-  - the variables `ANTHROPIC_FEDERATION_RULE_ID` and `ANTHROPIC_ORGANIZATION_ID`, from step 4. They are identifiers, not secrets: `.github/workflows/claude.yml`, `.github/workflows/agent-evals.yml`, and the **Triage failed build** job in `ci.yml` exchange the workflow's OIDC token for short-lived Claude API access, so the repository stores no Claude token.
-  - the variable `EVALS_MIN_PASS_RATE`, from 0 to 100, once the team has decided it (step 6).
 - **Rules → Rulesets:** protect `main` with:
   - squash merges only, a linear history, and no force pushes or deletion;
-  - the required checks `All Checks`, `Validate pull request title`, and `Agent evals`;
+  - the required checks `All Checks` and `Validate pull request title`;
   - a pull request before merging, with at least one approval, review from Code Owners, and stale approvals dismissed when new commits are pushed. Claude Code Review follows the severity, exclusion, and nit-cap rules in `REVIEW.md` only on a default branch protected this way ([customize Code Review](https://code.claude.com/docs/en/code-review-customize)).
 
   Rulesets in a private repository need GitHub Pro, Team, or Enterprise; on GitHub Free, make the repository public or upgrade.
 
 - Create the `needs triage` label, which the issue forms apply: `gh label create "needs triage"`.
 
-**Check:** a test pull request shows the three required checks and asks for a code owner's review.
+**Check:** a test pull request shows the two required checks and asks for a code owner's review.
 
 ## 4. Claude
 
 **Who:** an Owner of the Claude organization, with an owner of the GitHub organization.
 
-- **Code Review:** in [**Admin settings → Claude Code**](https://claude.ai/admin-settings/claude-code#code-review), turn on **Allow code review**, install the Claude GitHub App, and add this repository ([set up Code Review](https://code.claude.com/docs/en/code-review-setup)). It needs a Team or Enterprise plan ([availability](https://code.claude.com/docs/en/code-review#availability)). Keep **Review runs** at **After every push**, the default, so every push to a pull request gets a review. Reviews run on Anthropic's infrastructure, so the repository has no review workflow. The same app also serves `.github/workflows/claude.yml`.
-- **Workload identity federation:** in the [Claude Console](https://platform.claude.com), under **Settings → Workload identity**, register the issuer `https://token.actions.githubusercontent.com`, create a service account in the workspace the workflows should use, and create a federation rule for it that matches this repository's subject prefix, `repo:OWNER/REPOSITORY:` ([setup](https://github.com/anthropics/claude-code-action/blob/main/docs/setup.md), [workload identity federation](https://platform.claude.com/docs/en/manage-claude/workload-identity-federation)). Put the rule's `fdrl_...` ID and the organization ID in the repository variables of step 3. Usage is billed to the Console organization.
+- **Code Review:** in [**Admin settings → Claude Code**](https://claude.ai/admin-settings/claude-code#code-review), turn on **Allow code review**, install the Claude GitHub App, and add this repository ([set up Code Review](https://code.claude.com/docs/en/code-review-setup)). It needs a Team or Enterprise plan ([availability](https://code.claude.com/docs/en/code-review#availability)). Keep **Review runs** at **After every push**, the default, so every push to a pull request gets a review. Reviews run on Anthropic's infrastructure, so the repository has no review workflow.
 - **Managed settings:** deploy the non-negotiable settings and hooks as [managed settings](https://code.claude.com/docs/en/settings), tailored from the playbook's worked example in `.claude/managed-settings.example.json`. Engineers cannot override them.
 - **Monitoring:** turn on the [OpenTelemetry export](https://code.claude.com/docs/en/monitoring-usage) that the playbook's indicators read.
 
-**Check:** the test pull request gets a **Claude Code Review** check run within a few minutes. A review comment that tags `@claude` starts the **Claude** workflow.
+**Check:** the test pull request gets a **Claude Code Review** check run within a few minutes.
 
 ## 5. Cursor
 
@@ -98,7 +94,6 @@ Also replace the owner placeholder in `.github/zizmor.yml`.
 - **Policies (each policy owner, with an engineer):** write the policy in `.agents/skills/<area>-policy/SKILL.md` from the owner's source of truth, then run `pnpm rules:sync`. Test that the skill triggers: ask for the relevant task in different ways and confirm the skill loads each time. The policy owner approves every later change as its code owner.
 - **Production gate (engineering leadership, with change management and compliance):** list the approvals that must survive. A person then changes `.agents/hooks/agent-production-gate.sh` to match this project's production deploy command and approval; agent settings deny the file to agents.
 - **Review (tech lead):** replace `src/gen/` in `.agents/review.md` with this project's generated paths, then run `pnpm rules:sync`, which renders it to `REVIEW.md` for Claude Code Review. Once a month, rate the review findings and tune `.agents/review.md`.
-- **Evals (platform engineer):** collect 20 to 50 real tasks in `evals/` (`evals/README.md`), and set `EVALS_MIN_PASS_RATE` (step 3).
 - **People without Git experience:** connect GitHub to Claude (claude.ai or Cowork), so Claude commits `intent.md` for them.
 
 ## 7. Later, as the guardrails mature

package/templates/nestjs/.github/workflows/ci.yml

@@ -166,50 +166,6 @@ jobs:
       environment: dev
       commit_sha: ${{ github.sha }}
 
-  triage:
-    name: Triage failed build
-    needs:
-      - checks
-      - image
-    if: failure() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      actions: read # Needed to read the logs of the failed jobs.
-      id-token: write # Needed to authenticate to Anthropic with the workflow's OIDC token.
-      pull-requests: write # Needed to post the summary on the pull request.
-    steps:
-      - name: Collect the build log
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPOSITORY: ${{ github.repository }}
-          RUN_ID: ${{ github.run_id }}
-        run: |
-          mkdir -p out
-          for job in $(gh api "repos/$REPOSITORY/actions/runs/$RUN_ID/jobs" --paginate --jq '.jobs[] | select(.conclusion == "failure") | .id'); do
-            gh api "repos/$REPOSITORY/actions/jobs/$job/logs" >> out/build.log
-          done
-      - name: Triage failed build
-        id: triage
-        uses: anthropics/claude-code-action@61a9c274fa7110a66dfafc1bbbced03833eb25fe # v1.0.269
-        with:
-          anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
-          anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
-          prompt: >
-            Read the build log at out/build.log. Identify the most
-            likely cause, say whether the failure looks flaky or real, and write a
-            three-line summary for the PR thread.
-          claude_args: >-
-            --allowedTools "Read"
-            --json-schema '{"type":"object","properties":{"summary":{"type":"string"}},"required":["summary"]}'
-      - name: Post the summary
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          REPOSITORY: ${{ github.repository }}
-          SUMMARY: ${{ fromJSON(steps.triage.outputs.structured_output).summary }}
-        run: gh pr comment "$PR_NUMBER" --repo "$REPOSITORY" --body "$SUMMARY"
-
   ci:
     name: All Checks
     if: always()

package/templates/nestjs/Dockerfile

@@ -1,8 +1,10 @@
 # Runs on any OCI platform (Railway, Vercel Container Runtime, Fly.io, Cloud Run). The platform sets `PORT`.
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS base
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 \
+  AS base
 WORKDIR /app
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
-RUN npm install --global "pnpm@$(node --print 'require("./package.json").packageManager.split("+")[0].split("@")[1]')"
+RUN corepack enable
 
 FROM base AS build
 RUN pnpm install --frozen-lockfile --ignore-scripts
@@ -13,12 +15,20 @@ RUN pnpm build
 FROM base AS prod-deps
 RUN pnpm install --frozen-lockfile --ignore-scripts --prod
 
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
 ENV NODE_ENV=production
 WORKDIR /app
 # Apply Alpine security fixes released after the base image, and drop npm, corepack, and yarn: the app never runs them, and their bundled dependencies carry their own CVEs.
 RUN apk upgrade --no-cache \
-  && rm -rf /usr/local/lib/node_modules /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /usr/local/bin/yarn /usr/local/bin/yarnpkg /opt/yarn-*
+  && rm -rf \
+    /usr/local/lib/node_modules \
+    /usr/local/bin/npm \
+    /usr/local/bin/npx \
+    /usr/local/bin/corepack \
+    /usr/local/bin/yarn \
+    /usr/local/bin/yarnpkg \
+    /opt/yarn-*
 COPY package.json ./
 COPY --from=prod-deps /app/node_modules ./node_modules
 COPY --from=build /app/dist ./dist

package/templates/nextjs/.github/workflows/ci.yml

@@ -172,50 +172,6 @@ jobs:
       environment: dev
       commit_sha: ${{ github.sha }}
 
-  triage:
-    name: Triage failed build
-    needs:
-      - checks
-      - image
-    if: failure() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      actions: read # Needed to read the logs of the failed jobs.
-      id-token: write # Needed to authenticate to Anthropic with the workflow's OIDC token.
-      pull-requests: write # Needed to post the summary on the pull request.
-    steps:
-      - name: Collect the build log
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPOSITORY: ${{ github.repository }}
-          RUN_ID: ${{ github.run_id }}
-        run: |
-          mkdir -p out
-          for job in $(gh api "repos/$REPOSITORY/actions/runs/$RUN_ID/jobs" --paginate --jq '.jobs[] | select(.conclusion == "failure") | .id'); do
-            gh api "repos/$REPOSITORY/actions/jobs/$job/logs" >> out/build.log
-          done
-      - name: Triage failed build
-        id: triage
-        uses: anthropics/claude-code-action@61a9c274fa7110a66dfafc1bbbced03833eb25fe # v1.0.269
-        with:
-          anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
-          anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
-          prompt: >
-            Read the build log at out/build.log. Identify the most
-            likely cause, say whether the failure looks flaky or real, and write a
-            three-line summary for the PR thread.
-          claude_args: >-
-            --allowedTools "Read"
-            --json-schema '{"type":"object","properties":{"summary":{"type":"string"}},"required":["summary"]}'
-      - name: Post the summary
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          REPOSITORY: ${{ github.repository }}
-          SUMMARY: ${{ fromJSON(steps.triage.outputs.structured_output).summary }}
-        run: gh pr comment "$PR_NUMBER" --repo "$REPOSITORY" --body "$SUMMARY"
-
   ci:
     name: All Checks
     if: always()

package/templates/nextjs/Dockerfile

@@ -1,20 +1,30 @@
 # Runs on any OCI platform (Railway, Fly.io, Cloud Run). On Vercel, deploy without it. The platform sets `PORT`.
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS build
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 \
+  AS build
 ENV NEXT_TELEMETRY_DISABLED=1
 WORKDIR /app
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
-RUN npm install --global "pnpm@$(node --print 'require("./package.json").packageManager.split("+")[0].split("@")[1]')"
+RUN corepack enable
 RUN pnpm install --frozen-lockfile --ignore-scripts
 COPY next.config.ts postcss.config.mjs tsconfig.json ./
 COPY app ./app
 RUN pnpm build
 
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
 ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 HOSTNAME=0.0.0.0
 WORKDIR /app
 # Apply Alpine security fixes released after the base image, and drop npm, corepack, and yarn: the app never runs them, and their bundled dependencies carry their own CVEs.
 RUN apk upgrade --no-cache \
-  && rm -rf /usr/local/lib/node_modules /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /usr/local/bin/yarn /usr/local/bin/yarnpkg /opt/yarn-*
+  && rm -rf \
+    /usr/local/lib/node_modules \
+    /usr/local/bin/npm \
+    /usr/local/bin/npx \
+    /usr/local/bin/corepack \
+    /usr/local/bin/yarn \
+    /usr/local/bin/yarnpkg \
+    /opt/yarn-*
 # Next.js writes .next/cache at runtime. Add `COPY --from=build --chown=node:node /app/public ./public` when the app has a public/ folder, and allow it in .dockerignore.
 COPY --from=build --chown=node:node /app/.next/standalone ./
 COPY --from=build --chown=node:node /app/.next/static ./.next/static

package/templates/nodejs/.github/workflows/ci.yml

@@ -164,50 +164,6 @@ jobs:
       environment: dev
       commit_sha: ${{ github.sha }}
 
-  triage:
-    name: Triage failed build
-    needs:
-      - checks
-      - image
-    if: failure() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      actions: read # Needed to read the logs of the failed jobs.
-      id-token: write # Needed to authenticate to Anthropic with the workflow's OIDC token.
-      pull-requests: write # Needed to post the summary on the pull request.
-    steps:
-      - name: Collect the build log
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPOSITORY: ${{ github.repository }}
-          RUN_ID: ${{ github.run_id }}
-        run: |
-          mkdir -p out
-          for job in $(gh api "repos/$REPOSITORY/actions/runs/$RUN_ID/jobs" --paginate --jq '.jobs[] | select(.conclusion == "failure") | .id'); do
-            gh api "repos/$REPOSITORY/actions/jobs/$job/logs" >> out/build.log
-          done
-      - name: Triage failed build
-        id: triage
-        uses: anthropics/claude-code-action@61a9c274fa7110a66dfafc1bbbced03833eb25fe # v1.0.269
-        with:
-          anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
-          anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
-          prompt: >
-            Read the build log at out/build.log. Identify the most
-            likely cause, say whether the failure looks flaky or real, and write a
-            three-line summary for the PR thread.
-          claude_args: >-
-            --allowedTools "Read"
-            --json-schema '{"type":"object","properties":{"summary":{"type":"string"}},"required":["summary"]}'
-      - name: Post the summary
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          REPOSITORY: ${{ github.repository }}
-          SUMMARY: ${{ fromJSON(steps.triage.outputs.structured_output).summary }}
-        run: gh pr comment "$PR_NUMBER" --repo "$REPOSITORY" --body "$SUMMARY"
-
   ci:
     name: All Checks
     if: always()

package/templates/nodejs/Dockerfile

@@ -1,8 +1,10 @@
 # Runs on any OCI platform (Railway, Fly.io, Cloud Run). The platform sets `PORT`.
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS base
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 \
+  AS base
 WORKDIR /app
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
-RUN npm install --global "pnpm@$(node --print 'require("./package.json").packageManager.split("+")[0].split("@")[1]')"
+RUN corepack enable
 
 FROM base AS build
 RUN pnpm install --frozen-lockfile --ignore-scripts
@@ -13,12 +15,20 @@ RUN pnpm build
 FROM base AS prod-deps
 RUN pnpm install --frozen-lockfile --ignore-scripts --prod
 
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
 ENV NODE_ENV=production
 WORKDIR /app
 # Apply Alpine security fixes released after the base image, and drop npm, corepack, and yarn: the app never runs them, and their bundled dependencies carry their own CVEs.
 RUN apk upgrade --no-cache \
-  && rm -rf /usr/local/lib/node_modules /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /usr/local/bin/yarn /usr/local/bin/yarnpkg /opt/yarn-*
+  && rm -rf \
+    /usr/local/lib/node_modules \
+    /usr/local/bin/npm \
+    /usr/local/bin/npx \
+    /usr/local/bin/corepack \
+    /usr/local/bin/yarn \
+    /usr/local/bin/yarnpkg \
+    /opt/yarn-*
 COPY package.json ./
 COPY --from=prod-deps /app/node_modules ./node_modules
 COPY --from=build /app/dist ./dist

package/templates/payload/.github/workflows/ci.yml

@@ -189,50 +189,6 @@ jobs:
       environment: dev
       commit_sha: ${{ github.sha }}
 
-  triage:
-    name: Triage failed build
-    needs:
-      - checks
-      - image
-    if: failure() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      actions: read # Needed to read the logs of the failed jobs.
-      id-token: write # Needed to authenticate to Anthropic with the workflow's OIDC token.
-      pull-requests: write # Needed to post the summary on the pull request.
-    steps:
-      - name: Collect the build log
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPOSITORY: ${{ github.repository }}
-          RUN_ID: ${{ github.run_id }}
-        run: |
-          mkdir -p out
-          for job in $(gh api "repos/$REPOSITORY/actions/runs/$RUN_ID/jobs" --paginate --jq '.jobs[] | select(.conclusion == "failure") | .id'); do
-            gh api "repos/$REPOSITORY/actions/jobs/$job/logs" >> out/build.log
-          done
-      - name: Triage failed build
-        id: triage
-        uses: anthropics/claude-code-action@61a9c274fa7110a66dfafc1bbbced03833eb25fe # v1.0.269
-        with:
-          anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
-          anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
-          prompt: >
-            Read the build log at out/build.log. Identify the most
-            likely cause, say whether the failure looks flaky or real, and write a
-            three-line summary for the PR thread.
-          claude_args: >-
-            --allowedTools "Read"
-            --json-schema '{"type":"object","properties":{"summary":{"type":"string"}},"required":["summary"]}'
-      - name: Post the summary
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          REPOSITORY: ${{ github.repository }}
-          SUMMARY: ${{ fromJSON(steps.triage.outputs.structured_output).summary }}
-        run: gh pr comment "$PR_NUMBER" --repo "$REPOSITORY" --body "$SUMMARY"
-
   ci:
     name: All Checks
     if: always()

package/templates/payload/Dockerfile

@@ -1,9 +1,11 @@
 # Runs on any OCI platform (Railway, Fly.io, Cloud Run). On Vercel, deploy without it. The platform sets `PORT`.
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS build
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 \
+  AS build
 ENV NEXT_TELEMETRY_DISABLED=1
 WORKDIR /app
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
-RUN npm install --global "pnpm@$(node --print 'require("./package.json").packageManager.split("+")[0].split("@")[1]')"
+RUN corepack enable
 RUN pnpm install --frozen-lockfile --ignore-scripts
 COPY next.config.ts tsconfig.json ./
 COPY src ./src
@@ -11,12 +13,20 @@ COPY src ./src
 # the platform sets the real ones at runtime, and the build never connects to the database.
 RUN PAYLOAD_SECRET=build-only DATABASE_URL=postgres://build-only@localhost/build-only APP_URL=http://localhost:3000 pnpm build
 
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
 ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 HOSTNAME=0.0.0.0
 WORKDIR /app
 # Apply Alpine security fixes released after the base image, and drop npm, corepack, and yarn: the app never runs them, and their bundled dependencies carry their own CVEs.
 RUN apk upgrade --no-cache \
-  && rm -rf /usr/local/lib/node_modules /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /usr/local/bin/yarn /usr/local/bin/yarnpkg /opt/yarn-* \
+  && rm -rf \
+    /usr/local/lib/node_modules \
+    /usr/local/bin/npm \
+    /usr/local/bin/npx \
+    /usr/local/bin/corepack \
+    /usr/local/bin/yarn \
+    /usr/local/bin/yarnpkg \
+    /opt/yarn-* \
   && install -d -o node -g node media
 # Next.js writes .next/cache at runtime. Add `COPY --from=build --chown=node:node /app/public ./public` when the app has a public/ folder, and allow it in .dockerignore. Uploads go to the container filesystem, which is lost on redeploy; use a storage adapter or a mounted volume in production.
 COPY --from=build --chown=node:node /app/.next/standalone ./

package/templates/turborepo/.github/workflows/ci.yml

@@ -297,50 +297,6 @@ jobs:
       environment: dev
       commit_sha: ${{ github.sha }}
 
-  triage:
-    name: Triage failed build
-    needs:
-      - checks
-      - image
-    if: failure() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      actions: read # Needed to read the logs of the failed jobs.
-      id-token: write # Needed to authenticate to Anthropic with the workflow's OIDC token.
-      pull-requests: write # Needed to post the summary on the pull request.
-    steps:
-      - name: Collect the build log
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPOSITORY: ${{ github.repository }}
-          RUN_ID: ${{ github.run_id }}
-        run: |
-          mkdir -p out
-          for job in $(gh api "repos/$REPOSITORY/actions/runs/$RUN_ID/jobs" --paginate --jq '.jobs[] | select(.conclusion == "failure") | .id'); do
-            gh api "repos/$REPOSITORY/actions/jobs/$job/logs" >> out/build.log
-          done
-      - name: Triage failed build
-        id: triage
-        uses: anthropics/claude-code-action@61a9c274fa7110a66dfafc1bbbced03833eb25fe # v1.0.269
-        with:
-          anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
-          anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
-          prompt: >
-            Read the build log at out/build.log. Identify the most
-            likely cause, say whether the failure looks flaky or real, and write a
-            three-line summary for the PR thread.
-          claude_args: >-
-            --allowedTools "Read"
-            --json-schema '{"type":"object","properties":{"summary":{"type":"string"}},"required":["summary"]}'
-      - name: Post the summary
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          REPOSITORY: ${{ github.repository }}
-          SUMMARY: ${{ fromJSON(steps.triage.outputs.structured_output).summary }}
-        run: gh pr comment "$PR_NUMBER" --repo "$REPOSITORY" --body "$SUMMARY"
-
   ci:
     name: All Checks
     if: always()

package/templates/turborepo/apps/app/Dockerfile

@@ -1,22 +1,32 @@
 # Runs on any OCI platform (Railway, Fly.io, Cloud Run). On Vercel, deploy without it. The platform sets `PORT`.
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS build
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 \
+  AS build
 ENV NEXT_TELEMETRY_DISABLED=1
 WORKDIR /app
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY apps/app/package.json apps/app/package.json
 COPY apps/backoffice/package.json apps/backoffice/package.json
-RUN npm install --global "pnpm@$(node --print 'require("./package.json").packageManager.split("+")[0].split("@")[1]')"
+RUN corepack enable
 RUN pnpm install --frozen-lockfile --ignore-scripts --filter ./apps/app...
 COPY apps/app/next.config.ts apps/app/postcss.config.mjs apps/app/tsconfig.json apps/app/
 COPY apps/app/app apps/app/app
 RUN pnpm --filter ./apps/app build
 
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
 ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 HOSTNAME=0.0.0.0
 WORKDIR /app
 # Apply Alpine security fixes released after the base image, and drop npm, corepack, and yarn: the app never runs them, and their bundled dependencies carry their own CVEs.
 RUN apk upgrade --no-cache \
-  && rm -rf /usr/local/lib/node_modules /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /usr/local/bin/yarn /usr/local/bin/yarnpkg /opt/yarn-*
+  && rm -rf \
+    /usr/local/lib/node_modules \
+    /usr/local/bin/npm \
+    /usr/local/bin/npx \
+    /usr/local/bin/corepack \
+    /usr/local/bin/yarn \
+    /usr/local/bin/yarnpkg \
+    /opt/yarn-*
 # Next.js writes .next/cache at runtime. Add `COPY --from=build --chown=node:node /app/apps/app/public ./apps/app/public` when the app has a public/ folder.
 COPY --from=build --chown=node:node /app/apps/app/.next/standalone ./
 COPY --from=build --chown=node:node /app/apps/app/.next/static ./apps/app/.next/static

package/templates/turborepo/apps/backoffice/Dockerfile

@@ -1,11 +1,13 @@
 # Runs on any OCI platform (Railway, Fly.io, Cloud Run). On Vercel, deploy without it. The platform sets `PORT`.
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 AS build
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53 \
+  AS build
 ENV NEXT_TELEMETRY_DISABLED=1
 WORKDIR /app
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY apps/app/package.json apps/app/package.json
 COPY apps/backoffice/package.json apps/backoffice/package.json
-RUN npm install --global "pnpm@$(node --print 'require("./package.json").packageManager.split("+")[0].split("@")[1]')"
+RUN corepack enable
 RUN pnpm install --frozen-lockfile --ignore-scripts --filter ./apps/backoffice...
 COPY apps/backoffice/next.config.ts apps/backoffice/tsconfig.json apps/backoffice/
 COPY apps/backoffice/src apps/backoffice/src
@@ -13,12 +15,20 @@ COPY apps/backoffice/src apps/backoffice/src
 # The platform sets the real ones at runtime, and the build never connects to the database.
 RUN PAYLOAD_SECRET=build-only DATABASE_URL=postgres://build-only@localhost/build-only APP_URL=http://localhost:3001 pnpm --filter ./apps/backoffice build
 
-FROM node:24.22.1-alpine@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
+FROM \
+  node@sha256:06d7adf3e0ef61a13f1d28682726366f97a15aa1888c934d3ecec86c33918b53
 ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 HOSTNAME=0.0.0.0
 WORKDIR /app
 # Apply Alpine security fixes released after the base image, and drop npm, corepack, and yarn: the app never runs them, and their bundled dependencies carry their own CVEs.
 RUN apk upgrade --no-cache \
-  && rm -rf /usr/local/lib/node_modules /usr/local/bin/npm /usr/local/bin/npx /usr/local/bin/corepack /usr/local/bin/yarn /usr/local/bin/yarnpkg /opt/yarn-* \
+  && rm -rf \
+    /usr/local/lib/node_modules \
+    /usr/local/bin/npm \
+    /usr/local/bin/npx \
+    /usr/local/bin/corepack \
+    /usr/local/bin/yarn \
+    /usr/local/bin/yarnpkg \
+    /opt/yarn-* \
   && install -d -o node -g node apps/backoffice/media
 # Next.js writes .next/cache at runtime. Uploads go to the container filesystem, which is lost on redeploy; use a storage adapter or a mounted volume in production.
 COPY --from=build --chown=node:node /app/apps/backoffice/.next/standalone ./

package/templates/base/.github/workflows/agent-evals.yml

@@ -1,128 +0,0 @@
-name: Agent evals
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
-  schedule:
-    - cron: "0 2 * * *"
-
-permissions: {}
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  list:
-    name: List evals
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-    outputs:
-      evals: ${{ steps.list.outputs.evals }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - name: List the evals to run
-        id: list
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-        run: |
-          if [[ "$EVENT_NAME" == "schedule" ]] || git diff --name-only "$BASE_SHA" HEAD | grep -qE '^(CLAUDE\.md|AGENTS\.md|REVIEW\.md|\.mcp\.json|\.agents/|\.claude/|\.cursor/|evals/)'; then
-            echo "evals=$(find evals -maxdepth 1 -name '*.json' | sort | jq -R -s -c 'split("\n")[:-1]')" >> "$GITHUB_OUTPUT"
-          else
-            echo 'evals=[]' >> "$GITHUB_OUTPUT"
-          fi
-
-  eval:
-    name: Eval
-    needs: list
-    if: needs.list.outputs.evals != '[]'
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    permissions:
-      contents: read
-      id-token: write # Needed to authenticate to Anthropic with the workflow's OIDC token.
-    strategy:
-      fail-fast: false
-      matrix:
-        eval: ${{ fromJSON(needs.list.outputs.evals) }}
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          persist-credentials: false
-      - name: Set up Node.js and pnpm
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
-        with:
-          cache: true
-          require-lockfile: true
-      - name: Read the eval prompt
-        id: read
-        env:
-          EVAL: ${{ matrix.eval }}
-        run: |
-          {
-            echo "prompt<<EVAL_PROMPT_END"
-            jq -r '.prompt' "$EVAL"
-            echo "EVAL_PROMPT_END"
-          } >> "$GITHUB_OUTPUT"
-      - name: Run the eval task
-        id: claude
-        uses: anthropics/claude-code-action@61a9c274fa7110a66dfafc1bbbced03833eb25fe # v1.0.269
-        with:
-          anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
-          anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
-          prompt: ${{ steps.read.outputs.prompt }}
-          claude_args: --permission-mode acceptEdits --allowedTools "Read,Edit,Bash(pnpm test)"
-      - name: Check the result
-        env:
-          EVAL: ${{ matrix.eval }}
-          CONCLUSION: ${{ steps.claude.outputs.conclusion }}
-        run: ./evals/check.sh "$EVAL" "$CONCLUSION"
-
-  evals:
-    name: Agent evals
-    needs:
-      - list
-      - eval
-    if: always()
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      actions: read # Needed to read the result of each eval job.
-    steps:
-      - name: Check the pass rate
-        env:
-          EVALS: ${{ needs.list.outputs.evals }}
-          LIST_RESULT: ${{ needs.list.result }}
-          EVALS_MIN_PASS_RATE: ${{ vars.EVALS_MIN_PASS_RATE }}
-          GH_TOKEN: ${{ github.token }}
-          REPOSITORY: ${{ github.repository }}
-          RUN_ID: ${{ github.run_id }}
-        run: |
-          if [[ "$LIST_RESULT" != "success" ]]; then
-            echo "::error::Listing the evals failed."
-            exit 1
-          fi
-          total=$(jq 'length' <<< "$EVALS")
-          if ((total == 0)); then
-            echo "No evals to run."
-            exit 0
-          fi
-          if [[ -z "$EVALS_MIN_PASS_RATE" ]]; then
-            echo "::error::Set the repository variable EVALS_MIN_PASS_RATE (0 to 100)."
-            exit 1
-          fi
-          passed=$(gh api "repos/$REPOSITORY/actions/runs/$RUN_ID/jobs" --paginate --jq '.jobs[] | select((.name | startswith("Eval (")) and .conclusion == "success") | .id' | wc -l)
-          rate=$((passed * 100 / total))
-          echo "Pass rate: $rate% ($passed of $total)"
-          if ((rate < EVALS_MIN_PASS_RATE)); then
-            echo "::error::The pass rate $rate% is below EVALS_MIN_PASS_RATE ($EVALS_MIN_PASS_RATE%)."
-            exit 1
-          fi

package/templates/base/.github/workflows/claude.yml

@@ -1,39 +0,0 @@
-name: Claude
-
-on:
-  pull_request_review_comment:
-    types: [created]
-  pull_request_review:
-    types: [submitted]
-
-permissions: {}
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-  cancel-in-progress: false
-
-jobs:
-  claude:
-    name: Address review comment
-    if: |
-      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude'))
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    permissions:
-      contents: write # Needed to push the fix.
-      pull-requests: write # Needed to reply on the pull request.
-      id-token: write # Needed by the action to authenticate.
-      actions: read # Needed to read CI results on pull requests.
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          fetch-depth: 1
-          persist-credentials: false
-      - name: Address the comment
-        uses: anthropics/claude-code-action@61a9c274fa7110a66dfafc1bbbced03833eb25fe # v1.0.269
-        with:
-          anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }}
-          anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }}
-          claude_args: --permission-mode acceptEdits

package/templates/base/evals/README.md

@@ -1,15 +0,0 @@
-# Agent evals
-
-Each eval is one real task from recent work with its accepted outcome, written as `evals/<name>.json`: the prompt, plus the check that defines an acceptable result.
-
-```json
-{
-  "prompt": "<the task, as a person would ask it>",
-  "check": "<a shell command that exits 0 when the result is acceptable, for example: pnpm test>"
-}
-```
-
-- Collect 20 to 50 real tasks from recent work.
-- `.github/workflows/agent-evals.yml` runs the suite every night, and on every pull request that changes `CLAUDE.md`, `AGENTS.md`, `.mcp.json`, `.agents/`, `.claude/`, `.cursor/`, or `evals/`. `evals/check.sh` checks one eval's result.
-- Set the repository variable `EVALS_MIN_PASS_RATE`, from 0 to 100. When the pass rate falls below it, the `Agent evals` check fails and the pull request cannot merge.
-- Each production incident gets an eval, written by the team that owned the incident, and it stays in the suite.

package/templates/base/evals/check.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-eval_file=$1
-conclusion=$2
-
-if [[ $conclusion != success ]]; then
-  echo "FAIL $eval_file: Claude Code reported $conclusion"
-  exit 1
-fi
-
-if bash -c "$(jq -r '.check' "$eval_file")"; then
-  echo "PASS $eval_file"
-else
-  echo "FAIL $eval_file"
-  exit 1
-fi

package/templates/base/lessons/README.md

@@ -1,3 +0,0 @@
-# Lessons
-
-Post-mortems, one version-controlled file per incident, named like `lessons/2026-06-checkout-cache.md`. Future investigations read them. When the fix ships, add an eval for the incident, as `evals/README.md` describes.