@next-friday/create-app 9.7.0 → 9.7.2

package/README.md

@@ -24,7 +24,7 @@ Without a terminal, as in CI or an agent, the name and `--stack` are required. P
 | `payload`   | Payload CMS on Next.js with PostgreSQL                            |
 | `turborepo` | A Turborepo workspace with a Next.js app and a Payload backoffice |
 
-Every stack is built from [`templates/base`](templates/base), which holds the shared company setup, plus its own directory under [`templates/`](templates), which holds the stack-specific files.
+Every stack is built from [`templates/base`](templates/base), which holds the shared company setup, plus its own directory under [`templates/`](templates), which holds the stack-specific files. With `--deploy railway`, the files of [`templates/deploy-railway`](templates/deploy-railway) are copied last.
 
 ## What every project includes
 

package/dist/main.mjs

@@ -285,10 +285,11 @@ function resolveDeploySections(content, target) {
 	const kept = [];
 	let section;
 	let isAfterMarker = false;
-	for (const line of content.split("\n")) {
+	const lines = content.split("\n");
+	for (const [index, line] of lines.entries()) {
 		const name = marker.exec(line)?.groups?.name;
 		if (name === void 0) {
-			if (!(isAfterMarker && line.trim() === "") && (section ?? target) === target) kept.push(line);
+			if (!(isAfterMarker && line.trim() === "" && index < lines.length - 1) && (section ?? target) === target) kept.push(line);
 		} else section = sectionAfterMarker(name, section);
 		isAfterMarker = name !== void 0;
 	}
@@ -306,6 +307,7 @@ function sectionAfterMarker(name, section) {
 		if (section === void 0) throw new Error("A deploy:end marker has no deploy target section to close.");
 		return;
 	}
+	if (!isDeployTarget(name)) throw new Error(`A deploy:${name} marker names no deploy target. Use one of: ${deployTargets.join(", ")}.`);
 	if (section !== void 0) throw new Error(`A deploy:${name} marker starts inside the deploy:${section} section.`);
 	return name;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@next-friday/create-app",
-  "version": "9.7.0",
+  "version": "9.7.2",
   "description": "Create a Next Friday project from a template.",
   "keywords": [
     "create",

package/templates/base/.agents/hooks/agent-production-gate.sh

@@ -45,9 +45,9 @@ release_gate="A release manager runs prod deploys, commands against prod, and re
 
 # The gate reads the command line as text, joining continued lines and dropping quotes,
 # backslashes, and fd redirections, so wrappers such as bash -c, eval, or npx and split words such
-# as pr''od do not hide the common forms. A dispatch input or Railway environment the gate cannot
-# read (a variable, a command substitution, a file, or stdin) counts as prod. It is a convenience,
-# not a security boundary: the prod environment's required reviewers and Railway credentials are.
+# as pr''od do not hide the common forms. A dispatch input the gate cannot read (a variable, a
+# command substitution, a file, or stdin) counts as prod. It is a convenience, not a security
+# boundary: the prod environment's required reviewers and the deploy credentials are.
 text=${command//'\\'/}
 text=${text//$'\\\n'/}
 text=$(sed -E 's/([0-9]*[<>]&[0-9-]*|&>>?)//g' <<< "${text//[\"\'\\]/}")
@@ -56,16 +56,21 @@ prod="(prod([^[:alnum:]_-]|$)|[\$\`@])"
 dispatch="(workflow[[:space:]]+run|/dispatches)"
 environment_field="environment[]]*[=:][[:space:]]*$prod"
 unreadable_inputs="--(json|input)([[:space:]=]|$)"
+# deploy:railway
+# A Railway environment the gate cannot read counts as prod too.
 railway="(^|[^[:alnum:]_.-])(railway|@railway/cli(@[^[:space:]]*)?)([[:space:]]$simple)?"
+# deploy:end
 git_push="(^|[^[:alnum:]_.-])git([[:space:]]+(-[Cc][[:space:]]+[^[:space:]]+|--(git-dir|work-tree|namespace|config-env)[[:space:]]+[^[:space:]]+|--?[^[:space:]]+))*[[:space:]]+push([[:space:]]$simple)?"
 tag_ref="([[:space:]:+]((refs/)?tags/|v[0-9])|[[:space:]]--((follow-)?tags|mirror)([[:space:]=]|$))"
 
 if [[ $text =~ $dispatch$simple($environment_field|$unreadable_inputs) || $text =~ $environment_field$simple$dispatch ]]; then
   block "$release_gate"
 fi
+# deploy:railway
 if [[ $text =~ $railway[[:space:]](-[[:alpha:]]*e([[:space:]]+|=)?|--environment([[:space:]]+|=))$prod || $text =~ $railway[[:space:]](env|environment)([[:space:]]+[[:alpha:]]+)?[[:space:]]+$prod ]]; then
   block "$release_gate"
 fi
+# deploy:end
 if [[ $text =~ $git_push$tag_ref || $(tr '[:upper:]' '[:lower:]' <<< "$text") == *push.followtags* ]]; then
   block "$release_gate"
 fi

package/templates/base/scripts/check-agent-gates.ts

@@ -137,7 +137,7 @@ const allowedCommands = [
   'gh api repos/next-friday/example/issues/1/comments -f body="APPROVED by QA"',
 ];
 
-const railwayProductionCommand = "railway up -e prod";
+const sampleProductionCommand = "gh workflow run deploy.yml -f environment=prod";
 
 const productionCommands = [
   "gh workflow run deploy.yml -f environment=prod -f commit_sha=abc",
@@ -158,8 +158,30 @@ const productionCommands = [
   "gh api repos/o/r/actions/workflows/1/dispatches --input body.json",
   "gh api repos/o/r/actions/workflows/1/dispatches -f inputs[environment]=$E",
   "bash -c 'gh workflow run deploy.yml -f environment=prod'",
+  sampleProductionCommand,
+  "git push origin v1.0.0",
+  "git push origin HEAD:refs/tags/v1.0.0",
+  "git push --tags",
+  "git push --follow-tags origin main",
+  "git -C . push origin v2.3.4",
+  "gh workflow run deploy.yml -f environment=pr''od",
+  "gh workflow run deploy.yml -f environment=p\\rod",
+  'gh workflow run deploy.yml -f "envi"ronment=prod',
+  "git push origin 'refs/tags/*'",
+  'git push origin "refs/tags/v*"',
+  "git push --mirror",
+  "git -c push.followTags=true push origin main",
+  "git config push.followTags true && git push",
+  "gh workflow run deploy.yml 2>&1 -f environment=prod",
+  "git push origin tags/v1.0.0",
+  "git --git-dir .git push origin v1.0.0",
+  "gh workflow run deploy.yml \\\n  -f environment=prod \\\n  -f commit_sha=abc",
+  "git push \\\n  origin v1.0.0",
+  "git push &>/dev/null origin v1.0.0",
+  "cd a\\\\\ngit push origin v1.0.0",
+  // deploy:railway
   "railway up --ci --environment prod",
-  railwayProductionCommand,
+  "railway up -e prod",
   "railway up -e=prod",
   "railway up -eprod",
   "railway up -ce prod",
@@ -181,32 +203,13 @@ const productionCommands = [
   "/usr/local/bin/railway up -e prod",
   "timeout 60 railway up -e prod",
   "eval railway up -e prod",
-  "git push origin v1.0.0",
-  "git push origin HEAD:refs/tags/v1.0.0",
-  "git push --tags",
-  "git push --follow-tags origin main",
-  "git -C . push origin v2.3.4",
   "npx @railway/cli@5.71.0 up -e prod",
   "npx @railway/cli@latest up --environment prod",
   "railway up -e pr''od",
-  "gh workflow run deploy.yml -f environment=pr''od",
-  "gh workflow run deploy.yml -f environment=p\\rod",
-  'gh workflow run deploy.yml -f "envi"ronment=prod',
-  "git push origin 'refs/tags/*'",
-  'git push origin "refs/tags/v*"',
-  "git push --mirror",
-  "git -c push.followTags=true push origin main",
-  "git config push.followTags true && git push",
-  "gh workflow run deploy.yml 2>&1 -f environment=prod",
   "railway up 2>&1 -e prod",
-  "git push origin tags/v1.0.0",
-  "git --git-dir .git push origin v1.0.0",
-  "gh workflow run deploy.yml \\\n  -f environment=prod \\\n  -f commit_sha=abc",
   "railway up \\\n  --environment prod",
-  "git push \\\n  origin v1.0.0",
   "railway up &>/dev/null -e prod",
-  "git push &>/dev/null origin v1.0.0",
-  "cd a\\\\\ngit push origin v1.0.0",
+  // deploy:end
 ];
 
 const approvalLiftsGate = ["CHG-123", "CHG-1"];
@@ -229,10 +232,6 @@ const approvalKeepsGate = [
 const nonProductionCommands = [
   "gh workflow run deploy.yml -f environment=uat -f commit_sha=abc",
   "gh api repos/o/r/actions/workflows/deploy.yml/dispatches -f 'inputs[environment]=uat'",
-  "railway up -e uat",
-  "railway up -e prod-eu",
-  "railway environment uat",
-  "railway status",
   "gh workflow list",
   "gh run list --workflow deploy.yml",
   "gh api repos/o/r/environments/prod",
@@ -241,14 +240,20 @@ const nonProductionCommands = [
   'git commit -m "release v1.0" && git push',
   'git commit -m "docs(x): deploy to production"',
   'gh pr create --title "ci(x): promote to prod" --body "run gh workflow run later"',
-  "echo railway",
   "git tag v1.0.0",
   'git stash push -m "wip v2"',
   'git commit -m "fix(ci): push v2 images"',
-  'git commit -m "fix: railway env uat and prod split"',
   "git push -u origin HEAD",
   "git push origin feature/push-v2",
   "pnpm verify 2>&1 | tail && git push",
+  // deploy:railway
+  "railway up -e uat",
+  "railway up -e prod-eu",
+  "railway environment uat",
+  "railway status",
+  "echo railway",
+  'git commit -m "fix: railway env uat and prod split"',
+  // deploy:end
 ];
 
 const mcpTools = {
@@ -461,11 +466,11 @@ const cases: GateCase[] = [
     expectedApproval: releaseApproval,
     input: {
       tool_input: {
-        command: railwayProductionCommand,
+        command: sampleProductionCommand,
       },
     },
     expectedPermission: "allow" as const,
-    name: `production with RELEASE_APPROVAL="${releaseApproval}": ${railwayProductionCommand}`,
+    name: `production with RELEASE_APPROVAL="${releaseApproval}": ${sampleProductionCommand}`,
     expectedExit: 0 as const,
   })),
   ...approvalKeepsGate.map(releaseApproval => ({
@@ -473,10 +478,10 @@ const cases: GateCase[] = [
     releaseApproval,
     input: {
       tool_input: {
-        command: railwayProductionCommand,
+        command: sampleProductionCommand,
       },
     },
-    name: `production with RELEASE_APPROVAL="${releaseApproval}": ${railwayProductionCommand}`,
+    name: `production with RELEASE_APPROVAL="${releaseApproval}": ${sampleProductionCommand}`,
     expectedExit: 2 as const,
   })),
   ...nonProductionCommands.map(command => ({
@@ -590,7 +595,7 @@ const cases: GateCase[] = [
     name: "record: the conversation of a Cursor hook input",
     expectedExit: 2,
     input: {
-      command: railwayProductionCommand,
+      command: sampleProductionCommand,
       conversation_id: "cursor-conversation",
     },
   },
@@ -617,7 +622,7 @@ const cases: GateCase[] = [
     releaseApproval: "CHG-123",
     expectedExit: 2,
     input: {
-      command: railwayProductionCommand,
+      command: sampleProductionCommand,
     },
   },
   {
@@ -636,7 +641,7 @@ const cases: GateCase[] = [
     expectedExit: 2,
     isRecordUnwritable: true,
     input: {
-      command: railwayProductionCommand,
+      command: sampleProductionCommand,
     },
   },
 ];

package/templates/nestjs/.github/workflows/ci.yml

@@ -118,7 +118,7 @@ jobs:
   image:
     name: Container Image
     needs: changes
-    if: needs.changes.outputs.full_verification == 'true' || github.event_name == 'schedule'
+    if: (needs.changes.outputs.full_verification == 'true' || github.event_name == 'schedule') && vars.CONTAINER_IMAGE != 'false'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     env:
@@ -157,6 +157,7 @@ jobs:
           tar --extract --gzip --file "$archive" trivy
           ./trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --no-progress app:ci
 
+  # deploy:railway
   deploy-dev:
     name: Deploy to dev
     needs:
@@ -171,6 +172,7 @@ jobs:
       environment: dev
       commit_sha: ${{ github.sha }}
 
+  # deploy:end
   triage:
     name: Triage failed build
     needs:

package/templates/nestjs/README.md

@@ -34,8 +34,18 @@ CI also runs the build, the end-to-end tests, the container image scan, and the
 
 ## Container
 
+<!-- deploy:railway -->
+
+The `Dockerfile` builds a production image that runs as a non-root user (UID 1000). The platform must set `PORT`; Railway sets it automatically. The build needs `pnpm-lock.yaml`, so run `pnpm install` once before the first `docker build`.
+
+<!-- deploy:end -->
+
+<!-- deploy:none -->
+
 The `Dockerfile` builds a production image that runs as a non-root user (UID 1000). The platform must set `PORT`. The build needs `pnpm-lock.yaml`, so run `pnpm install` once before the first `docker build`.
 
+<!-- deploy:end -->
+
 ```sh
 docker build -t app .
 docker run --env PORT=3000 --publish 3000:3000 app
@@ -58,6 +68,8 @@ docker run --env PORT=3000 --publish 3000:3000 app
 3. Set the repository variable `DEPLOY_ENABLED` to `true`. Each push to `main` that passes CI then deploys to `dev`.
 4. Promote with **Actions → Deploy → Run workflow**, giving the environment and the full commit SHA. The workflow requires a successful CI run on `main` for that commit and a successful deployment to the previous environment, then waits for `/health`.
 
+Remove the workflow, `railway.json`, and the `deploy-dev` job in `ci.yml` if the project deploys elsewhere.
+
 <!-- deploy:end -->
 
 <!-- deploy:none -->

package/templates/nextjs/.github/workflows/ci.yml

@@ -124,7 +124,7 @@ jobs:
   image:
     name: Container Image
     needs: changes
-    if: needs.changes.outputs.full_verification == 'true' || github.event_name == 'schedule'
+    if: (needs.changes.outputs.full_verification == 'true' || github.event_name == 'schedule') && vars.CONTAINER_IMAGE != 'false'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     env:
@@ -163,6 +163,7 @@ jobs:
           tar --extract --gzip --file "$archive" trivy
           ./trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --no-progress app:ci
 
+  # deploy:railway
   deploy-dev:
     name: Deploy to dev
     needs:
@@ -177,6 +178,7 @@ jobs:
       environment: dev
       commit_sha: ${{ github.sha }}
 
+  # deploy:end
   triage:
     name: Triage failed build
     needs:

package/templates/nextjs/README.md

@@ -32,8 +32,18 @@ CI also runs the build, the end-to-end tests, the container image scan, and the
 
 ## Container
 
+<!-- deploy:railway -->
+
+The `Dockerfile` builds a standalone production image that runs as the `node` user, for platforms such as Railway. The server listens on `PORT`, or 3000 when it is unset.
+
+<!-- deploy:end -->
+
+<!-- deploy:none -->
+
 The `Dockerfile` builds a standalone production image that runs as the `node` user for a container platform. The server listens on `PORT`, or 3000 when it is unset.
 
+<!-- deploy:end -->
+
 ```sh
 docker build -t app .
 docker run --publish 3000:3000 app
@@ -58,6 +68,8 @@ On Vercel, deploy without the image; the Next.js preset takes precedence over th
 3. Set the repository variable `DEPLOY_ENABLED` to `true`. Each push to `main` that passes CI then deploys to `dev`.
 4. Promote with **Actions → Deploy → Run workflow**, giving the environment and the full commit SHA. The workflow requires a successful CI run on `main` for that commit and a successful deployment to the previous environment, then waits for `/health`.
 
+Remove the workflow, `railway.json`, and the `deploy-dev` job in `ci.yml` if the project deploys elsewhere.
+
 <!-- deploy:end -->
 
 <!-- deploy:none -->

package/templates/nodejs/.github/workflows/ci.yml

@@ -116,7 +116,7 @@ jobs:
   image:
     name: Container Image
     needs: changes
-    if: needs.changes.outputs.full_verification == 'true' || github.event_name == 'schedule'
+    if: (needs.changes.outputs.full_verification == 'true' || github.event_name == 'schedule') && vars.CONTAINER_IMAGE != 'false'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     env:
@@ -155,6 +155,7 @@ jobs:
           tar --extract --gzip --file "$archive" trivy
           ./trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --no-progress app:ci
 
+  # deploy:railway
   deploy-dev:
     name: Deploy to dev
     needs:
@@ -169,6 +170,7 @@ jobs:
       environment: dev
       commit_sha: ${{ github.sha }}
 
+  # deploy:end
   triage:
     name: Triage failed build
     needs:

package/templates/nodejs/README.md

@@ -32,8 +32,18 @@ CI also runs the build, the container image scan, and the security scans, includ
 
 ## Container
 
+<!-- deploy:railway -->
+
+The `Dockerfile` builds a production image that runs as a non-root user (UID 1000). The platform must set `PORT`; Railway sets it automatically. The build needs `pnpm-lock.yaml`, so run `pnpm install` once before the first `docker build`.
+
+<!-- deploy:end -->
+
+<!-- deploy:none -->
+
 The `Dockerfile` builds a production image that runs as a non-root user (UID 1000). The platform must set `PORT`. The build needs `pnpm-lock.yaml`, so run `pnpm install` once before the first `docker build`.
 
+<!-- deploy:end -->
+
 ```sh
 docker build -t app .
 docker run --env PORT=3000 --publish 3000:3000 app
@@ -56,6 +66,8 @@ docker run --env PORT=3000 --publish 3000:3000 app
 3. Set the repository variable `DEPLOY_ENABLED` to `true`. Each push to `main` that passes CI then deploys to `dev`.
 4. Promote with **Actions → Deploy → Run workflow**, giving the environment and the full commit SHA. The workflow requires a successful CI run on `main` for that commit and a successful deployment to the previous environment, then waits for `/health`.
 
+Remove the workflow, `railway.json`, and the `deploy-dev` job in `ci.yml` if the project deploys elsewhere.
+
 <!-- deploy:end -->
 
 <!-- deploy:none -->

package/templates/payload/.github/workflows/ci.yml

@@ -141,7 +141,7 @@ jobs:
   image:
     name: Container Image
     needs: changes
-    if: needs.changes.outputs.full_verification == 'true' || github.event_name == 'schedule'
+    if: (needs.changes.outputs.full_verification == 'true' || github.event_name == 'schedule') && vars.CONTAINER_IMAGE != 'false'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     services:
@@ -196,6 +196,7 @@ jobs:
           tar --extract --gzip --file "$archive" trivy
           ./trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --no-progress app:ci
 
+  # deploy:railway
   deploy-dev:
     name: Deploy to dev
     needs:
@@ -210,6 +211,7 @@ jobs:
       environment: dev
       commit_sha: ${{ github.sha }}
 
+  # deploy:end
   triage:
     name: Triage failed build
     needs:

package/templates/payload/README.md

@@ -48,8 +48,18 @@ CI also runs the build, the end-to-end tests, the container image scan, and the
 
 ## Container
 
+<!-- deploy:railway -->
+
+The `Dockerfile` builds a standalone production image that runs as the `node` user, for platforms such as Railway. The server listens on `PORT`, or 3000 when it is unset, and needs `DATABASE_URL`, `PAYLOAD_SECRET`, and `APP_URL`, the public URL that Payload accepts cookie-authenticated and cross-origin requests from.
+
+<!-- deploy:end -->
+
+<!-- deploy:none -->
+
 The `Dockerfile` builds a standalone production image that runs as the `node` user for a container platform. The server listens on `PORT`, or 3000 when it is unset, and needs `DATABASE_URL`, `PAYLOAD_SECRET`, and `APP_URL`, the public URL that Payload accepts cookie-authenticated and cross-origin requests from.
 
+<!-- deploy:end -->
+
 ```sh
 docker build -t app .
 docker run --publish 3000:3000 --env DATABASE_URL --env PAYLOAD_SECRET --env APP_URL app
@@ -84,6 +94,8 @@ On Vercel, deploy without the image; the Next.js preset takes precedence over th
 3. Set the repository variable `DEPLOY_ENABLED` to `true`. Each push to `main` that passes CI then deploys to `dev`.
 4. Promote with **Actions → Deploy → Run workflow**, giving the environment and the full commit SHA. The workflow requires a successful CI run on `main` for that commit and a successful deployment to the previous environment, then waits for `/health`.
 
+Remove the workflow, `railway.json`, and the `deploy-dev` job in `ci.yml` if the project deploys elsewhere.
+
 <!-- deploy:end -->
 
 <!-- deploy:none -->

package/templates/turborepo/.github/workflows/ci.yml

@@ -212,7 +212,7 @@ jobs:
     needs:
       - changes
       - affected-apps
-    if: (needs.changes.outputs.full_verification == 'true' || github.event_name == 'schedule') && needs.affected-apps.outputs.apps != '[]'
+    if: (needs.changes.outputs.full_verification == 'true' || github.event_name == 'schedule') && needs.affected-apps.outputs.apps != '[]' && vars.CONTAINER_IMAGE != 'false'
     runs-on: ubuntu-latest
     timeout-minutes: 20
     strategy:
@@ -272,6 +272,7 @@ jobs:
           tar --extract --gzip --file "$archive" trivy
           ./trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed --no-progress "$APP:ci"
 
+  # deploy:railway
   deploy-dev:
     name: Deploy to dev
     needs:
@@ -286,6 +287,7 @@ jobs:
       environment: dev
       commit_sha: ${{ github.sha }}
 
+  # deploy:end
   triage:
     name: Triage failed build
     needs:

package/templates/turborepo/README.md

@@ -86,6 +86,8 @@ On Vercel, deploy an app without its image. The Next.js preset takes precedence
 3. Set the repository variable `DEPLOY_ENABLED` to `true`. Each push to `main` that passes CI then deploys to `dev`. The workflow compares the commit with the commit of the last successful deploy to that environment, found from the successful `deploy.yml` and `ci.yml` runs on `main`, and runs `railway up` only for services whose packages changed. A promotion through `uat` or `prod` uses the same comparison against the commit last deployed there, so several commits still ship every changed service. The first deploy to an environment ships both services.
 4. Promote with **Actions → Deploy → Run workflow**, giving the environment and the full commit SHA. The workflow requires a successful CI run on `main` for that commit and a successful deployment to the previous environment, then waits for `/health` on each service it uploaded.
 
+Remove the workflow, `railway.json`, and the `deploy-dev` job in `ci.yml` if the project deploys elsewhere.
+
 <!-- deploy:end -->
 
 <!-- deploy:none -->
@@ -108,6 +110,16 @@ To add an Expo app, create it under `apps/mobile`:
 2. Use `@expo/fingerprint` with `expo-github-action/fingerprint` so a pull request requests a native build only when the native layer changed ([Expo fingerprint](https://docs.expo.dev/versions/latest/sdk/fingerprint/)).
 3. Keep a single `react-native` version in the workspace. Duplicate React Native versions in one monorepo are not supported ([Expo: Monorepos](https://docs.expo.dev/guides/monorepos/)).
 
+<!-- deploy:railway -->
+
+EAS Build and Submit replace Railway for that app. CI `--affected` already includes `apps/*` and `packages/*`, so an Expo app is skipped when it did not change.
+
+<!-- deploy:end -->
+
+<!-- deploy:none -->
+
 EAS Build and Submit deploy that app, in place of the project's deploy step. CI `--affected` already includes `apps/*` and `packages/*`, so an Expo app is skipped when it did not change.
 
+<!-- deploy:end -->
+
 See [CONTRIBUTING.md](CONTRIBUTING.md) for the contribution workflow.