@rm-industries/create-forge 0.3.0-alpha.0 → 0.4.0-beta.0

package/dist/template/audit-ci.jsonc

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://github.com/IBM/audit-ci/raw/main/docs/schema.json",
+  "high": true,
+  "allowlist": [
+    {
+      "GHSA-jmr9-qjv8-65gv": {
+        "active": true,
+        "expiry": "2026-11-30",
+        "notes": "Lighthouse CI development-only browser download path; Forge uses the installed CI browser and does not extract attacker-provided archives.",
+      },
+    },
+    {
+      "GHSA-ph9p-34f9-6g65": {
+        "active": true,
+        "expiry": "2026-11-30",
+        "notes": "Lighthouse CI development-only temporary files use tool-controlled names and paths, not attacker-provided prefixes or postfixes.",
+      },
+    },
+  ],
+}

package/dist/template/cspell.config.ts

@@ -1,6 +1,22 @@
 import { defineConfig } from 'cspell';
 
 export default defineConfig({
-  ignorePaths: ['node_modules', 'dist', 'coverage', 'playwright-report', 'test-results'],
-  words: ['Catppuccin', 'contentinfo', 'daisyui', 'Fira', 'fontsource', 'Macchiato', 'prefersdark', 'Sveltia'],
+  // Ignore only installed dependencies and generated tool output.
+  ignorePaths: ['node_modules', 'dist', 'coverage', 'playwright-report', 'test-results', '.lighthouseci'],
+  words: [
+    'autorun',
+    'Catppuccin',
+    'contentinfo',
+    'daisyui',
+    'Fira',
+    'fontsource',
+    'GHSA',
+    'lhci',
+    'lighthouseci',
+    'Macchiato',
+    'prefersdark',
+    'Sveltia',
+    'unreviewed',
+    'WCAG',
+  ],
 });

package/dist/template/docs/accessibility-checklist.md

@@ -0,0 +1,50 @@
+# Accessibility review checklist
+
+This checklist records the manual accessibility review of the unmodified Forge
+template. Generated-project maintainers must repeat it after changing content,
+navigation, themes, components, or interactive behavior; replace the review
+record below with their own date, environment, results, and linked issues.
+
+## Baseline review
+
+- **Date:** 2026-08-30
+- **Environment:** Chromium via Playwright 1.62.1 against the production preview
+- **Viewport coverage:** desktop and 320 × 640 mobile
+- **Input:** keyboard and pointer
+- **Result:** passed without a release-blocking accessibility issue
+
+## Manual checks
+
+- [x] Keyboard order starts with the skip link and then follows the visible
+      page order without trapping focus.
+- [x] Every interactive element displays a visible focus indicator in light
+      and dark modes.
+- [x] Activating **Skip to content** moves focus to the single main landmark.
+- [x] Text, controls, focus indicators, and linked text remain distinguishable
+      in the default Latte and Mocha themes.
+- [x] Reduced-motion preference removes smooth scrolling and shortens CSS
+      animations and transitions.
+- [x] Representative pages contain one descriptive level-one heading and do
+      not skip heading levels.
+- [x] Public pages expose a banner, named primary navigation, one main landmark,
+      and a content information landmark.
+- [x] Desktop and mobile navigation remain operable using only the keyboard.
+- [x] The custom 404 page identifies the error and provides a clear route home.
+
+The content manager startup and no-index policy are tested separately. Its
+editor interface is supplied by the pinned Sveltia dependency and is outside
+this public-site audit; evaluate that third-party UI against the needs of the
+project's editors before deployment.
+
+## Automated companion checks
+
+Run `npm run test:a11y` after each manual review. The suite applies axe-core's
+WCAG 2.0, 2.1, and 2.2 A/AA rules to representative public routes in both
+default color schemes. It also asserts landmarks, level-one headings, skip-link
+behavior, responsive overflow, current-page navigation, and reduced motion.
+Serious or critical axe violations block the browser-test job.
+
+Automated checks do not replace judgment about reading order, wording, focus
+order, contrast in newly introduced states, or whether alternative text conveys
+the intended meaning. Record any failure as a linked release-blocking issue
+rather than checking off an unverified item.

package/dist/template/docs/performance-budget.md

@@ -0,0 +1,68 @@
+# Lighthouse performance budget
+
+Lighthouse CI protects the generated site's public-page baseline. Run
+`npm run lighthouse:ci` after changes that can affect rendering, assets,
+metadata, or client behavior. The command builds the production site, collects
+three reports per route, and evaluates the median result.
+
+## Enforced routes
+
+- `/` represents the landing-page layout and card content.
+- `/articles/` represents a content collection and repeated cards.
+- `/articles/designing-a-calm-starting-point/` represents rendered Markdown,
+  typography, tags, and article pagination.
+
+The about and custom 404 pages reuse the same public layout with smaller or
+equivalent resource profiles and remain covered by browser and accessibility
+tests. The `/admin/` route is intentionally excluded: it loads the pinned
+third-party Sveltia editor application and is not representative of public
+visitor performance. Reassess that editor separately before deploying it for a
+specific team.
+
+## Category thresholds
+
+| Category       | Minimum |
+| -------------- | ------: |
+| Performance    |      90 |
+| Accessibility  |     100 |
+| Best practices |      95 |
+| SEO            |      95 |
+
+Accessibility remains at 100 because FGE-063 separately enforces serious and
+critical axe findings. The other thresholds allow ordinary Lighthouse runtime
+variance while still failing a meaningful regression.
+
+## Transfer budgets
+
+| Resource | Maximum bytes | Rationale                                                           |
+| -------- | ------------: | ------------------------------------------------------------------- |
+| Script   |             0 | The public template ships no client JavaScript.                     |
+| Total    |       125,000 | Approximately 24% headroom above the measured 100,675-byte maximum. |
+
+The 2026-08-30 baseline used Lighthouse 12.6.1 and three local Chromium runs per
+route. Every run scored 99 performance and 100 for accessibility, best
+practices, and SEO. Script transfer was zero bytes. Total transfer was stable at
+100,675 bytes for home, 100,447 bytes for the listing, and 100,498 bytes for the
+article detail.
+
+The total budget leaves room for minor generated-content and toolchain variance
+without allowing an unreviewed asset or client bundle. Do not raise a threshold
+or exclude a route merely to make CI pass. If a product requirement deliberately
+changes the budget, record the new three-run measurements, explain the user
+benefit and cost, and review the change in its pull request.
+
+## Dependency note
+
+`@lhci/cli` 0.15.1 pins Lighthouse 12.6.1. Forge keeps that upstream-tested
+dependency graph instead of overriding Lighthouse or its transitive
+dependencies independently. Upgrade the top-level Lighthouse CI package when a
+release supports a newer Lighthouse runtime, then repeat the three-run
+collection and assertion compatibility checks.
+
+The pinned graph currently includes high-severity `extract-zip` and `tmp`
+advisories. Both are confined to development-only Lighthouse tooling:
+Lighthouse uses the installed browser rather than extracting an
+attacker-provided browser archive, and its temporary paths are tool-controlled.
+`audit-ci.jsonc` records narrow, expiring exceptions for those two advisory IDs.
+All other high or critical advisories still fail `npm run audit`. Review or
+remove the exceptions by 2026-11-30 rather than extending them automatically.