@rm-industries/create-forge 1.0.0-rc.2 → 1.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/README.md +3 -3
  2. package/dist/template/.github/actionlint.yaml +5 -0
  3. package/dist/template/.github/workflows/project.yml +7 -7
  4. package/dist/template/audit-ci.jsonc +8 -1
  5. package/dist/template/docs/performance-budget.md +1 -1
  6. package/dist/template/package-lock.json +560 -549
  7. package/dist/template/package.json +11 -11
  8. package/package.json +15 -5
package/README.md CHANGED
@@ -1,10 +1,10 @@
1
1
  # `@rm-industries/create-forge`
2
2
 
3
- The publishable Forge project initializer. Once the generator milestone is
4
- complete, npm will resolve the primary command to this scoped package:
3
+ The stable Forge project initializer. npm resolves the primary command to this
4
+ scoped package:
5
5
 
6
6
  ```sh
7
- npm create @rm-industries/forge@next
7
+ npm create @rm-industries/forge
8
8
  ```
9
9
 
10
10
  The initializer accepts interactive answers, documented defaults through
package/dist/template/.github/actionlint.yaml ADDED
@@ -0,0 +1,5 @@
1
+ paths:
2
+ .github/workflows/*.yml:
3
+ ignore:
4
+ # GitHub recommends $/ for same-repository actions, but Actionlint 1.7.12 does not recognize it yet.
5
+ - 'specifying action "\$/\.github/actions/setup-project" in invalid format because ref is missing'
package/dist/template/.github/workflows/project.yml CHANGED
@@ -34,7 +34,7 @@ jobs:
34
34
  persist-credentials: false
35
35
 
36
36
  - name: Setup project
37
- uses: ./.github/actions/setup-project
37
+ uses: $/.github/actions/setup-project
38
38
  with:
39
39
  node-version: '26.x'
40
40
 
@@ -55,7 +55,7 @@ jobs:
55
55
  persist-credentials: false
56
56
 
57
57
  - name: Setup project
58
- uses: ./.github/actions/setup-project
58
+ uses: $/.github/actions/setup-project
59
59
  with:
60
60
  node-version: '26.x'
61
61
 
@@ -76,7 +76,7 @@ jobs:
76
76
  persist-credentials: false
77
77
 
78
78
  - name: Setup project
79
- uses: ./.github/actions/setup-project
79
+ uses: $/.github/actions/setup-project
80
80
  with:
81
81
  node-version: '26.x'
82
82
 
@@ -97,7 +97,7 @@ jobs:
97
97
  persist-credentials: false
98
98
 
99
99
  - name: Setup project
100
- uses: ./.github/actions/setup-project
100
+ uses: $/.github/actions/setup-project
101
101
  with:
102
102
  node-version: '26.x'
103
103
 
@@ -131,7 +131,7 @@ jobs:
131
131
  persist-credentials: false
132
132
 
133
133
  - name: Setup project
134
- uses: ./.github/actions/setup-project
134
+ uses: $/.github/actions/setup-project
135
135
  with:
136
136
  node-version: '26.x'
137
137
 
@@ -169,7 +169,7 @@ jobs:
169
169
  persist-credentials: false
170
170
 
171
171
  - name: Setup project
172
- uses: ./.github/actions/setup-project
172
+ uses: $/.github/actions/setup-project
173
173
  with:
174
174
  node-version: '26.x'
175
175
 
@@ -204,7 +204,7 @@ jobs:
204
204
  persist-credentials: false
205
205
 
206
206
  - name: Setup project
207
- uses: ./.github/actions/setup-project
207
+ uses: $/.github/actions/setup-project
208
208
  with:
209
209
  node-version: '26.x'
210
210
 
package/dist/template/audit-ci.jsonc CHANGED
@@ -6,7 +6,14 @@
6
6
  "GHSA-jmr9-qjv8-65gv": {
7
7
  "active": true,
8
8
  "expiry": "2026-11-30",
9
- "notes": "Lighthouse CI development-only browser download path; Forge uses the installed CI browser and does not extract attacker-provided archives.",
9
+ "notes": "Lighthouse CI development-only browser download path; Forge uses the installed CI browser and does not extract untrusted archives.",
10
+ },
11
+ },
12
+ {
13
+ "GHSA-7pqw-9j4j-h8q3": {
14
+ "active": true,
15
+ "expiry": "2026-11-30",
16
+ "notes": "Lighthouse CI development-only browser download path; Forge uses the installed CI browser and does not extract untrusted archives.",
10
17
  },
11
18
  },
12
19
  {
package/dist/template/docs/performance-budget.md CHANGED
@@ -66,6 +66,6 @@ The pinned graph currently includes high-severity `extract-zip` and `tmp`
66
66
  advisories. Both are confined to development-only Lighthouse tooling:
67
67
  Lighthouse uses the installed browser rather than extracting an
68
68
  attacker-provided browser archive, and its temporary paths are tool-controlled.
69
- `audit-ci.jsonc` records narrow, expiring exceptions for those two advisory IDs.
69
+ `audit-ci.jsonc` records narrow, expiring exceptions for those advisory IDs.
70
70
  All other high or critical advisories still fail `npm run audit`. Review or
71
71
  remove the exceptions by 2026-11-30 rather than extending them automatically.