@rm-industries/create-forge 1.0.1 → 1.0.3

package/dist/template/.github/workflows/project.yml

@@ -5,19 +5,28 @@ on: # yamllint disable-line rule:truthy
   pull_request:
     branches:
       - main
+    paths:
+      - '__RM_INDUSTRIES_FORGE_TEMPLATE_V1_PROJECT_PATH_FILTER__'
+      - '.github/actions/setup-project/**'
+      - '.github/workflows/project.yml'
   push:
     branches:
       - main
+    paths:
+      - '__RM_INDUSTRIES_FORGE_TEMPLATE_V1_PROJECT_PATH_FILTER__'
+      - '.github/actions/setup-project/**'
+      - '.github/workflows/project.yml'
 
 permissions: {}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 defaults:
   run:
     shell: bash
+    working-directory: __RM_INDUSTRIES_FORGE_TEMPLATE_V1_PROJECT_DIRECTORY__
 
 jobs:
   format:
@@ -62,8 +71,8 @@ jobs:
       - name: Check spelling
         run: npm run spellcheck
 
-  static-quality:
-    name: Static quality
+  lint-code:
+    name: Lint code
     runs-on: ubuntu-latest
 
     permissions:
@@ -80,8 +89,106 @@ jobs:
         with:
           node-version: '26.x'
 
-      - name: Run remaining static quality checks
-        run: npm run quality:static:ci
+      - name: Lint code
+        run: npm run lint:code
+
+  lint-styles:
+    name: Lint styles
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Setup project
+        uses: $/.github/actions/setup-project
+        with:
+          node-version: '26.x'
+      - name: Lint styles
+        run: npm run lint:css
+
+  lint-markdown:
+    name: Lint Markdown
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Setup project
+        uses: $/.github/actions/setup-project
+        with:
+          node-version: '26.x'
+      - name: Lint source Markdown
+        run: npm run lint:markdown
+
+  audit-unused:
+    name: Audit unused code
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Setup project
+        uses: $/.github/actions/setup-project
+        with:
+          node-version: '26.x'
+      - name: Audit unused code and dependencies
+        run: npm run audit:unused
+
+  typecheck:
+    name: Type-check
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Setup project
+        uses: $/.github/actions/setup-project
+        with:
+          node-version: '26.x'
+      - name: Check TypeScript and Astro diagnostics
+        run: npm run typecheck
+
+  dependency-audit:
+    name: Dependency audit
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Setup project
+        uses: $/.github/actions/setup-project
+        with:
+          node-version: '26.x'
+
+      - name: Audit dependencies
+        id: audit
+        continue-on-error: true
+        run: npm run audit
+
+      - name: Report dependency audit
+        if: steps.audit.outcome == 'failure'
+        run: |
+          echo '::warning title=Dependency security findings::Review Dependabot alerts and the audit output. Dependency findings are reported here but do not block pull-request remediation.'
+          echo '## Dependency security findings' >> "$GITHUB_STEP_SUMMARY"
+          echo 'The dependency audit found blocking-severity advisories. Review the audit output and Dependabot alerts. Release security gates remain blocking.' >> "$GITHUB_STEP_SUMMARY"
 
   unit-tests:
     name: Unit tests and coverage
@@ -109,7 +216,7 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: unit-coverage
-          path: coverage
+          path: __RM_INDUSTRIES_FORGE_TEMPLATE_V1_PROJECT_DIRECTORY__/coverage
           if-no-files-found: error
           retention-days: 7
 
@@ -117,8 +224,13 @@ jobs:
     name: Production build
     needs:
       - format
+      - lint-code
+      - lint-styles
+      - lint-markdown
       - spellcheck
-      - static-quality
+      - audit-unused
+      - typecheck
+      - unit-tests
     runs-on: ubuntu-latest
 
     permissions:
@@ -135,17 +247,14 @@ jobs:
         with:
           node-version: '26.x'
 
-      - name: Build project
+      - name: Build production site once
         run: npm run build
 
-      - name: Validate generated output
-        run: npm run validate:build
-
       - name: Upload production build
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: site-build
-          path: dist
+          path: __RM_INDUSTRIES_FORGE_TEMPLATE_V1_PROJECT_DIRECTORY__/dist
           if-no-files-found: error
           retention-days: 7
 
@@ -153,10 +262,36 @@ jobs:
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
-          path: dist
+          path: __RM_INDUSTRIES_FORGE_TEMPLATE_V1_PROJECT_DIRECTORY__/dist
+
+  validate-build:
+    name: Validate build
+    needs:
+      - build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Setup project
+        uses: $/.github/actions/setup-project
+        with:
+          node-version: '26.x'
+      - name: Download production build
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: site-build
+          path: __RM_INDUSTRIES_FORGE_TEMPLATE_V1_PROJECT_DIRECTORY__/dist
+      - name: Validate production artifacts
+        run: npm run validate:build
 
   browser-tests:
     name: Browser and accessibility tests
+    needs:
+      - build
     runs-on: ubuntu-latest
 
     permissions:
@@ -176,6 +311,12 @@ jobs:
       - name: Install supported browsers
         run: npx playwright install --with-deps chromium firefox webkit
 
+      - name: Download production build
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: site-build
+          path: __RM_INDUSTRIES_FORGE_TEMPLATE_V1_PROJECT_DIRECTORY__/dist
+
       - name: Run browser and accessibility tests
         run: npm run test:e2e
 
@@ -185,13 +326,15 @@ jobs:
         with:
           name: browser-test-failures
           path: |
-            playwright-report
-            test-results
+            __RM_INDUSTRIES_FORGE_TEMPLATE_V1_PROJECT_DIRECTORY__/playwright-report
+            __RM_INDUSTRIES_FORGE_TEMPLATE_V1_PROJECT_DIRECTORY__/test-results
           if-no-files-found: error
           retention-days: 7
 
   lighthouse:
     name: Lighthouse budgets
+    needs:
+      - build
     runs-on: ubuntu-latest
 
     permissions:
@@ -208,6 +351,15 @@ jobs:
         with:
           node-version: '26.x'
 
+      - name: Install Lighthouse browser
+        run: npx playwright install --with-deps chromium
+
+      - name: Download production build
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: site-build
+          path: __RM_INDUSTRIES_FORGE_TEMPLATE_V1_PROJECT_DIRECTORY__/dist
+
       - name: Enforce Lighthouse budgets
         run: npm run lighthouse:ci
 
@@ -216,35 +368,26 @@ jobs:
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: lighthouse-reports
-          path: .lighthouseci
+          path: __RM_INDUSTRIES_FORGE_TEMPLATE_V1_PROJECT_DIRECTORY__/.lighthouseci
           include-hidden-files: true
           if-no-files-found: error
           retention-days: 7
 
-  project:
-    name: Project
+  deploy:
+    name: Deploy GitHub Pages
     needs:
       - format
+      - lint-code
+      - lint-styles
+      - lint-markdown
       - spellcheck
-      - static-quality
+      - audit-unused
+      - typecheck
       - unit-tests
       - build
+      - validate-build
       - browser-tests
       - lighthouse
-    runs-on: ubuntu-latest
-
-    permissions:
-      contents: read
-
-    steps:
-      - name: Confirm project checks
-        run: echo "All project checks passed."
-
-  deploy:
-    name: Deploy GitHub Pages
-    needs:
-      - build
-      - project
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
 
@@ -256,7 +399,44 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
 
+    outputs:
+      page-url: ${{ steps.deployment.outputs.page_url }}
+
     steps:
       - name: Deploy GitHub Pages
         id: deployment
         uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+
+  smoke-deployed:
+    name: Verify deployed website
+    needs:
+      - deploy
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Setup project
+        uses: $/.github/actions/setup-project
+        with:
+          node-version: '26.x'
+      - name: Install Chromium
+        run: npx playwright install --with-deps chromium
+      - name: Verify deployed routes, assets, and mobile layout
+        env:
+          DEPLOYMENT_URL: ${{ needs.deploy.outputs.page-url }}
+        run: npm run test:smoke
+      - name: Upload deployed smoke failure evidence
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: deployed-smoke-results
+          path: |
+            __RM_INDUSTRIES_FORGE_TEMPLATE_V1_PROJECT_DIRECTORY__/playwright-report
+            __RM_INDUSTRIES_FORGE_TEMPLATE_V1_PROJECT_DIRECTORY__/test-results
+          if-no-files-found: ignore
+          retention-days: 7

package/dist/template/.github/workflows/security.yml

@@ -5,9 +5,15 @@ on: # yamllint disable-line rule:truthy
   pull_request:
     branches:
       - main
+    paths:
+      - '__RM_INDUSTRIES_FORGE_TEMPLATE_V1_PROJECT_PATH_FILTER__'
+      - '.github/**'
   push:
     branches:
       - main
+    paths:
+      - '__RM_INDUSTRIES_FORGE_TEMPLATE_V1_PROJECT_PATH_FILTER__'
+      - '.github/**'
   schedule:
     - cron: '__RM_INDUSTRIES_FORGE_TEMPLATE_V1_SECURITY_SCHEDULE_MINUTE__ 5 * * 1'
 
@@ -65,6 +71,7 @@ jobs:
           persist-credentials: false
 
       - name: Review dependency changes
+        continue-on-error: true
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5
         with:
           fail-on-severity: high

package/dist/template/README.md

@@ -41,8 +41,8 @@ reference.
 | `npm run build`          | Create the production site in `dist/`.                           |
 | `npm run validate:build` | Validate required output and scan generated text.                |
 | `npm run preview`        | Serve the production build locally. Run `build` first.           |
-| `npm run typecheck`      | Generate Astro types and run TypeScript without emitting files.  |
-| `npm run astro:check`    | Validate Astro components, content, and diagnostics.             |
+| `npm run typecheck`      | Validate TypeScript, Astro components, content, and diagnostics. |
+| `npm run astro:check`    | Run the same Astro diagnostics directly.                         |
 | `npm run format`         | Check formatting with Oxfmt.                                     |
 | `npm run format:fix`     | Apply Oxfmt formatting.                                          |
 | `npm run lint`           | Run code, CSS, Markdown, and spelling checks.                    |
@@ -51,7 +51,7 @@ reference.
 | `npm run lint:markdown`  | Check Markdown with Markdownlint.                                |
 | `npm run spellcheck`     | Check repository text with cspell.                               |
 | `npm run audit:unused`   | Detect unused files, exports, and dependencies with Knip.        |
-| `npm run lighthouse:ci`  | Build and enforce Lighthouse scores and transfer budgets.        |
+| `npm run lighthouse:ci`  | Enforce Lighthouse scores against an existing build.             |
 | `npm test`               | Run the `test:unit` command.                                     |
 | `npm run test:unit`      | Run deterministic TypeScript unit tests with Vitest.             |
 | `npm run test:a11y`      | Run focused Playwright and axe accessibility checks.             |
@@ -74,45 +74,42 @@ any deployment base path from the configured canonical site URL.
 
 The complete command is intentionally high cost. Use `npm run quality:static`
 for the quickest source-only feedback or `npm run quality:core` for every check
-that does not launch a browser. Both commands include `npm run audit`, so they
-query the npm registry and can change when new advisories are published. Run
-the individual scripts when working offline. CI may execute independent stages
-in parallel, but a project generated by the packed Forge initializer must pass
-the documented `npm run quality` command as a single ordered pipeline.
+that does not launch a browser. Dependency auditing remains the explicit
+`npm run audit` command. CI executes independent source stages in parallel,
+builds once, and gives that output to validation, browser tests, Lighthouse, and
+deployment.
 
 ## Continuous integration
 
 The generated `.github/workflows/project.yml` runs on pull requests targeting
-`main` and on pushes to `main`. It separates static quality, coverage-enforced
-unit tests, the validated production build, browser and accessibility tests,
-and Lighthouse budgets so failures identify the affected gate directly. The
-required `Project` result succeeds only after every release-blocking job passes.
-On pushes to `main`, that result unlocks a separate GitHub Pages deployment;
-pull requests never upload or deploy a Pages artifact. Deployment setup,
-project-site URLs, custom domains, and environment protections are documented in
-[`docs/github-pages.md`](docs/github-pages.md).
-
-The workflow installs dependencies with `npm ci`, caches npm downloads using
-the lockfile, cancels superseded runs on the same Git reference, and grants only
-read access to repository contents. Pull requests receive no secrets or write
-permissions. Coverage, production builds, Lighthouse reports, and browser
+`main` and on pushes to `main`. Formatting, code/style/Markdown linting,
+spelling, unused-code analysis, Astro diagnostics, and unit coverage report
+independently. One production build follows those checks; build validation,
+browser tests, and Lighthouse download and test that same artifact. Deployment
+depends directly on every applicable check and publishes the Pages artifact
+packaged by the build job. A live Chromium smoke test then verifies the deployed
+URL, assets, and mobile layout. There is no aggregate/no-op project job.
+Deployment setup, project-site URLs, custom domains, and environment protections
+are documented in [`docs/github-pages.md`](docs/github-pages.md).
+
+The workflow installs dependencies with `npm ci`, caches npm downloads using the
+lockfile, cancels superseded pull-request runs, serializes deployment runs, and
+grants only read access outside deployment. Pull requests receive no secrets or
+write permissions. Coverage, production builds, Lighthouse reports, and browser
 failure evidence are retained for seven days. All third-party actions use
 immutable commit pins.
 
 Security automation is included alongside project CI. CodeQL analyzes the
 project's TypeScript and GitHub Actions on pull requests, pushes to `main`, and
-a weekly schedule. Dependency review rejects pull requests that introduce
-known high- or critical-severity vulnerabilities. A separate scheduled
-automation workflow validates workflow syntax and scans GitHub Actions with
-Zizmor. Zizmor uploads its findings to GitHub code scanning for review in the
-Security tab without failing the workflow solely because it found an issue.
-The job receives `security-events: write` only for that upload; all other access
-remains read-only. Repositories can make selected code-scanning severities
-merge-blocking later through their ruleset without changing the workflow.
-The `Automation` aggregate runs when `.github/**` changes and succeeds only after
-both workflow syntax and security validation pass. Because it is path-filtered,
-do not configure it as a globally required status check; review it whenever an
-automation change causes it to appear.
+a weekly schedule. Dependency review reports introduced dependency risk without
+blocking remediation pull requests. A separate scheduled automation workflow
+validates workflow syntax with Actionlint and scans GitHub Actions with Zizmor.
+Zizmor uploads its findings to GitHub code scanning and fails `Workflow security`
+when it finds an issue. The job receives `security-events: write` only for that
+upload; all other access remains read-only. `Workflow syntax` and `Workflow
+security` run when `.github/**` changes. Because they are path-filtered, do not
+configure them as globally required status checks; require both whenever an
+automation change causes them to appear.
 
 Dependabot checks npm and GitHub Actions weekly. Minor and patch npm updates are
 grouped by production or development scope, while major updates remain separate

package/dist/template/docs/github-pages.md

@@ -13,8 +13,10 @@ not upload a Pages artifact or run a deployment.
    needs a manual production approval.
 
 The build job has read-only repository access. The separate deployment job is
-the only job granted `pages: write` and `id-token: write`, and it cannot begin
-until the complete `Project` quality gate succeeds.
+the only job granted `pages: write` and `id-token: write`, and it depends
+directly on every source, unit, build, validation, browser, and Lighthouse job.
+After deployment, one Chromium smoke test verifies the live URL, assets, and
+mobile layout.
 
 ## Choose the public URL
 

package/dist/template/docs/guides/quality-and-troubleshooting.md

@@ -12,7 +12,7 @@ npm run quality
 ```
 
 - `quality:static` checks formatting, code, CSS, Markdown, spelling, unused code,
-  types, Astro diagnostics, and dependency policy.
+  types, and Astro diagnostics.
 - `quality:core` adds coverage-enforced unit tests, a production build, and
   required-output validation.
 - `quality` adds Playwright browser/accessibility tests and Lighthouse budgets.
@@ -83,11 +83,11 @@ the validator when introducing a route that is part of the public contract.
 
 ### GitHub Pages does not deploy
 
-Open the `Project` workflow first. Deployment is intentionally blocked unless
-all quality jobs pass on `main`. If they pass, inspect the `github-pages`
-environment, Pages source, branch restrictions, URL configuration, and deploy
-job. Follow the [GitHub Pages guide](../github-pages.md) rather than bypassing
-the quality dependency.
+Open the `Project Continuous Integration` workflow first. Deployment depends
+directly on every applicable source and artifact check. If they pass, inspect
+the `github-pages` environment, Pages source, branch restrictions, URL
+configuration, and deploy job. Follow the [GitHub Pages guide](../github-pages.md)
+rather than bypassing a failed dependency.
 
 ## Review dependency updates
 
@@ -98,7 +98,13 @@ Dependabot proposes npm and GitHub Actions updates. Before merging one:
 3. review changes to `package.json` and `package-lock.json` together;
 4. keep Sveltia updates within the exact content-model compatibility range;
 5. run `npm run audit`, `npm run quality`, and any affected manual check; and
-6. merge only after project and security workflows pass.
+6. review the project checks and all security findings before merging.
+
+CodeQL and dependency findings report through GitHub code scanning and
+Dependabot alerts rather than blocking ordinary pull requests. Actionlint and
+Zizmor block workflow changes with syntax or security defects. `npm run audit`
+remains an explicit release gate and must pass—or use a reviewed, justified,
+time-bounded exception—before publishing a release.
 
 Do not widen `@rm-industries/content-model` peer compatibility inside a
 generated project. Forge publishes tested content-model compatibility first,