@sidebase/base-config 0.3.1 → 0.3.3

package/README.md

@@ -23,9 +23,9 @@ instead.
 
 | File | Managed as | What it is |
 | ---- | ---------- | ---------- |
-| `.github/workflows/ci.yml` | owned | Lint, typecheck and build, plus optional test and e2e jobs |
-| `.github/workflows/pr-preview-cleanup.yml` | owned | Removes the `preview-deployed` label when `preview` is removed |
-| `.github/workflows/streamctl-upgrade.yml` | owned, opt-in | Weekly upgrade PRs (see [Upgrades](#upgrades)) |
+| `.github/workflows/ci.yaml` | owned | Lint, typecheck and build, plus optional test and e2e jobs |
+| `.github/workflows/pr-preview-cleanup.yaml` | owned | Removes the `preview-deployed` label when `preview` is removed |
+| `.github/workflows/streamctl-upgrade.yaml` | owned, opt-in | Weekly upgrade PRs (see [Upgrades](#upgrades)) |
 | `Dockerfile` | owned | Production image, runs `prisma migrate deploy` and then the server |
 | `tsconfig.json` | owned | Extends the shared strict base and Nuxt's generated config |
 | `pnpm-workspace.yaml` | owned | 7-day release cooldown and the install-script allowlist |
@@ -105,7 +105,7 @@ export default defineNuxtBaseConfig({
 | `docker.preInstall` | `""` | Dockerfile lines before `pnpm install` |
 | `docker.buildArgs` | `""` | Dockerfile lines before `COPY . .` |
 | `docker.buildSteps` | `nuxi prepare`, `prisma generate`, `build` | The build commands |
-| `docker.finalStage` | `""` | Dockerfile lines in the final stage, before `CMD` |
+| `docker.finalStage` | `""` | Dockerfile lines in the final stage, before `CMD`. The image runs as root unless this adds `USER node` |
 | `docker.prismaRuntime` | copy schema, install Prisma CLI | Prisma setup in the final stage |
 | `docker.prismaVersion` | your `prisma` version | Prisma CLI version in the image |
 | `docker.startCommand` | `npm exec prisma migrate deploy && exec node ...` | The `CMD`, one line |

package/dist/config.d.mts

@@ -25,7 +25,7 @@ interface NuxtBaseCiConfig {
     aptPackages?: string[];
 }
 /**
- * Runtime version pins (`config.versions.*`). `node` feeds every render (`ci.yml`,
+ * Runtime version pins (`config.versions.*`). `node` feeds every render (`ci.yaml`,
  * the Dockerfile, the upgrade workflow); `pnpm` feeds the Dockerfile only, because CI
  * takes pnpm from `package.json#packageManager`. Defaults come from the version
  * baseline (node 24.21.0, pnpm 10.34.5).

package/dist/config.d.ts

@@ -25,7 +25,7 @@ interface NuxtBaseCiConfig {
     aptPackages?: string[];
 }
 /**
- * Runtime version pins (`config.versions.*`). `node` feeds every render (`ci.yml`,
+ * Runtime version pins (`config.versions.*`). `node` feeds every render (`ci.yaml`,
  * the Dockerfile, the upgrade workflow); `pnpm` feeds the Dockerfile only, because CI
  * takes pnpm from `package.json#packageManager`. Defaults come from the version
  * baseline (node 24.21.0, pnpm 10.34.5).

package/docs/migration.md

@@ -607,38 +607,40 @@ anything it managed under an old path or an old payload is simply dropped from t
 managed set rather than removed. `check` reports clean either way, because it only
 inspects paths that are currently managed. Nothing will ever tell you these are there.
 
-#### 9a. The two orphaned workflow files
+#### 9a. The orphaned `.yml` workflow files
 
-Do this only if your repository synced the payload before the workflow extensions were
-normalized, which is the case for every adoption branch cut before this release. Check:
+Do this only if your repository synced a payload that still shipped `.yml` workflows,
+which is the case for every adoption branch cut before this release. Check:
 
 ```sh
 ls .github/workflows/
 ```
 
-If you see `ci.yaml` or `pr-preview-cleanup.yaml` sitting next to `ci.yml` and
-`pr-preview-cleanup.yml`, remove the `.yaml` pair:
+If you see `ci.yml`, `pr-preview-cleanup.yml` or `streamctl-upgrade.yml` sitting next to
+its `.yaml` counterpart, remove the `.yml` copies:
 
 ```sh
-git rm --ignore-unmatch .github/workflows/ci.yaml .github/workflows/pr-preview-cleanup.yaml
-```
-
-`--ignore-unmatch` matters: the condition above is "either file", but `git rm` is atomic, so
-naming a path that does not exist aborts with `fatal: pathspec ... did not match any files`
-and removes NEITHER. A repository that opted one workflow out, or never enabled preview
-cleanup, would skim that error and keep running both copies of the other.
-
-This is required, not tidying. The payload renamed those two managed files from `.yaml` to
-`.yml`. streamctl manages files by path, so the sync in step 7 wrote the new `.yml` files
-but did NOT delete the old `.yaml` ones: they are simply no longer in the managed set.
-GitHub Actions runs every file in `.github/workflows/`, so if you leave them the
-repository runs BOTH copies. That means duplicate CI on every push, and two
-`pr-preview-cleanup` jobs racing to tear down the same preview environment. The leftover
-copies are also frozen forever, so they never receive later fixes, including security
-updates to pinned action SHAs.
-
-While you are here, if your config opts out of either workflow by its old path, for
-example `files: { ".github/workflows/ci.yaml": "off" }`, re-key it to the `.yml` path.
+git rm --ignore-unmatch .github/workflows/ci.yml .github/workflows/pr-preview-cleanup.yml .github/workflows/streamctl-upgrade.yml
+```
+
+`--ignore-unmatch` matters: the condition above is "any of these files", but `git rm` is
+atomic, so naming a path that does not exist aborts with `fatal: pathspec ... did not match
+any files` and removes NONE. A repository that opted one workflow out, or never enabled
+preview cleanup or upgrade PRs, would skim that error and keep running both copies of the
+others.
+
+This is required, not tidying. The payload renamed those managed files from `.yml` to
+`.yaml`, so every YAML file it ships uses the same extension as `pnpm-workspace.yaml`.
+streamctl manages files by path, so the sync in step 7 wrote the new `.yaml` files but did
+NOT delete the old `.yml` ones: they are simply no longer in the managed set. GitHub
+Actions runs every file in `.github/workflows/`, so if you leave them the repository runs
+BOTH copies. That means duplicate CI on every push, two `pr-preview-cleanup` jobs racing to
+tear down the same preview environment, and two weekly upgrade PRs. The leftover copies
+are also frozen forever, so they never receive later fixes, including security updates to
+pinned action SHAs.
+
+While you are here, if your config opts out of any of these workflows by its old path, for
+example `files: { ".github/workflows/ci.yml": "off" }`, re-key it to the `.yaml` path.
 An opt-out naming a path that is no longer managed does nothing, so the file you meant to
 suppress would start arriving on the next sync.
 
@@ -646,7 +648,7 @@ suppress would start arriving on the next sync.
 
 The same problem in a harder-to-see form. A `block` file keeps its markers after the
 payload stops managing that path, so the block sits there forever: never updated, never
-reported, and indistinguishable from a block that is still live. The two `.yaml`
+reported, and indistinguishable from a block that is still live. The `.yml`
 workflows above are the known orphaned FILES for this release; orphaned blocks are not
 enumerable in advance, because they depend on which payload version your repository
 adopted first.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sidebase/base-config",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Shared @sidebase base configuration for Nuxt repos: ESLint / Prisma / tsconfig factories on npm, plus the streamctl file-sync preset payload",
   "keywords": [
     "sidebase",

package/presets/base/preset.json

@@ -10,7 +10,7 @@
     { "path": ".vscode/settings.json", "strategy": "merge", "source": "base/vscode/settings.json", "render": "editor", "projectFields": ["editor.fontSize", "editor.rulers", "editor.formatOnSave", "files.exclude", "search.exclude", "files.watcherExclude"] },
     { "path": ".vscode/extensions.json", "strategy": "merge", "source": "base/vscode/extensions.json", "projectFields": ["unwantedRecommendations"] },
     { "path": "AGENTS.md", "strategy": "full", "source": "base/AGENTS.md", "adoption": "expected" },
-    { "path": ".github/workflows/streamctl-upgrade.yml", "strategy": "full", "source": "base/github/workflows/streamctl-upgrade.yml", "render": "automation-upgrade", "enabledBy": "automation.upgradePr", "adoption": "unexpected" }
+    { "path": ".github/workflows/streamctl-upgrade.yaml", "strategy": "full", "source": "base/github/workflows/streamctl-upgrade.yaml", "render": "automation-upgrade", "enabledBy": "automation.upgradePr", "adoption": "unexpected" }
   ],
   "renders": {
     "automation-upgrade": {
@@ -32,7 +32,7 @@
         "MIN_RELEASE_AGE": { "configPath": "security.minimumReleaseAge", "default": "10080", "pattern": "^\\d+$" }
       },
       "fragments": [
-        { "forEach": "pnpm.onlyBuiltDependencies", "source": "base/templates/pnpm/only-built-dependency.yml" }
+        { "forEach": "pnpm.onlyBuiltDependencies", "source": "base/templates/pnpm/only-built-dependency.yaml" }
       ]
     }
   },

package/presets/nuxt-app/Dockerfile

@@ -50,10 +50,6 @@ WORKDIR /app
 
 ${DOCKER_PRISMA_RUNTIME}
 ${DOCKER_FINAL_STAGE}
-# The container stays root on purpose. A `USER node` switch here breaks any
-# deployment that overrides the CMD with a command needing root: the prisma-studio
-# pods apt-install postgresql-client on start, which fails as an unprivileged user.
-# Set docker.finalStage to "USER node" to opt back in.
 
 # start the app
 CMD ${DOCKER_START_COMMAND}

package/presets/nuxt-app/preset.json

@@ -6,8 +6,8 @@
     { "path": "eslint.config.ts", "strategy": "scaffold", "source": "nuxt-app/eslint.config.ts", "shadowedBy": ["eslint.config.mjs", "eslint.config.js", "eslint.config.cjs"] },
     { "path": "prisma.config.ts", "strategy": "scaffold", "source": "nuxt-app/prisma.config.ts" },
     { "path": "Dockerfile", "strategy": "full", "source": "nuxt-app/Dockerfile", "render": "dockerfile", "adoption": "expected" },
-    { "path": ".github/workflows/pr-preview-cleanup.yml", "strategy": "full", "source": "nuxt-app/github/workflows/pr-preview-cleanup.yml", "adoption": "expected" },
-    { "path": ".github/workflows/ci.yml", "strategy": "full", "source": "nuxt-app/github/workflows/ci.yml", "render": "ci" }
+    { "path": ".github/workflows/pr-preview-cleanup.yaml", "strategy": "full", "source": "nuxt-app/github/workflows/pr-preview-cleanup.yaml", "adoption": "expected" },
+    { "path": ".github/workflows/ci.yaml", "strategy": "full", "source": "nuxt-app/github/workflows/ci.yaml", "render": "ci" }
   ],
   "renders": {
     "ci": {
@@ -16,8 +16,8 @@
         "NODE_VERSION": { "configPath": "versions.node", "default": "24.21.0", "pattern": "^[\\w.+-]+$" }
       },
       "fragments": [
-        { "toggle": "ci.unitTests", "source": "nuxt-app/templates/ci/test-job.yml" },
-        { "toggle": "ci.e2e", "source": "nuxt-app/templates/ci/e2e-job.yml" }
+        { "toggle": "ci.unitTests", "source": "nuxt-app/templates/ci/test-job.yaml" },
+        { "toggle": "ci.e2e", "source": "nuxt-app/templates/ci/e2e-job.yaml" }
       ]
     },
     "dockerfile": {