@smi-digital/create-smi-app 2.10.0 → 2.11.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smi-digital/create-smi-app",
-  "version": "2.10.0",
+  "version": "2.11.0",
   "description": "",
   "main": "dist/index.js",
   "bin": {

package/templates/.husky/pre-commit

@@ -1,5 +1,10 @@
 #!/usr/bin/env sh
-npx lint-staged
+# --no-stash: keep eslint --fix / prettier --write running and blocking as normal,
+# but disable lint-staged's backup-stash + hard-revert. That stash/revert step is
+# what silently ate working-tree edits when a task failed (worsened by the required
+# ansible-vault filter round-tripping production.*.env during the rollback). Without
+# it, a failed lint just aborts the commit and leaves your changes untouched.
+npx lint-staged --no-stash
 
 # Safety net: never let an unencrypted production env file reach a commit.
 # The Ansible-Vault git filter normally encrypts these as they are staged; this

package/templates/integrations/strapi-astro/.github/workflows/pr-validation.yml.template

@@ -2,13 +2,25 @@ name: PR Validation
 
 on:
   pull_request:
-    branches: [ "main" ]
+    branches: ["main"]
+
+# Superseded pushes to the same PR cancel the previous run (saves minutes).
+concurrency:
+  group: pr-validation-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+# Least-privilege token. Do not remove `pull-requests: read` — change
+# detection needs it to list the PR's changed files.
+permissions:
+  contents: read
+  pull-requests: read
 
 jobs:
-  run-ci:
-    uses: smi-digital/ci-library/.github/workflows/basic-strapi-astro-pipeline.yml@main
-    with:
-      # Define your directory paths here.
-      # If your folders are exactly 'frontend' and 'backend', you can omit these lines entirely.
-      frontend_dir: './frontend'
-      backend_dir: './backend'
+  ci:
+    uses: smi-digital/ci-library/.github/workflows/pr-strapi-astro-pipeline.yml@main
+    # Defaults match this scaffold's layout (frontend/ + backend/, Node 24).
+    # See the smi-digital/ci-library README for all available inputs
+    # (frontend_dir, backend_dir, node_version, audit_level,
+    # backend_audit_mode, run_integration, run_sast).
+    #
+    # Branch protection: require the single check "ci / CI Status" on main.