@smi-digital/create-smi-app 2.10.1 → 2.11.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smi-digital/create-smi-app",
-  "version": "2.10.1",
+  "version": "2.11.1",
   "description": "",
   "main": "dist/index.js",
   "bin": {

package/templates/integrations/strapi-astro/.github/workflows/pr-validation.yml.template

@@ -2,13 +2,25 @@ name: PR Validation
 
 on:
   pull_request:
-    branches: [ "main" ]
+    branches: ["main"]
+
+# Superseded pushes to the same PR cancel the previous run (saves minutes).
+concurrency:
+  group: pr-validation-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+# Least-privilege token. Do not remove `pull-requests: read` — change
+# detection needs it to list the PR's changed files.
+permissions:
+  contents: read
+  pull-requests: read
 
 jobs:
-  run-ci:
-    uses: smi-digital/ci-library/.github/workflows/basic-strapi-astro-pipeline.yml@main
-    with:
-      # Define your directory paths here.
-      # If your folders are exactly 'frontend' and 'backend', you can omit these lines entirely.
-      frontend_dir: './frontend'
-      backend_dir: './backend'
+  ci:
+    uses: smi-digital/ci-library/.github/workflows/pr-strapi-astro-pipeline.yml@main
+    # Defaults match this scaffold's layout (frontend/ + backend/, Node 24).
+    # See the smi-digital/ci-library README for all available inputs
+    # (frontend_dir, backend_dir, node_version, audit_level,
+    # backend_audit_mode, run_integration, run_sast).
+    #
+    # Branch protection: require the single check "ci / CI Status" on main.

package/templates/integrations/strapi-astro/Dockerfile.backend.template

@@ -11,7 +11,10 @@ RUN apk update && apk add --no-cache build-base gcc autoconf automake zlib-dev l
 WORKDIR /opt/
 COPY package.json package-lock.json* ./
 RUN npm install -g node-gyp
-RUN npm config set fetch-retry-maxtimeout 600000 -g && npm install
+# Use `npm ci` for a deterministic install straight from the lockfile. This also
+# installs sharp's pinned prebuilt musl binary (@img/sharp-linuxmusl-x64), which
+# `npm install` skips when the lockfile was generated on another OS (npm/cli#4828).
+RUN npm config set fetch-retry-maxtimeout 600000 -g && npm ci
 ENV PATH=/opt/node_modules/.bin:$PATH
 
 WORKDIR /opt/app
@@ -27,7 +30,8 @@ ENV NODE_ENV=${NODE_ENV}
 WORKDIR /opt/
 COPY package.json package-lock.json* ./
 RUN npm install -g node-gyp
-RUN npm config set fetch-retry-maxtimeout 600000 -g && npm install --omit=dev
+# Deterministic prod install from the lockfile (see builder stage note re: sharp).
+RUN npm config set fetch-retry-maxtimeout 600000 -g && npm ci --omit=dev
 ENV PATH=/opt/node_modules/.bin:$PATH
 
 WORKDIR /opt/app