@smi-digital/create-smi-app 2.11.3 → 2.13.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smi-digital/create-smi-app",
-  "version": "2.11.3",
+  "version": "2.13.0",
   "description": "",
   "main": "dist/index.js",
   "bin": {

package/templates/base/renovate.json.template

@@ -0,0 +1,4 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["github>SMI-Digital/ci-library"]
+}

package/templates/integrations/strapi-astro/.github/workflows/pr-validation.yml.template

@@ -9,11 +9,14 @@ concurrency:
   group: pr-validation-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
-# Least-privilege token. Do not remove `pull-requests: read` — change
-# detection needs it to list the PR's changed files.
+# Least-privilege token.
+#   pull-requests: write — change detection needs to read the PR's changed files,
+#   and the A/B check posts its report as a PR comment. A reusable workflow can
+#   never exceed its caller's permissions, so downgrading this to `read` silently
+#   turns the A/B report into a skipped step with a warning.
 permissions:
   contents: read
-  pull-requests: read
+  pull-requests: write
 
 jobs:
   ci:
@@ -21,6 +24,11 @@ jobs:
     # Defaults match this scaffold's layout (frontend/ + backend/, Node 24).
     # See the smi-digital/ci-library README for all available inputs
     # (frontend_dir, backend_dir, node_version, audit_level,
-    # backend_audit_mode, run_integration, run_sast).
+    # backend_audit_mode, run_integration, run_sast, run_ab_check).
+    #
+    # The A/B check builds the frontend twice and diffs the result. It activates
+    # as soon as frontend/test/visual.config.json exists — which this scaffold
+    # ships — and is what makes a dependency bump verifiable. Extend the route
+    # list there as the site grows; see AGENTS.md.
     #
     # Branch protection: require the single check "ci / CI Status" on main.

package/templates/integrations/strapi-astro/frontend/test/visual.config.json.template

@@ -0,0 +1,7 @@
+{
+  "_comment": "Config for the A/B check in the shared CI pipeline. Both sides of every dependency PR are built and compared against this list, so it is what makes a bump verifiable. Starts with '/' only — extend it as the site grows. Aim for one route per page TYPE, not per page; five to ten is the useful range. A route is either \"/path\" (must answer 200) or {\"path\": \"/x\", \"status\": 404} for pages that legitimately do not. Listing a route that does not exist yet fails the check, so add them as you build them.",
+  "routes": ["/"],
+  "viewports": [375, 1440],
+  "_interactions": "Hydration probes. A screenshot cannot tell you an island stopped mounting — the server markup is identical either way — so these are the only thing that catches a dead island across a framework major. Supported: faq-accordion, mobile-nav, consent-banner. Remove any that this project does not have; a probe that never matches anything is reported as a configuration error rather than passing silently.",
+  "interactions": ["mobile-nav"]
+}

package/templates/integrations/strapi-astro/integration.config.json

@@ -46,6 +46,10 @@
     {
       "template": "backend/src/index.ts.template",
       "target": "backend/src/index.ts"
+    },
+    {
+      "template": "frontend/test/visual.config.json.template",
+      "target": "frontend/test/visual.config.json"
     }
   ],
   "cdFiles": [