@starci/hfs 4.3.0 → 4.4.0

package/templates/app/ci-workflows/github/workflows/images.yml

@@ -1,12 +1,11 @@
 {{header}}
-# Builds the image of every app on the release tag, so a Dockerfile that no longer builds fails the release (or a manual dispatch) that carries it.
+# Builds the image of every app on its release tag, so a Dockerfile that no longer builds fails that release.
 # It never pushes: publishing an image is the product's decision, not this file's.
 name: images
 
 on:
   push:
     tags: ["v*"]
-  workflow_dispatch:
 
 permissions:
   contents: read
@@ -26,12 +25,25 @@ jobs:
 {{imageMatrix}}
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - name: release tag matches package version
+        run: node -e "const version=require('./package.json').version;if(process.env.GITHUB_REF_NAME!=='v'+version)process.exit(1)"
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
       - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: .
           file: ${{ matrix.file }}
           push: false
-          tags: {{imageProject}}/${{ matrix.name }}:ci
+          tags: {{imageProject}}/${{ matrix.name }}:${{ github.ref_name }}
+          # OCI keeps the SBOM and provenance attestations without publishing to a registry.
+          outputs: type=oci,dest=${{ runner.temp }}/${{ matrix.name }}.oci.tar
+          sbom: true
+          provenance: mode=max
           cache-from: type=gha,scope=${{ matrix.name }}
           cache-to: type=gha,scope=${{ matrix.name }},mode=max
+      - name: retain image with SBOM and provenance
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: image-${{ matrix.name }}-${{ github.sha }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/${{ matrix.name }}.oci.tar
+          if-no-files-found: error
+          compression-level: 0

package/templates/app/ci-workflows/github/workflows/stack-deploy.yml

@@ -0,0 +1,148 @@
+{{header}}
+# Deploys the app's Docker Swarm stack. This file only assembles arguments: the logic lives in the verbs connect, build-args, deploy,
+# rollback and disconnect of "starci app stack". It runs by hand only (Actions > deploy stack > Run workflow) from a release tag v*
+# whose version is the package.json version; it has no push or schedule trigger.
+# operation deploy    builds and pushes one image per environments.<env>.deploy.images entry of .starcistacks/application-stacks.yaml,
+#                     then deploys their immutable digests (render, provision, converge, verify, accept; a failure redeploys the previous release)
+# operation rollback  redeploys a stored release; "release" is 16 lowercase hex characters, empty means the previous accepted release
+# The environment input names a protected GitHub environment (required reviewers) that holds:
+#   vars    VPS_HOST, VPS_USER (the swarm manager); a variable named in deploy.passEnv, when the stack interpolates one
+#   secrets SOPS_AGE_KEY (the age identity of .sops.yaml), VPS_SSH_KEY (CI-only deploy key), VPS_KNOWN_HOSTS (pinned host keys)
+# Nothing else is a secret: images are pushed with the workflow token. Dispatch inputs reach scripts only through env.
+name: deploy stack
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: Protected environment holding the VPS variables and the sealed custody under .starcistacks
+        required: true
+        type: environment
+      operation:
+        description: Deploy a new release or roll back to a stored one
+        required: true
+        type: choice
+        default: deploy
+        options:
+          - deploy
+          - rollback
+      release:
+        description: "Rollback only: release id (16 lowercase hex) to deploy again; empty means the previous accepted release"
+        required: false
+        type: string
+        default: ""
+
+permissions:
+  contents: read
+
+concurrency:
+  group: stack-${{ inputs.environment }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    if: ${{ inputs.operation == 'deploy' }}
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment }}
+    timeout-minutes: 60
+    permissions:
+      contents: read
+      packages: write
+    env:
+      STACK_ENVIRONMENT: ${{ inputs.environment }}
+      XDG_DATA_HOME: ${{ runner.temp }}/starci-data
+    steps:{{stackGuard}}
+      - name: require release tag
+        shell: bash
+        run: '[[ "$GITHUB_REF" == refs/tags/v* ]] || exit 1'
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - name: release tag matches package version
+        run: node -e "const version=require('./package.json').version;if(process.env.GITHUB_REF_NAME!=='v'+version)process.exit(1)"
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: {{nodeMajor}}
+          cache: npm
+      - run: npm ci --ignore-scripts
+      - name: install SOPS
+        uses: mdgreenwald/mozilla-sops-action@bb2d96a13ef438ad122e5827a57ebd75d6ff118d # v2.1.0
+        with:
+          version: v3.13.2
+      - name: image repositories
+        id: names
+        shell: bash
+        run: |
+          owner="${GITHUB_REPOSITORY_OWNER,,}"{{stackNames}}
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+      - uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}{{stackImageSteps}}
+      - name: connect to the swarm manager
+        env:
+          VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
+          VPS_KNOWN_HOSTS: ${{ secrets.VPS_KNOWN_HOSTS }}
+          VPS_HOST: ${{ vars.VPS_HOST }}
+          VPS_USER: ${{ vars.VPS_USER }}
+        run: npx --no-install starci app stack connect --env "$STACK_ENVIRONMENT" --execute
+      - name: deploy the release
+        env:
+          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}{{stackImageEnv}}{{stackPassEnv}}
+        run: |
+          npx --no-install starci app stack deploy --env "$STACK_ENVIRONMENT" \{{stackImageArgs}}
+            --source-sha "$GITHUB_SHA" --execute
+      - name: disconnect from the swarm manager
+        if: ${{ always() }}
+        run: npx --no-install starci app stack disconnect --env "$STACK_ENVIRONMENT" --execute
+
+  rollback:
+    if: ${{ inputs.operation == 'rollback' }}
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment }}
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: read
+    env:
+      STACK_ENVIRONMENT: ${{ inputs.environment }}
+      XDG_DATA_HOME: ${{ runner.temp }}/starci-data
+    steps:
+      - name: require release tag
+        shell: bash
+        run: '[[ "$GITHUB_REF" == refs/tags/v* ]] || exit 1'
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - name: release tag matches package version
+        run: node -e "const version=require('./package.json').version;if(process.env.GITHUB_REF_NAME!=='v'+version)process.exit(1)"
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: {{nodeMajor}}
+          cache: npm
+      - run: npm ci --ignore-scripts
+      - name: install SOPS
+        uses: mdgreenwald/mozilla-sops-action@bb2d96a13ef438ad122e5827a57ebd75d6ff118d # v2.1.0
+        with:
+          version: v3.13.2
+      - uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+      - name: connect to the swarm manager
+        env:
+          VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
+          VPS_KNOWN_HOSTS: ${{ secrets.VPS_KNOWN_HOSTS }}
+          VPS_HOST: ${{ vars.VPS_HOST }}
+          VPS_USER: ${{ vars.VPS_USER }}
+        run: npx --no-install starci app stack connect --env "$STACK_ENVIRONMENT" --execute
+      - name: redeploy the stored release
+        env:
+          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
+          RELEASE: ${{ inputs.release }}
+        shell: bash
+        run: |
+          release=()
+          [ -z "$RELEASE" ] || release=(--release "$RELEASE")
+          npx --no-install starci app stack rollback --env "$STACK_ENVIRONMENT" "${release[@]}" --execute
+      - name: disconnect from the swarm manager
+        if: ${{ always() }}
+        run: npx --no-install starci app stack disconnect --env "$STACK_ENVIRONMENT" --execute

package/templates/app/ci-workflows-lite/github/workflows/ci.yml

@@ -30,18 +30,22 @@ jobs:
           node-version: {{nodeMajor}}
           cache: npm
       - run: npm ci --ignore-scripts
+      - name: production dependency audit
+        run: npm audit --omit=dev --audit-level=high
       - name: lint
         if: env.SONAR_TOKEN == ''
-        run: npm run lint
+        run: {{ciLint}}
       - name: lint with Sonar import
         if: env.SONAR_TOKEN != ''
-        run: npm run lint -- --sonar reports/lint.sonar.json
+        run: {{ciLintSonar}}
       - name: format
         run: npm run format:check
       - name: typecheck
         run: npm run typecheck
       - name: unit
         run: npm test -- --ci
+      - name: coverage proof
+        run: {{ciCoverageProof}}
       - name: coverage upload
         uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         if: ${{ !cancelled() && startsWith(github.ref, 'refs/tags/v') }}
@@ -55,7 +59,7 @@ jobs:
       - name: build fe
         run: npm run build:fe
       - name: database migration checks
-        run: npm run db:lint
+        run: {{ciDatabaseLint}}
 {{> app/ci-workflows/sonar-steps.yml}}
 
   db-types:

package/templates/app/ci-workflows-lite/github/workflows/db-deploy.yml

@@ -5,27 +5,59 @@ on:
   workflow_dispatch:
     inputs:
       environment:
-        description: GitHub environment whose Supabase secrets will be used
+        description: Protected environment with sealed Supabase custody under .starcistacks
         required: true
         type: environment
+      backup_receipt:
+        description: Tracked backup receipt path verified by the deployment owner before migration
+        required: true
+        type: string
 
 permissions:
   contents: read
 
+concurrency:
+  group: database-${{ inputs.environment }}
+  cancel-in-progress: false
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
     environment: ${{ inputs.environment }}
     env:
-      SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
-      SUPABASE_DB_PASSWORD: ${{ secrets.SUPABASE_DB_PASSWORD }}
-      SUPABASE_PROJECT_ID: ${{ secrets.SUPABASE_PROJECT_ID }}
+      STACK_ENVIRONMENT: ${{ inputs.environment }}
+      BACKUP_RECEIPT: ${{ inputs.backup_receipt }}
+      SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
+      XDG_DATA_HOME: ${{ runner.temp }}/starci-data
     steps:
+      - name: require release tag
+        shell: bash
+        run: '[[ "$GITHUB_REF" == refs/tags/v* ]] || exit 1'
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - name: release tag matches package version
+        run: node -e "const version=require('./package.json').version;if(process.env.GITHUB_REF_NAME!=='v'+version)process.exit(1)"
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: {{nodeMajor}}
           cache: npm
       - run: npm ci --ignore-scripts
-      - name: push migrations
-        run: npm run db:push
+      - name: install SOPS
+        uses: mdgreenwald/mozilla-sops-action@bb2d96a13ef438ad122e5827a57ebd75d6ff118d # v2.1.0
+        with:
+          version: v3.13.2
+      - name: materialize sealed custody and push migrations
+        shell: bash
+        run: |
+          set -euo pipefail
+          [[ "$STACK_ENVIRONMENT" =~ ^[a-z][a-z0-9-]*$ ]]
+          git ls-files --error-unmatch -- "$BACKUP_RECEIPT" > /dev/null
+          test -s "$BACKUP_RECEIPT"
+          secret_dir="$XDG_DATA_HOME/StarCi/secrets/{{project}}/$STACK_ENVIRONMENT"
+          trap 'rm -rf -- "$secret_dir"' EXIT
+          npx --no-install starci app secret materialize "$STACK_ENVIRONMENT"
+          export SUPABASE_ACCESS_TOKEN="$(cat "$secret_dir/SUPABASE_ACCESS_TOKEN")"
+          export SUPABASE_DB_PASSWORD="$(cat "$secret_dir/SUPABASE_DB_PASSWORD")"
+          project_id="$(cat "$secret_dir/SUPABASE_PROJECT_ID")"
+          npx --no-install supabase link --project-ref "$project_id"
+          npm run db:push -- --dry-run
+          npm run db:push

package/templates/app/ci-workflows-lite/github/workflows/images.yml

@@ -6,7 +6,6 @@ name: images
 on:
   push:
     tags: ["v*"]
-  workflow_dispatch:
 
 permissions:
   contents: read
@@ -26,12 +25,25 @@ jobs:
 {{imageMatrix}}
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - name: release tag matches package version
+        run: node -e "const version=require('./package.json').version;if(process.env.GITHUB_REF_NAME!=='v'+version)process.exit(1)"
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
       - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: .
           file: ${{ matrix.file }}
           push: false
-          tags: {{imageProject}}/${{ matrix.name }}:ci
+          tags: {{imageProject}}/${{ matrix.name }}:${{ github.ref_name }}
+          # OCI keeps the SBOM and provenance attestations without publishing to a registry.
+          outputs: type=oci,dest=${{ runner.temp }}/${{ matrix.name }}.oci.tar
+          sbom: true
+          provenance: mode=max
           cache-from: type=gha,scope=${{ matrix.name }}
           cache-to: type=gha,scope=${{ matrix.name }},mode=max
+      - name: retain image with SBOM and provenance
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: image-${{ matrix.name }}-${{ github.sha }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/${{ matrix.name }}.oci.tar
+          if-no-files-found: error
+          compression-level: 0

package/templates/app/ci-workflows-lite/github/workflows/stack-deploy.yml

@@ -0,0 +1,148 @@
+{{header}}
+# Deploys the app's Docker Swarm stack. This file only assembles arguments: the logic lives in the verbs connect, build-args, deploy,
+# rollback and disconnect of "starci app stack". It runs by hand only (Actions > deploy stack > Run workflow) from a release tag v*
+# whose version is the package.json version; it has no push or schedule trigger.
+# operation deploy    builds and pushes one image per environments.<env>.deploy.images entry of .starcistacks/application-stacks.yaml,
+#                     then deploys their immutable digests (render, provision, converge, verify, accept; a failure redeploys the previous release)
+# operation rollback  redeploys a stored release; "release" is 16 lowercase hex characters, empty means the previous accepted release
+# The environment input names a protected GitHub environment (required reviewers) that holds:
+#   vars    VPS_HOST, VPS_USER (the swarm manager); a variable named in deploy.passEnv, when the stack interpolates one
+#   secrets SOPS_AGE_KEY (the age identity of .sops.yaml), VPS_SSH_KEY (CI-only deploy key), VPS_KNOWN_HOSTS (pinned host keys)
+# Nothing else is a secret: images are pushed with the workflow token. Dispatch inputs reach scripts only through env.
+name: deploy stack
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: Protected environment holding the VPS variables and the sealed custody under .starcistacks
+        required: true
+        type: environment
+      operation:
+        description: Deploy a new release or roll back to a stored one
+        required: true
+        type: choice
+        default: deploy
+        options:
+          - deploy
+          - rollback
+      release:
+        description: "Rollback only: release id (16 lowercase hex) to deploy again; empty means the previous accepted release"
+        required: false
+        type: string
+        default: ""
+
+permissions:
+  contents: read
+
+concurrency:
+  group: stack-${{ inputs.environment }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    if: ${{ inputs.operation == 'deploy' }}
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment }}
+    timeout-minutes: 60
+    permissions:
+      contents: read
+      packages: write
+    env:
+      STACK_ENVIRONMENT: ${{ inputs.environment }}
+      XDG_DATA_HOME: ${{ runner.temp }}/starci-data
+    steps:{{stackGuard}}
+      - name: require release tag
+        shell: bash
+        run: '[[ "$GITHUB_REF" == refs/tags/v* ]] || exit 1'
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - name: release tag matches package version
+        run: node -e "const version=require('./package.json').version;if(process.env.GITHUB_REF_NAME!=='v'+version)process.exit(1)"
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: {{nodeMajor}}
+          cache: npm
+      - run: npm ci --ignore-scripts
+      - name: install SOPS
+        uses: mdgreenwald/mozilla-sops-action@bb2d96a13ef438ad122e5827a57ebd75d6ff118d # v2.1.0
+        with:
+          version: v3.13.2
+      - name: image repositories
+        id: names
+        shell: bash
+        run: |
+          owner="${GITHUB_REPOSITORY_OWNER,,}"{{stackNames}}
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+      - uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}{{stackImageSteps}}
+      - name: connect to the swarm manager
+        env:
+          VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
+          VPS_KNOWN_HOSTS: ${{ secrets.VPS_KNOWN_HOSTS }}
+          VPS_HOST: ${{ vars.VPS_HOST }}
+          VPS_USER: ${{ vars.VPS_USER }}
+        run: npx --no-install starci app stack connect --env "$STACK_ENVIRONMENT" --execute
+      - name: deploy the release
+        env:
+          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}{{stackImageEnv}}{{stackPassEnv}}
+        run: |
+          npx --no-install starci app stack deploy --env "$STACK_ENVIRONMENT" \{{stackImageArgs}}
+            --source-sha "$GITHUB_SHA" --execute
+      - name: disconnect from the swarm manager
+        if: ${{ always() }}
+        run: npx --no-install starci app stack disconnect --env "$STACK_ENVIRONMENT" --execute
+
+  rollback:
+    if: ${{ inputs.operation == 'rollback' }}
+    runs-on: ubuntu-latest
+    environment: ${{ inputs.environment }}
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: read
+    env:
+      STACK_ENVIRONMENT: ${{ inputs.environment }}
+      XDG_DATA_HOME: ${{ runner.temp }}/starci-data
+    steps:
+      - name: require release tag
+        shell: bash
+        run: '[[ "$GITHUB_REF" == refs/tags/v* ]] || exit 1'
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - name: release tag matches package version
+        run: node -e "const version=require('./package.json').version;if(process.env.GITHUB_REF_NAME!=='v'+version)process.exit(1)"
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: {{nodeMajor}}
+          cache: npm
+      - run: npm ci --ignore-scripts
+      - name: install SOPS
+        uses: mdgreenwald/mozilla-sops-action@bb2d96a13ef438ad122e5827a57ebd75d6ff118d # v2.1.0
+        with:
+          version: v3.13.2
+      - uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+      - name: connect to the swarm manager
+        env:
+          VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
+          VPS_KNOWN_HOSTS: ${{ secrets.VPS_KNOWN_HOSTS }}
+          VPS_HOST: ${{ vars.VPS_HOST }}
+          VPS_USER: ${{ vars.VPS_USER }}
+        run: npx --no-install starci app stack connect --env "$STACK_ENVIRONMENT" --execute
+      - name: redeploy the stored release
+        env:
+          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
+          RELEASE: ${{ inputs.release }}
+        shell: bash
+        run: |
+          release=()
+          [ -z "$RELEASE" ] || release=(--release "$RELEASE")
+          npx --no-install starci app stack rollback --env "$STACK_ENVIRONMENT" "${release[@]}" --execute
+      - name: disconnect from the swarm manager
+        if: ${{ always() }}
+        run: npx --no-install starci app stack disconnect --env "$STACK_ENVIRONMENT" --execute

package/templates/app/codegen-graphql.mjs.partial

@@ -8,12 +8,12 @@ const posix = (file) => file.split(path.sep).join("/")
 const schemas = (fs.existsSync(CONTRACTS) ? fs.readdirSync(CONTRACTS) : [])
     .map((app) => path.join(CONTRACTS, app, "schema.graphql"))
     .filter((file) => fs.existsSync(file))
-    .sort()
+    .sort(byCodeUnit)
     .map(posix)
 const operationRoots = (fs.existsSync(FE_APPS) ? fs.readdirSync(FE_APPS) : [])
     .map((app) => path.join(FE_APPS, app, "src", "modules", "api", "graphql"))
     .filter((dir) => fs.existsSync(dir))
-    .sort()
+    .sort(byCodeUnit)
     .map(posix)
 if (schemas.length === 0 || operationRoots.length === 0) {
     process.stdout.write("codegen: no GraphQL contract under be/contracts yet\n")
@@ -31,4 +31,15 @@ if (schemas.length === 0 || operationRoots.length === 0) {
         ]),
     )
     await generate({ schema: schemas, generates, ignoreNoDocuments: true, silent: true }, true)
+    // Stamp only a successful generation, using the same sorted paths and LF-normalized schemas as R52.
+    const hash = createHash("sha256")
+    for (const schema of schemas) {
+        const source = fs.readFileSync(schema, "utf8").replaceAll("\r\n", "\n")
+        hash.update(`${schema}\0${source}\0`)
+    }
+    const digest = hash.digest("hex")
+    for (const root of operationRoots) {
+        const generated = `${root}/__generated__`
+        if (fs.existsSync(generated)) fs.writeFileSync(`${generated}/.schema-sha256`, `${digest}\n`)
+    }
 }

package/templates/app/codegen-lite/scripts/codegen.mjs

@@ -7,6 +7,11 @@ import { createHash } from "node:crypto"
 import fs from "node:fs"
 import path from "node:path"
 
+const byCodeUnit = (left, right) => {
+    if (left === right) return 0
+    return left < right ? -1 : 1
+}
+
 const MIGRATIONS = path.join("supabase", "migrations")
 const TYPES = path.join("supabase", "types", "database.types.ts")
 const STAMP = /^\/\/ migrations-sha256: ([0-9a-f]{64})$/
@@ -20,7 +25,7 @@ if (!process.argv.includes("--graphql")) {
     const hash = createHash("sha256")
     for (const name of (fs.existsSync(MIGRATIONS) ? fs.readdirSync(MIGRATIONS) : [])
         .filter((file) => file.endsWith(".sql"))
-        .sort()) {
+        .sort(byCodeUnit)) {
         hash.update(`${name}\0${fs.readFileSync(path.join(MIGRATIONS, name), "utf8").replace(/\r\n/g, "\n")}\0`)
     }
     const digest = hash.digest("hex")

package/templates/app/codegen-prelude.mjs.partial

@@ -0,0 +1,8 @@
+import fs from "node:fs"
+import path from "node:path"
+import { createHash } from "node:crypto"
+
+const byCodeUnit = (left, right) => {
+    if (left === right) return 0
+    return left < right ? -1 : 1
+}

package/templates/app/gitignore

@@ -31,3 +31,6 @@ next-env.d.ts
 .starcistacks/*/infra/terraform/files/
 .starcistacks/*/infra/terraform/*.tar.gz
 !.starcistacks/**/*.enc
+
+# Host-local agent credentials and app age identity never enter Git.
+.claude/

package/templates/app/gitignore-lite

@@ -34,3 +34,6 @@ next-env.d.ts
 .starcistacks/*/infra/terraform/files/
 .starcistacks/*/infra/terraform/*.tar.gz
 !.starcistacks/**/*.enc
+
+# Host-local agent credentials and app age identity never enter Git.
+.claude/

package/templates/app/package-scripts/package.json

@@ -10,6 +10,7 @@
     "test:e2e": "npm run typecheck:tests && cd be && jest --selectProjects e2e",
     "test:contract": "npm run typecheck:tests && cd be && jest --selectProjects contract",
     "test:stack": "starci app stack",
+{{supabaseScripts}}
     "contract:emit": "starci app emit"
   }
 }

package/templates/app/package-scripts/supabase.json

@@ -0,0 +1,7 @@
+    "db:start": "supabase start",
+    "db:stop": "supabase stop",
+    "db:reset": "supabase db reset",
+    "db:new": "supabase migration new",
+    "db:push": "supabase db push",
+    "db:types": "npm run contract:emit",
+    "db:lint": "{{appBinary}} check --fast",

package/templates/app/package-scripts-lite/package.json

@@ -7,13 +7,7 @@
     "test": "cd be && jest --selectProjects unit --coverage",
     "test:affected": "cd be && jest --selectProjects unit --passWithNoTests",
     "test:integration": "npm run typecheck:tests && cd be && jest --selectProjects integration",
-    "db:start": "supabase start",
-    "db:stop": "supabase stop",
-    "db:reset": "supabase db reset",
-    "db:new": "supabase migration new",
-    "db:push": "supabase db push",
-    "db:types": "npm run contract:emit",
-    "db:lint": "{{appBinary}} check --fast",
+{{> app/package-scripts/supabase.json}}
     "contract:emit": "{{appBinary}} emit"
   }
 }

package/templates/app/skeleton/.editorconfig

@@ -1,3 +1,4 @@
+{{header}}
 root = true
 
 [*]

package/templates/app/skeleton/.gitattributes

@@ -1,2 +1,8 @@
-* text=auto
+{{header}}
+* text=auto eol=lf
 *.enc binary
+# Scripts and the deploy data are mounted into Linux containers: CRLF there fails (set: Illegal option -).
+*.sh text eol=lf
+*.mjs text eol=lf
+.starcistacks/** text eol=lf
+.starcistacks/**/*.enc binary

package/templates/app/skeleton/.github/dependabot.yml

@@ -0,0 +1,17 @@
+{{header}}
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: docker
+    directories:
+      - /be/apps/*
+      - /fe/apps/*
+    schedule:
+      interval: weekly

package/templates/app/skeleton/.nvmrc

@@ -1 +1 @@
-22
+{{nodeMajor}}