@starci/hfs 4.4.0 → 4.5.0

package/templates/app/ci-workflows-lite/github/workflows/ci.yml

@@ -9,68 +9,61 @@ on:
 permissions:
   contents: read
 
-# One run per ref.
+# One run per ref: a release tag is never cancelled by another run.
 concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: false
 
 jobs:
-  ci:
+  fast:
     runs-on: ubuntu-latest
-    # id-token: write lets the Codecov upload authenticate with GitHub's OIDC token: no repository secret, no silent skip.
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+{{sonarEnv}}
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version: {{nodeMajor}}
-          cache: npm
-      - run: npm ci --ignore-scripts
+{{> app/ci-workflows/install-steps.yml}}
       - name: production dependency audit
-        run: npm audit --omit=dev --audit-level=high
-      - name: lint
-        if: env.SONAR_TOKEN == ''
-        run: {{ciLint}}
-      - name: lint with Sonar import
-        if: env.SONAR_TOKEN != ''
-        run: {{ciLintSonar}}
+        run: {{auditCommand}}
+{{ciLintSteps}}
       - name: format
         run: npm run format:check
       - name: typecheck
         run: npm run typecheck
+
+  test:
+    runs-on: ubuntu-latest
+    # Codecov OIDC authentication requires a job-scoped identity token.
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+{{> app/ci-workflows/install-steps.yml}}
       - name: unit
         run: npm test -- --ci
       - name: coverage proof
         run: {{ciCoverageProof}}
-      - name: coverage upload
-        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
-        if: ${{ !cancelled() && startsWith(github.ref, 'refs/tags/v') }}
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        if: always() && hashFiles('{{lcovReport}}') != ''
         with:
-          use_oidc: true
-          files: {{lcovReport}}
-          disable_search: true
-          fail_ci_if_error: true
+          name: {{lcovArtifact}}
+          path: {{lcovReport}}
+{{codecovSteps}}
+
+  build:
+    runs-on: ubuntu-latest
+    steps:
+{{> app/ci-workflows/install-steps.yml}}
       - name: build be
         run: npm run build:be
       - name: build fe
         run: npm run build:fe
       - name: database migration checks
         run: {{ciDatabaseLint}}
-{{> app/ci-workflows/sonar-steps.yml}}
+
+{{sonarJob}}
 
   db-types:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version: {{nodeMajor}}
-          cache: npm
-      - run: npm ci --ignore-scripts
+{{> app/ci-workflows/install-steps.yml}}
       - name: start Supabase
         run: npm run db:start
       - name: apply migrations

package/templates/app/ci-workflows-lite/github/workflows/db-deploy.yml

@@ -28,7 +28,6 @@ jobs:
       STACK_ENVIRONMENT: ${{ inputs.environment }}
       BACKUP_RECEIPT: ${{ inputs.backup_receipt }}
       SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
-      XDG_DATA_HOME: ${{ runner.temp }}/starci-data
     steps:
       - name: require release tag
         shell: bash
@@ -46,6 +45,8 @@ jobs:
         with:
           version: v3.13.2
       - name: materialize sealed custody and push migrations
+        env:
+          XDG_DATA_HOME: ${{ runner.temp }}/starci-data
         shell: bash
         run: |
           set -euo pipefail

package/templates/app/ci-workflows-lite/github/workflows/images.yml

@@ -17,21 +17,43 @@ concurrency:
 
 jobs:
   image:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest{{imageJobEnvironment}}
+    env:
+      STACK_ENVIRONMENT: {{imageEnvironment}}
     strategy:
       fail-fast: false
       matrix:
         include:
 {{imageMatrix}}
-    steps:
+    steps:{{imageEnvironmentGuard}}
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: release tag matches package version
         run: node -e "const version=require('./package.json').version;if(process.env.GITHUB_REF_NAME!=='v'+version)process.exit(1)"
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        if: {{imageBuildArgsIf}}
+        with:
+          node-version: {{nodeMajor}}
+          cache: npm
+      - run: npm ci --ignore-scripts
+        if: {{imageBuildArgsIf}}
+      - name: install SOPS
+        if: {{imageBuildArgsIf}}
+        uses: mdgreenwald/mozilla-sops-action@bb2d96a13ef438ad122e5827a57ebd75d6ff118d # v2.1.0
+        with:
+          version: v3.13.2
+      - name: public build values
+        id: args
+        if: {{imageBuildArgsIf}}
+        env:
+          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
+          IMAGE_APP: ${{ matrix.name }}
+        run: npx --no-install starci app stack build-args --env "$STACK_ENVIRONMENT" --app "$IMAGE_APP"
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
       - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: .
           file: ${{ matrix.file }}
+          build-args: ${{ steps.args.outputs.args }}
           push: false
           tags: {{imageProject}}/${{ matrix.name }}:${{ github.ref_name }}
           # OCI keeps the SBOM and provenance attestations without publishing to a registry.

package/templates/app/ci-workflows-lite/github/workflows/stack-deploy.yml

@@ -50,7 +50,6 @@ jobs:
       packages: write
     env:
       STACK_ENVIRONMENT: ${{ inputs.environment }}
-      XDG_DATA_HOME: ${{ runner.temp }}/starci-data
     steps:{{stackGuard}}
       - name: require release tag
         shell: bash
@@ -80,6 +79,7 @@ jobs:
           password: ${{ github.token }}{{stackImageSteps}}
       - name: connect to the swarm manager
         env:
+          XDG_DATA_HOME: ${{ runner.temp }}/starci-data
           VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
           VPS_KNOWN_HOSTS: ${{ secrets.VPS_KNOWN_HOSTS }}
           VPS_HOST: ${{ vars.VPS_HOST }}
@@ -87,11 +87,14 @@ jobs:
         run: npx --no-install starci app stack connect --env "$STACK_ENVIRONMENT" --execute
       - name: deploy the release
         env:
+          XDG_DATA_HOME: ${{ runner.temp }}/starci-data
           SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}{{stackImageEnv}}{{stackPassEnv}}
         run: |
           npx --no-install starci app stack deploy --env "$STACK_ENVIRONMENT" \{{stackImageArgs}}
             --source-sha "$GITHUB_SHA" --execute
       - name: disconnect from the swarm manager
+        env:
+          XDG_DATA_HOME: ${{ runner.temp }}/starci-data
         if: ${{ always() }}
         run: npx --no-install starci app stack disconnect --env "$STACK_ENVIRONMENT" --execute
 
@@ -105,7 +108,6 @@ jobs:
       packages: read
     env:
       STACK_ENVIRONMENT: ${{ inputs.environment }}
-      XDG_DATA_HOME: ${{ runner.temp }}/starci-data
     steps:
       - name: require release tag
         shell: bash
@@ -129,6 +131,7 @@ jobs:
           password: ${{ github.token }}
       - name: connect to the swarm manager
         env:
+          XDG_DATA_HOME: ${{ runner.temp }}/starci-data
           VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
           VPS_KNOWN_HOSTS: ${{ secrets.VPS_KNOWN_HOSTS }}
           VPS_HOST: ${{ vars.VPS_HOST }}
@@ -136,6 +139,7 @@ jobs:
         run: npx --no-install starci app stack connect --env "$STACK_ENVIRONMENT" --execute
       - name: redeploy the stored release
         env:
+          XDG_DATA_HOME: ${{ runner.temp }}/starci-data
           SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
           RELEASE: ${{ inputs.release }}
         shell: bash
@@ -144,5 +148,7 @@ jobs:
           [ -z "$RELEASE" ] || release=(--release "$RELEASE")
           npx --no-install starci app stack rollback --env "$STACK_ENVIRONMENT" "${release[@]}" --execute
       - name: disconnect from the swarm manager
+        env:
+          XDG_DATA_HOME: ${{ runner.temp }}/starci-data
         if: ${{ always() }}
         run: npx --no-install starci app stack disconnect --env "$STACK_ENVIRONMENT" --execute

package/templates/app/quality-config/codecov.yml

@@ -1,21 +1,21 @@
 {{header}}
 # The be unit run's lcov ({{lcovReport}}), uploaded by the managed CI workflow. Coverage is the logic of be/src/modules/**: the status
 # paths are the measured roots of the one coverage scope (derived from the slot manifest's `coverage` field; its complement is rendered into
-# sonar.coverage.exclusions and its roots into be/jest.config.js), held at 100 on the project and on the patch, and each component (one per
-# service app, plus platform) is held at 100 too. fe/ and be/src/features are outside coverage (features are thin by rule; a front end has no tests).
+# sonar.coverage.exclusions and its roots into be/jest.config.js), held at {{codecovTarget}} on the project and on the patch, and each component (one per
+# service app, plus platform) is held at {{codecovTarget}} too. fe/ and be/src/features are outside coverage (features are thin by rule; a front end has no tests).
 codecov:
   require_ci_to_pass: true
 coverage:
   status:
     project:
       default:
-        target: 100%
+        target: {{codecovTarget}}%
         threshold: 0%
         paths:
 {{codecovPaths}}
     patch:
       default:
-        target: 100%
+        target: {{codecovTarget}}%
         threshold: 0%
         paths:
 {{codecovPaths}}
@@ -23,10 +23,10 @@ component_management:
   default_rules:
     statuses:
       - type: project
-        target: 100%
+        target: {{codecovTarget}}%
         threshold: 0%
       - type: patch
-        target: 100%
+        target: {{codecovTarget}}%
         threshold: 0%
   individual_components:
 {{codecovComponents}}

package/templates/app/quality-config/sonar-project.properties

@@ -1,4 +1,5 @@
 {{> app/quality-config/sonar-base.properties}}
+{{sonarHostLine}}
 sonar.tests=be/apps,be/src
 sonar.exclusions={{sonarExclusions}}
 sonar.test.inclusions=**/*.spec.ts

package/templates/app/readme-badges/README.md

@@ -0,0 +1 @@
+{{readmeBadges}}

package/templates/app/skeleton/.github/dependabot.yml

@@ -1,17 +1,4 @@
 {{header}}
 version: 2
 updates:
-  - package-ecosystem: npm
-    directory: /
-    schedule:
-      interval: weekly
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-  - package-ecosystem: docker
-    directories:
-      - /be/apps/*
-      - /fe/apps/*
-    schedule:
-      interval: weekly
+{{dependabotUpdates}}

package/templates/app/skeleton/.starcistacks/application-stacks.yaml

@@ -1,6 +1,8 @@
 # The app declares its topology before any owner provisions a deployment.
 # All-zero application digests are illustrative and must be replaced by verified release digests.
 schema: starci/application-stacks@1
+# To render README badges, declare ci.github: {repository: owner/repo, defaultBranch: main}.
+# A GitHub package.json repository URL also enables the managed block.
 sources:
   - repository: "{{project}}"
 backing:
@@ -104,8 +106,15 @@ environments:
           app: core
         app:
           app: app
+          # Public browser configuration; replace the placeholder origin before deployment.
+          buildArgs:
+            values:
+              NEXT_PUBLIC_SITE_URL: "https://{{project}}.example.invalid"
         landing:
           app: landing
+          buildArgs:
+            values:
+              NEXT_PUBLIC_APP_URL: "https://{{project}}.example.invalid"
       volumes:
         - {{project}}-production-ingress-data
         - {{project}}-production-ingress-config-data
@@ -126,19 +135,68 @@ environments:
 k8s:
   status: deferred
   reason: This starter declares Docker Swarm production; no Kubernetes environment is provisioned.
+ci:
+  secrets:
+    - {name: SONAR_TOKEN, scope: repository, purpose: Sonar analysis token provisioned for this app, optional: true}
+    - {name: SOPS_AGE_KEY, scope: environment, environment: production, purpose: Decrypt app members during deployment, optional: true}
+    - {name: VPS_SSH_KEY, scope: environment, environment: production, purpose: Deployment SSH key, optional: true}
+    - {name: VPS_KNOWN_HOSTS, scope: environment, environment: production, purpose: Pinned deployment SSH host keys, optional: true}
+  vars:
+    - {name: SONAR_HOST_URL, scope: repository, value: "https://sonar.{{project}}.example.invalid", purpose: Documentation endpoint to replace with this app's public Sonar host, optional: true}
+    - {name: VPS_HOST, scope: environment, environment: production, value: 203.0.113.10, purpose: Documentation deployment address to replace before use, optional: true}
+    - {name: VPS_USER, scope: environment, environment: production, value: deploy, purpose: Documentation deployment user to replace before use, optional: true}
 services:
   sonar:
     provider: sonarqube
     mode: local
     qualityGate: {{sonarGate}}
-    host: { local: http://127.0.0.1:9000 }
+    host: {local: http://127.0.0.1:9000, public: "https://sonar.{{project}}.example.invalid"}
     stack:
       owner: host
       root: .claude/ext/sonar
       environment: dev
       compose: compose.yaml
     auth: token
-    ci: { wiring: optional-follow-up }
+    credentials: []
+    projects: [{repository: "{{project}}", key: "{{project}}"}]
+    ci: {wiring: optional-follow-up, workflow: .github/workflows/ci.yml, token: SONAR_TOKEN, hostVar: SONAR_HOST_URL}
     ownerAction:
-      needed: Provision the shared host Sonar project and its analysis credential through sealed custody.
+      needed: Provision this app's Sonar host and project, then set SONAR_TOKEN with starci app ci secret set and sync SONAR_HOST_URL.
       reason: A fresh app declares its quality service without fabricating credentials or a successful analysis.
+  codecov:
+    provider: codecov
+    mode: hosted
+    purpose: Report application coverage through GitHub OIDC.
+    auth: oidc
+    target: 100
+    components: auto
+    required: true
+    ci: {wiring: optional-follow-up, workflow: .github/workflows/ci.yml}
+    ownerAction: none
+  dependabot:
+    provider: github
+    mode: hosted
+    purpose: Keep application dependencies and workflow actions current.
+    ecosystems: [npm, docker, github-actions]
+    schedule: {interval: weekly}
+    groups: {minorPatch: grouped, major: per-package}
+    ignore: ['@starci/*']
+    security: immediate
+    ownerAction: none
+  audit:
+    provider: npm
+    mode: local
+    purpose: Refuse high severity production dependency vulnerabilities.
+    level: high
+    omitDev: true
+    in: [release-gate, ci]
+    ownerAction: none
+  container-registry:
+    provider: ghcr
+    mode: hosted
+    purpose: Publish this app's deployment images with the workflow GitHub token.
+    host: {public: https://ghcr.io}
+    auth: github-token
+    projects: [{repository: "{{project}}", key: "{{project}}"}]
+    ci: {wiring: optional-follow-up}
+    ownerAction: none

package/templates/app/skeleton/README.md

@@ -16,6 +16,10 @@ TypeScript everywhere; NestJS in `be/`, Next.js with next-intl in `fe/`; npm wit
 - `fe/`: the front end, one Next app per `fe/apps/<app>` and the shared workspace packages under `fe/packages/` (the ui drawings and the next-intl stack both apps call).
 - `scripts/`: the app's operational scripts; `hfs.json` declares both sides.
 
+## Status badges
+
+Declare `ci.github.repository` and `ci.github.defaultBranch` in `.starcistacks/application-stacks.yaml` (or set the GitHub `repository` URL in `package.json`), then run `npx starci app sync --write`. Sync inserts a managed badge block after the title; `npx starci app sync --check` verifies it.
+
 ## Development
 
 ```sh
@@ -33,6 +37,8 @@ requests) and `PRIMARY_DB_URL` at boot; every door is closed until it is marked
 `npm run cli -- seed run` runs the dev seeds of `.starcistacks/dev/seeds` (run both from the app root). The product app reads
 `NEXT_PUBLIC_SITE_URL` and `NEXT_PUBLIC_GRAPHQL_URL` (the back end it calls through `fe/apps/app/src/modules/api`, read once the first GraphQL operation exists), the landing `NEXT_PUBLIC_APP_URL` (the product app it hands the reader over to). A missing key stops the process with an error that names it.
 
+Production browser build values live in `.starcistacks/application-stacks.yaml` under `environments.production.deploy.images.*.buildArgs.values`. Replace the placeholder origins for the product's `NEXT_PUBLIC_SITE_URL` and the landing's `NEXT_PUBLIC_APP_URL` with your product app's public origin before building deployment images.
+
 ## Work
 
 The product's Work records live in `.starciwork`.

package/templates/app/skeleton-lite/.github/dependabot.yml

@@ -1,17 +1,4 @@
 {{header}}
 version: 2
 updates:
-  - package-ecosystem: npm
-    directory: /
-    schedule:
-      interval: weekly
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-  - package-ecosystem: docker
-    directories:
-      - /be/apps/*
-      - /fe/apps/*
-    schedule:
-      interval: weekly
+{{dependabotUpdates}}

package/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml

@@ -2,6 +2,8 @@
 # The source models declare intended compute; they prove no completed deployment.
 # All-zero application digests are illustrative and must be replaced by verified release digests.
 schema: starci/application-stacks@1
+# To render README badges, declare ci.github: {repository: owner/repo, defaultBranch: main}.
+# A GitHub package.json repository URL also enables the managed block.
 sources:
   - repository: {{project}}
 backing:
@@ -145,9 +147,12 @@ environments:
           app: api
         web:
           app: web
+          # Public browser configuration; replace these placeholders before deployment.
           buildArgs:
             values:
               NEXT_PUBLIC_SITE_URL: "https://{{project}}.example.invalid"
+              NEXT_PUBLIC_SUPABASE_URL: "https://supabase.{{project}}.example.invalid"
+              NEXT_PUBLIC_SUPABASE_ANON_KEY: "REPLACE_WITH_PUBLIC_SUPABASE_ANON_KEY"
       volumes:
         - {{project}}-production-ingress-data
         - {{project}}-production-ingress-config-data
@@ -175,19 +180,68 @@ environments:
 k8s:
   status: deferred
   reason: Lite production uses Docker Swarm with managed Supabase backing; Kubernetes belongs to a future full-edition deployment.
+ci:
+  secrets:
+    - {name: SONAR_TOKEN, scope: repository, purpose: Sonar analysis token provisioned for this app, optional: true}
+    - {name: SOPS_AGE_KEY, scope: environment, environment: production, purpose: Decrypt app members during deployment, optional: true}
+    - {name: VPS_SSH_KEY, scope: environment, environment: production, purpose: Deployment SSH key, optional: true}
+    - {name: VPS_KNOWN_HOSTS, scope: environment, environment: production, purpose: Pinned deployment SSH host keys, optional: true}
+  vars:
+    - {name: SONAR_HOST_URL, scope: repository, value: "https://sonar.{{project}}.example.invalid", purpose: Documentation endpoint to replace with this app's public Sonar host, optional: true}
+    - {name: VPS_HOST, scope: environment, environment: production, value: 203.0.113.10, purpose: Documentation deployment address to replace before use, optional: true}
+    - {name: VPS_USER, scope: environment, environment: production, value: deploy, purpose: Documentation deployment user to replace before use, optional: true}
 services:
   sonar:
     provider: sonarqube
     mode: local
     qualityGate: {{sonarGate}}
-    host: {local: http://127.0.0.1:9000}
+    host: {local: http://127.0.0.1:9000, public: "https://sonar.{{project}}.example.invalid"}
     stack:
       owner: host
       root: .claude/ext/sonar
       environment: dev
       compose: compose.yaml
     auth: token
-    ci: {wiring: optional-follow-up}
+    credentials: []
+    projects: [{repository: "{{project}}", key: "{{project}}"}]
+    ci: {wiring: optional-follow-up, workflow: .github/workflows/ci.yml, token: SONAR_TOKEN, hostVar: SONAR_HOST_URL}
     ownerAction:
-      needed: Provision the shared host Sonar project and its analysis credential through sealed custody.
+      needed: Provision this app's Sonar host and project, then set SONAR_TOKEN with starci app ci secret set and sync SONAR_HOST_URL.
       reason: A fresh app declares its quality service without fabricating credentials or a successful analysis.
+  codecov:
+    provider: codecov
+    mode: hosted
+    purpose: Report application coverage through GitHub OIDC.
+    auth: oidc
+    target: 100
+    components: auto
+    required: true
+    ci: {wiring: optional-follow-up, workflow: .github/workflows/ci.yml}
+    ownerAction: none
+  dependabot:
+    provider: github
+    mode: hosted
+    purpose: Keep application dependencies and workflow actions current.
+    ecosystems: [npm, docker, github-actions]
+    schedule: {interval: weekly}
+    groups: {minorPatch: grouped, major: per-package}
+    ignore: ['@starci/*']
+    security: immediate
+    ownerAction: none
+  audit:
+    provider: npm
+    mode: local
+    purpose: Refuse high severity production dependency vulnerabilities.
+    level: high
+    omitDev: true
+    in: [release-gate, ci]
+    ownerAction: none
+  container-registry:
+    provider: ghcr
+    mode: hosted
+    purpose: Publish this app's deployment images with the workflow GitHub token.
+    host: {public: https://ghcr.io}
+    auth: github-token
+    projects: [{repository: "{{project}}", key: "{{project}}"}]
+    ci: {wiring: optional-follow-up}
+    ownerAction: none

package/templates/app/skeleton-lite/README.md

@@ -18,6 +18,10 @@ TypeScript everywhere, NestJS in `be/`, Next.js with next-intl in `fe/`, Supabas
 - `.starcistacks/`: value-free environment metadata and encrypted-secret custody.
 - `.starciwork/`: `.gitignore`, `.starciwork/workspace.yaml` project metadata and repo roles, and optional brand drawing records, references, and assets.
 
+## Status badges
+
+Declare `ci.github.repository` and `ci.github.defaultBranch` in `.starcistacks/application-stacks.yaml` (or set the GitHub `repository` URL in `package.json`), then run `npx starci app sync --write`. Sync inserts a managed badge block after the title; `npx starci app sync --check` verifies it.
+
 ## Development
 
 ```sh
@@ -32,6 +36,8 @@ npm run build:fe
 
 The API reads `PORT`, `HTTP_SECURITY_ALLOWED_ORIGINS`, `PRIMARY_DB_URL`, `PRIMARY_DB_SCHEMA`, `SUPABASE_URL`, and `SUPABASE_SERVICE_ROLE_KEY`. The web app reads `NEXT_PUBLIC_SITE_URL`, `NEXT_PUBLIC_SUPABASE_URL`, `NEXT_PUBLIC_SUPABASE_ANON_KEY`, and, once the first GraphQL operation exists, `NEXT_PUBLIC_GRAPHQL_URL`. Missing configuration stops the relevant process with a named error; no template supplies credential defaults.
 
+Production browser build values live in `.starcistacks/application-stacks.yaml` under `environments.production.deploy.images.web.buildArgs.values`. Before building deployment images, replace the placeholders with your site's public origin, your Supabase project's public URL, and its public anonymous key. These values reach every browser; keep the service role key in sealed runtime custody.
+
 `npm test` runs the back end's unit specs with per-file coverage. Optional integration specs run with `npm run test:integration` against the local Supabase stack (`npm run db:start`); a lite app has no e2e world.
 
 The public runtime template tracks only sealed member names. Scaffolding creates this app's own age recipient and encrypts generated placeholder values into the declared `.starcistacks/<environment>/secrets/*.enc` members. Keep the matching host age identity in untracked local custody, then use `starci app secret set` to replace each placeholder with an actual value before deployment. Product apps retain sealed member custody. Runtime specs use disposable copies with ephemeral identities and remove them afterwards.

package/templates/app/upgrade-full/.starcistacks/application-stacks.yaml

@@ -1,4 +1,6 @@
 schema: starci/application-stacks@1
+# To render README badges, declare ci.github: {repository: owner/repo, defaultBranch: main}.
+# A GitHub package.json repository URL also enables the managed block.
 sources:
   - repository: "{{project}}"
 components:
@@ -28,11 +30,60 @@ environments:
 k8s:
   status: deferred
   reason: The upgrade establishes the full local stack first; deployment topology is selected separately.
+ci:
+  secrets:
+    - {name: SONAR_TOKEN, scope: repository, purpose: Sonar analysis token provisioned for this app, optional: true}
+    - {name: SOPS_AGE_KEY, scope: repository, purpose: Decrypt app members during deployment, optional: true}
+    - {name: VPS_SSH_KEY, scope: repository, purpose: Deployment SSH key, optional: true}
+    - {name: VPS_KNOWN_HOSTS, scope: repository, purpose: Pinned deployment SSH host keys, optional: true}
+  vars:
+    - {name: SONAR_HOST_URL, scope: repository, value: "https://sonar.{{project}}.example.invalid", purpose: Documentation endpoint to replace with this app's public Sonar host, optional: true}
+    - {name: VPS_HOST, scope: repository, value: 203.0.113.10, purpose: Documentation deployment address to replace before use, optional: true}
+    - {name: VPS_USER, scope: repository, value: deploy, purpose: Documentation deployment user to replace before use, optional: true}
 services:
   sonar:
     provider: sonarqube
     mode: disabled
     reason: Enable the repository's Sonar service when a host and project token are provisioned.
     qualityGate: starci-quality
-    ci: { wiring: not-used }
+    credentials: []
+    projects: [{repository: "{{project}}", key: "{{project}}"}]
+    ci: {wiring: optional-follow-up, workflow: .github/workflows/ci.yml, token: SONAR_TOKEN, hostVar: SONAR_HOST_URL}
+    ownerAction: none
+  codecov:
+    provider: codecov
+    mode: hosted
+    purpose: Report application coverage through GitHub OIDC.
+    auth: oidc
+    target: 100
+    components: auto
+    required: true
+    ci: {wiring: optional-follow-up, workflow: .github/workflows/ci.yml}
+    ownerAction: none
+  dependabot:
+    provider: github
+    mode: hosted
+    purpose: Keep application dependencies and workflow actions current.
+    ecosystems: [npm, docker, github-actions]
+    schedule: {interval: weekly}
+    groups: {minorPatch: grouped, major: per-package}
+    ignore: ['@starci/*']
+    security: immediate
+    ownerAction: none
+  audit:
+    provider: npm
+    mode: local
+    purpose: Refuse high severity production dependency vulnerabilities.
+    level: high
+    omitDev: true
+    in: [release-gate, ci]
+    ownerAction: none
+  container-registry:
+    provider: ghcr
+    mode: hosted
+    purpose: Publish this app's deployment images with the workflow GitHub token.
+    host: {public: https://ghcr.io}
+    auth: github-token
+    projects: [{repository: "{{project}}", key: "{{project}}"}]
+    ci: {wiring: optional-follow-up}
     ownerAction: none

package/upgrade/index.mjs

@@ -413,7 +413,7 @@ async function model({ root, to, presets, manifest }) {
  * Plans or applies the lite -> full migration. Returns the ordered public plan (`{op,path,why}[]`) in both modes.
  * `presets` and `lock` are test seams for the full managed render and npm lock resolution.
  */
-export async function upgradeEdition({
+async function upgradeEdition({
   root,
   to,
   plan = false,