@starci/hfs 4.4.1 → 4.5.1

package/templates/app/ci-workflows/github/workflows/images.yml

@@ -17,21 +17,44 @@ concurrency:
 
 jobs:
   image:
-    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    runs-on: ubuntu-latest{{imageJobEnvironment}}
+    env:
+      STACK_ENVIRONMENT: {{imageEnvironment}}
     strategy:
       fail-fast: false
       matrix:
         include:
 {{imageMatrix}}
-    steps:
+    steps:{{imageEnvironmentGuard}}
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: release tag matches package version
         run: node -e "const version=require('./package.json').version;if(process.env.GITHUB_REF_NAME!=='v'+version)process.exit(1)"
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        if: {{imageBuildArgsIf}}
+        with:
+          node-version: {{nodeMajor}}
+          cache: npm
+      - run: npm ci --ignore-scripts
+        if: {{imageBuildArgsIf}}
+      - name: install SOPS
+        if: {{imageBuildArgsIf}}
+        uses: mdgreenwald/mozilla-sops-action@bb2d96a13ef438ad122e5827a57ebd75d6ff118d # v2.1.0
+        with:
+          version: v3.13.2
+      - name: public build values
+        id: args
+        if: {{imageBuildArgsIf}}
+        env:
+          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
+          IMAGE_APP: ${{ matrix.name }}
+        run: npx --no-install starci app stack build-args --env "$STACK_ENVIRONMENT" --app "$IMAGE_APP"
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
       - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: .
           file: ${{ matrix.file }}
+          build-args: ${{ steps.args.outputs.args }}
           push: false
           tags: {{imageProject}}/${{ matrix.name }}:${{ github.ref_name }}
           # OCI keeps the SBOM and provenance attestations without publishing to a registry.

package/templates/app/ci-workflows/github/workflows/stack-deploy.yml

@@ -50,7 +50,6 @@ jobs:
       packages: write
     env:
       STACK_ENVIRONMENT: ${{ inputs.environment }}
-      XDG_DATA_HOME: ${{ runner.temp }}/starci-data
     steps:{{stackGuard}}
       - name: require release tag
         shell: bash
@@ -80,6 +79,7 @@ jobs:
           password: ${{ github.token }}{{stackImageSteps}}
       - name: connect to the swarm manager
         env:
+          XDG_DATA_HOME: ${{ runner.temp }}/starci-data
           VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
           VPS_KNOWN_HOSTS: ${{ secrets.VPS_KNOWN_HOSTS }}
           VPS_HOST: ${{ vars.VPS_HOST }}
@@ -87,11 +87,14 @@ jobs:
         run: npx --no-install starci app stack connect --env "$STACK_ENVIRONMENT" --execute
       - name: deploy the release
         env:
+          XDG_DATA_HOME: ${{ runner.temp }}/starci-data
           SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}{{stackImageEnv}}{{stackPassEnv}}
         run: |
           npx --no-install starci app stack deploy --env "$STACK_ENVIRONMENT" \{{stackImageArgs}}
             --source-sha "$GITHUB_SHA" --execute
       - name: disconnect from the swarm manager
+        env:
+          XDG_DATA_HOME: ${{ runner.temp }}/starci-data
         if: ${{ always() }}
         run: npx --no-install starci app stack disconnect --env "$STACK_ENVIRONMENT" --execute
 
@@ -105,7 +108,6 @@ jobs:
       packages: read
     env:
       STACK_ENVIRONMENT: ${{ inputs.environment }}
-      XDG_DATA_HOME: ${{ runner.temp }}/starci-data
     steps:
       - name: require release tag
         shell: bash
@@ -129,6 +131,7 @@ jobs:
           password: ${{ github.token }}
       - name: connect to the swarm manager
         env:
+          XDG_DATA_HOME: ${{ runner.temp }}/starci-data
           VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
           VPS_KNOWN_HOSTS: ${{ secrets.VPS_KNOWN_HOSTS }}
           VPS_HOST: ${{ vars.VPS_HOST }}
@@ -136,6 +139,7 @@ jobs:
         run: npx --no-install starci app stack connect --env "$STACK_ENVIRONMENT" --execute
       - name: redeploy the stored release
         env:
+          XDG_DATA_HOME: ${{ runner.temp }}/starci-data
           SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
           RELEASE: ${{ inputs.release }}
         shell: bash
@@ -144,5 +148,7 @@ jobs:
           [ -z "$RELEASE" ] || release=(--release "$RELEASE")
           npx --no-install starci app stack rollback --env "$STACK_ENVIRONMENT" "${release[@]}" --execute
       - name: disconnect from the swarm manager
+        env:
+          XDG_DATA_HOME: ${{ runner.temp }}/starci-data
         if: ${{ always() }}
         run: npx --no-install starci app stack disconnect --env "$STACK_ENVIRONMENT" --execute

package/templates/app/ci-workflows/install-steps.yml

@@ -0,0 +1,23 @@
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: {{nodeMajor}}
+          cache: npm
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        id: deps
+        with:
+          path: node_modules
+          key: ${{ runner.os }}-node{{nodeMajor}}-modules-${{ hashFiles('package-lock.json') }}
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            .turbo
+            fe/apps/*/.next/cache
+          key: ${{ runner.os }}-node{{nodeMajor}}-build-${{ hashFiles('package-lock.json') }}-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-node{{nodeMajor}}-build-${{ hashFiles('package-lock.json') }}-
+            ${{ runner.os }}-node{{nodeMajor}}-build-
+      - run: npm ci --ignore-scripts
+        if: steps.deps.outputs.cache-hit != 'true'

package/templates/app/ci-workflows/jest-cache.yml

@@ -0,0 +1,8 @@
+      - name: Jest cache
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: .jest-cache
+          key: ${{ runner.os }}-node{{nodeMajor}}-jest-${{ hashFiles('package-lock.json') }}-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-node{{nodeMajor}}-jest-${{ hashFiles('package-lock.json') }}-
+            ${{ runner.os }}-node{{nodeMajor}}-jest-

package/templates/app/ci-workflows/lint-base.yml

@@ -0,0 +1,16 @@
+      - name: lint baseline
+        shell: bash
+        env:
+          BASE_BRANCH: ${{ github.base_ref }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          BEFORE: ${{ github.event.before }}
+        run: |
+          base="origin/$DEFAULT_BRANCH"
+          if [[ "$GITHUB_EVENT_NAME" == pull_request ]]; then
+            base="origin/$BASE_BRANCH"
+          elif [[ "$GITHUB_REF" == refs/tags/* ]]; then
+            base=$(git describe --tags --abbrev=0 "$GITHUB_REF^" 2>/dev/null) || base="origin/$DEFAULT_BRANCH"
+          elif [[ "$GITHUB_EVENT_NAME" == push && -n "$BEFORE" && ! "$BEFORE" =~ ^0+$ ]]; then
+            base="$BEFORE"
+          fi
+          echo "STARCI_BASE_REF=$base" >> "$GITHUB_ENV"

package/templates/app/ci-workflows/sonar-steps.yml

@@ -1,9 +1,3 @@
-      - uses: SonarSource/sonarqube-scan-action@c7ee0f9df90b7aa20e8dcf9695dcfe2e7da5b4f2 # v7.2.1
-        if: ${{ !cancelled() && startsWith(github.ref, 'refs/tags/v') && env.SONAR_TOKEN != '' }}
-        env:
-          SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}
-      - uses: SonarSource/sonarqube-quality-gate-action@7a5fffe8e523c40e0c740b6bc2712ab503e52efa # v1.2.1
-        if: ${{ !cancelled() && startsWith(github.ref, 'refs/tags/v') && env.SONAR_TOKEN != '' }}
-        timeout-minutes: 10
-        env:
-          SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}
+{{sonarJobHeader}}
+{{> app/ci-workflows/install-steps.yml}}
+{{sonarJobSteps}}

package/templates/app/ci-workflows-lite/github/workflows/ci.yml

@@ -9,68 +9,68 @@ on:
 permissions:
   contents: read
 
-# One run per ref.
+# One run per ref: a release tag is never cancelled by another run.
 concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: false
 
 jobs:
-  ci:
+  fast:
+    timeout-minutes: 20
     runs-on: ubuntu-latest
-    # id-token: write lets the Codecov upload authenticate with GitHub's OIDC token: no repository secret, no silent skip.
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+{{sonarEnv}}
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version: {{nodeMajor}}
-          cache: npm
-      - run: npm ci --ignore-scripts
+{{> app/ci-workflows/install-steps.yml}}
+{{> app/ci-workflows/lint-base.yml}}
       - name: production dependency audit
-        run: npm audit --omit=dev --audit-level=high
-      - name: lint
-        if: env.SONAR_TOKEN == ''
-        run: {{ciLint}}
-      - name: lint with Sonar import
-        if: env.SONAR_TOKEN != ''
-        run: {{ciLintSonar}}
+        run: {{auditCommand}}
+{{ciLintSteps}}
       - name: format
         run: npm run format:check
       - name: typecheck
         run: npm run typecheck
+
+  test:
+    timeout-minutes: 45
+    runs-on: ubuntu-latest
+    # Codecov OIDC authentication requires a job-scoped identity token.
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+{{> app/ci-workflows/install-steps.yml}}
+{{> app/ci-workflows/jest-cache.yml}}
       - name: unit
-        run: npm test -- --ci
+        run: npm test -- --ci --forceExit --cacheDirectory .jest-cache
       - name: coverage proof
         run: {{ciCoverageProof}}
-      - name: coverage upload
-        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
-        if: ${{ !cancelled() && startsWith(github.ref, 'refs/tags/v') }}
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        if: always() && hashFiles('{{lcovReport}}') != ''
         with:
-          use_oidc: true
-          files: {{lcovReport}}
-          disable_search: true
-          fail_ci_if_error: true
+          name: {{lcovArtifact}}
+          path: {{lcovReport}}
+{{codecovSteps}}
+
+  build:
+    timeout-minutes: 30
+    runs-on: ubuntu-latest
+    steps:
+{{> app/ci-workflows/install-steps.yml}}
       - name: build be
         run: npm run build:be
       - name: build fe
         run: npm run build:fe
+{{ciBuildEnv}}
       - name: database migration checks
         run: {{ciDatabaseLint}}
-{{> app/ci-workflows/sonar-steps.yml}}
+
+{{sonarJob}}
 
   db-types:
+    timeout-minutes: 30
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
-        with:
-          node-version: {{nodeMajor}}
-          cache: npm
-      - run: npm ci --ignore-scripts
+{{> app/ci-workflows/install-steps.yml}}
       - name: start Supabase
         run: npm run db:start
       - name: apply migrations

package/templates/app/ci-workflows-lite/github/workflows/db-deploy.yml

@@ -22,13 +22,13 @@ concurrency:
 
 jobs:
   deploy:
+    timeout-minutes: 30
     runs-on: ubuntu-latest
     environment: ${{ inputs.environment }}
     env:
       STACK_ENVIRONMENT: ${{ inputs.environment }}
       BACKUP_RECEIPT: ${{ inputs.backup_receipt }}
       SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
-      XDG_DATA_HOME: ${{ runner.temp }}/starci-data
     steps:
       - name: require release tag
         shell: bash
@@ -46,6 +46,8 @@ jobs:
         with:
           version: v3.13.2
       - name: materialize sealed custody and push migrations
+        env:
+          XDG_DATA_HOME: ${{ runner.temp }}/starci-data
         shell: bash
         run: |
           set -euo pipefail

package/templates/app/ci-workflows-lite/github/workflows/images.yml

@@ -17,21 +17,44 @@ concurrency:
 
 jobs:
   image:
-    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    runs-on: ubuntu-latest{{imageJobEnvironment}}
+    env:
+      STACK_ENVIRONMENT: {{imageEnvironment}}
     strategy:
       fail-fast: false
       matrix:
         include:
 {{imageMatrix}}
-    steps:
+    steps:{{imageEnvironmentGuard}}
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: release tag matches package version
         run: node -e "const version=require('./package.json').version;if(process.env.GITHUB_REF_NAME!=='v'+version)process.exit(1)"
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        if: {{imageBuildArgsIf}}
+        with:
+          node-version: {{nodeMajor}}
+          cache: npm
+      - run: npm ci --ignore-scripts
+        if: {{imageBuildArgsIf}}
+      - name: install SOPS
+        if: {{imageBuildArgsIf}}
+        uses: mdgreenwald/mozilla-sops-action@bb2d96a13ef438ad122e5827a57ebd75d6ff118d # v2.1.0
+        with:
+          version: v3.13.2
+      - name: public build values
+        id: args
+        if: {{imageBuildArgsIf}}
+        env:
+          SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
+          IMAGE_APP: ${{ matrix.name }}
+        run: npx --no-install starci app stack build-args --env "$STACK_ENVIRONMENT" --app "$IMAGE_APP"
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
       - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: .
           file: ${{ matrix.file }}
+          build-args: ${{ steps.args.outputs.args }}
           push: false
           tags: {{imageProject}}/${{ matrix.name }}:${{ github.ref_name }}
           # OCI keeps the SBOM and provenance attestations without publishing to a registry.

package/templates/app/ci-workflows-lite/github/workflows/stack-deploy.yml

@@ -50,7 +50,6 @@ jobs:
       packages: write
     env:
       STACK_ENVIRONMENT: ${{ inputs.environment }}
-      XDG_DATA_HOME: ${{ runner.temp }}/starci-data
     steps:{{stackGuard}}
       - name: require release tag
         shell: bash
@@ -80,6 +79,7 @@ jobs:
           password: ${{ github.token }}{{stackImageSteps}}
       - name: connect to the swarm manager
         env:
+          XDG_DATA_HOME: ${{ runner.temp }}/starci-data
           VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
           VPS_KNOWN_HOSTS: ${{ secrets.VPS_KNOWN_HOSTS }}
           VPS_HOST: ${{ vars.VPS_HOST }}
@@ -87,11 +87,14 @@ jobs:
         run: npx --no-install starci app stack connect --env "$STACK_ENVIRONMENT" --execute
       - name: deploy the release
         env:
+          XDG_DATA_HOME: ${{ runner.temp }}/starci-data
           SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}{{stackImageEnv}}{{stackPassEnv}}
         run: |
           npx --no-install starci app stack deploy --env "$STACK_ENVIRONMENT" \{{stackImageArgs}}
             --source-sha "$GITHUB_SHA" --execute
       - name: disconnect from the swarm manager
+        env:
+          XDG_DATA_HOME: ${{ runner.temp }}/starci-data
         if: ${{ always() }}
         run: npx --no-install starci app stack disconnect --env "$STACK_ENVIRONMENT" --execute
 
@@ -105,7 +108,6 @@ jobs:
       packages: read
     env:
       STACK_ENVIRONMENT: ${{ inputs.environment }}
-      XDG_DATA_HOME: ${{ runner.temp }}/starci-data
     steps:
       - name: require release tag
         shell: bash
@@ -129,6 +131,7 @@ jobs:
           password: ${{ github.token }}
       - name: connect to the swarm manager
         env:
+          XDG_DATA_HOME: ${{ runner.temp }}/starci-data
           VPS_SSH_KEY: ${{ secrets.VPS_SSH_KEY }}
           VPS_KNOWN_HOSTS: ${{ secrets.VPS_KNOWN_HOSTS }}
           VPS_HOST: ${{ vars.VPS_HOST }}
@@ -136,6 +139,7 @@ jobs:
         run: npx --no-install starci app stack connect --env "$STACK_ENVIRONMENT" --execute
       - name: redeploy the stored release
         env:
+          XDG_DATA_HOME: ${{ runner.temp }}/starci-data
           SOPS_AGE_KEY: ${{ secrets.SOPS_AGE_KEY }}
           RELEASE: ${{ inputs.release }}
         shell: bash
@@ -144,5 +148,7 @@ jobs:
           [ -z "$RELEASE" ] || release=(--release "$RELEASE")
           npx --no-install starci app stack rollback --env "$STACK_ENVIRONMENT" "${release[@]}" --execute
       - name: disconnect from the swarm manager
+        env:
+          XDG_DATA_HOME: ${{ runner.temp }}/starci-data
         if: ${{ always() }}
         run: npx --no-install starci app stack disconnect --env "$STACK_ENVIRONMENT" --execute

package/templates/app/gitignore

@@ -1,4 +1,6 @@
 {{> common/gitignore.base}}
+# Jest transforms reused by the CI test job
+.jest-cache/
 # be: the schema Nest writes when it boots GraphQL
 schema.gql
 # fe: Next build output and its generated type file

package/templates/app/gitignore-lite

@@ -1,4 +1,6 @@
 {{> common/gitignore.base}}
+# Jest transforms reused by the CI test job
+.jest-cache/
 # Supabase CLI state is local Docker metadata, never application source.
 supabase/.temp/
 supabase/.branches/

package/templates/app/quality-config/codecov.yml

@@ -1,21 +1,21 @@
 {{header}}
 # The be unit run's lcov ({{lcovReport}}), uploaded by the managed CI workflow. Coverage is the logic of be/src/modules/**: the status
 # paths are the measured roots of the one coverage scope (derived from the slot manifest's `coverage` field; its complement is rendered into
-# sonar.coverage.exclusions and its roots into be/jest.config.js), held at 100 on the project and on the patch, and each component (one per
-# service app, plus platform) is held at 100 too. fe/ and be/src/features are outside coverage (features are thin by rule; a front end has no tests).
+# sonar.coverage.exclusions and its roots into be/jest.config.js), held at {{codecovTarget}} on the project and on the patch, and each component (one per
+# service app, plus platform) is held at {{codecovTarget}} too. fe/ and be/src/features are outside coverage (features are thin by rule; a front end has no tests).
 codecov:
   require_ci_to_pass: true
 coverage:
   status:
     project:
       default:
-        target: 100%
+        target: {{codecovTarget}}%
         threshold: 0%
         paths:
 {{codecovPaths}}
     patch:
       default:
-        target: 100%
+        target: {{codecovTarget}}%
         threshold: 0%
         paths:
 {{codecovPaths}}
@@ -23,10 +23,10 @@ component_management:
   default_rules:
     statuses:
       - type: project
-        target: 100%
+        target: {{codecovTarget}}%
         threshold: 0%
       - type: patch
-        target: 100%
+        target: {{codecovTarget}}%
         threshold: 0%
   individual_components:
 {{codecovComponents}}

package/templates/app/quality-config/sonar-project.properties

@@ -1,4 +1,5 @@
 {{> app/quality-config/sonar-base.properties}}
+{{sonarHostLine}}
 sonar.tests=be/apps,be/src
 sonar.exclusions={{sonarExclusions}}
 sonar.test.inclusions=**/*.spec.ts

package/templates/app/readme-badges/README.md

@@ -0,0 +1 @@
+{{readmeBadges}}

package/templates/app/skeleton/.github/dependabot.yml

@@ -1,17 +1,4 @@
 {{header}}
 version: 2
 updates:
-  - package-ecosystem: npm
-    directory: /
-    schedule:
-      interval: weekly
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-  - package-ecosystem: docker
-    directories:
-      - /be/apps/*
-      - /fe/apps/*
-    schedule:
-      interval: weekly
+{{dependabotUpdates}}

package/templates/app/skeleton/.starcistacks/application-stacks.yaml

@@ -1,6 +1,8 @@
 # The app declares its topology before any owner provisions a deployment.
 # All-zero application digests are illustrative and must be replaced by verified release digests.
 schema: starci/application-stacks@1
+# To render README badges, declare ci.github: {repository: owner/repo, defaultBranch: main}.
+# A GitHub package.json repository URL also enables the managed block.
 sources:
   - repository: "{{project}}"
 backing:
@@ -104,8 +106,15 @@ environments:
           app: core
         app:
           app: app
+          # Public browser configuration; replace the placeholder origin before deployment.
+          buildArgs:
+            values:
+              NEXT_PUBLIC_SITE_URL: "https://{{project}}.example.invalid"
         landing:
           app: landing
+          buildArgs:
+            values:
+              NEXT_PUBLIC_APP_URL: "https://{{project}}.example.invalid"
       volumes:
         - {{project}}-production-ingress-data
         - {{project}}-production-ingress-config-data
@@ -126,19 +135,69 @@ environments:
 k8s:
   status: deferred
   reason: This starter declares Docker Swarm production; no Kubernetes environment is provisioned.
+ci:
+  secrets:
+    - {name: SONAR_TOKEN, scope: repository, purpose: Sonar analysis token provisioned for this app, optional: true}
+    - {name: SOPS_AGE_KEY, scope: environment, environment: production, purpose: Decrypt app members during deployment, optional: true}
+    - {name: VPS_SSH_KEY, scope: environment, environment: production, purpose: Deployment SSH key, optional: true}
+    - {name: VPS_KNOWN_HOSTS, scope: environment, environment: production, purpose: Pinned deployment SSH host keys, optional: true}
+  vars:
+    - {name: SONAR_HOST_URL, scope: repository, value: "https://sonar.{{project}}.example.invalid", purpose: Documentation endpoint to replace with this app's public Sonar host, optional: true}
+    - {name: VPS_HOST, scope: environment, environment: production, value: 203.0.113.10, purpose: Documentation deployment address to replace before use, optional: true}
+    - {name: VPS_USER, scope: environment, environment: production, value: deploy, purpose: Documentation deployment user to replace before use, optional: true}
 services:
   sonar:
     provider: sonarqube
+    optional: true
     mode: local
     qualityGate: {{sonarGate}}
-    host: { local: http://127.0.0.1:9000 }
+    host: {local: http://127.0.0.1:9000, public: "https://sonar.{{project}}.example.invalid"}
     stack:
       owner: host
       root: .claude/ext/sonar
       environment: dev
       compose: compose.yaml
     auth: token
-    ci: { wiring: optional-follow-up }
+    credentials: []
+    projects: [{repository: "{{project}}", key: "{{project}}"}]
+    ci: {wiring: optional-follow-up, workflow: .github/workflows/ci.yml, token: SONAR_TOKEN, hostVar: SONAR_HOST_URL}
     ownerAction:
-      needed: Provision the shared host Sonar project and its analysis credential through sealed custody.
+      needed: Provision this app's Sonar host and project, then set SONAR_TOKEN with starci app ci secret set and sync SONAR_HOST_URL.
       reason: A fresh app declares its quality service without fabricating credentials or a successful analysis.
+  codecov:
+    provider: codecov
+    mode: hosted
+    purpose: Report application coverage through GitHub OIDC.
+    auth: oidc
+    target: 100
+    components: auto
+    required: true
+    ci: {wiring: optional-follow-up, workflow: .github/workflows/ci.yml}
+    ownerAction: none
+  dependabot:
+    provider: github
+    mode: hosted
+    purpose: Keep application dependencies and workflow actions current.
+    ecosystems: [npm, docker, github-actions]
+    schedule: {interval: weekly}
+    groups: {minorPatch: grouped, major: per-package}
+    ignore: ['@starci/*']
+    security: immediate
+    ownerAction: none
+  audit:
+    provider: npm
+    mode: local
+    purpose: Refuse high severity production dependency vulnerabilities.
+    level: high
+    omitDev: true
+    in: [release-gate, ci]
+    ownerAction: none
+  container-registry:
+    provider: ghcr
+    mode: hosted
+    purpose: Publish this app's deployment images with the workflow GitHub token.
+    host: {public: https://ghcr.io}
+    auth: github-token
+    projects: [{repository: "{{project}}", key: "{{project}}"}]
+    ci: {wiring: optional-follow-up}
+    ownerAction: none

package/templates/app/skeleton/README.md

@@ -16,6 +16,10 @@ TypeScript everywhere; NestJS in `be/`, Next.js with next-intl in `fe/`; npm wit
 - `fe/`: the front end, one Next app per `fe/apps/<app>` and the shared workspace packages under `fe/packages/` (the ui drawings and the next-intl stack both apps call).
 - `scripts/`: the app's operational scripts; `hfs.json` declares both sides.
 
+## Status badges
+
+Declare `ci.github.repository` and `ci.github.defaultBranch` in `.starcistacks/application-stacks.yaml` (or set the GitHub `repository` URL in `package.json`), then run `npx starci app sync --write`. Sync inserts a managed badge block after the title; `npx starci app sync --check` verifies it.
+
 ## Development
 
 ```sh
@@ -33,6 +37,8 @@ requests) and `PRIMARY_DB_URL` at boot; every door is closed until it is marked
 `npm run cli -- seed run` runs the dev seeds of `.starcistacks/dev/seeds` (run both from the app root). The product app reads
 `NEXT_PUBLIC_SITE_URL` and `NEXT_PUBLIC_GRAPHQL_URL` (the back end it calls through `fe/apps/app/src/modules/api`, read once the first GraphQL operation exists), the landing `NEXT_PUBLIC_APP_URL` (the product app it hands the reader over to). A missing key stops the process with an error that names it.
 
+Production browser build values live in `.starcistacks/application-stacks.yaml` under `environments.production.deploy.images.*.buildArgs.values`. Replace the placeholder origins for the product's `NEXT_PUBLIC_SITE_URL` and the landing's `NEXT_PUBLIC_APP_URL` with your product app's public origin before building deployment images.
+
 ## Work
 
 The product's Work records live in `.starciwork`.

package/templates/app/skeleton-lite/.github/dependabot.yml

@@ -1,17 +1,4 @@
 {{header}}
 version: 2
 updates:
-  - package-ecosystem: npm
-    directory: /
-    schedule:
-      interval: weekly
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-  - package-ecosystem: docker
-    directories:
-      - /be/apps/*
-      - /fe/apps/*
-    schedule:
-      interval: weekly
+{{dependabotUpdates}}