@starci/hfs 4.4.1 → 4.5.1

package/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml

@@ -2,6 +2,8 @@
 # The source models declare intended compute; they prove no completed deployment.
 # All-zero application digests are illustrative and must be replaced by verified release digests.
 schema: starci/application-stacks@1
+# To render README badges, declare ci.github: {repository: owner/repo, defaultBranch: main}.
+# A GitHub package.json repository URL also enables the managed block.
 sources:
   - repository: {{project}}
 backing:
@@ -145,9 +147,12 @@ environments:
           app: api
         web:
           app: web
+          # Public browser configuration; replace these placeholders before deployment.
           buildArgs:
             values:
               NEXT_PUBLIC_SITE_URL: "https://{{project}}.example.invalid"
+              NEXT_PUBLIC_SUPABASE_URL: "https://supabase.{{project}}.example.invalid"
+              NEXT_PUBLIC_SUPABASE_ANON_KEY: "REPLACE_WITH_PUBLIC_SUPABASE_ANON_KEY"
       volumes:
         - {{project}}-production-ingress-data
         - {{project}}-production-ingress-config-data
@@ -175,19 +180,69 @@ environments:
 k8s:
   status: deferred
   reason: Lite production uses Docker Swarm with managed Supabase backing; Kubernetes belongs to a future full-edition deployment.
+ci:
+  secrets:
+    - {name: SONAR_TOKEN, scope: repository, purpose: Sonar analysis token provisioned for this app, optional: true}
+    - {name: SOPS_AGE_KEY, scope: environment, environment: production, purpose: Decrypt app members during deployment, optional: true}
+    - {name: VPS_SSH_KEY, scope: environment, environment: production, purpose: Deployment SSH key, optional: true}
+    - {name: VPS_KNOWN_HOSTS, scope: environment, environment: production, purpose: Pinned deployment SSH host keys, optional: true}
+  vars:
+    - {name: SONAR_HOST_URL, scope: repository, value: "https://sonar.{{project}}.example.invalid", purpose: Documentation endpoint to replace with this app's public Sonar host, optional: true}
+    - {name: VPS_HOST, scope: environment, environment: production, value: 203.0.113.10, purpose: Documentation deployment address to replace before use, optional: true}
+    - {name: VPS_USER, scope: environment, environment: production, value: deploy, purpose: Documentation deployment user to replace before use, optional: true}
 services:
   sonar:
     provider: sonarqube
+    optional: true
     mode: local
     qualityGate: {{sonarGate}}
-    host: {local: http://127.0.0.1:9000}
+    host: {local: http://127.0.0.1:9000, public: "https://sonar.{{project}}.example.invalid"}
     stack:
       owner: host
       root: .claude/ext/sonar
       environment: dev
       compose: compose.yaml
     auth: token
-    ci: {wiring: optional-follow-up}
+    credentials: []
+    projects: [{repository: "{{project}}", key: "{{project}}"}]
+    ci: {wiring: optional-follow-up, workflow: .github/workflows/ci.yml, token: SONAR_TOKEN, hostVar: SONAR_HOST_URL}
     ownerAction:
-      needed: Provision the shared host Sonar project and its analysis credential through sealed custody.
+      needed: Provision this app's Sonar host and project, then set SONAR_TOKEN with starci app ci secret set and sync SONAR_HOST_URL.
       reason: A fresh app declares its quality service without fabricating credentials or a successful analysis.
+  codecov:
+    provider: codecov
+    mode: hosted
+    purpose: Report application coverage through GitHub OIDC.
+    auth: oidc
+    target: 100
+    components: auto
+    required: true
+    ci: {wiring: optional-follow-up, workflow: .github/workflows/ci.yml}
+    ownerAction: none
+  dependabot:
+    provider: github
+    mode: hosted
+    purpose: Keep application dependencies and workflow actions current.
+    ecosystems: [npm, docker, github-actions]
+    schedule: {interval: weekly}
+    groups: {minorPatch: grouped, major: per-package}
+    ignore: ['@starci/*']
+    security: immediate
+    ownerAction: none
+  audit:
+    provider: npm
+    mode: local
+    purpose: Refuse high severity production dependency vulnerabilities.
+    level: high
+    omitDev: true
+    in: [release-gate, ci]
+    ownerAction: none
+  container-registry:
+    provider: ghcr
+    mode: hosted
+    purpose: Publish this app's deployment images with the workflow GitHub token.
+    host: {public: https://ghcr.io}
+    auth: github-token
+    projects: [{repository: "{{project}}", key: "{{project}}"}]
+    ci: {wiring: optional-follow-up}
+    ownerAction: none

package/templates/app/skeleton-lite/README.md

@@ -18,6 +18,10 @@ TypeScript everywhere, NestJS in `be/`, Next.js with next-intl in `fe/`, Supabas
 - `.starcistacks/`: value-free environment metadata and encrypted-secret custody.
 - `.starciwork/`: `.gitignore`, `.starciwork/workspace.yaml` project metadata and repo roles, and optional brand drawing records, references, and assets.
 
+## Status badges
+
+Declare `ci.github.repository` and `ci.github.defaultBranch` in `.starcistacks/application-stacks.yaml` (or set the GitHub `repository` URL in `package.json`), then run `npx starci app sync --write`. Sync inserts a managed badge block after the title; `npx starci app sync --check` verifies it.
+
 ## Development
 
 ```sh
@@ -32,6 +36,8 @@ npm run build:fe
 
 The API reads `PORT`, `HTTP_SECURITY_ALLOWED_ORIGINS`, `PRIMARY_DB_URL`, `PRIMARY_DB_SCHEMA`, `SUPABASE_URL`, and `SUPABASE_SERVICE_ROLE_KEY`. The web app reads `NEXT_PUBLIC_SITE_URL`, `NEXT_PUBLIC_SUPABASE_URL`, `NEXT_PUBLIC_SUPABASE_ANON_KEY`, and, once the first GraphQL operation exists, `NEXT_PUBLIC_GRAPHQL_URL`. Missing configuration stops the relevant process with a named error; no template supplies credential defaults.
 
+Production browser build values live in `.starcistacks/application-stacks.yaml` under `environments.production.deploy.images.web.buildArgs.values`. Before building deployment images, replace the placeholders with your site's public origin, your Supabase project's public URL, and its public anonymous key. These values reach every browser; keep the service role key in sealed runtime custody.
+
 `npm test` runs the back end's unit specs with per-file coverage. Optional integration specs run with `npm run test:integration` against the local Supabase stack (`npm run db:start`); a lite app has no e2e world.
 
 The public runtime template tracks only sealed member names. Scaffolding creates this app's own age recipient and encrypts generated placeholder values into the declared `.starcistacks/<environment>/secrets/*.enc` members. Keep the matching host age identity in untracked local custody, then use `starci app secret set` to replace each placeholder with an actual value before deployment. Product apps retain sealed member custody. Runtime specs use disposable copies with ephemeral identities and remove them afterwards.

package/templates/app/upgrade-full/.starcistacks/application-stacks.yaml

@@ -1,4 +1,6 @@
 schema: starci/application-stacks@1
+# To render README badges, declare ci.github: {repository: owner/repo, defaultBranch: main}.
+# A GitHub package.json repository URL also enables the managed block.
 sources:
   - repository: "{{project}}"
 components:
@@ -28,11 +30,61 @@ environments:
 k8s:
   status: deferred
   reason: The upgrade establishes the full local stack first; deployment topology is selected separately.
+ci:
+  secrets:
+    - {name: SONAR_TOKEN, scope: repository, purpose: Sonar analysis token provisioned for this app, optional: true}
+    - {name: SOPS_AGE_KEY, scope: repository, purpose: Decrypt app members during deployment, optional: true}
+    - {name: VPS_SSH_KEY, scope: repository, purpose: Deployment SSH key, optional: true}
+    - {name: VPS_KNOWN_HOSTS, scope: repository, purpose: Pinned deployment SSH host keys, optional: true}
+  vars:
+    - {name: SONAR_HOST_URL, scope: repository, value: "https://sonar.{{project}}.example.invalid", purpose: Documentation endpoint to replace with this app's public Sonar host, optional: true}
+    - {name: VPS_HOST, scope: repository, value: 203.0.113.10, purpose: Documentation deployment address to replace before use, optional: true}
+    - {name: VPS_USER, scope: repository, value: deploy, purpose: Documentation deployment user to replace before use, optional: true}
 services:
   sonar:
     provider: sonarqube
+    optional: true
     mode: disabled
     reason: Enable the repository's Sonar service when a host and project token are provisioned.
     qualityGate: starci-quality
-    ci: { wiring: not-used }
+    credentials: []
+    projects: [{repository: "{{project}}", key: "{{project}}"}]
+    ci: {wiring: optional-follow-up, workflow: .github/workflows/ci.yml, token: SONAR_TOKEN, hostVar: SONAR_HOST_URL}
+    ownerAction: none
+  codecov:
+    provider: codecov
+    mode: hosted
+    purpose: Report application coverage through GitHub OIDC.
+    auth: oidc
+    target: 100
+    components: auto
+    required: true
+    ci: {wiring: optional-follow-up, workflow: .github/workflows/ci.yml}
+    ownerAction: none
+  dependabot:
+    provider: github
+    mode: hosted
+    purpose: Keep application dependencies and workflow actions current.
+    ecosystems: [npm, docker, github-actions]
+    schedule: {interval: weekly}
+    groups: {minorPatch: grouped, major: per-package}
+    ignore: ['@starci/*']
+    security: immediate
+    ownerAction: none
+  audit:
+    provider: npm
+    mode: local
+    purpose: Refuse high severity production dependency vulnerabilities.
+    level: high
+    omitDev: true
+    in: [release-gate, ci]
+    ownerAction: none
+  container-registry:
+    provider: ghcr
+    mode: hosted
+    purpose: Publish this app's deployment images with the workflow GitHub token.
+    host: {public: https://ghcr.io}
+    auth: github-token
+    projects: [{repository: "{{project}}", key: "{{project}}"}]
+    ci: {wiring: optional-follow-up}
     ownerAction: none