@starci/hfs 4.5.1 → 4.6.0

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 4.6.0 - 2026-10-18
+- Added: `services.codecov|sonar.badgeToken` README badge tokens and `ci.github.visibility` with a private-repository notice (sync, ci verify); `ci.vars` `ownerValue: true` (var sync skips, var set reads stdin, verify checks the name).
+- Fixed: the app release gate counts tag-push CI runs reachable from origin/main, main or HEAD; the secret scans exempt only declared badge tokens.
+- Fixed: empty placeholder lines vanish so every managed file is prettier-stable; CI coverage proof heap, per-side Sonar lint reports merged for the import, per-fe-app build env; `app lint --side` combines with `--sonar`.
+
 ## 4.5.1 - 2026-10-18
 - Fixed: managed CI base refs, public build values, caching and timeouts; optional quality service handling, README formatting and Supabase migration-history parsing.
 

package/ci/cli.mjs

@@ -5,7 +5,7 @@ import { readCiDeclaration, sealedKeyNames } from '../runtime/scripts/hfs/ci-dec
 import { github, refuse } from './github.mjs';
 import { setSecret } from './secret.mjs';
 import { setVariable, syncVariables } from './vars.mjs';
-import { verifyCi } from './verify.mjs';
+import { badgeVisibilityNotices, verifyCi } from './verify.mjs';
 
 const COMMANDS = {
   'secret set': ['env', 'dependabot', 'repo'],
@@ -46,16 +46,18 @@ function parse(argv) {
 export async function ciMain(argv, { cwd = process.cwd(), stdout = (s) => process.stdout.write(s), stderr = (s) => process.stderr.write(s), stdin, env = process.env, tools = {} } = {}) {
   try {
     const parsed = parse(argv);
-    let declaration, sealed;
+    let doc, declaration, sealed;
     try {
-      declaration = readCiDeclaration(parseYaml(fs.readFileSync(path.join(cwd, '.starcistacks/application-stacks.yaml'), 'utf8')));
+      doc = parseYaml(fs.readFileSync(path.join(cwd, '.starcistacks/application-stacks.yaml'), 'utf8'));
+      declaration = readCiDeclaration(doc);
       sealed = sealedKeyNames(cwd, { fs });
     } catch { throw refuse('CI_DECLARATION_INVALID', 'the manifest or sealed key names could not be read'); }
     if (declaration.problems.length) throw refuse('CI_DECLARATION_INVALID', 'correct the CI declaration before using GitHub');
     const context = { ...parsed, declaration, sealed, gh: github({ cwd, env, spawn: tools.spawn }), stdin, stdout };
     if (parsed.command === 'secret set') return await setSecret(context);
-    if (parsed.command === 'var set') return setVariable(context);
+    if (parsed.command === 'var set') return await setVariable(context);
     if (parsed.command === 'var sync') return syncVariables(context);
+    context.notices = badgeVisibilityNotices({ doc, gh: context.gh, repo: context.gh.repository(parsed.options.repo) });
     return verifyCi(context);
   } catch (error) {
     stderr(`${error.code ? error.message : 'CI_USAGE: CI command could not complete'}\n`);

package/ci/vars.mjs

@@ -1,3 +1,4 @@
+import fs from 'node:fs';
 import { refuse, scopeArgs, scopeName } from './github.mjs';
 import { declaredEntry } from './secret.mjs';
 
@@ -15,18 +16,34 @@ function writeVariable(gh, repo, entry, value, options, stdout) {
   stdout(`set variable ${entry.name} (${scopeName(options)})\n`);
 }
 
-export function setVariable({ declaration, gh, options, name, stdout }) {
-  const entry = declaredEntry(declaration.vars, name, options), value = valueOf(entry, options.value);
+/** Owner-supplied input is read once from stdin, with one trailing newline removed and no value echoed. */
+async function ownerValueOf(options, stdin) {
+  if (Object.hasOwn(options, 'value')) throw refuse('CI_VALUE_ARGV', 'an owner-supplied variable takes its value on stdin');
+  let value;
+  if (stdin === undefined) {
+    if (process.stdin.isTTY) throw refuse('CI_VALUE_EMPTY', 'an owner-supplied variable value is required on stdin');
+    value = fs.readFileSync(0, 'utf8');
+  } else value = typeof stdin === 'function' ? await stdin() : stdin;
+  value = String(value ?? '').replace(/\r?\n$/, '');
+  if (!value.length) throw refuse('CI_VALUE_EMPTY', 'an owner-supplied variable value is required on stdin');
+  return value;
+}
+
+/** Owner-supplied variables accept stdin only; other public variables retain manifest and argv agreement. */
+export async function setVariable({ declaration, gh, options, name, stdin, stdout }) {
+  const entry = declaredEntry(declaration.vars, name, options);
+  const value = entry.ownerValue ? await ownerValueOf(options, stdin) : valueOf(entry, options.value);
   writeVariable(gh, gh.repository(options.repo), entry, value, options, stdout);
   return 0;
 }
 
 /** Sync validates the whole plan first and performs no GitHub access until execution is requested. */
 export function syncVariables({ declaration, gh, options, stdout }) {
-  const plan = declaration.vars.map((entry) => ({ entry, value: valueOf(entry), options: { env: entry.scope === 'environment' ? entry.environment : undefined } }));
-  const repo = options.execute && plan.length ? gh.repository(options.repo) : undefined;
+  const plan = declaration.vars.map((entry) => ({ entry, value: entry.ownerValue ? undefined : valueOf(entry), options: { env: entry.scope === 'environment' ? entry.environment : undefined } }));
+  const repo = options.execute && plan.some((item) => !item.entry.ownerValue) ? gh.repository(options.repo) : undefined;
   for (const item of plan) {
-    if (options.execute) writeVariable(gh, repo, item.entry, item.value, item.options, stdout);
+    if (item.entry.ownerValue) stdout(`skip variable ${item.entry.name} (${scopeName(item.options)}): owner-supplied value; the owner runs starci app ci var set ${item.entry.name} [--env ENV] with the value on stdin\n`);
+    else if (options.execute) writeVariable(gh, repo, item.entry, item.value, item.options, stdout);
     else stdout(`would set variable ${item.entry.name} (${scopeName(item.options)})\n`);
   }
   return 0;

package/ci/verify.mjs

@@ -1,7 +1,8 @@
+import { badgeTokenNotices } from '../sync/readme-badges.mjs';
 import { refuse, scopeArgs, scopeName } from './github.mjs';
 
 /** Verification reports names and scopes only; values are compared in memory and excluded from findings. */
-export function verifyCi({ declaration, sealed, gh, options, stdout }) {
+export function verifyCi({ declaration, sealed, gh, options, stdout, notices = [] }) {
   const repo = gh.repository(options.repo), stores = [];
   const environments = [...new Set([...declaration.secrets, ...declaration.vars].filter((item) => item.scope === 'environment').map((item) => item.environment))].sort();
   for (const scope of [{}, ...environments.map((env) => ({ env })), { dependabot: true }]) {
@@ -29,8 +30,21 @@ export function verifyCi({ declaration, sealed, gh, options, stdout }) {
       add(sameKind.some((entry) => entry.name === row.name) ? 'CI_SCOPE_MISMATCH' : store.kind === 'secret' ? 'CI_SECRET_UNDECLARED' : 'CI_VAR_UNDECLARED', row.name, store.scope);
     }
   }
-  if (options.json) stdout(`${JSON.stringify({ ok: findings.length === 0, findings }, null, 2)}\n`);
+  if (options.json) stdout(`${JSON.stringify({ ok: findings.length === 0, findings, notices }, null, 2)}\n`);
   else if (!findings.length) stdout('CI verification passed\n');
   else for (const finding of findings) stdout(`${finding.code}: ${finding.name} (${finding.scope})\n`);
+  if (!options.json) for (const notice of notices) stdout(`${notice}\n`);
   return findings.length ? 1 : 0;
 }
+
+/** Manifest visibility wins; optional GitHub visibility discovery never changes verification findings or errors. */
+export function badgeVisibilityNotices({ doc, gh, repo }) {
+  let visibility = doc?.ci?.github?.visibility;
+  if (visibility === undefined) {
+    try {
+      const remote = gh.json(['repo', 'view', '--json', 'visibility', '--repo', repo]);
+      visibility = ['PRIVATE', 'INTERNAL'].includes(remote?.visibility) ? 'private' : 'public';
+    } catch { return []; }
+  }
+  return badgeTokenNotices({ ...doc, ci: { ...doc?.ci, github: { ...doc?.ci?.github, visibility } } }, { repository: `https://github.com/${repo}` });
+}

package/lint/run.mjs

@@ -26,7 +26,7 @@ import { STYLE_GLOB } from '../sync/index.mjs';
 import { byCodeUnit } from '../report/order.mjs';
 import { braceVariants, globExpression } from '../runtime/scripts/lib/glob.mjs';
 
-// --side judges only that side; root HFS findings belong to be, and Sonar always requires the full lint.
+// --side judges only that side; root HFS findings belong to be, its Sonar report stays on that side.
 export const LINT_SCHEMA = 'starci/lint@1';
 /** The side whose stylesheets stylelint judges. */
 const STYLE_SIDE = 'fe';
@@ -42,11 +42,10 @@ export function workspaceOf(workspace) {
   return rel;
 }
 
-/** Side scopes partition the full lint; Sonar requires the complete report and a frontend workspace cannot belong to be. */
+/** Side scopes partition the full lint; Sonar reports share that scope and a frontend workspace cannot belong to be. */
 function validateSide(opts) {
   if (opts.side === undefined) return;
   if (!SIDES.includes(opts.side)) throw new Error('LINT_SIDE_INVALID: --side is be or fe');
-  if (opts.sonar !== undefined) throw new Error('LINT_SIDE_SONAR_CONFLICT: --side and --sonar do not combine');
   if (opts.side === 'be' && opts.workspace !== undefined) throw new Error('LINT_SIDE_WORKSPACE_CONFLICT: --side be cannot judge a frontend workspace');
 }
 
@@ -312,7 +311,7 @@ export async function lintRepository({ repoRoot, opts, hfsCheck, trackedFiles =
 
   let properties = '';
   try { properties = fs.readFileSync(path.join(repoRoot, 'sonar-project.properties'), 'utf8'); } catch { /* no properties: every finding keeps its own path */ }
-  const sourceRoots = sourceRootsOf(properties);
+  const sourceRoots = sourceRootsOf(properties).filter((root) => findingOnSide({ path: root }, opts.side));
   const tracked = sourceRoots.length ? trackedFiles(repoRoot) : [];
   const sonar = mergeReports([
     sonarReport(kept, { sourceRoots, tracked }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starci/hfs",
-  "version": "4.5.1",
+  "version": "4.6.0",
   "description": "The StarCi app command implementation for scaffolding, linting, checking and synchronizing one product repository.",
   "type": "module",
   "license": "MIT",

package/release/ci-red.mjs

@@ -20,29 +20,61 @@ function runsOf(result) {
   } catch { return null; }
 }
 
+/** Resolve each available default-branch reference once, including HEAD in detached release worktrees. */
+function referenceTips(spawn, cwd, defaultBranch) {
+  const refs = [`origin/${defaultBranch}`, defaultBranch, 'HEAD'];
+  return refs.flatMap((name) => {
+    const result = run(spawn, cwd, 'git', ['rev-parse', '--verify', '--quiet', `${name}^{commit}`]);
+    const tip = String(result.stdout ?? '').trim();
+    return !result.error && result.status === 0 && SHA.test(tip) ? [{ name, tip }] : [];
+  });
+}
+
+/** Equality proves reachability directly; ancestry is unknown only when every available probe errors. */
+function pushAncestry(spawn, cwd, row, refs) {
+  if (refs.some((ref) => ref.tip === row.headSha)) return { candidate: true, unknown: false };
+  let known = false;
+  for (const ref of refs) {
+    const result = run(spawn, cwd, 'git', ['merge-base', '--is-ancestor', row.headSha, ref.tip]);
+    if (!result.error && result.status === 0) return { candidate: true, unknown: false };
+    if (!result.error && result.status === 1) known = true;
+  }
+  return { candidate: false, unknown: !known };
+}
+
+/** Branch rows remain candidates; push rows must reach a resolved reference, and each databaseId counts once. */
+function candidateRuns(spawn, cwd, branch, pushes, refs) {
+  const candidates = branch.filter((row) => row && SHA.test(row.headSha));
+  let ancestryUnknown = refs.length === 0;
+  for (const row of pushes) {
+    if (!row || !SHA.test(row.headSha) || row.event !== 'push') continue;
+    const ancestry = pushAncestry(spawn, cwd, row, refs);
+    if (ancestry.candidate) candidates.push(row);
+    if (ancestry.unknown) ancestryUnknown = true;
+  }
+  const unique = new Map();
+  for (const row of candidates) if (!unique.has(row.databaseId)) unique.set(row.databaseId, row);
+  return { candidates: [...unique.values()], ancestryUnknown };
+}
+
 /** Reads branch runs plus push/tag runs whose commits are reachable from the default branch; the newest completed run decides, even if a newer run is pending. */
 export function latestDefaultBranchCi({ spawn, cwd, defaultBranch = 'main' }) {
+  const refs = referenceTips(spawn, cwd, defaultBranch);
+  const unknown = (why) => ({ state: 'unknown', why: `${why} (refs: ${refs.map((ref) => ref.name).join(', ') || 'none'})` });
   const args = ['run', 'list', '--workflow', 'ci.yml'];
   const tail = ['--limit', '20', '--json', FIELDS];
   const branch = runsOf(run(spawn, cwd, 'gh', [...args, '--branch', defaultBranch, ...tail]));
-  if (!branch) return { state: 'unknown', why: 'gh branch runs unavailable (missing gh, authentication, or unreadable response)' };
+  if (!branch) return unknown('gh branch runs unavailable (missing gh, authentication, or unreadable response)');
   const pushes = runsOf(run(spawn, cwd, 'gh', [...args, '--event', 'push', ...tail]));
-  if (!pushes) return { state: 'unknown', why: 'gh push runs unavailable (missing gh, authentication, or unreadable response)' };
-  const candidates = branch.filter((row) => row && SHA.test(row.headSha));
-  let ancestryUnknown = false;
-  for (const row of pushes) {
-    if (!row || !SHA.test(row.headSha) || row.event !== 'push') continue;
-    const ancestor = run(spawn, cwd, 'git', ['merge-base', '--is-ancestor', row.headSha, defaultBranch]);
-    if (!ancestor.error && ancestor.status === 0) candidates.push(row);
-    else if (ancestor.error || ancestor.status !== 1) ancestryUnknown = true;
-  }
+  if (!pushes) return unknown('gh push runs unavailable (missing gh, authentication, or unreadable response)');
+  const { candidates, ancestryUnknown } = candidateRuns(spawn, cwd, branch, pushes, refs);
   const completed = candidates.filter((row) => row.status === 'completed' && Number.isFinite(Date.parse(row.createdAt)));
   completed.sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt) || Number(b.databaseId) - Number(a.databaseId));
   const latest = completed[0];
-  if (!latest) return { state: 'unknown', why: ancestryUnknown ? 'cannot establish push run ancestry on the default branch' : 'no completed CI run on the default branch' };
+  if (!latest) return unknown(ancestryUnknown ? 'cannot establish push run ancestry on the default branch' : 'no completed CI run on the default branch');
   if (latest.conclusion === 'success') return { state: 'green', run: latest };
   if (RED.has(latest.conclusion)) return { state: 'red', run: latest };
-  return { state: 'unknown', why: 'latest completed CI run has no success or red conclusion', run: latest };
+  return { ...unknown('latest completed CI run has no success or red conclusion'), run: latest };
 }
 
 /** Only a complete starci/ci-override@1 record for this exact commit can excuse a red run. */

package/runtime/knowledge/hfs/canon-pins.yaml

@@ -29,14 +29,14 @@ pins:
     source: packages/grammar/package.json
     why: 'the grammar front ends read: the brand layer sets `--font-sans` and `--font-mono` and the grammar reads them; it carries the Input tel kind, the copyable and read-only Input, the IconButton disclosure props and count badge, ChatBubble, FillViewport, Textarea mentions and Enter-to-send, the leading PrimaryRailLayout rail, the plate-less Image, ListRow, the soft Alert, Progress steps, the floating primary IconButton, FlowGraph, the STATE-8 loading views and the bordered selectable TagGroup chips. The runtime source version wins for a @starci package.'
   '@starci/eslint-canon-be':
-    version: 3.4.3
+    version: 3.4.4
     group: starci
     install: registry
     side: be
     source: packages/eslint/be/package.json
     why: 'the back-end ESLint canon: `loadHfs(import.meta.url)` of be/eslint.config.mjs finds the app-root hfs.json (kind app) and gives every linted file the view of the be side, and the project graph is built per side; its bundled runtime copies (slots, canon-pins, failure codes, the architecture machine) put .starcistacks and .sops.yaml at the app root; `starciBeConfig({ hfs: loadHfs(import.meta.url) })` is the typed factory and the BE-CONVENTION laws are its rules.'
   '@starci/eslint-canon-fe':
-    version: 8.4.3
+    version: 8.4.4
     group: starci
     install: registry
     side: fe
@@ -76,14 +76,14 @@ pins:
     source: packages/test-world/package.json
     why: 'the shared e2e library of every back end (R47, R48), a devDependency of every back end: the warm stack behind toxiproxy, the network-edge fakes, the Nest boot, the typed useTestWorld handle, useSandbox for contract specs and the outage lock. Kafka is real own infra (the one digest-pinned apache/kafka KRaft image, a broker listener and proxy per slot, slot-prefixed topics, consumer groups and client ids) and Postgres is schema-per-context (a schema and a login role per context in a shared database). Each worker has its own data slot (<ns>_w<k>) with its own databases, Keycloak realm, leased Redis DB, bucket/collection/topic prefixes, fakes host, toxiproxy proxies and outage lock; a run provisions min(jest workers, workers cap, default 2) slots, and state file protocol 2 pairs exactly with @starci/jest-preset (TEST_WORLD_PAIR_MISMATCH otherwise). A modules world boots real peer apps beside its modules, world.apps.<name>.during(fn) is the outage of a peer app, w.keycloak.clientSecret(client) answers the run-generated secret of a confidential realm client, world.keycloak.events/sessions read the realm user events and live sessions, world.infra.postgresql.connection(name) takes one database connection down while the others serve, and world.resolve and scope.resolve take any Nest token. Every path a declaration names (`stack`, seeds, the realm, Dockerfiles) resolves from the app root (the directory of hfs.json); the globalSetup registers the path aliases as TypeScript resolves them. Its CLI main is exported at ./cli for starci app stack.'
   '@starci/cli':
-    version: 1.5.1
+    version: 1.6.0
     group: starci
     install: registry
     side: both
     source: packages/cli/package.json
     why: 'the only StarCi command package; product repositories install it for starci app, while @starci/hfs remains its pinned transitive implementation.'
   '@starci/hfs':
-    version: 4.5.1
+    version: 4.6.0
     group: starci
     install: registry
     side: both

package/runtime/knowledge/sonar-gate.yaml

@@ -41,8 +41,8 @@ newCode:
     minReviewedPercent: 100
     unreviewedMax: 0
 # The whole code, not only the new code. Every finding of the HFS canon reaches Sonar through ONE entry, `starci app lint`
-# (packages/hfs, contract changes hfs-sonar-import and hfs-lint-entry), which writes ONE file, reports/lint.sonar.json
-# (`starci app lint --sonar reports/lint.sonar.json`), named by sonar.externalIssuesReportPaths; the gate holds the open-issue count of
+# (packages/hfs, contract changes hfs-sonar-import and hfs-lint-entry). CI runs it per side with --side and --sonar,
+# then merges rules by id and joins issues into ONE file, reports/lint.sonar.json, named by sonar.externalIssuesReportPaths; the gate holds the open-issue count of
 # the whole project at zero. The file carries three engines:
 #   starci-hfs   the repository findings of `starci app check` (managed files, tree, pins, CI, contracts; the rule id is the finding code)
 #   eslint       ESLint's json over the repository (the BE and FE canon plugins alike, per-file and project-graph rules)

package/runtime/modules/schemas/application-stacks.schema.yaml

@@ -152,6 +152,13 @@ $defs:
       optional:
         description: Skip an unreachable quality provider with a notice; SonarQube defaults true, SonarCloud and Codecov false.
         type: boolean
+      badgeToken:
+        description: >-
+          codecov and sonar only: a read-only, public-safe badge token (Codecov graphing token, Sonar project badge token)
+          that the README badge of a private repository needs. It is public configuration rendered into README.md, never a
+          secret; a CI token or any write credential never goes here.
+        type: string
+        pattern: '^[A-Za-z0-9_-]{6,128}$'
       ecosystems: {type: array, items: {enum: [npm, docker, github-actions]}}
       schedule:
         type: object
@@ -275,6 +282,9 @@ $defs:
           repository: {type: string, pattern: '^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$'}
           defaultBranch: {type: string, minLength: 1, default: main}
           workflow: {type: string, pattern: '^[A-Za-z0-9_.-]+\.ya?ml$', default: ci.yml}
+          visibility:
+            description: The GitHub repository visibility; private READMEs need services.<id>.badgeToken for live badges. Omitted means unknown.
+            enum: [public, private]
       secrets: {type: array, items: {$ref: '#/$defs/ciSecret'}}
       vars: {type: array, items: {$ref: '#/$defs/ciVariable'}}
       dependabot:
@@ -310,6 +320,9 @@ $defs:
           purpose: {type: string}
           optional: {type: boolean}
   ciVariable:
+    description: >-
+      A public CI variable either carries its literal value, or declares ownerValue true (no value) when only the owner
+      may supply it; var sync skips an owner-supplied value and ci verify checks that it exists by name.
     anyOf:
       - type: object
         additionalProperties: false
@@ -330,6 +343,25 @@ $defs:
           value: {type: string}
           purpose: {type: string}
           optional: {type: boolean}
+      - type: object
+        additionalProperties: false
+        required: [name, scope, ownerValue]
+        properties:
+          name: {$ref: '#/$defs/ciName'}
+          scope: {const: repository}
+          ownerValue: {const: true}
+          purpose: {type: string}
+          optional: {type: boolean}
+      - type: object
+        additionalProperties: false
+        required: [name, scope, ownerValue, environment]
+        properties:
+          name: {$ref: '#/$defs/ciName'}
+          scope: {const: environment}
+          environment: {type: string, pattern: '^[a-z][a-z0-9-]*$'}
+          ownerValue: {const: true}
+          purpose: {type: string}
+          optional: {type: boolean}
   serviceStack:
     description: >-
       Which stack defines a local service - either a project-owned .starcistacks stack

package/runtime/packages/cli/src/catalog.generated.mjs

@@ -1,7 +1,7 @@
 // GENERATED by scripts/cli/gen-catalog.mjs — do not edit
 export const CATALOG = {
   "schema": "starci/cli-catalog@1",
-  "hash": "d230745d3aa5cfe65f75cb5fb2872924b935f1b4610c0b72db2f729572386404",
+  "hash": "93fd9007c93fe7430043d8b6682fd46dd0e1d5f9f9b7094fc94ffad2ccdcceeb",
   "global": [
     {
       "name": "json",
@@ -224,12 +224,12 @@ export const CATALOG = {
             {
               "name": "value",
               "type": "string",
-              "summary": "public variable value that must agree with the manifest"
+              "summary": "public variable value that must agree with the manifest; var set ownerValue requires stdin instead"
             },
             {
               "name": "execute",
               "type": "boolean",
-              "summary": "apply the variable sync plan"
+              "summary": "apply the variable sync plan; var sync skips ownerValue variables"
             },
             {
               "name": "json",
@@ -7317,12 +7317,12 @@ export const CATALOG = {
             {
               "name": "dev",
               "type": "boolean",
-              "summary": "save the packages as development dependencies"
+              "summary": "save the CLI and explicit packages as development dependencies"
             },
             {
               "name": "canon",
               "type": "boolean",
-              "summary": "install the target CLI and all of its exact StarCi canon pins"
+              "summary": "install the target CLI and move its declared exact StarCi canon pins"
             }
           ],
           "exit": {
@@ -7353,10 +7353,12 @@ export const CATALOG = {
             "bare package names resolve only from knowledge/hfs/canon-pins.yaml and never through a registry lookup",
             "explicit versions use exact x.y.z form and must agree with the canon pin when one exists, except the target CLI version on a canon upgrade",
             "naming @starci/cli or passing --canon installs the exact target CLI first,",
-            "then reads its installed HFS runtime canon-pins.yaml and installs every pinned @starci package in the same host lock",
+            "then reads its installed HFS runtime canon-pins.yaml and, in the same host lock,",
+            "moves each other pinned @starci package only where a root or workspace package.json declares it, in its own section",
             "--canon without a CLI positional uses the running runtime's exact CLI pin as the target",
             "target pins never fall back to the running runtime when the target pin file is missing or inconsistent",
-            "each target StarCi pin is reported as moved or refused with a reason; a failed canon phase exits nonzero even when the first CLI install succeeded",
+            "each target StarCi pin is reported as moved (with its workspace), skipped when no package.json declares it, or refused with a reason",
+            "a failed canon phase exits nonzero even when the first CLI install succeeded",
             "installs always use --save-exact and report the package.json and package-lock.json diff stat"
           ],
           "runtimeSide": "host"

package/runtime/scripts/hfs/ci-declaration.mjs

@@ -4,6 +4,14 @@ import { parseYaml } from '../../engine/yaml.mjs';
 
 const nameOf = (item) => typeof item === 'string' ? item : item?.name;
 
+/** A public CI variable declares either a manifest value or an owner-supplied value, never both. */
+function variableProblems(item, at, invalid) {
+  const hasValue = item != null && Object.hasOwn(item, 'value');
+  const hasOwnerValue = item != null && Object.hasOwn(item, 'ownerValue');
+  if (hasValue && hasOwnerValue) invalid(at, 'a variable has either a value or ownerValue');
+  else if (!hasValue && item?.ownerValue !== true) invalid(at, 'a variable needs a value or ownerValue: true');
+}
+
 /** Each CI name belongs to one class and scope; declarations contain names and public configuration only. */
 export function readCiDeclaration(doc) {
   const problems = [], seen = new Set();
@@ -17,8 +25,9 @@ export function readCiDeclaration(doc) {
     if (!['repository', 'environment'].includes(scope)) invalid(`${where}.scope`, 'scope must be repository or environment');
     if (scope === 'environment' && (typeof item?.environment !== 'string' || !/^[a-z][a-z0-9-]*$/.test(item.environment))) invalid(`${where}.environment`, 'environment scope requires an environment name');
     if ((dependabot || scope !== 'environment') && item && Object.hasOwn(item, 'environment')) invalid(`${where}.environment`, 'only environment scope may name an environment');
+    if (variable) variableProblems(item, where, invalid);
     return { name, scope, environment: item?.environment ?? null, purpose: item?.purpose ?? null,
-      optional: item?.optional === true, ...(variable ? { value: item?.value } : {}) };
+      optional: item?.optional === true, ...(variable ? { value: item?.value, ownerValue: item?.ownerValue === true } : {}) };
   });
   const ci = doc?.ci;
   const secrets = normalize(ci?.secrets, 'ci.secrets');

package/runtime/scripts/hfs/rules/secrets.mjs

@@ -7,7 +7,7 @@
 // A finding names the file, the line and the pattern, never the value.
 import fs from 'node:fs';
 import path from 'node:path';
-import { FORBIDDEN_FILES, secretHits } from '../../lib/secret-patterns.mjs';
+import { FORBIDDEN_FILES, secretHitsInFile } from '../../lib/secret-patterns.mjs';
 import { isSopsEnvelope } from '../../lib/sops-envelope.mjs';
 import { found, readText } from './read.mjs';
 
@@ -34,20 +34,17 @@ export function untrackedSecretFindings({ repoRoot, files, repo }) {
  * no sops envelope, or a line that matches a secret pattern. `text` is the file's text, or null when it cannot be read (binary, too
  * large, absent). The whole-tree check reads the work tree and the commit hook (`starci app hygiene`) reads the staged blob: one judgement.
  */
-export function secretFileFindings({ file, text }) {
+export function secretFileFindings({ file, text, manifestText }) {
   const being = FORBIDDEN_FILES.find((rule) => rule.test(file));
   if (being) return [found(PLAINTEXT_SECRET, file, `${file} is a plaintext secret by being (${being.name}); a secret is committed only as a sops envelope at .starcistacks/<env>/secrets/<slug>.enc`, { pattern: being.name })];
   if (text === null || text === undefined || NOT_SCANNED.test(file)) return [];
   if (file.endsWith('.enc')) return isSopsEnvelope(text) ? [] : [found(PLAINTEXT_SECRET, file, `${file} is named like a sealed secret but is not a sops envelope; encrypt the value with sops and commit only the envelope`, { pattern: 'sops-not-envelope' })];
   const findings = [];
-  const lines = text.split(/\r?\n/);
   const seen = new Set();
-  for (const [index, line] of lines.entries()) {
-    for (const pattern of secretHits(file, line)) {
-      if (seen.has(pattern)) continue;
-      seen.add(pattern);
-      findings.push(found(PLAINTEXT_SECRET, file, `${file}:${index + 1} holds a plaintext secret (${pattern}); seal it with sops at .starcistacks/<env>/secrets/<slug>.enc and read it by *_FILE`, { line: index + 1, pattern }));
-    }
+  for (const { line, pattern } of secretHitsInFile(file, text, { manifestText })) {
+    if (seen.has(pattern)) continue;
+    seen.add(pattern);
+    findings.push(found(PLAINTEXT_SECRET, file, `${file}:${line} holds a plaintext secret (${pattern}); seal it with sops at .starcistacks/<env>/secrets/<slug>.enc and read it by *_FILE`, { line, pattern }));
   }
   return findings;
 }
@@ -62,7 +59,8 @@ export function secretFindings({ repoRoot, files, resolver }) {
       findings.push(found(PLAINTEXT_SECRET, file, `${file} is a plaintext secret file tracked in ${slot.slot}${destination}`, { slot: slot.slot, goesTo: slot.goesTo }));
       continue;
     }
-    findings.push(...secretFileFindings({ file, text: readText(repoRoot, file) }));
+    const manifestText = /(?:^|\/)README\.md$/.test(file) ? readText(repoRoot, path.posix.join(path.posix.dirname(file), '.starcistacks/application-stacks.yaml')) : undefined;
+    findings.push(...secretFileFindings({ file, text: readText(repoRoot, file), manifestText }));
   }
   return findings;
 }

package/runtime/scripts/lib/secret-patterns.mjs

@@ -1,3 +1,5 @@
+import { parseYaml } from '../../engine/yaml.mjs';
+
 // secret-patterns.mjs — the one list of secret shapes the runtime refuses to carry: the push secret scan
 // (scripts/supervisor/push-mains.mjs scanDiff) refuses an outgoing range that adds one, and the typed-log
 // redaction (scripts/kernel/typed-logs.mjs redactText) blanks the value before a log row is stored.
@@ -102,3 +104,78 @@ export function secretHits(file, text) {
   }
   return names;
 }
+
+const BADGE_BEGIN = '<!-- >>> starci app sync (managed block; do not edit) >>> -->';
+const BADGE_END = '<!-- <<< starci app sync <<< -->';
+
+/** Provider-shaped credentials remain refused even where the keyword heuristic admits public badge tokens. */
+function blankBadgeValue(value) {
+  return secretHits('badge.mjs', value).length ? value : ' '.repeat(value.length);
+}
+
+/** Only scalar values at the two block-mapping service paths qualify; every other YAML substring remains scanned. */
+function manifestBadgeText(text) {
+  try { parseYaml(text); } catch { return text; }
+  const parents = [];
+  return text.split('\n').map(line => {
+    if (/^\s*(?:#.*)?$/.test(line)) return line;
+    const indent = /^ */.exec(line)[0].length;
+    while (parents.length && parents.at(-1).indent >= indent) parents.pop();
+    const match = /^( *)(?:([A-Za-z0-9_-]+)|"([A-Za-z0-9_-]+)"|'([A-Za-z0-9_-]+)'):(.*)$/.exec(line);
+    if (!match) { parents.push({ indent, key: null }); return line; }
+    match[5] = match[5].trimStart();
+    const key = match[2] ?? match[3] ?? match[4];
+    const keys = [...parents.map(parent => parent.key), key].join('.');
+    const container = /^(?:#.*)?$/.test(match[5].trim());
+    const nestedScalar = parents.some(parent => parent.container === false);
+    parents.push({ indent, key, container });
+    if (nestedScalar) return line;
+    if (!['services.codecov.badgeToken', 'services.sonar.badgeToken'].includes(keys)) return line;
+    const scalar = /^(?:"([A-Za-z0-9_-]{6,128})"|'([A-Za-z0-9_-]{6,128})'|([A-Za-z0-9_-]{6,128}))(?=\s*(?:#|$))/.exec(match[5]);
+    if (!scalar) return line;
+    const start = line.length - match[5].length;
+    return line.slice(0, start) + blankBadgeValue(scalar[0]) + match[5].slice(scalar[0].length);
+  }).join('\n');
+}
+
+/** Unreadable manifests admit only the default badge hosts; readable Sonar declarations select their own hosts. */
+function badgeHosts(manifestText) {
+  const hosts = new Set(['codecov.io']);
+  let doc;
+  try { doc = parseYaml(manifestText); } catch { hosts.add('sonarcloud.io'); return hosts; }
+  const sonar = doc?.services?.sonar;
+  if (sonar?.provider === 'sonarcloud') hosts.add('sonarcloud.io');
+  else for (const host of [sonar?.host?.public, sonar?.host?.local]) {
+    try { hosts.add(new URL(host).host); } catch { /* Invalid hosts admit nothing. */ }
+  }
+  return hosts;
+}
+
+/** Only token query values in managed Markdown badge images on declared hosts are blanked; links and other parameters remain scanned. */
+function readmeBadgeText(text, manifestText) {
+  const begin = text.indexOf(BADGE_BEGIN), end = text.indexOf(BADGE_END, begin + BADGE_BEGIN.length);
+  if (begin < 0 || end < 0) return text;
+  const hosts = badgeHosts(manifestText);
+  const start = begin + BADGE_BEGIN.length;
+  const block = text.slice(start, end).replace(/!\[[^\]\n]*\]\((https?:\/\/[^\s)]+)\)/g, (image, address) => {
+    let url;
+    try { url = new URL(address); } catch { return image; }
+    if (!hosts.has(url.host) || url.username || url.password) return image;
+    const badgePath = url.host === 'codecov.io' ? /\/graph\/badge\.svg$/.test(url.pathname) : url.pathname === '/api/project_badges/measure';
+    if (!badgePath) return image;
+    const fragment = address.indexOf('#');
+    const queryEnd = fragment < 0 ? address.length : fragment;
+    const safe = address.slice(0, queryEnd).replace(/([?&]token=)([^&#)\s]*)/g, (_, prefix, value) => prefix + blankBadgeValue(value));
+    return image.replace(address, () => safe + address.slice(queryEnd));
+  });
+  return text.slice(0, start) + block + text.slice(end);
+}
+
+/** Whole-file secret judgement exempts only declared public badge values and preserves original line numbers and every provider shape. */
+export function secretHitsInFile(file, fullText, { manifestText } = {}) {
+  const normalized = file.replace(/\\/g, '/');
+  let text = fullText;
+  if (/(?:^|\/)\.starcistacks\/application-stacks\.yaml$/.test(normalized)) text = manifestBadgeText(text);
+  if (/(?:^|\/)README\.md$/.test(normalized)) text = readmeBadgeText(text, manifestText);
+  return text.split(/\r?\n/).flatMap((line, index) => secretHits(file, line).map(pattern => ({ line: index + 1, pattern })));
+}

package/scaffold/app.mjs

@@ -222,7 +222,7 @@ const FE_PACKAGES = Object.freeze({
 const PACKAGE_WORKSPACE_SCRIPTS = Object.freeze({ build: 'tsc -p tsconfig.build.json', lint: WORKSPACE_LINT, typecheck: 'tsc --noEmit -p tsconfig.json' });
 
 /** The app hfs.json of a new app called `name`; full remains the byte-for-byte default declaration. */
-const starterDeclaration = (name, manifest = loadSlotManifest(), edition = 'full') => ({
+export const starterDeclaration = (name, manifest = loadSlotManifest(), edition = 'full') => ({
   hfs: manifest.major,
   kind: 'app',
   ...(edition === 'full' ? {} : { edition }),
@@ -493,7 +493,7 @@ export function scaffoldWorkSeeds(project) {
  * be side (once per product app of the fe side, coreFeApps), the be `apps/cli/` folder once when the cli app is declared, an fe `apps/<name>/` folder
  * once for the declared fe app <name> (none other), `__project__` in a path replaced by the project name.
  */
-function skeletonOf(scope, app, vars) {
+export function skeletonOf(scope, app, vars) {
   const files = app.edition === 'lite'
     ? [...skeletonDirectory(scope, 'skeleton', app, vars, rel => liteBaseFile(scope, rel)), ...skeletonDirectory(scope, 'skeleton-lite', app, vars, rel => liteOverlayFile(scope, rel))]
     : skeletonDirectory(scope, 'skeleton', app, vars);

package/sync/ci-commands.mjs

@@ -131,7 +131,7 @@ function sonarJob(sonar, lcovReport, lcovArtifact, nodeMajor) {
     .replaceAll('{{nodeMajor}}', nodeMajor)
     .replace('{{sonarJobHeader}}', () => header)
     .replace('{{sonarJobSteps}}', () => steps)
-    .trimEnd();
+    .trimEnd() + '\n';
 }
 
 /** The app source reader is be-relative; the authored manifest lives one directory above that side. */
@@ -158,29 +158,64 @@ function mergeBuildValues(values, entries) {
   }
 }
 
-/** CI builds render only plain values from the images.yml environment plus the explicit build-fe gate; sealed members stay unopened. */
-function buildEnv(source) {
+/** Image values own their keys; the build-fe gate supplies only missing keys, and sealed members stay unopened. */
+function imageBuildEnv(image, gates) {
+  const values = new Map();
+  mergeBuildValues(values, image?.buildArgs?.values);
+  const fallback = new Map();
+  for (const gate of gates.filter(entry => entry.name === 'build-fe')) mergeBuildValues(fallback, gate.env);
+  for (const [key, value] of fallback) if (!values.has(key)) values.set(key, value);
+  if (!values.size) return '';
+  return ['        env:', ...[...values.keys()].sort(byCodeUnit).map(key => '          ' + key + ': ' + JSON.stringify(values.get(key)))].join('\n');
+}
+
+/** Multiple deployed front ends build separately through the installed turbo (a run step has no node_modules/.bin on PATH), so each fe/apps/<app> and its dependencies see its own public values. */
+function frontendBuild(source, app) {
   const declaration = buildDeclaration(source);
   const environments = Object.keys(source?.stack?.imageEnvironments ?? {});
   const environment = environments.length > 1 ? 'production' : environments[0];
-  const images = declaration.environments?.[environment]?.deploy?.images ?? {};
-  const values = new Map();
-  for (const image of Object.values(images)) mergeBuildValues(values, image?.buildArgs?.values);
+  const images = Object.values(declaration.environments?.[environment]?.deploy?.images ?? {});
+  const frontend = images.filter(image => app?.sides.fe.apps.some(entry => entry.name === image.app));
   const gates = declaration.release?.gates ?? [];
-  for (const gate of gates.filter(entry => entry.name === 'build-fe')) mergeBuildValues(values, gate.env);
-  if (!values.size) return '';
-  return ['        env:', ...[...values.keys()].sort(byCodeUnit).map(key => '          ' + key + ': ' + JSON.stringify(values.get(key)))].join('\n');
+  const singleEnv = imageBuildEnv(frontend[0], gates);
+  if (frontend.length <= 1) return { env: singleEnv, steps: ['      - name: build fe', '        run: npm run build:fe', singleEnv].filter(Boolean).join('\n') };
+  const steps = frontend.map(image => [
+    '      - name: build fe ' + image.app,
+    '        run: npm run codegen --silent && npx --no-install turbo run build --filter=./fe/apps/' + image.app,
+    imageBuildEnv(image, gates),
+  ].filter(Boolean).join('\n')).join('\n');
+  return { env: singleEnv, steps };
+}
+
+/** Side lint reports join into the single Sonar artifact even when one side could not write its report. */
+function sonarMergeSteps() {
+  return [
+    '      - name: merge Sonar lint reports',
+    "        if: always() && env.SONAR_TOKEN != ''",
+    '        run: |',
+    "          node --input-type=module <<'NODE'",
+    "          import fs from 'node:fs';",
+    "          const files = ['reports/lint.be.sonar.json', 'reports/lint.fe.sonar.json'];",
+    "          const reports = files.filter(file => fs.existsSync(file)).map(file => JSON.parse(fs.readFileSync(file, 'utf8')));",
+    '          const rules = [...new Map(reports.flatMap(report => report.rules).map(rule => [rule.id, rule])).values()];',
+    '          const issues = reports.flatMap(report => report.issues);',
+    "          fs.mkdirSync('reports', { recursive: true });",
+    "          fs.writeFileSync('reports/lint.sonar.json', JSON.stringify({ rules, issues }, null, 2) + '\\n');",
+    '          NODE',
+  ];
 }
 
 /** An omitted quality declaration preserves hosted Sonar, required OIDC Codecov, and the high production dependency audit. */
-export function ciWorkflowCommands(source, lcovReport = 'be/coverage/lcov.info', quality = undefined, { nodeMajor = '22' } = {}) {
+export function ciWorkflowCommands(source, lcovReport = 'be/coverage/lcov.info', quality = undefined, { nodeMajor = '22', app } = {}) {
   const configuredSonar = quality === undefined ? { token: 'SONAR_TOKEN', hostVar: 'SONAR_HOST_URL' } : quality.sonar;
   const sonar = configuredSonar?.wiring === 'not-used' || configuredSonar?.mode === 'disabled' ? null : configuredSonar;
   const codecov = quality?.codecov ?? { enabled: true, auth: 'oidc' };
   const audit = quality?.audit ?? { level: 'high', omitDev: true };
   const lcovArtifact = 'coverage-lcov';
+  const build = frontendBuild(source, app);
   return {
-    ciBuildEnv: buildEnv(source),
+    ciBuildEnv: build.env,
+    ciBuildSteps: build.steps,
     ciLint: exampleCommand(source, 'npm run lint'),
     ciLintSonar: exampleCommand(source, 'npm run lint -- --sonar reports/lint.sonar.json'),
     ciCoverageProof: exampleCommand(source, 'npx starci app check --coverage-from ' + lcovReport),
@@ -198,11 +233,14 @@ export function ciWorkflowCommands(source, lcovReport = 'be/coverage/lcov.info',
         '          NODE_OPTIONS: --max-old-space-size=6144',
       ]),
       ...(sonar ? [
-        '      - name: lint with Sonar import',
-        "        if: env.SONAR_TOKEN != ''",
-        `        run: ${exampleCommand(source, 'npm run lint -- --sonar reports/lint.sonar.json')}`,
-        '        env:',
-        '          NODE_OPTIONS: --max-old-space-size=6144',
+        ...['be', 'fe'].flatMap((side) => [
+          '      - name: lint ' + side + ' with Sonar import',
+          "        if: env.SONAR_TOKEN != ''",
+          `        run: ${exampleCommand(source, 'npm run lint -- --side ' + side + ' --sonar reports/lint.' + side + '.sonar.json')}`,
+          '        env:',
+          '          NODE_OPTIONS: --max-old-space-size=6144',
+        ]),
+        ...sonarMergeSteps(),
         `      - uses: ${UPLOAD_ARTIFACT}`,
         "        if: always() && env.SONAR_TOKEN != '' && hashFiles('reports/lint.sonar.json') != ''",
         '        with:',

package/sync/hygiene.mjs

@@ -79,7 +79,10 @@ function stagedText(cwd, file) {
 
 /** The secret findings of `files` read from the index, as {file, code, message}; a file the name check already refused is not reported twice. */
 function secretGuardFindings(cwd, files, alreadyRefused = new Set()) {
-  return files.filter(file => !alreadyRefused.has(file)).flatMap(file => secretFileFindings({ file, text: stagedText(cwd, file) }).map(finding => ({ file, code: finding.code, message: finding.message })));
+  return files.filter(file => !alreadyRefused.has(file)).flatMap(file => {
+    const manifestText = /(?:^|\/)README\.md$/.test(file) ? stagedText(cwd, path.posix.join(path.posix.dirname(file), '.starcistacks/application-stacks.yaml')) ?? undefined : undefined;
+    return secretFileFindings({ file, text: stagedText(cwd, file), manifestText }).map(finding => ({ file, code: finding.code, message: finding.message }));
+  });
 }
 
 /** Findings for `files`: the guarded trees, then the secret guard over every file. */

package/sync/index.mjs

@@ -128,11 +128,12 @@ function readBundled(name) {
 
 /**
  * Fill `{{name}}` from vars and expand `{{> partial}}` lines. A partial line may be written as a line comment (`// {{> partial}}`)
- * so a JavaScript template stays valid source before rendering. An unknown name is an error, never an empty string.
+ * so a JavaScript template stays valid source before rendering. Empty variable-only lines disappear; an unknown name is an error.
  */
 export function render(text, vars, readTemplate = readBundled) {
   const withPartials = text.replace(/^(?:\/\/ )?\{\{> ([\w./-]+)\}\}\n/gm, (_, name) => trailingNewline(render(readTemplate(name), vars, readTemplate)));
-  return withPartials.replace(/\{\{([A-Za-z]\w*)\}\}/g, (_, key) => {
+  const presentLines = withPartials.replace(/^[ \t]*\{\{([A-Za-z]\w*)\}\}[ \t]*(?:\n|$)/gm, (line, key) => vars[key] === '' ? '' : line);
+  return presentLines.replace(/\{\{([A-Za-z]\w*)\}\}/g, (_, key) => {
     if (!Object.hasOwn(vars, key)) throw new SyncError('HFS_SYNC_TEMPLATE_VARIABLE', `template names {{${key}}}, which sync does not provide`);
     return vars[key];
   });
@@ -169,7 +170,7 @@ const SOURCE_SKIPPED = new Set(['node_modules', 'dist', 'coverage']);
  * lite brand tree exists, so sync can preserve its absence. `hasImage` identifies authored optional Dockerfiles without reading
  * their content. An app with no be folder has no source files.
  */
-export function appSource(root, { parseYaml } = {}) {
+export function appSource(root, { parseYaml, notices } = {}) {
   const files = [];
   const walk = dir => {
     let entries;
@@ -183,7 +184,7 @@ export function appSource(root, { parseYaml } = {}) {
   return { runtimeExample: isRuntimeExampleApp(root), files: files.sort(byCodeUnit), read: file => fs.readFileSync(path.join(root, 'be', file), 'utf8'),
     workPresent: fs.existsSync(path.join(root, '.starciwork')), hasImage: file => isFile(path.join(root, file), { followLinks: false }),
     stack: readDeclaredStack(root, { parseYaml }), quality: readDeclaredQuality(root, { parseYaml }),
-    badges: readDeclaredBadges(root, { parseYaml }),
+    badges: readDeclaredBadges(root, { parseYaml, notices }),
     qualityDeclared: hasDeclaredServices(root, { parseYaml }) };
 }
 
@@ -323,7 +324,7 @@ export function variables(app, scope, presets, sonarKey, manifest = loadSlotMani
     sonarExclusions: [presets?.sonarExclusions, '**/.next/**', '**/node_modules/**', '**/src/messages/**', ...(lite ? ['supabase/types/**'] : [])].filter(Boolean).join(','),
     sonarSources: ['be/apps', 'be/src', 'fe/apps', ...(packages ? ['fe/packages'] : [])].join(','),
     lcovReport: LCOV_REPORT,
-    ...ciWorkflowCommands(source, LCOV_REPORT, source.qualityDeclared === false ? undefined : source.quality),
+    ...ciWorkflowCommands(source, LCOV_REPORT, source.qualityDeclared === false ? undefined : source.quality, { app }),
     // The coverage scope is the same in both editions: lite measures exactly what full measures (ruling:R212/case-1, amended by ruling:R212/case-4).
     jestCoverage: scope === 'be' ? jestCoverageSource(jestCoverage(manifest, providers)) : '',
     coverageExclusions: scope === APP_SCOPE ? sonarCoverageExclusions(manifest, providers).join(',') : '',
@@ -370,7 +371,7 @@ export function renderTargets(hfs, presets, { sonarKey, readTemplate = readBundl
       const template = target.path === 'codecov.yml' && source?.quality?.codecov.enabled === false
         ? '{{header}}\n# Codecov is disabled in the manifest.\ncodecov:\n  require_ci_to_pass: false\n'
         : readTemplate(target.template);
-      const body = render(template, vars, readTemplate);
+      const body = trailingNewline(render(template, vars, readTemplate));
       const where = onSide(scope, target.path);
       if (target.mode === 'scripts') {
         const scripts = parseScripts(body);
@@ -429,8 +430,8 @@ function insertAfterTitle(existing, content) {
   return `${heading}\n${content}${existing.slice(end)}`;
 }
 
-/** Rewrite the missing or drifted targets; returns the paths written. */
-function writtenContent(target, existing) {
+/** Apply exactly one target to its whole file while preserving content outside the managed block or scripts. */
+export function writtenContent(target, existing) {
   if (target.mode === 'scripts') {
     let pkg = {};
     if (existing) {
@@ -477,10 +478,10 @@ export function loadHfs(root, manifest = loadSlotManifest()) {
 }
 
 /** The rendered targets of the app at `root`: its hfs.json, the Sonar key the be side's stack declaration names, the presets it installs. */
-export async function renderRepo(root, { presets, parseYaml, manifest = loadSlotManifest() } = {}) {
+export async function renderRepo(root, { presets, parseYaml, notices, manifest = loadSlotManifest() } = {}) {
   const hfs = loadHfs(root, manifest);
   const sonarKey = await readDeclaredSonarKey(root, { parseYaml, fail: message => { throw new SyncError('HFS_SYNC_SONAR_KEY', message); } });
-  return { hfs, targets: renderTargets(hfs, presets ?? await loadPresets(root), { sonarKey, manifest, source: appSource(root, { parseYaml }) }) };
+  return { hfs, targets: renderTargets(hfs, presets ?? await loadPresets(root), { sonarKey, manifest, source: appSource(root, { parseYaml, notices }) }) };
 }
 
 /** `starci app sync --check | --write [--cwd <dir>]` at the app root; returns 0 clean, 1 drift, 2 usage. */
@@ -516,7 +517,9 @@ export async function runSync(argv, { cwd = process.cwd(), out = line => process
   const { write, cwdAt } = options;
   const root = cwdAt >= 0 ? path.resolve(cwd, argv[cwdAt + 1]) : cwd;
   try {
-    const { targets } = await renderRepo(root, { presets, parseYaml });
+    const notices = [];
+    const { targets } = await renderRepo(root, { presets, parseYaml, notices });
+    if (targets.some(target => target.path === 'README.md')) for (const notice of new Set(notices)) out(notice);
     if (write) {
       const written = writeTargets(root, targets);
       for (const file of written) out(`wrote ${file}`);

package/sync/quality-services.mjs

@@ -3,7 +3,7 @@ import path from 'node:path';
 import { parseYaml as bundledParseYaml } from '../runtime/engine/yaml.mjs';
 import { qualityServices } from '../runtime/scripts/hfs/ci-declaration.mjs';
 import { isRuntimeExampleApp } from '../runtime/scripts/lib/runtime-example.mjs';
-import { renderReadmeBadges } from './readme-badges.mjs';
+import { badgeTokenNotices, renderReadmeBadges } from './readme-badges.mjs';
 import { DECLARATION } from './sonar-key.mjs';
 
 /** Apps without any service block retain the legacy CI defaults until they declare their services. */
@@ -35,8 +35,8 @@ export function sonarHostLine(sonar) {
 
 /** Dependabot groups minor and patch updates while majors remain per package; security updates have their own immediate group. */
 export function dependabotUpdates(dependabot) {
-  if (!dependabot.ecosystems.length) return '  []';
-  return dependabot.ecosystems.map(ecosystem => [
+  if (!dependabot.ecosystems.length) return ' []';
+  return '\n' + dependabot.ecosystems.map(ecosystem => [
     `  - package-ecosystem: ${ecosystem}`,
     ...(ecosystem === 'docker' ? ['    directories:', '      - /be/apps/*', '      - /fe/apps/*'] : ['    directory: /']),
     '    schedule:',
@@ -53,9 +53,11 @@ export function dependabotUpdates(dependabot) {
 }
 
 /** README badges use only public manifest fields and the package repository fallback. */
-export function readDeclaredBadges(root, { parseYaml = bundledParseYaml } = {}) {
+export function readDeclaredBadges(root, { parseYaml = bundledParseYaml, notices } = {}) {
   let doc = {}, pkg = {};
   try { doc = parseYaml(fs.readFileSync(path.join(root, DECLARATION), 'utf8')); } catch { /* No declaration. */ }
   try { pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')); } catch { /* No repository fallback. */ }
-  return renderReadmeBadges(doc, { repository: pkg.repository, example: isRuntimeExampleApp(root) });
+  const options = { repository: pkg.repository, example: isRuntimeExampleApp(root) };
+  notices?.push(...badgeTokenNotices(doc, options));
+  return renderReadmeBadges(doc, options);
 }

package/sync/readme-badges.mjs

@@ -7,6 +7,9 @@ function githubRepository(repository) {
   return (match?.[1] ?? match?.[2] ?? '').replace(/\.git$/, '');
 }
 
+/** Notice code (never an error) of a private repository badge rendered without its read-only badge token. */
+const BADGE_TOKEN_NOTICE = 'README_BADGE_TOKEN_MISSING';
+
 const badge = (name, image, link) => `[![${name}](${image})](${link})`;
 
 /** Render live CI, coverage, quality gate and Dependabot badges only when a GitHub repository is declared or inferable; no network is used. */
@@ -20,7 +23,10 @@ export function renderReadmeBadges(doc, { repository, example = false } = {}) {
   const quality = qualityServices(doc, { example });
   const lines = [badge('CI', `${base}/actions/workflows/${workflow}/badge.svg?branch=${branch}`, `${base}/actions/workflows/${workflow}`)];
   if (quality.codecov.enabled) {
-    const flag = quality.codecov.flag ? `?flag=${encodeURIComponent(quality.codecov.flag)}` : '';
+    const params = [];
+    if (quality.codecov.flag) params.push(`flag=${encodeURIComponent(quality.codecov.flag)}`);
+    if (doc?.services?.codecov?.badgeToken) params.push(`token=${encodeURIComponent(doc.services.codecov.badgeToken)}`);
+    const flag = params.length ? `?${params.join('&')}` : '';
     lines.push(badge('Codecov', `https://codecov.io/gh/${repo}/branch/${branch}/graph/badge.svg${flag}`, `https://codecov.io/gh/${repo}`));
   }
   const sonar = sonarBadge(doc, quality.sonar, example);
@@ -40,5 +46,15 @@ function sonarBadge(doc, sonar, example) {
   const organization = sonar.organization ?? doc?.ci?.vars?.find(entry => entry.name === sonar.organizationVar)?.value;
   const prefix = example && organization ? `${organization}_` : '';
   const key = encodeURIComponent(prefix + sonar.projectKey);
-  return badge('Quality Gate', `${host}/api/project_badges/measure?project=${key}&metric=alert_status`, `${host}/dashboard?id=${key}`);
+  const token = doc?.services?.sonar?.badgeToken ? `&token=${encodeURIComponent(doc.services.sonar.badgeToken)}` : '';
+  return badge('Quality Gate', `${host}/api/project_badges/measure?project=${key}&metric=alert_status${token}`, `${host}/dashboard?id=${key}`);
+}
+
+/** Private repositories need public-safe badge tokens only for badges the renderer actually emits; examples never receive notices. */
+export function badgeTokenNotices(doc, { example = false, repository } = {}) {
+  if (example || doc?.ci?.github?.visibility !== 'private') return [];
+  const rendered = renderReadmeBadges(doc, { example, repository });
+  return [['codecov', 'Codecov', 'Codecov'], ['sonar', 'Sonar', 'Quality Gate']]
+    .filter(([id, , label]) => !doc?.services?.[id]?.badgeToken && rendered.includes(`[![${label}](`))
+    .map(([id, name]) => `${BADGE_TOKEN_NOTICE} notice: the ${name} badge of a private repository renders "unknown" without services.${id}.badgeToken (a read-only badge token, not a CI secret)`);
 }

package/sync/stack-images.mjs

@@ -71,6 +71,11 @@ export function readDeclaredStack(root, { parseYaml = bundledParseYaml } = {}) {
   } catch {
     return { images: [], passEnv: [] };
   }
+  return declaredStack(declaration);
+}
+
+/** Parsed declarations share the exact image, environment and pass-env projection used by sync. */
+export function declaredStack(declaration) {
   return { images: declaredStackImages(declaration), passEnv: declaredPassEnv(declaration), imageEnvironments: imageEnvironments(declaration) };
 }
 

package/templates/app/ci-workflows/github/workflows/ci.yml

@@ -44,6 +44,8 @@ jobs:
         run: npm test -- --ci --forceExit --cacheDirectory .jest-cache
       - name: coverage proof
         run: {{ciCoverageProof}}
+        env:
+          NODE_OPTIONS: --max-old-space-size=6144
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always() && hashFiles('{{lcovReport}}') != ''
         with:
@@ -58,8 +60,6 @@ jobs:
 {{> app/ci-workflows/install-steps.yml}}
       - name: build be
         run: npm run build:be
-      - name: build fe
-        run: npm run build:fe
-{{ciBuildEnv}}
+{{ciBuildSteps}}
 
 {{sonarJob}}

package/templates/app/ci-workflows-lite/github/workflows/ci.yml

@@ -44,6 +44,8 @@ jobs:
         run: npm test -- --ci --forceExit --cacheDirectory .jest-cache
       - name: coverage proof
         run: {{ciCoverageProof}}
+        env:
+          NODE_OPTIONS: --max-old-space-size=6144
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always() && hashFiles('{{lcovReport}}') != ''
         with:
@@ -58,14 +60,11 @@ jobs:
 {{> app/ci-workflows/install-steps.yml}}
       - name: build be
         run: npm run build:be
-      - name: build fe
-        run: npm run build:fe
-{{ciBuildEnv}}
+{{ciBuildSteps}}
       - name: database migration checks
         run: {{ciDatabaseLint}}
 
 {{sonarJob}}
-
   db-types:
     timeout-minutes: 30
     runs-on: ubuntu-latest

package/templates/app/skeleton/.github/dependabot.yml

@@ -1,4 +1,3 @@
 {{header}}
 version: 2
-updates:
-{{dependabotUpdates}}
+updates:{{dependabotUpdates}}

package/templates/app/skeleton-lite/.github/dependabot.yml

@@ -1,4 +1,3 @@
 {{header}}
 version: 2
-updates:
-{{dependabotUpdates}}
+updates:{{dependabotUpdates}}