@usequark/quark-create-app 1.24.0 → 1.24.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usequark/quark-create-app",
-  "version": "1.24.0",
+  "version": "1.24.1",
   "description": "CLI to scaffold new Quark projects with Next.js, Prisma, BullMQ, and Railway deployment",
   "keywords": [
     "quark",

package/src/index.js

@@ -9,6 +9,7 @@ import { Command } from "commander";
 import { execa } from "execa";
 import fs from "fs-extra";
 import prompts from "prompts";
+import { SCAFFOLD_GITIGNORE } from "./scaffold-gitignore.js";
 import { findEnclosingGitRepo, formatProjectDisplayName } from "./utils.js";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -117,6 +118,17 @@ async function copyTemplate(templateName, targetDir, variables = {}) {
 	// Copy the template
 	await fs.copy(templatePath, targetDir);
 
+	// npm strips every .gitignore from published tarballs, so a CLI installed
+	// from npm never has this file in its templates - only a git checkout does.
+	// Written from the shared module so both paths produce the same result, and
+	// skipped when the copy already provided one so a real template file always
+	// wins. Without this, a scaffolded project gets `git init` and no ignore
+	// rules, so the first `git add .` stages node_modules, .next and .env.
+	const gitignorePath = path.join(targetDir, ".gitignore");
+	if (!(await fs.pathExists(gitignorePath))) {
+		await fs.writeFile(gitignorePath, SCAFFOLD_GITIGNORE);
+	}
+
 	// Replace variables in package.json files
 	if (Object.keys(variables).length > 0) {
 		const packageJsonPath = path.join(targetDir, "package.json");

package/src/scaffold-gitignore.js

@@ -0,0 +1,54 @@
+/**
+ * .gitignore content for scaffolded projects.
+ *
+ * This lives in a module rather than only as `base-project/.gitignore` because
+ * **npm strips every `.gitignore` out of published tarballs**, unconditionally,
+ * with no opt-out. The template copy of the file therefore never reaches anyone
+ * installing `@usequark/quark-create-app` from npm - only someone running the CLI
+ * from a git checkout sees it. Scaffolded projects were consequently shipping
+ * with no `.gitignore` at all, while `.dockerignore`, `.nvmrc` and `.env.example`
+ * all arrived normally, because npm strips only `.gitignore` and `.npmrc`.
+ *
+ * That matters: the scaffolder runs `git init`, so the first `git add .` in a
+ * generated project would stage `node_modules/`, `.next/`, and `.env` - which
+ * `scripts/prepare.js` populates with real credentials.
+ *
+ * `generate-templates.js` writes the in-repo copy from this same export, so the
+ * file a contributor sees and the file a user gets cannot drift apart.
+ */
+export const SCAFFOLD_GITIGNORE_ENTRIES = [
+	"# dependencies",
+	"node_modules/",
+	"",
+	"# environment",
+	".env",
+	".env.local",
+	".env.*.local",
+	"",
+	"# next.js",
+	".next/",
+	"out/",
+	"",
+	"# build artifacts",
+	"dist/",
+	"build/",
+	"",
+	"# testing",
+	"coverage/",
+	"",
+	"# misc",
+	".DS_Store",
+	"*.log",
+	".quark-auto-clean.json",
+	"",
+	"# turbo",
+	".turbo/",
+	"",
+	"# prisma",
+	"packages/db/src/generated/",
+	"",
+	"# uploads",
+	"**/uploads/",
+];
+
+export const SCAFFOLD_GITIGNORE = `${SCAFFOLD_GITIGNORE_ENTRIES.join("\n")}\n`;

package/templates/base-project/.github/dependabot.yml

@@ -29,3 +29,23 @@ updates:
         update-types: ["patch"]
 
     open-pull-requests-limit: 10
+
+  # Keep workflow actions current. Without this block nothing tracks the `uses:`
+  # pins, and an action that drops to a deprecated runtime only ever shows up as
+  # a log annotation — never as a failing check — so scaffolded projects
+  # silently accumulate stale pins. Majors get their own PR because action
+  # majors can change runtime or drop inputs.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions-majors:
+        update-types: ["major"]
+      actions-minor:
+        update-types: ["minor"]
+      actions-patch:
+        update-types: ["patch"]
+    commit-message:
+      prefix: "deps(actions)"
+    open-pull-requests-limit: 4

package/templates/base-project/.github/workflows/ci.yml

@@ -25,11 +25,11 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 24
           cache: pnpm
@@ -77,11 +77,11 @@ jobs:
       NEXTAUTH_SECRET: ci-test-secret-must-be-at-least-32-characters-long
       NODE_ENV: test
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 24
           cache: pnpm
@@ -98,11 +98,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 24
           cache: pnpm

package/templates/base-project/.github/workflows/dependabot-auto-merge.yml

@@ -11,7 +11,7 @@ jobs:
     if: github.actor == 'dependabot[bot]'
     runs-on: ubuntu-latest
     steps:
-      - uses: dependabot/fetch-metadata@v2
+      - uses: dependabot/fetch-metadata@v3
         id: meta
 
       - name: Auto-merge patch updates

package/templates/base-project/.github/workflows/install-windows.yml

@@ -15,11 +15,11 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 24
           cache: pnpm

package/templates/base-project/.github/workflows/release.yml

@@ -19,7 +19,7 @@ jobs:
     name: Tag & Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: main
           fetch-depth: 0
@@ -60,7 +60,7 @@ jobs:
           git push origin "${{ steps.tag.outputs.tag }}"
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ steps.tag.outputs.tag }}
           generate_release_notes: true