@usequark/quark-create-app 1.24.0 → 1.24.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usequark/quark-create-app",
-  "version": "1.24.0",
+  "version": "1.24.2",
   "description": "CLI to scaffold new Quark projects with Next.js, Prisma, BullMQ, and Railway deployment",
   "keywords": [
     "quark",
@@ -56,7 +56,7 @@
     "sync-templates:check": "node scripts/sync-templates.js --check",
     "regen-migration": "node scripts/regenerate-template-migration.js",
     "smoke:published": "node scripts/smoke-published.js",
-    "test": "node test-cli.js && node --test src/utils.test.js && node --test src/prepare-hooks.test.js && node --test src/scaffold-output.test.js && node --test src/template-scripts.test.js && node --test src/scaffold-guards.test.js && node --test src/worker-dockerfile.test.js && node --test src/dependabot-config.test.js && node --test 'src/deploy/**/*.test.js' && node --test --test-concurrency=1 'src/deploy/**/*.integration.test.js'",
+    "test": "node test-cli.js && node --test src/utils.test.js && node --test src/prepare-hooks.test.js && node --test src/scaffold-output.test.js && node --test src/template-scripts.test.js && node --test src/scaffold-guards.test.js && node --test src/template-config.test.js && node --test src/worker-dockerfile.test.js && node --test src/dependabot-config.test.js && node --test 'src/deploy/**/*.test.js' && node --test --test-concurrency=1 'src/deploy/**/*.integration.test.js'",
     "test:build": "node test-build.js",
     "test:e2e": "node test-e2e.js",
     "test:e2e:full": "node test-e2e-full.js",

package/src/index.js

@@ -9,6 +9,7 @@ import { Command } from "commander";
 import { execa } from "execa";
 import fs from "fs-extra";
 import prompts from "prompts";
+import { SCAFFOLD_GITIGNORE } from "./scaffold-gitignore.js";
 import { findEnclosingGitRepo, formatProjectDisplayName } from "./utils.js";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -117,6 +118,17 @@ async function copyTemplate(templateName, targetDir, variables = {}) {
 	// Copy the template
 	await fs.copy(templatePath, targetDir);
 
+	// npm strips every .gitignore from published tarballs, so a CLI installed
+	// from npm never has this file in its templates - only a git checkout does.
+	// Written from the shared module so both paths produce the same result, and
+	// skipped when the copy already provided one so a real template file always
+	// wins. Without this, a scaffolded project gets `git init` and no ignore
+	// rules, so the first `git add .` stages node_modules, .next and .env.
+	const gitignorePath = path.join(targetDir, ".gitignore");
+	if (!(await fs.pathExists(gitignorePath))) {
+		await fs.writeFile(gitignorePath, SCAFFOLD_GITIGNORE);
+	}
+
 	// Replace variables in package.json files
 	if (Object.keys(variables).length > 0) {
 		const packageJsonPath = path.join(targetDir, "package.json");

package/src/scaffold-gitignore.js

@@ -0,0 +1,54 @@
+/**
+ * .gitignore content for scaffolded projects.
+ *
+ * This lives in a module rather than only as `base-project/.gitignore` because
+ * **npm strips every `.gitignore` out of published tarballs**, unconditionally,
+ * with no opt-out. The template copy of the file therefore never reaches anyone
+ * installing `@usequark/quark-create-app` from npm - only someone running the CLI
+ * from a git checkout sees it. Scaffolded projects were consequently shipping
+ * with no `.gitignore` at all, while `.dockerignore`, `.nvmrc` and `.env.example`
+ * all arrived normally, because npm strips only `.gitignore` and `.npmrc`.
+ *
+ * That matters: the scaffolder runs `git init`, so the first `git add .` in a
+ * generated project would stage `node_modules/`, `.next/`, and `.env` - which
+ * `scripts/prepare.js` populates with real credentials.
+ *
+ * `generate-templates.js` writes the in-repo copy from this same export, so the
+ * file a contributor sees and the file a user gets cannot drift apart.
+ */
+export const SCAFFOLD_GITIGNORE_ENTRIES = [
+	"# dependencies",
+	"node_modules/",
+	"",
+	"# environment",
+	".env",
+	".env.local",
+	".env.*.local",
+	"",
+	"# next.js",
+	".next/",
+	"out/",
+	"",
+	"# build artifacts",
+	"dist/",
+	"build/",
+	"",
+	"# testing",
+	"coverage/",
+	"",
+	"# misc",
+	".DS_Store",
+	"*.log",
+	".quark-auto-clean.json",
+	"",
+	"# turbo",
+	".turbo/",
+	"",
+	"# prisma",
+	"packages/db/src/generated/",
+	"",
+	"# uploads",
+	"**/uploads/",
+];
+
+export const SCAFFOLD_GITIGNORE = `${SCAFFOLD_GITIGNORE_ENTRIES.join("\n")}\n`;

package/templates/base-project/.github/dependabot.yml

@@ -29,3 +29,23 @@ updates:
         update-types: ["patch"]
 
     open-pull-requests-limit: 10
+
+  # Keep workflow actions current. Without this block nothing tracks the `uses:`
+  # pins, and an action that drops to a deprecated runtime only ever shows up as
+  # a log annotation — never as a failing check — so scaffolded projects
+  # silently accumulate stale pins. Majors get their own PR because action
+  # majors can change runtime or drop inputs.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions-majors:
+        update-types: ["major"]
+      actions-minor:
+        update-types: ["minor"]
+      actions-patch:
+        update-types: ["patch"]
+    commit-message:
+      prefix: "deps(actions)"
+    open-pull-requests-limit: 4

package/templates/base-project/.github/workflows/ci.yml

@@ -25,11 +25,11 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 24
           cache: pnpm
@@ -77,11 +77,11 @@ jobs:
       NEXTAUTH_SECRET: ci-test-secret-must-be-at-least-32-characters-long
       NODE_ENV: test
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 24
           cache: pnpm
@@ -98,11 +98,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 24
           cache: pnpm

package/templates/base-project/.github/workflows/dependabot-auto-merge.yml

@@ -11,7 +11,7 @@ jobs:
     if: github.actor == 'dependabot[bot]'
     runs-on: ubuntu-latest
     steps:
-      - uses: dependabot/fetch-metadata@v2
+      - uses: dependabot/fetch-metadata@v3
         id: meta
 
       - name: Auto-merge patch updates

package/templates/base-project/.github/workflows/install-windows.yml

@@ -15,11 +15,11 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v6
         with:
           node-version: 24
           cache: pnpm

package/templates/base-project/.github/workflows/release.yml

@@ -19,7 +19,7 @@ jobs:
     name: Tag & Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: main
           fetch-depth: 0
@@ -60,7 +60,7 @@ jobs:
           git push origin "${{ steps.tag.outputs.tag }}"
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ steps.tag.outputs.tag }}
           generate_release_notes: true

package/templates/base-project/biome.json

@@ -47,6 +47,5 @@
 				"organizeImports": "on"
 			}
 		}
-	},
-	"root": false
+	}
 }

package/templates/worker/src/index.js

@@ -131,6 +131,16 @@ export async function waitForRedis(
 		intervalMs = parseInt(process.env.WORKER_HEALTH_INTERVAL_MS || "1000", 10),
 	} = config;
 
+	// See waitForDatabase: reject a config object in the healthCheck slot
+	// rather than failing with an opaque TypeError.
+	if (typeof healthCheck !== "function") {
+		throw new AppError(
+			"waitForRedis expects a health check function as its first argument.",
+			500,
+			"REDIS_HEALTH_CHECK_INVALID",
+		);
+	}
+
 	const reportThrottledError = throttledError(logger, 3000);
 
 	for (let attempt = 1; attempt <= maxRetries; attempt++) {
@@ -190,6 +200,18 @@ export async function waitForDatabase(
 		intervalMs = parseInt(process.env.WORKER_DB_INTERVAL_MS || "2000", 10),
 	} = config;
 
+	// Guard against the config object being passed in the healthCheck slot:
+	// that surfaces as an opaque "healthCheck is not a function" TypeError and,
+	// because a TypeError is neither a schema nor a connection error, it
+	// rethrows on the first attempt so the retry config never applies.
+	if (typeof healthCheck !== "function") {
+		throw new AppError(
+			"waitForDatabase expects a health check function as its first argument.",
+			500,
+			"DATABASE_HEALTH_CHECK_INVALID",
+		);
+	}
+
 	const reportThrottledError = throttledError(logger, 5000);
 
 	for (let attempt = 1; attempt <= maxRetries; attempt++) {
@@ -379,7 +401,12 @@ async function startWorker() {
 
 		// Wait for database schema to be ready (migrations may still be running)
 		logger.info("Checking database schema readiness...");
-		await waitForDatabase(isDevMode ? { maxRetries: 5, intervalMs: 1000 } : {});
+		// healthCheck takes the first argument; the config object must not be
+		// passed in its slot or the call throws "healthCheck is not a function".
+		await waitForDatabase(
+			undefined,
+			isDevMode ? { maxRetries: 5, intervalMs: 1000 } : {},
+		);
 		logger.info("Database schema ready");
 
 		// Register a worker for each queue