create-daloy 0.1.20 → 0.1.22

package/README.md

@@ -18,6 +18,7 @@ The CLI is interactive when arguments are missing. It will ask you for:
   `deno-basic` runtime template
 - Whether to install dependencies
 - Whether to initialize a git repository
+- Whether to add hardened GitHub Actions and security/governance files
 
 Interactive runs use a polished terminal UI with a DaloyJS welcome banner,
 arrow-key template and package-manager pickers, progress indicators, and a
@@ -30,6 +31,8 @@ script-friendly transcript with the same decisions and next steps.
 pnpm create daloy@latest my-api \
   --template node-basic \
   --package-manager pnpm \
+  --with-ci \
+  --code-owner @acme/security \
   --install \
   --git
 ```
@@ -44,6 +47,8 @@ pnpm create daloy@latest my-api \
 | `--install` / `--no-install` | Install dependencies after scaffolding. Defaults to interactive. |
 | `--git` / `--no-git` | Initialize a git repository. Defaults to interactive. |
 | `--minimal` | Strip the bookstore demo route and the built-in `/docs` + `/openapi.json` routes so only the framework bootstrap and `/healthz` ship. |
+| `--with-ci` / `--no-ci` | Add the hardened GitHub Actions, Dependabot, CODEOWNERS, SECURITY.md, and lockfile-source verification bundle. |
+| `--code-owner <owner>` | Replace the CODEOWNERS placeholder when `--with-ci` is used, for example `@acme/security`. |
 | `--force` | Overwrite an existing non-empty directory. |
 | `--yes` | Accept all defaults; never prompt. |
 | `--help` | Print usage and exit. |
@@ -118,14 +123,50 @@ Sentinel comments (`// daloy-minimal:strip-start <tag>` /
 `// daloy-minimal:strip-end <tag>`) survive a default scaffold so you can
 re-run with `--minimal`, or delete the marked blocks by hand later.
 
+## Hardened GitHub security bundle
+
+Pass `--with-ci` when you want the generated project to start with the same
+security posture as a serious company repo:
+
+```bash
+pnpm create daloy@latest my-api \
+  --template node-basic \
+  --package-manager pnpm \
+  --with-ci \
+  --code-owner @acme/security
+```
+
+For Node-style templates, the bundle adds:
+
+- `.github/workflows/ci.yml` with top-level `permissions: {}`, pinned actions,
+  `harden-runner`, `persist-credentials: false`, no package-manager cache, and
+  install scripts disabled.
+- `.github/workflows/release.yml` as a disabled-by-default npm trusted publishing
+  skeleton. It only publishes when `NPM_PUBLISH_ENABLED=true`, the package is no
+  longer private, and the protected `npm-publish` environment is configured.
+- CodeQL, OpenSSF Scorecard, zizmor, Dependabot, CODEOWNERS, and `SECURITY.md`.
+- `scripts/verify-lockfile-sources.mjs` plus a `verify:lockfile` package script
+  that rejects git dependencies and non-registry tarball URLs in text lockfiles.
+
+For `deno-basic`, `--with-ci` generates a Deno-native CI workflow plus CodeQL,
+Scorecard, zizmor, Dependabot for GitHub Actions, CODEOWNERS, and `SECURITY.md`.
+It does not generate an npm release workflow because the Deno template has no
+`package.json`.
+
+If you omit `--code-owner`, the generated CODEOWNERS file uses
+`@your-org/security-team` as a placeholder. Replace it before relying on branch
+protection. You should also enable GitHub secret scanning, push protection, and
+required status checks in the repository settings.
+
 ## What the CLI guarantees
 
 - Zero runtime dependencies (uses only Node built-ins) for a clean supply-chain footprint.
 - A modern terminal experience with Unicode/color capability detection and ASCII fallbacks.
 - Templates are copied verbatim from this package's `templates/` directory.
-- Files and folders prefixed with `_` are renamed on copy (`_gitignore` → `.gitignore`, `_npmrc` → `.npmrc`, `_agents/` → `.agents/`) to survive npm packing.
+- Files and folders prefixed with `_` are renamed on copy (`_gitignore` → `.gitignore`, `_npmrc` → `.npmrc`, `_github/` → `.github`, `_agents/` → `.agents/`) to survive npm packing.
 - pnpm-specific `.npmrc` hardening is kept only when you choose `pnpm`; other package managers get a clean project without unsupported config warnings.
 - pnpm projects ship with `ignore-scripts=true`, `minimum-release-age=1440`, `verify-store-integrity=true`, `prefer-frozen-lockfile=true`, and `strict-peer-dependencies=true` by default.
+- `--with-ci` projects ship with pinned GitHub Actions workflows, CODEOWNERS, Dependabot, SECURITY.md, and lockfile-source verification.
 - The CLI never executes template scripts and never makes network calls beyond the package manager you select.
 
 ## AI agent helper files

package/bin/create-daloy.mjs

@@ -13,6 +13,7 @@ import { fileURLToPath } from "node:url";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const PKG_ROOT = path.resolve(__dirname, "..");
 const TEMPLATES_DIR = path.join(PKG_ROOT, "templates");
+const CI_TEMPLATES_DIR = path.join(TEMPLATES_DIR, "_ci");
 
 const TEMPLATE_OPTIONS = [
   {
@@ -56,6 +57,7 @@ const RENAME_ON_COPY = new Map([
   ["_gitignore", ".gitignore"],
   ["_npmrc", ".npmrc"],
   ["_env.example", ".env.example"],
+  ["_github", ".github"],
   // Directory: holds skill files for AI coding agents under
   // `.agents/skills/<skill-name>/SKILL.md`. Templates author this as
   // `_agents/` so npm pack does not drop the dotfolder during publish.
@@ -72,6 +74,8 @@ const NO_PACKAGE_JSON_TEMPLATES = new Set(["deno-basic"]);
 // `daloy-minimal:strip-start <tag>` / `daloy-minimal:strip-end <tag>`
 // sentinels.
 const MINIMAL_STRIP_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".mjs", ".cjs", ".md"]);
+const CI_PLACEHOLDER_EXTENSIONS = new Set([".json", ".md", ".mjs", ".yaml", ".yml"]);
+const CI_PLACEHOLDER_FILES = new Set(["CODEOWNERS"]);
 
 // ----------------------------------------------------------------------------
 // Terminal capability detection + style primitives.
@@ -308,6 +312,8 @@ ${heading("Options")}
   ${color(COLORS.green, "--install / --no-install")}   Install dependencies after scaffolding.
   ${color(COLORS.green, "--git / --no-git")}           Initialize a git repository.
   ${color(COLORS.green, "--minimal")}                  Strip the bookstore + Swagger/OpenAPI demo routes.
+  ${color(COLORS.green, "--with-ci / --no-ci")}         Add hardened GitHub Actions + governance files.
+  ${color(COLORS.green, "--code-owner <owner>")}        CODEOWNERS owner for --with-ci, e.g. @acme/security.
   ${color(COLORS.green, "--force")}                    Overwrite an existing non-empty directory.
   ${color(COLORS.green, "--yes, -y")}                  Accept all defaults; never prompt.
   ${color(COLORS.green, "--help, -h")}                 Print this help.
@@ -353,6 +359,8 @@ function parseArgs(argv) {
     version: false,
     listTemplates: false,
     minimal: false,
+    ci: undefined,
+    codeOwner: undefined,
   };
   const args = [...argv];
   while (args.length) {
@@ -363,6 +371,10 @@ function parseArgs(argv) {
     else if (a === "--yes" || a === "-y") out.yes = true;
     else if (a === "--force") out.force = true;
     else if (a === "--minimal") out.minimal = true;
+    else if (a === "--with-ci") out.ci = true;
+    else if (a === "--no-ci") out.ci = false;
+    else if (a === "--code-owner") out.codeOwner = args.shift();
+    else if (a?.startsWith("--code-owner=")) out.codeOwner = a.slice("--code-owner=".length);
     else if (a === "--install") out.install = true;
     else if (a === "--no-install") out.install = false;
     else if (a === "--git") out.git = true;
@@ -391,6 +403,11 @@ function detectPackageManager() {
 }
 
 const VALID_NAME = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+// Match the GitHub CODEOWNERS owner grammar: a personal handle (@user), an
+// organization team (@org/team), or an email address. Anything else is
+// rejected so the scaffolded CODEOWNERS stays meaningful for branch protection.
+const VALID_CODE_OWNER =
+  /^(?:@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,38})(?:\/[a-zA-Z0-9][a-zA-Z0-9._-]*)?|[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,})$/;
 
 function validateProjectName(name) {
   if (!name || !name.trim()) return "Project name cannot be empty.";
@@ -521,9 +538,176 @@ function rewriteScriptsForPackageManager(scripts, pm) {
 
 async function normalizePackageManagerFiles(dir, packageManager) {
   if (packageManager === "pnpm") return;
-  const npmrcPath = path.join(dir, ".npmrc");
-  if (!existsSync(npmrcPath)) return;
-  await rm(npmrcPath, { force: true });
+  // The hardened `.npmrc` and `pnpm-workspace.yaml` only make sense for pnpm.
+  // Removing them keeps npm/yarn/bun scaffolds from inheriting pnpm-specific
+  // settings the chosen package manager would either ignore or misinterpret.
+  for (const file of [".npmrc", "pnpm-workspace.yaml"]) {
+    const target = path.join(dir, file);
+    if (existsSync(target)) {
+      await rm(target, { force: true });
+    }
+  }
+}
+
+function hasPackageScript(packageJson, scriptName) {
+  return typeof packageJson?.scripts?.[scriptName] === "string";
+}
+
+function runScriptCommand(packageManager, scriptName) {
+  if (packageManager === "pnpm") return `pnpm ${scriptName}`;
+  if (packageManager === "npm") return scriptName === "test" ? "npm test" : `npm run ${scriptName}`;
+  if (packageManager === "yarn") return scriptName === "test" ? "yarn test" : `yarn run ${scriptName}`;
+  if (packageManager === "bun") return scriptName === "test" ? "bun test" : `bun run ${scriptName}`;
+  return `${packageManager} run ${scriptName}`;
+}
+
+function installCommand(packageManager) {
+  if (packageManager === "pnpm") return "pnpm install --frozen-lockfile --ignore-scripts";
+  if (packageManager === "npm") return "npm ci --ignore-scripts";
+  if (packageManager === "yarn") return "yarn install --frozen-lockfile --ignore-scripts";
+  if (packageManager === "bun") return "bun install --frozen-lockfile --ignore-scripts";
+  return `${packageManager} install`;
+}
+
+function auditCommand(packageManager) {
+  if (packageManager === "pnpm") return "pnpm audit --prod";
+  if (packageManager === "npm") return "npm audit --omit=dev";
+  if (packageManager === "yarn") return "yarn audit --groups dependencies";
+  if (packageManager === "bun") return "bun audit";
+  return "";
+}
+
+function setupPackageManagerStep(packageManager) {
+  if (packageManager === "pnpm") {
+    return `      - name: Set up pnpm
+        uses: pnpm/action-setup@ac6db6d3c1f721f886538a378a2d73e85697340a # v6
+        with:
+          version: 11.1.2
+          run_install: false`;
+  }
+  if (packageManager === "yarn") {
+    return `      - name: Enable Corepack
+        run: corepack enable`;
+  }
+  if (packageManager === "bun") return setupBunStep();
+  return "";
+}
+
+function setupBunStep() {
+  return `      - name: Set up Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: latest`;
+}
+
+function workflowStep(name, command) {
+  return `      - name: ${name}
+        run: ${command}`;
+}
+
+function multilineWorkflowStep(name, command) {
+  return `      - name: ${name}
+        run: |
+${command
+  .split("\n")
+  .map((line) => `          ${line}`)
+  .join("\n")}`;
+}
+
+async function readPackageJsonIfPresent(dir) {
+  const file = path.join(dir, "package.json");
+  if (!existsSync(file)) return null;
+  return JSON.parse(await readFile(file, "utf8"));
+}
+
+async function writePackageJson(dir, packageJson) {
+  await writeFile(path.join(dir, "package.json"), JSON.stringify(packageJson, null, 2) + "\n", "utf8");
+}
+
+async function addLockfileVerifyScript(dir) {
+  const packageJson = await readPackageJsonIfPresent(dir);
+  if (!packageJson) return;
+  packageJson.scripts ??= {};
+  packageJson.scripts["verify:lockfile"] = "node scripts/verify-lockfile-sources.mjs";
+  await writePackageJson(dir, packageJson);
+}
+
+function renderCiReplacements({ packageManager, template, packageJson, codeOwner }) {
+  const setupPm = setupPackageManagerStep(packageManager);
+  const needsBunRuntime = template === "bun-basic" && packageManager !== "bun";
+  const audit = auditCommand(packageManager);
+  const buildStep = hasPackageScript(packageJson, "build") ? workflowStep("Build", runScriptCommand(packageManager, "build")) : "";
+  const auditStep = audit ? workflowStep("Audit production dependencies", audit) : "";
+  const tagVersionCheck = `set -eu
+tag_version="\${GITHUB_REF_NAME#v}"
+pkg_version="$(node -p "require('./package.json').version")"
+if [ "$tag_version" != "$pkg_version" ]; then
+  echo "::error::Tag $GITHUB_REF_NAME does not match package.json version $pkg_version"
+  exit 1
+fi`;
+
+  return new Map([
+    ["__CODE_OWNER__", codeOwner],
+    ["__SETUP_PACKAGE_MANAGER_STEP__", setupPm],
+    ["__SETUP_BUN_RUNTIME_STEP__", needsBunRuntime ? setupBunStep() : ""],
+    ["__INSTALL_COMMAND__", installCommand(packageManager)],
+    ["__VERIFY_LOCKFILE_COMMAND__", runScriptCommand(packageManager, "verify:lockfile")],
+    ["__TYPECHECK_COMMAND__", runScriptCommand(packageManager, "typecheck")],
+    ["__TEST_COMMAND__", runScriptCommand(packageManager, "test")],
+    ["__BUILD_STEP__", buildStep],
+    ["__AUDIT_STEP__", auditStep],
+    ["__TAG_VERSION_CHECK_STEP__", multilineWorkflowStep("Verify tag matches package.json version", tagVersionCheck)],
+  ]);
+}
+
+async function replacePlaceholdersInTree(dir, replacements) {
+  const entries = await readdir(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name === "node_modules" || entry.name === ".git") continue;
+      await replacePlaceholdersInTree(full, replacements);
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    if (!CI_PLACEHOLDER_EXTENSIONS.has(path.extname(entry.name)) && !CI_PLACEHOLDER_FILES.has(entry.name)) {
+      continue;
+    }
+    const raw = await readFile(full, "utf8");
+    let next = raw;
+    for (const [placeholder, value] of replacements) {
+      next = next.replaceAll(placeholder, value);
+    }
+    if (next !== raw) await writeFile(full, next, "utf8");
+  }
+}
+
+async function copyCiBundle(targetDir, template, packageManager, skipPackageManager, codeOwner) {
+  const flavor = skipPackageManager ? "deno" : "node";
+  const sourceDir = path.join(CI_TEMPLATES_DIR, flavor);
+  if (!existsSync(sourceDir)) {
+    throw new Error(`CI template bundle "${flavor}" is missing from this CLI build.`);
+  }
+  await copyTemplate(sourceDir, targetDir);
+
+  const candidate = codeOwner?.trim() ?? "";
+  if (candidate && !VALID_CODE_OWNER.test(candidate)) {
+    throw new Error(
+      `Invalid --code-owner "${candidate}". Use a GitHub handle (@user), a team (@org/team), or an email address.`,
+    );
+  }
+  const owner = candidate || "@your-org/security-team";
+  if (skipPackageManager) {
+    await replacePlaceholdersInTree(targetDir, new Map([["__CODE_OWNER__", owner]]));
+    return;
+  }
+
+  await addLockfileVerifyScript(targetDir);
+  const packageJson = await readPackageJsonIfPresent(targetDir);
+  await replacePlaceholdersInTree(
+    targetDir,
+    renderCiReplacements({ packageManager, template, packageJson, codeOwner: owner }),
+  );
 }
 
 /**
@@ -858,7 +1042,7 @@ function createSpinner(initialMessage) {
   };
 }
 
-function printSummary({ projectName, template, packageManager, installDeps, skipPackageManager }) {
+function printSummary({ projectName, template, packageManager, installDeps, skipPackageManager, withCi }) {
   const templateMeta = TEMPLATE_OPTIONS.find((option) => option.value === template);
   const templateLabel = templateMeta ? `${templateMeta.title} ${color(COLORS.dim, `(${template})`)}` : template;
   const summaryLines = [
@@ -872,6 +1056,9 @@ function printSummary({ projectName, template, packageManager, installDeps, skip
   } else {
     summaryLines.push(`${color(COLORS.gray, "Manager   ")} ${color(COLORS.cyan, packageManager)}`);
   }
+  if (withCi) {
+    summaryLines.push(`${color(COLORS.gray, "Security  ")} ${color(COLORS.cyan, "GitHub CI bundle")}`);
+  }
   console.log("");
   console.log(renderBox(summaryLines, { accent: COLORS.green }));
   console.log("");
@@ -1010,6 +1197,11 @@ async function main() {
       initGit = rl ? await askYesNo(rl, "Initialize a git repository?", true) : false;
     }
 
+    let withCi = opts.ci;
+    if (withCi === undefined) {
+      withCi = rl ? await askYesNo(rl, "Add hardened GitHub Actions and security files?", false) : false;
+    }
+
     rl?.close();
 
     if (interactive) {
@@ -1036,6 +1228,11 @@ async function main() {
       }
     }
 
+    if (withCi) {
+      await copyCiBundle(targetDir, template, packageManager, skipPackageManager, opts.codeOwner);
+      logStep("GitHub security bundle added", skipPackageManager ? "deno" : packageManager);
+    }
+
     if (initGit) {
       const code = await run("git", ["init", "--quiet"], targetDir);
       if (code === 0) {
@@ -1062,7 +1259,7 @@ async function main() {
       }
     }
 
-    printSummary({ projectName, template, packageManager, installDeps, skipPackageManager });
+    printSummary({ projectName, template, packageManager, installDeps, skipPackageManager, withCi });
   } catch (err) {
     rl?.close();
     if (err && err.message === "Cancelled") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-daloy",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
   "type": "module",
   "license": "MIT",

package/templates/_ci/deno/SECURITY.md

@@ -0,0 +1,32 @@
+# Security Policy
+
+## Supported versions
+
+This project is generated by `create-daloy`. Apply security fixes to the
+currently deployed branch and keep dependencies current through review.
+
+## Reporting a vulnerability
+
+Do not open a public issue for suspected vulnerabilities. Use your company's
+private intake process, GitHub private vulnerability reporting, or the security
+contact for this repository.
+
+## Generated controls
+
+The `--with-ci` bundle adds these defaults:
+
+- GitHub Actions workflows use top-level `permissions: {}` and job-scoped permissions.
+- Fork pull requests use `pull_request`, not `pull_request_target`.
+- Third-party actions are pinned to commit SHAs.
+- `actions/checkout` uses `persist-credentials: false`.
+- Deno CI runs `deno task typecheck` and `deno task test` with the template's narrow permission flags.
+- CodeQL, OpenSSF Scorecard, zizmor, Dependabot for GitHub Actions, and CODEOWNERS are generated.
+
+## Required repository settings
+
+Before relying on these files for a company project:
+
+1. Replace `@your-org/security-team` in `.github/CODEOWNERS` or pass `--code-owner` when scaffolding.
+2. Protect the `main` branch and require the CI, CodeQL, Scorecard, and zizmor checks.
+3. Enable GitHub secret scanning and push protection.
+4. Keep Deno permissions narrow; do not switch tasks to `--allow-all`.

package/templates/_ci/deno/_github/CODEOWNERS

@@ -0,0 +1,17 @@
+# Replace the placeholder owner with the GitHub user or team that must review
+# privileged files before relying on CODEOWNERS protection.
+
+* __CODE_OWNER__
+
+# Workflow / CI / CD.
+/.github/                         __CODE_OWNER__
+/.github/workflows/               __CODE_OWNER__
+/.github/dependabot.yml           __CODE_OWNER__
+/.github/CODEOWNERS               __CODE_OWNER__
+
+# Files that affect dependency resolution or runtime permissions.
+/deno.json                        __CODE_OWNER__
+/deno.lock                        __CODE_OWNER__
+
+# Vulnerability handling.
+/SECURITY.md                      __CODE_OWNER__

package/templates/_ci/deno/_github/dependabot.yml

@@ -0,0 +1,15 @@
+version: 2
+
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 10
+    groups:
+      actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "chore(actions)"

package/templates/_ci/deno/_github/workflows/ci.yml

@@ -0,0 +1,47 @@
+# Hardened Deno CI generated by create-daloy --with-ci.
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions: {}
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    name: Verify
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+          disable-file-monitoring: false
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Set up Deno
+        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4
+        with:
+          deno-version: v2.x
+
+      - name: Typecheck
+        run: deno task typecheck
+
+      - name: Test
+        run: deno task test

package/templates/_ci/deno/_github/workflows/codeql.yml

@@ -0,0 +1,56 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "37 4 * * 1"
+
+permissions: {}
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: javascript-typescript
+            build-mode: none
+          - language: actions
+            build-mode: none
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@52485aec7be33610227643b0fe83936b8b5f061a # v3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          queries: security-extended,security-and-quality
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@52485aec7be33610227643b0fe83936b8b5f061a # v3
+        with:
+          category: "/language:${{ matrix.language }}"

package/templates/_ci/deno/_github/workflows/scorecard.yml

@@ -0,0 +1,46 @@
+name: Scorecard
+
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "23 5 * * 2"
+  push:
+    branches: [main]
+
+permissions: {}
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      security-events: write
+      id-token: write
+      contents: read
+      actions: read
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: Upload to code-scanning
+        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+        with:
+          sarif_file: results.sarif

package/templates/_ci/deno/_github/workflows/zizmor.yml

@@ -0,0 +1,38 @@
+name: Zizmor
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "0 7 * * *"
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Lint workflows
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@b572f7b1a1c2d41efaab43d504f68d215c3cd727 # v0.5.4
+        with:
+          version: v1.25.0

package/templates/_ci/node/SECURITY.md

@@ -0,0 +1,36 @@
+# Security Policy
+
+## Supported versions
+
+This project is generated by `create-daloy`. Apply security fixes to the
+currently deployed branch and keep dependencies current through Dependabot.
+
+## Reporting a vulnerability
+
+Do not open a public issue for suspected vulnerabilities. Use your company's
+private intake process, GitHub private vulnerability reporting, or the security
+contact for this repository.
+
+## Generated controls
+
+The `--with-ci` bundle adds these defaults:
+
+- GitHub Actions workflows use top-level `permissions: {}` and job-scoped permissions.
+- Fork pull requests use `pull_request`, not `pull_request_target`.
+- Third-party actions are pinned to commit SHAs.
+- `actions/checkout` uses `persist-credentials: false`.
+- Dependency installs run with lifecycle scripts disabled.
+- Package-manager caches are disabled in CI to avoid cache-poisoning bridges.
+- Lockfile source verification rejects git dependencies and non-registry tarball URLs.
+- CodeQL, OpenSSF Scorecard, zizmor, Dependabot, and CODEOWNERS are generated.
+- npm publishing is disabled until `NPM_PUBLISH_ENABLED=true` is set and npm trusted publishing is configured.
+
+## Required repository settings
+
+Before relying on these files for a company project:
+
+1. Replace `@your-org/security-team` in `.github/CODEOWNERS` or pass `--code-owner` when scaffolding.
+2. Protect the `main` branch and require the CI, CodeQL, Scorecard, and zizmor checks.
+3. Enable GitHub secret scanning and push protection.
+4. Configure a protected `npm-publish` Environment before enabling npm publish.
+5. Keep `ignore-scripts=true` and the `pnpm-workspace.yaml` supply-chain settings on when using pnpm.

package/templates/_ci/node/_github/CODEOWNERS

@@ -0,0 +1,25 @@
+# Replace the placeholder owner with the GitHub user or team that must review
+# privileged files before relying on CODEOWNERS protection.
+
+* __CODE_OWNER__
+
+# Workflow / CI / CD.
+/.github/                         __CODE_OWNER__
+/.github/workflows/               __CODE_OWNER__
+/.github/workflows/release.yml    __CODE_OWNER__
+/.github/dependabot.yml           __CODE_OWNER__
+/.github/CODEOWNERS               __CODE_OWNER__
+
+# Files that affect dependency resolution, install scripts, or publishing.
+/package.json                     __CODE_OWNER__
+/package-lock.json                __CODE_OWNER__
+/npm-shrinkwrap.json              __CODE_OWNER__
+/pnpm-lock.yaml                   __CODE_OWNER__
+/pnpm-workspace.yaml              __CODE_OWNER__
+/yarn.lock                        __CODE_OWNER__
+/bun.lock                         __CODE_OWNER__
+/.npmrc                           __CODE_OWNER__
+/scripts/verify-lockfile-sources.mjs __CODE_OWNER__
+
+# Vulnerability handling.
+/SECURITY.md                      __CODE_OWNER__

package/templates/_ci/node/_github/dependabot.yml

@@ -0,0 +1,28 @@
+version: 2
+
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 10
+    groups:
+      actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "chore(actions)"
+
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 10
+    versioning-strategy: increase-if-necessary
+    groups:
+      dev-dependencies:
+        dependency-type: development
+    commit-message:
+      prefix: "chore(deps)"

package/templates/_ci/node/_github/workflows/ci.yml

@@ -0,0 +1,65 @@
+# Hardened CI generated by create-daloy --with-ci.
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions: {}
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify:
+    name: Verify
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+          disable-file-monitoring: false
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+__SETUP_PACKAGE_MANAGER_STEP__
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 24
+          # Package-manager caching is intentionally disabled. Shared caches
+          # can bridge fork PRs into trusted branches when mis-keyed.
+
+__SETUP_BUN_RUNTIME_STEP__
+
+      - name: Install dependencies
+        run: __INSTALL_COMMAND__
+        env:
+          npm_config_ignore_scripts: "true"
+
+      - name: Verify lockfile sources
+        run: __VERIFY_LOCKFILE_COMMAND__
+
+      - name: Typecheck
+        run: __TYPECHECK_COMMAND__
+
+      - name: Test
+        run: __TEST_COMMAND__
+
+__BUILD_STEP__
+
+__AUDIT_STEP__

package/templates/_ci/node/_github/workflows/codeql.yml

@@ -0,0 +1,56 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "37 4 * * 1"
+
+permissions: {}
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: javascript-typescript
+            build-mode: none
+          - language: actions
+            build-mode: none
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@52485aec7be33610227643b0fe83936b8b5f061a # v3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          queries: security-extended,security-and-quality
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@52485aec7be33610227643b0fe83936b8b5f061a # v3
+        with:
+          category: "/language:${{ matrix.language }}"

package/templates/_ci/node/_github/workflows/release.yml

@@ -0,0 +1,125 @@
+# Hardened npm publish skeleton generated by create-daloy --with-ci.
+#
+# Publishing is disabled until you set the repository variable
+# NPM_PUBLISH_ENABLED=true, remove "private": true from package.json, and
+# configure npm trusted publishing for this repository/environment.
+name: Publish
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  verify:
+    name: Verify before publish
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+__SETUP_PACKAGE_MANAGER_STEP__
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 24
+
+__SETUP_BUN_RUNTIME_STEP__
+
+      - name: Install dependencies
+        run: __INSTALL_COMMAND__
+        env:
+          npm_config_ignore_scripts: "true"
+
+      - name: Verify lockfile sources
+        run: __VERIFY_LOCKFILE_COMMAND__
+
+      - name: Typecheck
+        run: __TYPECHECK_COMMAND__
+
+      - name: Test
+        run: __TEST_COMMAND__
+
+__BUILD_STEP__
+
+  publish-npm:
+    name: Publish npm package
+    needs: verify
+    if: vars.NPM_PUBLISH_ENABLED == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    environment:
+      name: ${{ vars.NPM_PUBLISH_ENVIRONMENT || 'npm-publish' }}
+      url: https://www.npmjs.com/package/${{ github.event.repository.name }}
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
+            objects.githubusercontent.com:443
+            registry.npmjs.org:443
+            fulcio.sigstore.dev:443
+            rekor.sigstore.dev:443
+            tuf-repo-cdn.sigstore.dev:443
+          disable-sudo: true
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+__SETUP_PACKAGE_MANAGER_STEP__
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 24
+          registry-url: "https://registry.npmjs.org"
+
+__SETUP_BUN_RUNTIME_STEP__
+
+      - name: Install dependencies
+        run: __INSTALL_COMMAND__
+        env:
+          npm_config_ignore_scripts: "true"
+
+      - name: Refuse private package publish
+        run: |
+          node -e "const pkg = require('./package.json'); if (pkg.private) { console.error('package.json is private; remove private:true before enabling npm publish'); process.exit(1); }"
+
+__TAG_VERSION_CHECK_STEP__
+
+__BUILD_STEP__
+
+      - name: Publish to npm with provenance
+        run: npm publish --access public --provenance
+        env:
+          NPM_CONFIG_PROVENANCE: "true"

package/templates/_ci/node/_github/workflows/scorecard.yml

@@ -0,0 +1,46 @@
+name: Scorecard
+
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "23 5 * * 2"
+  push:
+    branches: [main]
+
+permissions: {}
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      security-events: write
+      id-token: write
+      contents: read
+      actions: read
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Run analysis
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - name: Upload to code-scanning
+        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+        with:
+          sarif_file: results.sarif

package/templates/_ci/node/_github/workflows/zizmor.yml

@@ -0,0 +1,38 @@
+name: Zizmor
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "0 7 * * *"
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Lint workflows
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@b572f7b1a1c2d41efaab43d504f68d215c3cd727 # v0.5.4
+        with:
+          version: v1.25.0

package/templates/_ci/node/scripts/verify-lockfile-sources.mjs

@@ -0,0 +1,61 @@
+import { access, readFile } from "node:fs/promises";
+
+const TEXT_LOCKFILES = ["pnpm-lock.yaml", "package-lock.json", "npm-shrinkwrap.json", "yarn.lock", "bun.lock"];
+const BINARY_LOCKFILES = ["bun.lockb"];
+const GIT_SOURCE_PATTERN = /(?:specifier:\s*)?(?:github:|git\+|git:\/\/|ssh:\/\/git@|git@github\.com:)/i;
+const URL_PATTERN = /(?:tarball|resolved)["':\s]+(?<url>https?:\/\/[^"'\s},]+)/i;
+const ALLOWED_TARBALL_PREFIXES = ["https://registry.npmjs.org/", "https://registry.yarnpkg.com/"];
+
+async function exists(file) {
+  try {
+    await access(file);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function findForbiddenSources(lockfile) {
+  const findings = [];
+  const lines = lockfile.split(/\r?\n/);
+  for (const [index, rawLine] of lines.entries()) {
+    const text = rawLine.trim();
+    if (GIT_SOURCE_PATTERN.test(text)) {
+      findings.push({ line: index + 1, reason: "git dependency source", text });
+      continue;
+    }
+
+    const url = URL_PATTERN.exec(text)?.groups?.url;
+    if (url && !ALLOWED_TARBALL_PREFIXES.some((prefix) => url.startsWith(prefix))) {
+      findings.push({ line: index + 1, reason: "non-registry tarball source", text });
+    }
+  }
+  return findings;
+}
+
+let checked = false;
+let failed = false;
+
+for (const file of TEXT_LOCKFILES) {
+  if (!(await exists(file))) continue;
+  checked = true;
+  const findings = findForbiddenSources(await readFile(file, "utf8"));
+  for (const finding of findings) {
+    failed = true;
+    console.error(`${file}: ${finding.reason} on line ${finding.line}: ${finding.text}`);
+  }
+}
+
+for (const file of BINARY_LOCKFILES) {
+  if (await exists(file)) {
+    failed = true;
+    console.error(`${file}: binary lockfiles cannot be source-verified; use a text lockfile in CI.`);
+  }
+}
+
+if (!checked) {
+  failed = true;
+  console.error("No text lockfile found. Commit a lockfile before relying on CI.");
+}
+
+if (failed) process.exitCode = 1;

package/templates/bun-basic/pnpm-workspace.yaml

@@ -0,0 +1,25 @@
+# pnpm workspace-level supply-chain settings.
+#
+# This file is here even though the default package manager for this
+# template is Bun, because users can switch to pnpm with
+# `pnpm create daloy --package-manager pnpm`. When that happens, the
+# scaffolder keeps this file so pnpm 11+ picks up the workspace-level
+# supply-chain controls below. If you keep using Bun, you can delete it.
+#
+# pnpm 11+ reads `pnpm-workspace.yaml` as a settings file even when no
+# `packages:` list is declared. It is the only file format that accepts
+# the v11 keys below (`.npmrc` cannot express them).
+#
+# See the DaloyJS supply-chain notes and the 2026-05-11 TanStack
+# postmortem (https://tanstack.com/blog/npm-supply-chain-compromise-postmortem)
+# for why every setting below is on by default.
+
+# Wait 24h (1440 minutes) before resolving a freshly published version.
+# Most npm worm campaigns are detected and unpublished within hours.
+# Set to 0 only for a real hotfix.
+minimumReleaseAge: 1440
+
+# Only direct dependencies may use exotic sources (git, tarball URLs).
+# Transitive deps must resolve from the configured registry, which makes
+# typosquatted-tarball and compromised-fork attacks much harder to land.
+blockExoticSubdeps: true

package/templates/cloudflare-worker/pnpm-workspace.yaml

@@ -0,0 +1,24 @@
+# pnpm workspace-level supply-chain settings.
+#
+# This file looks unusual in a single-package project, but pnpm 11+ reads
+# `pnpm-workspace.yaml` as a settings file even when no `packages:` list
+# is declared. It is the only file format that accepts the v11 keys
+# below (`.npmrc` cannot express them).
+#
+# See the DaloyJS supply-chain notes and the 2026-05-11 TanStack
+# postmortem (https://tanstack.com/blog/npm-supply-chain-compromise-postmortem)
+# for why every setting below is on by default.
+#
+# Want a real monorepo? Add a `packages:` key listing your sub-package
+# globs (e.g. `packages: ["apps/*", "packages/*"]`) and the keys below
+# will continue to apply.
+
+# Wait 24h (1440 minutes) before resolving a freshly published version.
+# Most npm worm campaigns are detected and unpublished within hours.
+# Set to 0 only for a real hotfix.
+minimumReleaseAge: 1440
+
+# Only direct dependencies may use exotic sources (git, tarball URLs).
+# Transitive deps must resolve from the configured registry, which makes
+# typosquatted-tarball and compromised-fork attacks much harder to land.
+blockExoticSubdeps: true

package/templates/node-basic/pnpm-workspace.yaml

@@ -0,0 +1,24 @@
+# pnpm workspace-level supply-chain settings.
+#
+# This file looks unusual in a single-package project, but pnpm 11+ reads
+# `pnpm-workspace.yaml` as a settings file even when no `packages:` list
+# is declared. It is the only file format that accepts the v11 keys
+# below (`.npmrc` cannot express them).
+#
+# See the DaloyJS supply-chain notes and the 2026-05-11 TanStack
+# postmortem (https://tanstack.com/blog/npm-supply-chain-compromise-postmortem)
+# for why every setting below is on by default.
+#
+# Want a real monorepo? Add a `packages:` key listing your sub-package
+# globs (e.g. `packages: ["apps/*", "packages/*"]`) and the keys below
+# will continue to apply.
+
+# Wait 24h (1440 minutes) before resolving a freshly published version.
+# Most npm worm campaigns are detected and unpublished within hours.
+# Set to 0 only for a real hotfix.
+minimumReleaseAge: 1440
+
+# Only direct dependencies may use exotic sources (git, tarball URLs).
+# Transitive deps must resolve from the configured registry, which makes
+# typosquatted-tarball and compromised-fork attacks much harder to land.
+blockExoticSubdeps: true

package/templates/vercel-edge/pnpm-workspace.yaml

@@ -0,0 +1,24 @@
+# pnpm workspace-level supply-chain settings.
+#
+# This file looks unusual in a single-package project, but pnpm 11+ reads
+# `pnpm-workspace.yaml` as a settings file even when no `packages:` list
+# is declared. It is the only file format that accepts the v11 keys
+# below (`.npmrc` cannot express them).
+#
+# See the DaloyJS supply-chain notes and the 2026-05-11 TanStack
+# postmortem (https://tanstack.com/blog/npm-supply-chain-compromise-postmortem)
+# for why every setting below is on by default.
+#
+# Want a real monorepo? Add a `packages:` key listing your sub-package
+# globs (e.g. `packages: ["apps/*", "packages/*"]`) and the keys below
+# will continue to apply.
+
+# Wait 24h (1440 minutes) before resolving a freshly published version.
+# Most npm worm campaigns are detected and unpublished within hours.
+# Set to 0 only for a real hotfix.
+minimumReleaseAge: 1440
+
+# Only direct dependencies may use exotic sources (git, tarball URLs).
+# Transitive deps must resolve from the configured registry, which makes
+# typosquatted-tarball and compromised-fork attacks much harder to land.
+blockExoticSubdeps: true