create-daloy 0.24.0 → 0.34.0

package/README.md

@@ -1,3 +1,12 @@
+<p align="center">
+  <a href="https://daloyjs.dev">
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="https://daloyjs.dev/assets/banner-x-1500x500.png">
+      <img alt="DaloyJS — Contract-first REST APIs for Node · Bun · Deno · Workers · Edge" src="https://daloyjs.dev/assets/banner-light-1280x426.png" width="100%">
+    </picture>
+  </a>
+</p>
+
 # create-daloy
 
 Scaffold a new [DaloyJS](https://github.com/daloyjs/daloy) project in seconds.
@@ -144,17 +153,21 @@ For Node-style templates, the bundle adds:
 - `.github/workflows/ci.yml` with top-level `permissions: {}`, pinned actions,
   `harden-runner`, `persist-credentials: false`, no package-manager cache, and
   install scripts disabled.
-- `.github/workflows/release.yml` as a disabled-by-default npm trusted publishing
-  skeleton. It only publishes when `NPM_PUBLISH_ENABLED=true`, the package is no
-  longer private, and the protected `npm-publish` environment is configured.
+- `.github/workflows/vuln-scan.yml` — a daily scheduled SCA cron that runs the
+  package manager's audit against the committed lockfile. Catches CVEs disclosed
+  *after* the last PR or push and provides SOC 2 CC7.1
+  ([continuous vulnerability management](https://www.aikido.dev/blog/a-guide-to-automating-technical-vulnerability-management-for-soc-2))
+  evidence even when developers are not touching the repo.
 - CodeQL, OpenSSF Scorecard, zizmor, Dependabot, CODEOWNERS, and `SECURITY.md`.
 - `scripts/verify-lockfile-sources.mjs` plus a `verify:lockfile` package script
   that rejects git dependencies and non-registry tarball URLs in text lockfiles.
 
+The bundle deliberately does **not** generate an npm publish workflow.
+`create-daloy` scaffolds REST API services, not libraries; if you later carve
+out a reusable package, opt into npm trusted publishing yourself.
+
 For `deno-basic`, `--with-ci` generates a Deno-native CI workflow plus CodeQL,
 Scorecard, zizmor, Dependabot for GitHub Actions, CODEOWNERS, and `SECURITY.md`.
-It does not generate an npm release workflow because the Deno template has no
-`package.json`.
 
 If you omit `--code-owner`, the generated CODEOWNERS file uses
 `@your-org/security-team` as a placeholder. Replace it before relying on branch

package/bin/create-daloy.mjs

@@ -250,15 +250,27 @@ function renderBox(lines, options = {}) {
   return out.join("\n");
 }
 
-// Block-letter "DALOYJS" banner rendered with a left-to-right golden
-// gradient (dark goldenrod → bright gold) on truecolor terminals. Falls back
-// to a single bold-yellow line on 256-color TTYs and to plain text in dumb
-// terminals. The shape is built from half-block characters so it stays
-// compact (2 lines tall) and each glyph is 3 columns wide with a single
-// space between letters, keeping the top and bottom rows perfectly aligned.
-const LOGO_LINES = [
-  " \u2588\u2580\u2584 \u2584\u2580\u2588 \u2588   \u2588\u2580\u2588 \u2588 \u2588   \u2588 \u2584\u2580\u2580 ",
-  " \u2588\u2584\u2580 \u2588\u2580\u2588 \u2588\u2584\u2584 \u2588\u2584\u2588  \u2588  \u2584\u2584\u2588 \u2584\u2584\u2580 ",
+// "Flowing waves" banner that mirrors the DaloyJS brand mark: three sine
+// curves cascading left-to-right in sky-blue tones. Each row is rendered
+// with a left-to-right gradient on truecolor terminals, falls back to ANSI
+// cyan on 256-color TTYs, and degrades to ASCII tildes in dumb terminals.
+//
+// "Daloy" means "flow" in Filipino — the three waves represent contracts,
+// requests, and responses moving cleanly between client and server.
+const LOGO_WAVE_LINES = SUPPORTS_UNICODE
+  ? [
+      "\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F",
+      "\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F",
+      "\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F\u223F",
+    ]
+  : ["~".repeat(25), "~".repeat(25), "~".repeat(25)];
+
+// Sky-blue palette tuned to match `tailwindcss` sky-200/400/700 — the same
+// colors used in the wordmark on https://daloyjs.dev.
+const LOGO_WAVE_GRADIENTS = [
+  { start: [186, 230, 253], end: [125, 211, 252] }, // sky-200 -> sky-300
+  { start: [56, 189, 248], end: [14, 165, 233] }, //   sky-400 -> sky-500
+  { start: [2, 132, 199], end: [3, 105, 161] }, //     sky-600 -> sky-700
 ];
 
 function gradientLine(line, startRgb, endRgb) {
@@ -278,25 +290,26 @@ function gradientLine(line, startRgb, endRgb) {
 
 function printBanner(version) {
   if (!SUPPORTS_UNICODE) {
-    console.log(`\n${color(COLORS.bold + COLORS.yellow, "create-daloy")}  ${color(COLORS.dim, `v${version}`)}`);
+    console.log(`\n${color(COLORS.bold + COLORS.cyan, "create-daloy")}  ${color(COLORS.dim, `v${version}`)}`);
     console.log(color(COLORS.dim, "Contract-first REST APIs for Node, Bun, Deno, Vercel Edge, and Workers"));
     console.log(color(COLORS.dim, "https://daloyjs.dev\n"));
     return;
   }
-  // Golden gradient: DarkGoldenrod → Gold. Evokes the DaloyJS "flow of gold"
-  // brand and stays legible on both light and dark terminal backgrounds.
-  const start = [184, 134, 11]; // DarkGoldenrod
-  const end = [255, 215, 0]; // Gold
-  console.log("");
-  for (const line of LOGO_LINES) {
-    console.log(` ${gradientLine(line, start, end)}`);
+  for (let i = 0; i < LOGO_WAVE_LINES.length; i += 1) {
+    const { start, end } = LOGO_WAVE_GRADIENTS[i];
+    console.log(`  ${gradientLine(LOGO_WAVE_LINES[i], start, end)}`);
   }
+  // Centered wordmark beneath the waves: "Daloy" in neutral text, "JS" in
+  // brand sky-blue. Mirrors the SVG lockup used on the website.
+  const wordmark = `${color(COLORS.bold + COLORS.white, "Daloy")}${color(COLORS.bold + COLORS.cyan, "JS")}`;
+  const wordmarkPadding = " ".repeat(Math.max(0, Math.floor((stringWidth(LOGO_WAVE_LINES[0]) - 7) / 2)));
+  console.log(`  ${wordmarkPadding}${wordmark}`);
   // Build the welcome content lines (each contains its own ANSI color codes).
-  const headline = `${color(COLORS.bold + COLORS.yellow, "Welcome to DaloyJS")}  ${color(COLORS.gray, `\u2014 v${version}`)}`;
+  const headline = `${color(COLORS.bold + COLORS.cyan, "Welcome to DaloyJS")}  ${color(COLORS.gray, `\u2014 v${version}`)}`;
   const subline = color(COLORS.dim, "Contract-first REST APIs for Node, Bun, Deno, Vercel Edge, and Workers.");
   const docs = `${color(COLORS.gray, "docs:")} ${color(COLORS.cyan, "https://daloyjs.dev/docs")}`;
   console.log("");
-  console.log(renderBox([headline, subline, "", docs], { accent: COLORS.yellow }));
+  console.log(renderBox([headline, subline, "", docs], { accent: COLORS.cyan }));
   console.log("");
 }
 
@@ -556,6 +569,73 @@ async function normalizePackageManagerFiles(dir, packageManager) {
   }
 }
 
+function dockerInstallSnippet(packageManager) {
+  if (packageManager === "npm") {
+    return {
+      copy: "COPY package.json package-lock.json* npm-shrinkwrap.json* ./",
+      run: "RUN npm ci --ignore-scripts",
+      text: "npm ci --ignore-scripts",
+    };
+  }
+  if (packageManager === "yarn") {
+    return {
+      copy: "COPY package.json yarn.lock* ./",
+      run: "RUN corepack enable && yarn install --frozen-lockfile --ignore-scripts",
+      text: "yarn install --frozen-lockfile --ignore-scripts",
+    };
+  }
+  if (packageManager === "bun") {
+    return {
+      copy: "COPY package.json bun.lock* bun.lockb* ./",
+      run: "RUN bun install --frozen-lockfile --ignore-scripts",
+      text: "bun install --frozen-lockfile --ignore-scripts",
+    };
+  }
+  return {
+    copy: "COPY package.json pnpm-lock.yaml* ./",
+    run: "RUN corepack enable && corepack prepare pnpm@latest --activate && \\\n    pnpm install --frozen-lockfile --ignore-scripts",
+    text: "pnpm install --frozen-lockfile --ignore-scripts",
+  };
+}
+
+async function patchDockerfileForPackageManager(dir, packageManager) {
+  const file = path.join(dir, "Dockerfile");
+  if (!existsSync(file)) return;
+
+  const raw = await readFile(file, "utf8");
+  const install = dockerInstallSnippet(packageManager);
+  const defaultPnpmInstallBlock = [
+    "COPY package.json pnpm-lock.yaml* ./",
+    "RUN corepack enable && corepack prepare pnpm@latest --activate && \\",
+    "    pnpm install --frozen-lockfile --ignore-scripts",
+  ].join("\n");
+  let next = raw.replace(
+    "COPY package.json pnpm-lock.yaml* ./\nRUN corepack enable && corepack prepare pnpm@latest --activate && \\\n    pnpm install --frozen-lockfile --ignore-scripts",
+    `${install.copy}\n${install.run}`,
+  );
+  next = next.replace(defaultPnpmInstallBlock, `${install.copy}\n${install.run}`);
+
+  if (packageManager !== "pnpm") {
+    next = next.replaceAll(
+      "pnpm install --frozen-lockfile --ignore-scripts",
+      install.text,
+    );
+    next = next.replaceAll("pnpm build", runScriptCommand(packageManager, "build"));
+  }
+
+  if (packageManager === "bun" && next.includes("FROM ${NODE_IMAGE} AS builder")) {
+    if (!next.includes("ARG BUN_IMAGE=")) {
+      next = next.replace(
+        "ARG NODE_IMAGE=node:24-alpine\n",
+        "ARG NODE_IMAGE=node:24-alpine\nARG BUN_IMAGE=oven/bun:1-alpine\n",
+      );
+    }
+    next = next.replace("FROM ${NODE_IMAGE} AS builder", "FROM ${BUN_IMAGE} AS builder");
+  }
+
+  if (next !== raw) await writeFile(file, next, "utf8");
+}
+
 function hasPackageScript(packageJson, scriptName) {
   return typeof packageJson?.scripts?.[scriptName] === "string";
 }
@@ -584,6 +664,21 @@ function auditCommand(packageManager) {
   return "";
 }
 
+function auditStepName(packageManager, suffix = "") {
+  const baseName = packageManager === "bun" ? "Audit dependencies" : "Audit production dependencies";
+  return suffix ? `${baseName} ${suffix}` : baseName;
+}
+
+// Extra full-tree audit (includes devDependencies) for package managers that
+// expose separate prod/full scopes. Surfaced for triage but non-blocking so a
+// low-severity dev-tool advisory does not page the on-call.
+function auditFullCommand(packageManager) {
+  if (packageManager === "pnpm") return "pnpm audit";
+  if (packageManager === "npm") return "npm audit";
+  if (packageManager === "yarn") return "yarn audit";
+  return "";
+}
+
 function setupPackageManagerStep(packageManager) {
   if (packageManager === "pnpm") {
     return `      - name: Set up pnpm
@@ -612,15 +707,6 @@ function workflowStep(name, command) {
         run: ${command}`;
 }
 
-function multilineWorkflowStep(name, command) {
-  return `      - name: ${name}
-        run: |
-${command
-  .split("\n")
-  .map((line) => `          ${line}`)
-  .join("\n")}`;
-}
-
 async function readPackageJsonIfPresent(dir) {
   const file = path.join(dir, "package.json");
   if (!existsSync(file)) return null;
@@ -643,15 +729,18 @@ function renderCiReplacements({ packageManager, template, packageJson, codeOwner
   const setupPm = setupPackageManagerStep(packageManager);
   const needsBunRuntime = template === "bun-basic" && packageManager !== "bun";
   const audit = auditCommand(packageManager);
+  const auditFull = auditFullCommand(packageManager);
   const buildStep = hasPackageScript(packageJson, "build") ? workflowStep("Build", runScriptCommand(packageManager, "build")) : "";
-  const auditStep = audit ? workflowStep("Audit production dependencies", audit) : "";
-  const tagVersionCheck = `set -eu
-tag_version="\${GITHUB_REF_NAME#v}"
-pkg_version="$(node -p "require('./package.json').version")"
-if [ "$tag_version" != "$pkg_version" ]; then
-  echo "::error::Tag $GITHUB_REF_NAME does not match package.json version $pkg_version"
-  exit 1
-fi`;
+  const auditStep = audit ? workflowStep(auditStepName(packageManager), audit) : "";
+  // vuln-scan.yml: production-tree audit is blocking, full-tree audit is
+  // advisory (continue-on-error) so a low-severity dev-tool advisory does
+  // not page the on-call on a daily cron.
+  const auditProdStep = audit
+    ? workflowStep(auditStepName(packageManager, "(blocking)"), audit)
+    : workflowStep("No package-manager audit available", "echo 'No audit command available for this package manager; consider switching to npm/pnpm/yarn/bun.'");
+  const auditFullStep = auditFull
+    ? `      - name: Audit full dependency tree (advisory)\n        run: ${auditFull}\n        continue-on-error: true`
+    : "";
 
   return new Map([
     ["__CODE_OWNER__", codeOwner],
@@ -663,7 +752,8 @@ fi`;
     ["__TEST_COMMAND__", runScriptCommand(packageManager, "test")],
     ["__BUILD_STEP__", buildStep],
     ["__AUDIT_STEP__", auditStep],
-    ["__TAG_VERSION_CHECK_STEP__", multilineWorkflowStep("Verify tag matches package.json version", tagVersionCheck)],
+    ["__AUDIT_PROD_STEP__", auditProdStep],
+    ["__AUDIT_FULL_STEP__", auditFullStep],
   ]);
 }
 
@@ -1305,6 +1395,9 @@ async function main() {
       await patchPackageJson(targetDir, projectName, packageManager);
       logStep("Package metadata written", projectName);
       await patchTemplateTextFiles(targetDir, packageManager);
+      if (packageManager !== "pnpm") {
+        await patchDockerfileForPackageManager(targetDir, packageManager);
+      }
       await normalizePackageManagerFiles(targetDir, packageManager);
       if (packageManager !== "pnpm") {
         logStep("Package-manager config normalized", packageManager);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-daloy",
-  "version": "0.24.0",
+  "version": "0.34.0",
   "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
   "type": "module",
   "license": "MIT",
@@ -35,7 +35,9 @@
   "files": [
     "bin",
     "templates",
-    "README.md"
+    "README.md",
+    "sbom.cdx.json",
+    "sbom.spdx.json"
   ],
   "publishConfig": {
     "access": "public"
@@ -43,4 +45,4 @@
   "scripts": {
     "test": "node --test test/**/*.test.mjs"
   }
-}
+}

package/sbom.cdx.json

@@ -0,0 +1,56 @@
+{
+  "bomFormat": "CycloneDX",
+  "specVersion": "1.5",
+  "serialNumber": "urn:uuid:82c87bf3-10d1-59f3-9cc6-48dd49603d42",
+  "version": 1,
+  "metadata": {
+    "timestamp": "2026-05-21T23:55:46.185Z",
+    "tools": [
+      {
+        "vendor": "DaloyJS",
+        "name": "daloy-generate-sbom",
+        "version": "0.34.0"
+      }
+    ],
+    "authors": [],
+    "component": {
+      "type": "library",
+      "bom-ref": "pkg:npm/create-daloy@0.34.0",
+      "name": "create-daloy",
+      "version": "0.34.0",
+      "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
+      "purl": "pkg:npm/create-daloy@0.34.0",
+      "licenses": [
+        {
+          "license": {
+            "id": "MIT"
+          }
+        }
+      ],
+      "externalReferences": [
+        {
+          "type": "vcs",
+          "url": "https://github.com/daloyjs/daloy"
+        },
+        {
+          "type": "website",
+          "url": "https://github.com/daloyjs/daloy/tree/main/packages/create-daloy#readme"
+        }
+      ],
+      "swid": {
+        "tagId": "swidtag-create-daloy-0.34.0",
+        "name": "create-daloy",
+        "version": "0.34.0",
+        "tagVersion": 0,
+        "patch": false
+      }
+    }
+  },
+  "components": [],
+  "dependencies": [
+    {
+      "ref": "pkg:npm/create-daloy@0.34.0",
+      "dependsOn": []
+    }
+  ]
+}

package/sbom.spdx.json

@@ -0,0 +1,42 @@
+{
+  "spdxVersion": "SPDX-2.3",
+  "dataLicense": "CC0-1.0",
+  "SPDXID": "SPDXRef-DOCUMENT",
+  "name": "create-daloy-0.34.0",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-0.34.0-82c87bf3-10d1-59f3-9cc6-48dd49603d42",
+  "creationInfo": {
+    "created": "2026-05-21T23:55:46.185Z",
+    "creators": [
+      "Tool: daloy-generate-sbom",
+      "Organization: DaloyJS"
+    ],
+    "licenseListVersion": "3.24"
+  },
+  "packages": [
+    {
+      "SPDXID": "SPDXRef-Package-create-daloy",
+      "name": "create-daloy",
+      "versionInfo": "0.34.0",
+      "downloadLocation": "https://github.com/daloyjs/daloy",
+      "filesAnalyzed": false,
+      "licenseConcluded": "MIT",
+      "licenseDeclared": "MIT",
+      "copyrightText": "NOASSERTION",
+      "supplier": "NOASSERTION",
+      "externalRefs": [
+        {
+          "referenceCategory": "PACKAGE-MANAGER",
+          "referenceType": "purl",
+          "referenceLocator": "pkg:npm/create-daloy@0.34.0"
+        }
+      ]
+    }
+  ],
+  "relationships": [
+    {
+      "spdxElementId": "SPDXRef-DOCUMENT",
+      "relationshipType": "DESCRIBES",
+      "relatedSpdxElement": "SPDXRef-Package-create-daloy"
+    }
+  ]
+}

package/templates/_ci/deno/SECURITY.md

@@ -20,7 +20,11 @@ The `--with-ci` bundle adds these defaults:
 - Third-party actions are pinned to commit SHAs.
 - `actions/checkout` uses `persist-credentials: false`.
 - Deno CI runs `deno task typecheck` and `deno task test` with the template's narrow permission flags.
-- CodeQL, OpenSSF Scorecard, zizmor, Dependabot for GitHub Actions, and CODEOWNERS are generated.
+- If the generated project keeps the `Dockerfile`, container scanning lints it
+	with hadolint, scans the source tree and built image with Trivy, and warns
+	when `FROM` lines are not pinned to an immutable `@sha256:` digest.
+- CodeQL, OpenSSF Scorecard, zizmor, Dependabot for GitHub Actions and Docker
+	base images, and CODEOWNERS are generated.
 
 ## Required repository settings
 

package/templates/_ci/deno/_github/dependabot.yml

@@ -12,4 +12,15 @@ updates:
         patterns:
           - "*"
     commit-message:
-      prefix: "chore(actions)"
+      prefix: "chore(actions)"
+
+  # Keep the Deno runtime base image (Dockerfile `FROM`) patched. Combined
+  # with the `container-scan.yml` workflow, this catches base-image CVEs early.
+  - package-ecosystem: docker
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(docker)"

package/templates/_ci/deno/_github/workflows/container-scan.yml

@@ -0,0 +1,158 @@
+# Container security scan generated by create-daloy --with-ci.
+#
+# The Deno template has no npm package manager, but its Dockerfile still
+# deserves the same container review as Node-based scaffolds:
+#
+#   - hadolint lints the Dockerfile for known anti-patterns and unsafe
+#     instructions (CIS Docker Benchmark coverage).
+#   - Trivy scans the source tree (config + secrets + vulnerable lockfile
+#     entries), then scans the built image for OS + language CVEs.
+#   - SARIF results are uploaded to the Code Scanning tab so findings show
+#     up in the same place as CodeQL.
+
+name: Container scan
+
+on:
+  pull_request:
+    paths:
+      - "Dockerfile"
+      - ".dockerignore"
+      - "deno.json"
+      - "deno.lock"
+      - ".github/workflows/container-scan.yml"
+  push:
+    branches: [main]
+    paths:
+      - "Dockerfile"
+      - ".dockerignore"
+      - "deno.json"
+      - "deno.lock"
+      - ".github/workflows/container-scan.yml"
+  schedule:
+    # Weekly run catches newly-disclosed base-image CVEs even when the
+    # Dockerfile itself has not changed.
+    - cron: "17 6 * * 1"
+
+permissions: {}
+
+concurrency:
+  group: container-scan-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    name: Lint + scan container
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Detect Dockerfile
+        id: detect
+        run: |
+          if [ -f Dockerfile ]; then
+            echo "present=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "present=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::No Dockerfile found at the repo root; skipping container scan."
+          fi
+
+      - name: Pin check (FROM @sha256 digest)
+        # Floating tags like `denoland/deno:alpine` silently re-resolve to
+        # fresh digests on every build. Pinning `FROM <image>@sha256:<digest>`
+        # makes the base reproducible; the Docker Dependabot ecosystem then
+        # opens PRs when newer digests are published.
+        if: steps.detect.outputs.present == 'true'
+        run: |
+          unpinned=0
+          while IFS= read -r line; do
+            ref="${line#FROM }"
+            ref="${ref#from }"
+            ref="${ref%% AS *}"
+            ref="${ref%% as *}"
+            ref="${ref## }"
+            ref="${ref%% }"
+            case "$ref" in
+              scratch|"\${"*|*"@sha256:"*) ;;
+              *)
+                echo "::warning file=Dockerfile::FROM '$ref' is not pinned to a @sha256:<digest>. Override at build time with --build-arg DENO_IMAGE=denoland/deno:alpine@sha256:<digest> or hard-code the digest and let Dependabot keep it fresh."
+                unpinned=$((unpinned + 1))
+                ;;
+            esac
+          done < <(grep -E '^(FROM|from) ' Dockerfile || true)
+          if [ "$unpinned" -gt 0 ]; then
+            echo "::notice::$unpinned unpinned FROM line(s)."
+          fi
+
+      - name: Lint Dockerfile (hadolint)
+        if: steps.detect.outputs.present == 'true'
+        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+        with:
+          dockerfile: Dockerfile
+          format: sarif
+          output-file: hadolint.sarif
+          no-fail: true
+
+      - name: Upload hadolint SARIF
+        if: steps.detect.outputs.present == 'true'
+        uses: github/codeql-action/upload-sarif@52485aec7be33610227643b0fe83936b8b5f061a # v3
+        with:
+          sarif_file: hadolint.sarif
+          category: hadolint
+
+      - name: Trivy filesystem scan (config + secrets + vulns)
+        if: steps.detect.outputs.present == 'true'
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+          format: sarif
+          output: trivy-fs.sarif
+          exit-code: "0"
+
+      - name: Upload Trivy filesystem SARIF
+        if: steps.detect.outputs.present == 'true'
+        uses: github/codeql-action/upload-sarif@52485aec7be33610227643b0fe83936b8b5f061a # v3
+        with:
+          sarif_file: trivy-fs.sarif
+          category: trivy-fs
+
+      - name: Build image (no push)
+        if: steps.detect.outputs.present == 'true'
+        run: |
+          docker build --pull --load -t local/app:scan .
+
+      - name: Trivy image scan
+        if: steps.detect.outputs.present == 'true'
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          image-ref: local/app:scan
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+          format: sarif
+          output: trivy-image.sarif
+          exit-code: "1"
+          vuln-type: os,library
+
+      - name: Upload Trivy image SARIF
+        if: always() && steps.detect.outputs.present == 'true'
+        uses: github/codeql-action/upload-sarif@52485aec7be33610227643b0fe83936b8b5f061a # v3
+        with:
+          sarif_file: trivy-image.sarif
+          category: trivy-image

package/templates/_ci/node/SECURITY.md

@@ -23,7 +23,38 @@ The `--with-ci` bundle adds these defaults:
 - Package-manager caches are disabled in CI to avoid cache-poisoning bridges.
 - Lockfile source verification rejects git dependencies and non-registry tarball URLs.
 - CodeQL, OpenSSF Scorecard, zizmor, Dependabot, and CODEOWNERS are generated.
-- npm publishing is disabled until `NPM_PUBLISH_ENABLED=true` is set and npm trusted publishing is configured.
+- A daily scheduled `vuln-scan.yml` runs the package manager's audit against the committed lockfile so newly-disclosed CVEs are surfaced even when no PR or push has run CI (SOC 2 CC7.1 continuous-vulnerability-management evidence).
+- No npm publish workflow is generated: this scaffold is a REST API service, not a published package. If you later carve out a reusable library you can opt into npm trusted publishing yourself.
+
+## Container hardening
+
+If you scaffolded the `node-basic` template (the only one that ships a
+`Dockerfile`), the following defaults are also enabled. They cover the same
+ground the Snyk container-security guidance recommends, using only free,
+SHA-pinned open-source tooling:
+
+- Runtime stage is `node:24-alpine` with `tini` as PID 1 and **no `curl`** —
+  the `HEALTHCHECK` uses BusyBox `wget` already shipped in the image.
+- Base image is consumed through `ARG NODE_IMAGE`, so production builds can
+  pin to an immutable digest: `docker build --build-arg NODE_IMAGE=node:24-alpine@sha256:<digest> .`.
+- App runs as a non-root user (uid 1001) with `STOPSIGNAL SIGTERM`; the
+  framework's graceful-shutdown drain fires on container stop.
+- `Dockerfile` is monitored by Dependabot's `docker` ecosystem so the base
+  image gets bumped automatically when CVEs land.
+- The `.github/workflows/container-scan.yml` workflow runs on every PR
+  and weekly on `main`:
+  - **Pin check** emits a PR annotation when any `FROM` line is not
+    pinned to a `@sha256:<digest>` (Aikido x Root.io 2026,
+    [Harden your containers without the headaches](https://www.aikido.dev/blog/aikido-x-root-io-harden-your-containers-without-the-headaches)).
+    Non-blocking so a fresh scaffold goes green; pair with the `docker`
+    Dependabot ecosystem to keep the pinned digest current.
+  - **hadolint** lints the `Dockerfile` (CIS Docker Benchmark coverage).
+  - **Trivy** scans the source tree for secrets, config issues, and
+    vulnerable lockfile entries.
+  - **Trivy** builds the image and scans it for OS + language CVEs
+    (`HIGH`/`CRITICAL`, `--ignore-unfixed`); merges block on CRITICAL.
+  - All findings are uploaded as SARIF to the GitHub **Code Scanning**
+    tab alongside CodeQL.
 
 ## Required repository settings
 
@@ -32,5 +63,4 @@ Before relying on these files for a company project:
 1. Replace `@your-org/security-team` in `.github/CODEOWNERS` or pass `--code-owner` when scaffolding.
 2. Protect the `main` branch and require the CI, CodeQL, Scorecard, and zizmor checks.
 3. Enable GitHub secret scanning and push protection.
-4. Configure a protected `npm-publish` Environment before enabling npm publish.
-5. Keep `ignore-scripts=true` and the `pnpm-workspace.yaml` supply-chain settings on when using pnpm.
+4. Keep `ignore-scripts=true` and the `pnpm-workspace.yaml` supply-chain settings on when using pnpm.

package/templates/_ci/node/_github/CODEOWNERS

@@ -6,7 +6,7 @@
 # Workflow / CI / CD.
 /.github/                         __CODE_OWNER__
 /.github/workflows/               __CODE_OWNER__
-/.github/workflows/release.yml    __CODE_OWNER__
+/.github/workflows/vuln-scan.yml  __CODE_OWNER__
 /.github/dependabot.yml           __CODE_OWNER__
 /.github/CODEOWNERS               __CODE_OWNER__
 

package/templates/_ci/node/_github/dependabot.yml

@@ -25,4 +25,15 @@ updates:
       dev-dependencies:
         dependency-type: development
     commit-message:
-      prefix: "chore(deps)"
+      prefix: "chore(deps)"
+
+  # Keep the runtime base image (Dockerfile `FROM`) patched. Combined with
+  # the `container-scan.yml` workflow, this catches base-image CVEs early.
+  - package-ecosystem: docker
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(docker)"