create-daloy 0.34.2 → 0.35.0

package/README.md

@@ -53,10 +53,11 @@ pnpm create daloy@latest my-api \
 | `--template <name>` | `node-basic` (default), `vercel-edge`, `cloudflare-worker`, `bun-basic`, or `deno-basic`. |
 | `--package-manager <pm>` | `pnpm` (default), `npm`, `yarn`, or `bun`. Ignored for `deno-basic`. |
 | `--list-templates` | Print available templates with descriptions. |
-| `--install` / `--no-install` | Install dependencies after scaffolding. Defaults to **Y** for npm/yarn/bun and **N** for pnpm (so first-time runs are not blocked by the 24h `minimumReleaseAge` embargo or the `pnpm.onlyBuiltDependencies` allowlist required by the hardened `.npmrc`). |
+| `--install` / `--no-install` | Install dependencies after scaffolding. Defaults to **Y** for npm/yarn/bun and **N** for pnpm (so first-time runs are not blocked by the 24h `minimumReleaseAge` embargo and so you can review the scaffold's hardened `.npmrc` and `pnpm-workspace.yaml` before the first install). |
 | `--git` / `--no-git` | Initialize a git repository. Defaults to interactive. |
 | `--minimal` | Strip the bookstore demo route and the built-in `/docs` + `/openapi.json` routes so only the framework bootstrap and `/healthz` ship. |
 | `--with-ci` / `--no-ci` | Add the hardened GitHub Actions, Dependabot, CODEOWNERS, SECURITY.md, and lockfile-source verification bundle. **Defaults to Y** so scaffolded projects are secure by default. |
+| `--with-deploy` / `--no-deploy` | Add the starter `.github/workflows/deploy.yml`. Defaults to the same value as `--with-ci`, so you can keep CI but opt out of deploy scaffolding with `--no-deploy`. |
 | `--code-owner <owner>` | Replace the CODEOWNERS placeholder when `--with-ci` is used, for example `@acme/security`. |
 | `--force` | Overwrite an existing non-empty directory. |
 | `--yes` | Accept all defaults; never prompt. |
@@ -85,8 +86,7 @@ A minimal Cloudflare Worker bootstrap using `@daloyjs/core/cloudflare` with:
 
 - `wrangler.toml` ready to deploy.
 - `secureHeaders` and `requestId` enabled by default, with smaller edge-friendly body and timeout limits.
-- Zod-validated route exposed as `fetch`.
-- A sample test that exercises `app.request(...)`.
+- A Zod-validated `/healthz` route and contract-first `/books/:id` route exposed via `toFetchHandler(app)`.
 
 ### `vercel-edge`
 
@@ -153,11 +153,51 @@ For Node-style templates, the bundle adds:
 - `.github/workflows/ci.yml` with top-level `permissions: {}`, pinned actions,
   `harden-runner`, `persist-credentials: false`, no package-manager cache, and
   install scripts disabled.
+- `.github/workflows/deploy.yml` as a manual-only deployment starter. Container
+  templates publish a Docker image to GHCR with the repo-scoped `GITHUB_TOKEN`,
+  while Vercel and Cloudflare templates ship concrete CLI deploy steps that
+  read their platform credentials from GitHub Actions secrets/variables. The
+  deploy job is gated to `main` or a tag by default, and Node-style templates
+  re-run `verify:lockfile` before shipping.
 - `.github/workflows/vuln-scan.yml` — a daily scheduled SCA cron that runs the
   package manager's audit against the committed lockfile. Catches CVEs disclosed
   *after* the last PR or push and provides SOC 2 CC7.1
   ([continuous vulnerability management](https://www.aikido.dev/blog/a-guide-to-automating-technical-vulnerability-management-for-soc-2))
   evidence even when developers are not touching the repo.
+- `.github/workflows/osv-scan.yml` — a SECOND, independent SCA source.
+  `vuln-scan.yml` queries the package manager's audit feed (GHSA); this one
+  runs Google's OSV-Scanner against the committed lockfile and cross-references
+  the OpenSSF
+  [malicious-packages](https://github.com/ossf/malicious-packages) corpus, so
+  a malware advisory that lands in OSV.dev before it propagates to GHSA still
+  fails the build. The binary is downloaded from a pinned official release and
+  verified by SHA-256 before execution — no third-party action is added to the
+  supply chain just for this scan. This is the missing layer the Aikido
+  [SAST vs SCA](https://www.aikido.dev/blog/sast-vs-sca) and
+  [npm-audit-guide](https://www.aikido.dev/blog/npm-audit-guide) write-ups
+  warn about, and the Deno scaffold gets it too (Deno has no `audit` built
+  in, so without OSV-Scanner a Deno scaffold would have no scheduled SCA at
+  all).
+- `.github/workflows/secret-scan.yml` — runs [gitleaks](https://github.com/gitleaks/gitleaks)
+  on every PR / push (working tree) and on a daily schedule across the **full
+  git history**, so a credential leaked anywhere in any commit, branch, or tag
+  is surfaced even if GitHub-native push protection missed it. The gitleaks
+  binary is downloaded from a pinned official release and verified by SHA-256
+  before execution — no third-party action is added to the supply chain just
+  for this scan. See Aikido's
+  [Secrets Detection guide](https://www.aikido.dev/blog/secret-detection-application-security)
+  for why history-aware scanning is the floor and not the ceiling.
+- `.github/workflows/opengrep.yml` — a second SAST source alongside CodeQL,
+  using [Opengrep](https://github.com/opengrep/opengrep) (an open-source
+  Semgrep fork) with the same pinned-binary + SHA-256-verified pattern as the
+  OSV and gitleaks scans.
+- `.github/workflows/container-scan.yml` — runs Trivy against the image
+  produced by the template's `_Dockerfile` (filesystem scan on PR, full image
+  scan on push to `main`) so a base-image CVE or a vulnerable layer is
+  surfaced before deploy.
+- `.github/workflows/dast.yml` — a manual-only dynamic-analysis workflow that
+  boots the scaffolded API and runs an OWASP ZAP baseline scan against it,
+  for teams that want a black-box check before promoting a release.
 - CodeQL, OpenSSF Scorecard, zizmor, Dependabot, CODEOWNERS, and `SECURITY.md`.
 - `scripts/verify-lockfile-sources.mjs` plus a `verify:lockfile` package script
   that rejects git dependencies and non-registry tarball URLs in text lockfiles.
@@ -166,20 +206,36 @@ The bundle deliberately does **not** generate an npm publish workflow.
 `create-daloy` scaffolds REST API services, not libraries; if you later carve
 out a reusable package, opt into npm trusted publishing yourself.
 
-For `deno-basic`, `--with-ci` generates a Deno-native CI workflow plus CodeQL,
-Scorecard, zizmor, Dependabot for GitHub Actions, CODEOWNERS, and `SECURITY.md`.
+For `deno-basic`, `--with-ci` generates a Deno-native CI workflow, a manual-only
+container publish starter for GHCR that is guarded to `main` or a tag by
+default, plus CodeQL, Opengrep, **OSV-Scanner** (the only scheduled SCA layer
+a Deno scaffold has, since Deno ships no `audit`), Scorecard, zizmor,
+Dependabot for GitHub Actions, CODEOWNERS, and `SECURITY.md`.
+
+If you want the governance bundle but not the deployment starter, pass
+`--with-ci --no-deploy`. If you only want a deployment starter, pass
+`--with-deploy --no-ci`.
 
 If you omit `--code-owner`, the generated CODEOWNERS file uses
 `@your-org/security-team` as a placeholder. Replace it before relying on branch
 protection. You should also enable GitHub secret scanning, push protection, and
 required status checks in the repository settings.
 
+## Container-first scaffolds
+
+Every template (Node, Bun, Vercel Edge, Cloudflare Worker, and Deno) ships a
+production-oriented `Dockerfile` and `.dockerignore` with the secure-by-default
+posture from `@daloyjs/core` `0.24.0`: a non-root user, `STOPSIGNAL SIGTERM`,
+`tini` as PID 1, and a `HEALTHCHECK` pointed at `/readyz`. Node-style templates
+also ship an `.env.example`. None of this is required — delete or replace
+whatever you do not need.
+
 ## What the CLI guarantees
 
 - Zero runtime dependencies (uses only Node built-ins) for a clean supply-chain footprint.
 - A modern terminal experience with Unicode/color capability detection and ASCII fallbacks.
 - Templates are copied verbatim from this package's `templates/` directory.
-- Files and folders prefixed with `_` are renamed on copy (`_gitignore` → `.gitignore`, `_npmrc` → `.npmrc`, `_github/` → `.github`, `_agents/` → `.agents/`) to survive npm packing.
+- Files and folders prefixed with `_` are renamed on copy (`_gitignore` → `.gitignore`, `_npmrc` → `.npmrc`, `_github/` → `.github`, `_agents/` → `.agents/`, `_Dockerfile` → `Dockerfile`, `_dockerignore` → `.dockerignore`, `_env.example` → `.env.example`) to survive npm packing.
 - pnpm-specific `.npmrc` hardening is kept only when you choose `pnpm`; other package managers get a clean project without unsupported config warnings.
 - pnpm projects ship with `ignore-scripts=true`, `minimum-release-age=1440`, `verify-store-integrity=true`, `prefer-frozen-lockfile=true`, and `strict-peer-dependencies=true` by default.
 - `--with-ci` projects ship with pinned GitHub Actions workflows, CODEOWNERS, Dependabot, SECURITY.md, and lockfile-source verification.

package/bin/create-daloy.mjs

@@ -329,10 +329,11 @@ ${heading("Options")}
   ${color(COLORS.green, "--template <name>")}          ${TEMPLATES.join(" | ")}  ${color(COLORS.dim, "(default: node-basic)")}
   ${color(COLORS.green, "--package-manager <pm>")}     ${PACKAGE_MANAGERS.join(" | ")}  ${color(COLORS.dim, "(default: pnpm)")}
   ${color(COLORS.green, "--list-templates")}           Print available templates and exit.
-  ${color(COLORS.green, "--install / --no-install")}   Install dependencies after scaffolding. ${color(COLORS.dim, "(default: Y, except pnpm \u2014 N to respect minimumReleaseAge + onlyBuiltDependencies)")}
+  ${color(COLORS.green, "--install / --no-install")}   Install dependencies after scaffolding. ${color(COLORS.dim, "(default: Y, except pnpm \u2014 N to respect minimumReleaseAge + ignore-scripts review)")}
   ${color(COLORS.green, "--git / --no-git")}           Initialize a git repository.
   ${color(COLORS.green, "--minimal")}                  Strip the bookstore + OpenAPI docs demo routes.
   ${color(COLORS.green, "--with-ci / --no-ci")}         Add hardened GitHub Actions + governance files. ${color(COLORS.dim, "(default: Y)")}
+  ${color(COLORS.green, "--with-deploy / --no-deploy")} Add starter deploy.yml workflow(s). ${color(COLORS.dim, "(default: inherits --with-ci)")}
   ${color(COLORS.green, "--code-owner <owner>")}        CODEOWNERS owner for --with-ci, e.g. @acme/security.
   ${color(COLORS.green, "--force")}                    Overwrite an existing non-empty directory.
   ${color(COLORS.green, "--yes, -y")}                  Accept all defaults; never prompt.
@@ -380,6 +381,7 @@ function parseArgs(argv) {
     listTemplates: false,
     minimal: false,
     ci: undefined,
+    deploy: undefined,
     codeOwner: undefined,
   };
   const args = [...argv];
@@ -393,6 +395,8 @@ function parseArgs(argv) {
     else if (a === "--minimal") out.minimal = true;
     else if (a === "--with-ci") out.ci = true;
     else if (a === "--no-ci") out.ci = false;
+    else if (a === "--with-deploy") out.deploy = true;
+    else if (a === "--no-deploy") out.deploy = false;
     else if (a === "--code-owner") out.codeOwner = args.shift();
     else if (a?.startsWith("--code-owner=")) out.codeOwner = a.slice("--code-owner=".length);
     else if (a === "--install") out.install = true;
@@ -686,6 +690,15 @@ function runScriptCommand(packageManager, scriptName) {
   return `${packageManager} run ${scriptName}`;
 }
 
+function execCommand(packageManager, binary, args = "") {
+  const suffix = args ? ` ${args}` : "";
+  if (packageManager === "pnpm") return `pnpm exec ${binary}${suffix}`;
+  if (packageManager === "npm") return `npx ${binary}${suffix}`;
+  if (packageManager === "yarn") return `yarn exec ${binary}${suffix}`;
+  if (packageManager === "bun") return `bunx ${binary}${suffix}`;
+  return `${binary}${suffix}`;
+}
+
 function installCommand(packageManager) {
   if (packageManager === "pnpm") return "pnpm install --frozen-lockfile --ignore-scripts";
   if (packageManager === "npm") return "npm ci --ignore-scripts";
@@ -740,6 +753,227 @@ function setupBunStep() {
           bun-version: latest`;
 }
 
+function setupNodeStep() {
+  return `      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 24
+          # Package-manager caching is intentionally disabled. Shared caches
+          # can bridge fork PRs into trusted branches when mis-keyed.`;
+}
+
+function installDependenciesStep(command) {
+  return `      - name: Install dependencies
+        run: ${command}
+        env:
+          npm_config_ignore_scripts: "true"`;
+}
+
+function joinWorkflowBlocks(blocks) {
+  return blocks.filter(Boolean).join("\n\n");
+}
+
+// Deploy job ref guard. `workflow_dispatch` accepts any branch by default, so
+// a junior could trigger a production deploy from an unreviewed feature
+// branch by accident. This `if:` limits the deploy job to `main` or a tag
+// push while still allowing maintainers to flip the guard off if they need
+// to deploy from a release branch.
+function deployRefGuard() {
+  return `    # Lock production deploys to main or a tag push. \`workflow_dispatch\`
+    # accepts any branch, so this guard stops an accidental dispatch from a
+    # feature branch from shipping unreviewed code.
+    if: github.ref == 'refs/heads/main' || github.ref_type == 'tag'`;
+}
+
+function containerRegistryHeader() {
+  return `# Default target: GitHub Container Registry (GHCR).
+# No extra secret is required; the workflow uses the repo-scoped GITHUB_TOKEN.
+# After the image is published, point your platform at GHCR or replace the
+# final push steps with your provider's deploy command.
+#
+# Every pushed image is also signed and attested with Sigstore Cosign
+# (keyless / OIDC) and an SPDX SBOM, so consumers can verify provenance
+# with \`cosign verify\` and \`cosign verify-attestation --type spdxjson\`
+# instead of trusting the registry alone. See Aikido's "Container
+# Security Best Practices" (https://www.aikido.dev/blog/container-security-best-practices)
+# for why signed images + SBOM attestation are the supply-chain floor.
+#
+# Optional container-host handoff examples:
+#   - Fly.io: install flyctl in a later step and run
+#       flyctl deploy --image "$IMAGE_REPO@\${IMAGE_DIGEST}" --remote-only
+#   - Render: create an image-backed service that tracks
+#       ghcr.io/<owner>/<repo>@\${IMAGE_DIGEST}`;
+}
+
+function containerPublishSteps() {
+  return `      - name: Log in to GHCR
+        env:
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -eu
+          echo "$GH_TOKEN" | docker login ghcr.io -u "\${{ github.actor }}" --password-stdin
+
+      - name: Derive image name
+        run: |
+          set -eu
+          owner="\${GITHUB_REPOSITORY_OWNER,,}"
+          repo="\${GITHUB_REPOSITORY#*/}"
+          repo="\${repo,,}"
+          echo "IMAGE_REPO=ghcr.io/\${owner}/\${repo}" >> "$GITHUB_ENV"
+
+      - name: Build image
+        env:
+          DOCKER_BUILDKIT: "1"
+        run: |
+          set -eu
+          docker build \
+            --tag "$IMAGE_REPO:sha-\${GITHUB_SHA}" \
+            --tag "$IMAGE_REPO:latest" \
+            .
+
+      - name: Push image
+        run: |
+          set -eu
+          docker push "$IMAGE_REPO:sha-\${GITHUB_SHA}"
+          docker push "$IMAGE_REPO:latest"
+
+      - name: Resolve pushed image digest
+        # Resolve and pin the immutable digest the rest of the workflow
+        # signs and attests against. Signing a mutable tag would let any
+        # later push silently re-point a "verified" tag at attacker
+        # content; binding cosign + the SBOM attestation to
+        # \${IMAGE_REPO}@sha256:<digest> closes that race.
+        run: |
+          set -eu
+          digest="$(docker inspect --format='{{index .RepoDigests 0}}' "$IMAGE_REPO:sha-\${GITHUB_SHA}" | awk -F@ '{print $2}')"
+          if [ -z "$digest" ]; then
+            echo "::error::Failed to resolve image digest for $IMAGE_REPO:sha-\${GITHUB_SHA}" >&2
+            exit 1
+          fi
+          echo "IMAGE_DIGEST=$digest" >> "$GITHUB_ENV"
+          echo "IMAGE_REF=$IMAGE_REPO@$digest" >> "$GITHUB_ENV"
+          echo "::notice::Signed image reference: $IMAGE_REPO@$digest"
+
+      - name: Install Cosign
+        # SHA-pinned per the project's actions-pinning policy. v4.1.2,
+        # commit 6f9f17788090df1f26f669e9d70d6ae9567deba6.
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+
+      - name: Sign image with Cosign (keyless / OIDC)
+        # Keyless signing uses the workflow's \`id-token\` OIDC identity
+        # — no long-lived signing key to leak. Verifiers can pin to
+        # \`--certificate-identity\` matching this workflow URL.
+        env:
+          COSIGN_EXPERIMENTAL: "1"
+        run: |
+          set -eu
+          cosign sign --yes "$IMAGE_REF"
+
+      - name: Generate SPDX SBOM for image
+        # SHA-pinned per the project's actions-pinning policy. v0.24.0,
+        # commit e22c389904149dbc22b58101806040fa8d37a610.
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        with:
+          image: \${{ env.IMAGE_REF }}
+          format: spdx-json
+          output-file: sbom.spdx.json
+          upload-artifact: false
+          upload-release-assets: false
+
+      - name: Attest SBOM with Cosign
+        env:
+          COSIGN_EXPERIMENTAL: "1"
+        run: |
+          set -eu
+          cosign attest --yes \
+            --predicate sbom.spdx.json \
+            --type spdxjson \
+            "$IMAGE_REF"`;
+}
+
+function vercelDeployHeader() {
+  return `# Configure before the first run:
+#   - GitHub Actions secret: VERCEL_TOKEN
+#   - GitHub Actions variables or environment variables: VERCEL_ORG_ID and VERCEL_PROJECT_ID
+# This workflow stays manual-only until you wire those in and decide whether
+# you want automatic deploys from main.`;
+}
+
+function cloudflareDeployHeader() {
+  return `# Configure before the first run:
+#   - GitHub Actions secret: CLOUDFLARE_API_TOKEN
+#   - GitHub Actions variable or environment variable: CLOUDFLARE_ACCOUNT_ID
+# Keep this manual-only until the worker is linked to the right account and
+# the production environment has approval rules.`;
+}
+
+function providerDeploySetup({ packageManager, needsBunRuntime }) {
+  return joinWorkflowBlocks([
+    setupPackageManagerStep(packageManager),
+    setupNodeStep(),
+    needsBunRuntime ? setupBunStep() : "",
+    installDependenciesStep(installCommand(packageManager)),
+  ]);
+}
+
+function vercelDeploySteps(packageManager) {
+  return `      - name: Deploy to Vercel
+        env:
+          VERCEL_TOKEN: \${{ secrets.VERCEL_TOKEN }}
+          VERCEL_ORG_ID: \${{ vars.VERCEL_ORG_ID }}
+          VERCEL_PROJECT_ID: \${{ vars.VERCEL_PROJECT_ID }}
+        run: |
+          set -eu
+          : "\${VERCEL_TOKEN:?Set the VERCEL_TOKEN Actions secret before running this workflow.}"
+          : "\${VERCEL_ORG_ID:?Set the VERCEL_ORG_ID Actions variable before running this workflow.}"
+          : "\${VERCEL_PROJECT_ID:?Set the VERCEL_PROJECT_ID Actions variable before running this workflow.}"
+          ${execCommand(packageManager, "vercel", "deploy --prod --yes --token \"$VERCEL_TOKEN\"")}`;
+}
+
+function cloudflareDeploySteps(packageManager) {
+  return `      - name: Deploy to Cloudflare Workers
+        env:
+          CLOUDFLARE_API_TOKEN: \${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: \${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+        run: |
+          set -eu
+          : "\${CLOUDFLARE_API_TOKEN:?Set the CLOUDFLARE_API_TOKEN Actions secret before running this workflow.}"
+          : "\${CLOUDFLARE_ACCOUNT_ID:?Set the CLOUDFLARE_ACCOUNT_ID Actions variable before running this workflow.}"
+          ${execCommand(packageManager, "wrangler", "deploy")}`;
+}
+
+function renderDeployConfig({ template, packageManager, needsBunRuntime }) {
+  if (template === "vercel-edge") {
+    return {
+      header: vercelDeployHeader(),
+      jobName: "Deploy to Vercel",
+      jobPermissions: "",
+      setupSteps: providerDeploySetup({ packageManager, needsBunRuntime }),
+      steps: vercelDeploySteps(packageManager),
+    };
+  }
+  if (template === "cloudflare-worker") {
+    return {
+      header: cloudflareDeployHeader(),
+      jobName: "Deploy to Cloudflare Workers",
+      jobPermissions: "",
+      setupSteps: providerDeploySetup({ packageManager, needsBunRuntime }),
+      steps: cloudflareDeploySteps(packageManager),
+    };
+  }
+  return {
+    header: containerRegistryHeader(),
+    jobName: "Publish container image",
+    // `packages: write` lets us push to GHCR; `id-token: write` lets
+    // Cosign mint a short-lived OIDC identity for keyless image signing
+    // + SBOM attestation. Both are scoped to this single job — the
+    // top-level workflow still has `permissions: {}`.
+    jobPermissions: "      packages: write\n      id-token: write",
+    setupSteps: "",
+    steps: containerPublishSteps(),
+  };
+}
+
 function workflowStep(name, command) {
   return `      - name: ${name}
         run: ${command}`;
@@ -763,13 +997,21 @@ async function addLockfileVerifyScript(dir) {
   await writePackageJson(dir, packageJson);
 }
 
-function renderCiReplacements({ packageManager, template, packageJson, codeOwner }) {
+function renderCiReplacements({ packageManager, template, packageJson, codeOwner, includeSecurityBundle = true }) {
   const setupPm = setupPackageManagerStep(packageManager);
   const needsBunRuntime = template === "bun-basic" && packageManager !== "bun";
   const audit = auditCommand(packageManager);
   const auditFull = auditFullCommand(packageManager);
   const buildStep = hasPackageScript(packageJson, "build") ? workflowStep("Build", runScriptCommand(packageManager, "build")) : "";
   const auditStep = audit ? workflowStep(auditStepName(packageManager), audit) : "";
+  const deploy = renderDeployConfig({ template, packageManager, needsBunRuntime });
+  // The verify:lockfile script is only scaffolded when the security bundle
+  // ships. In a deploy-only scaffold the script does not exist on disk, so
+  // the deploy workflow must omit the step instead of failing fast on a
+  // missing file.
+  const deployVerifyLockfileStep = includeSecurityBundle
+    ? workflowStep("Verify lockfile sources", runScriptCommand(packageManager, "verify:lockfile"))
+    : "";
   // vuln-scan.yml: production-tree audit is blocking, full-tree audit is
   // advisory (continue-on-error) so a low-severity dev-tool advisory does
   // not page the on-call on a daily cron.
@@ -781,6 +1023,13 @@ function renderCiReplacements({ packageManager, template, packageJson, codeOwner
     : "";
 
   return new Map([
+    ["__DEPLOY_HEADER__", deploy.header],
+    ["__DEPLOY_JOB_NAME__", deploy.jobName],
+    ["__DEPLOY_JOB_PERMISSIONS__", deploy.jobPermissions],
+    ["__DEPLOY_SETUP_STEPS__", deploy.setupSteps],
+    ["__DEPLOY_STEPS__", deploy.steps],
+    ["__DEPLOY_VERIFY_LOCKFILE_STEP__", deployVerifyLockfileStep],
+    ["__DEPLOY_REF_GUARD__", deployRefGuard()],
     ["__CODE_OWNER__", codeOwner],
     ["__SETUP_PACKAGE_MANAGER_STEP__", setupPm],
     ["__SETUP_BUN_RUNTIME_STEP__", needsBunRuntime ? setupBunStep() : ""],
@@ -817,7 +1066,35 @@ async function replacePlaceholdersInTree(dir, replacements) {
   }
 }
 
-async function copyCiBundle(targetDir, template, packageManager, skipPackageManager, codeOwner) {
+async function pruneCiBundle(targetDir, flavor, { includeSecurityBundle, includeDeployWorkflow }) {
+  if (!includeSecurityBundle) {
+    const workflowFiles = flavor === "deno"
+      ? ["ci.yml", "codeql.yml", "container-scan.yml", "dast.yml", "opengrep.yml", "osv-scan.yml", "scorecard.yml", "secret-scan.yml", "zizmor.yml"]
+      : ["ci.yml", "codeql.yml", "container-scan.yml", "dast.yml", "opengrep.yml", "osv-scan.yml", "scorecard.yml", "secret-scan.yml", "vuln-scan.yml", "zizmor.yml"];
+    for (const file of workflowFiles) {
+      await rm(path.join(targetDir, ".github", "workflows", file), { force: true });
+    }
+    await rm(path.join(targetDir, ".github", "dependabot.yml"), { force: true });
+    await rm(path.join(targetDir, ".github", "CODEOWNERS"), { force: true });
+    await rm(path.join(targetDir, "SECURITY.md"), { force: true });
+    if (flavor === "node") {
+      await rm(path.join(targetDir, "scripts", "verify-lockfile-sources.mjs"), { force: true });
+    }
+  }
+
+  if (!includeDeployWorkflow) {
+    await rm(path.join(targetDir, ".github", "workflows", "deploy.yml"), { force: true });
+  }
+}
+
+async function copyCiBundle(
+  targetDir,
+  template,
+  packageManager,
+  skipPackageManager,
+  codeOwner,
+  { includeSecurityBundle = true, includeDeployWorkflow = true } = {},
+) {
   const flavor = skipPackageManager ? "deno" : "node";
   const sourceDir = path.join(CI_TEMPLATES_DIR, flavor);
   if (!existsSync(sourceDir)) {
@@ -825,23 +1102,42 @@ async function copyCiBundle(targetDir, template, packageManager, skipPackageMana
   }
   await copyTemplate(sourceDir, targetDir);
 
-  const candidate = codeOwner?.trim() ?? "";
-  if (candidate && !VALID_CODE_OWNER.test(candidate)) {
-    throw new Error(
-      `Invalid --code-owner "${candidate}". Use a GitHub handle (@user), a team (@org/team), or an email address.`,
-    );
+  await pruneCiBundle(targetDir, flavor, { includeSecurityBundle, includeDeployWorkflow });
+
+  if (!includeSecurityBundle && !includeDeployWorkflow) {
+    return;
   }
+
+  const candidate = codeOwner?.trim() ?? "";
   const owner = candidate || "@your-org/security-team";
   if (skipPackageManager) {
+    if (includeSecurityBundle && candidate && !VALID_CODE_OWNER.test(candidate)) {
+      throw new Error(
+        `Invalid --code-owner "${candidate}". Use a GitHub handle (@user), a team (@org/team), or an email address.`,
+      );
+    }
     await replacePlaceholdersInTree(targetDir, new Map([["__CODE_OWNER__", owner]]));
     return;
   }
 
-  await addLockfileVerifyScript(targetDir);
+  if (includeSecurityBundle) {
+    if (candidate && !VALID_CODE_OWNER.test(candidate)) {
+      throw new Error(
+        `Invalid --code-owner "${candidate}". Use a GitHub handle (@user), a team (@org/team), or an email address.`,
+      );
+    }
+    await addLockfileVerifyScript(targetDir);
+  }
   const packageJson = await readPackageJsonIfPresent(targetDir);
   await replacePlaceholdersInTree(
     targetDir,
-    renderCiReplacements({ packageManager, template, packageJson, codeOwner: owner }),
+    renderCiReplacements({
+      packageManager,
+      template,
+      packageJson,
+      codeOwner: owner,
+      includeSecurityBundle,
+    }),
   );
 }
 
@@ -1213,7 +1509,7 @@ function createSpinner(initialMessage) {
   };
 }
 
-function printSummary({ projectName, template, packageManager, installDeps, skipPackageManager, withCi }) {
+function printSummary({ projectName, template, packageManager, installDeps, skipPackageManager, withCi, withDeploy }) {
   const templateMeta = TEMPLATE_OPTIONS.find((option) => option.value === template);
   const templateLabel = templateMeta ? `${templateMeta.title} ${color(COLORS.dim, `(${template})`)}` : template;
   const summaryLines = [
@@ -1230,6 +1526,9 @@ function printSummary({ projectName, template, packageManager, installDeps, skip
   if (withCi) {
     summaryLines.push(`${color(COLORS.gray, "Security  ")} ${color(COLORS.cyan, "GitHub CI bundle")}`);
   }
+  if (withDeploy) {
+    summaryLines.push(`${color(COLORS.gray, "Deploy    ")} ${color(COLORS.cyan, "Starter workflow")}`);
+  }
   console.log("");
   console.log(renderBox(summaryLines, { accent: COLORS.green }));
   console.log("");
@@ -1254,10 +1553,13 @@ function printSummary({ projectName, template, packageManager, installDeps, skip
       `  ${color(COLORS.gray, SYMBOLS.pointer)} ${color(COLORS.dim, "(including a just-released @daloyjs/core) are embargoed for 24 h.")}`,
     );
     console.log(
-      `  ${color(COLORS.gray, SYMBOLS.pointer)} ${color(COLORS.dim, "Lifecycle scripts are blocked by default; allowlist trusted builds in")}`,
+      `  ${color(COLORS.gray, SYMBOLS.pointer)} ${color(COLORS.dim, "Lifecycle scripts stay blocked by default (ignore-scripts=true);")}`,
+    );
+    console.log(
+      `  ${color(COLORS.gray, SYMBOLS.pointer)} ${color(COLORS.dim, "if you later tighten build-script policy, keep exceptions in")}`,
     );
     console.log(
-      `  ${color(COLORS.gray, SYMBOLS.pointer)} ${color(COLORS.dim, "package.json under pnpm.onlyBuiltDependencies if install complains.")}`,
+      `  ${color(COLORS.gray, SYMBOLS.pointer)} ${color(COLORS.dim, "pnpm-workspace.yaml under allowBuilds instead of weakening .npmrc.")}`,
     );
   }
 
@@ -1378,18 +1680,17 @@ async function main() {
       } else if (packageManager === "pnpm") {
         // Deny-by-default for pnpm: the scaffolded `pnpm-workspace.yaml` ships
         // with `minimumReleaseAge: 1440` (24 h embargo on newly-published
-        // versions) and the `.npmrc` blocks lifecycle scripts unless they're
-        // allowlisted in `package.json` under `pnpm.onlyBuiltDependencies`.
-        // Both are security best practices, but they mean a fresh
-        // `pnpm install` can fail until the user (a) waits 24 h for newly
-        // published `@daloyjs/core` versions to clear the embargo, or (b)
-        // allowlists any dep that needs a build script. Defaulting to N
-        // makes that explicit instead of failing the install silently.
+        // versions), and the scaffolded `.npmrc` keeps `ignore-scripts=true`.
+        // Both are security best practices, but they mean the first install
+        // should be a deliberate user choice rather than something the CLI
+        // does implicitly. Defaulting to N makes that explicit, and it also
+        // avoids surprising users when a fresh `@daloyjs/core` release is
+        // still inside the 24 h embargo window.
         if (rl) {
           console.log(
             color(
               COLORS.gray,
-              "  (pnpm install may fail until you set pnpm.onlyBuiltDependencies in package.json and wait 24h for fresh @daloyjs/core releases \u2014 see pnpm-workspace.yaml)",
+              "  (pnpm install may wait out a fresh-release embargo and keeps lifecycle scripts blocked by default \u2014 see .npmrc + pnpm-workspace.yaml)",
             ),
           );
           installDeps = await askYesNo(rl, `Install dependencies with ${packageManager}?`, false);
@@ -1413,6 +1714,15 @@ async function main() {
       withCi = rl ? await askYesNo(rl, "Add hardened GitHub Actions and security files?", true) : true;
     }
 
+    let withDeploy = opts.deploy;
+    if (withDeploy === undefined) {
+      if (withCi) {
+        withDeploy = true;
+      } else {
+        withDeploy = rl ? await askYesNo(rl, "Add a starter deployment workflow?", false) : false;
+      }
+    }
+
     rl?.close();
 
     if (interactive) {
@@ -1443,9 +1753,18 @@ async function main() {
       }
     }
 
-    if (withCi) {
-      await copyCiBundle(targetDir, template, packageManager, skipPackageManager, opts.codeOwner);
-      logStep("GitHub security bundle added", skipPackageManager ? "deno" : packageManager);
+    if (withCi || withDeploy) {
+      await copyCiBundle(targetDir, template, packageManager, skipPackageManager, opts.codeOwner, {
+        includeSecurityBundle: withCi,
+        includeDeployWorkflow: withDeploy,
+      });
+      if (withCi && withDeploy) {
+        logStep("GitHub automation added", `${skipPackageManager ? "deno" : packageManager} + deploy`);
+      } else if (withCi) {
+        logStep("GitHub security bundle added", skipPackageManager ? "deno" : packageManager);
+      } else if (withDeploy) {
+        logStep("Deploy starter added", template);
+      }
     }
 
     if (initGit) {
@@ -1474,7 +1793,7 @@ async function main() {
       }
     }
 
-    printSummary({ projectName, template, packageManager, installDeps, skipPackageManager, withCi });
+    printSummary({ projectName, template, packageManager, installDeps, skipPackageManager, withCi, withDeploy });
   } catch (err) {
     rl?.close();
     if (err && err.message === "Cancelled") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-daloy",
-  "version": "0.34.2",
+  "version": "0.35.0",
   "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
   "type": "module",
   "license": "MIT",
@@ -45,4 +45,4 @@
   "scripts": {
     "test": "node --test test/**/*.test.mjs"
   }
-}
+}