create-daloy 0.34.2 → 0.35.0

package/templates/_ci/deno/_github/workflows/secret-scan.yml

@@ -0,0 +1,106 @@
+# Secret scanning — gitleaks against PRs, pushes to main, and a daily
+# scheduled sweep of the full git history.
+#
+# Why this exists (Aikido "Secrets Detection: A Practical Guide"
+# https://www.aikido.dev/blog/secret-detection-application-security):
+#
+#   GitHub-native push protection only flags provider-shaped secrets at
+#   push time. Aikido's guide argues that effective secret detection must
+#   also scan the **full git history** (not just the latest snapshot) on
+#   a regular cadence, because a single leaked credential anywhere in any
+#   commit, branch, or tag should be treated as compromised.
+#
+#   This workflow runs `gitleaks` on every PR / push against the working
+#   tree and, on a daily schedule, sweeps the entire commit history so
+#   long-lived secrets that pre-date push-protection enablement (or
+#   secrets that slipped past it via rebased / squashed fork PRs) are
+#   still surfaced.
+#
+# Hardening (matches the rest of the scaffolded CI bundle):
+#
+#   * No new third-party GitHub Action: the gitleaks binary is fetched
+#     from the pinned official release and its SHA-256 is verified
+#     before execution.
+#   * Top-level `permissions: {}`; the single job opts in to
+#     `contents: read`.
+#   * `step-security/harden-runner` in audit mode, sudo disabled.
+#   * `actions/checkout` with `persist-credentials: false`.
+#   * `--redact` keeps any matched value out of the public log.
+#
+# When a finding lands:
+#   1. Rotate the credential immediately.
+#   2. Assess scope (what did the secret access?).
+#   3. Remove it from history if your workflow allows (filter-repo /
+#      BFG); otherwise treat the repo + every downstream clone as
+#      compromised.
+#   4. Add a `.gitleaksignore` entry only for confirmed false positives.
+
+name: Secret scan
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "21 4 * * *"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: secret-scan-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gitleaks:
+    name: gitleaks
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+
+    env:
+      # Pinned gitleaks release — bump in lockstep with the SHA-256 below.
+      # Source of truth: https://github.com/gitleaks/gitleaks/releases
+      GITLEAKS_VERSION: "8.30.1"
+      GITLEAKS_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+          disable-file-monitoring: false
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+          # Full history for the scheduled sweep so gitleaks can walk
+          # every commit; for PR / push runs a shallow clone is fine
+          # because the checked-out tree is what gitleaks scans.
+          fetch-depth: ${{ github.event_name == 'schedule' && 0 || 1 }}
+
+      - name: Install gitleaks (verified SHA-256)
+        run: |
+          set -euo pipefail
+          archive="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
+          url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${archive}"
+          curl --proto '=https' --tlsv1.2 -sSfL "$url" -o "$archive"
+          echo "${GITLEAKS_SHA256}  ${archive}" | sha256sum --check --strict
+          mkdir -p "$RUNNER_TEMP/gitleaks"
+          tar -xzf "$archive" -C "$RUNNER_TEMP/gitleaks" gitleaks
+          rm -f "$archive"
+          echo "$RUNNER_TEMP/gitleaks" >> "$GITHUB_PATH"
+
+      - name: gitleaks version
+        run: gitleaks version
+
+      - name: gitleaks (working tree)
+        run: gitleaks dir --no-banner --redact --verbose --exit-code 1 .
+
+      - name: gitleaks (full git history)
+        if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+        run: gitleaks git --no-banner --redact --verbose --exit-code 1 .

package/templates/_ci/node/SECURITY.md

@@ -23,7 +23,10 @@ The `--with-ci` bundle adds these defaults:
 - Package-manager caches are disabled in CI to avoid cache-poisoning bridges.
 - Lockfile source verification rejects git dependencies and non-registry tarball URLs.
 - CodeQL, OpenSSF Scorecard, zizmor, Dependabot, and CODEOWNERS are generated.
+- A weekly scheduled `opengrep.yml` runs a second SAST engine (Aikido's LGPL-2.1 fork of Semgrep) against the repository using the curated `p/security-audit`, `p/owasp-top-ten`, `p/cwe-top-25`, `p/javascript`, `p/typescript`, `p/nodejs`, and `p/secrets` rule packs. The Opengrep binary is downloaded from a pinned GitHub release and its sigstore cosign signature is verified against the official `opengrep/opengrep` release identity before it runs — no third-party action sits in the supply chain just for this scan. Running two SAST engines (CodeQL + Opengrep) catches different bug classes than either alone; see Aikido's [Ultimate SAST Guide](https://www.aikido.dev/blog/ultimate-sast-guide-static-application-security-testing) for why a layered SAST posture is the recommended default.
 - A daily scheduled `vuln-scan.yml` runs the package manager's audit against the committed lockfile so newly-disclosed CVEs are surfaced even when no PR or push has run CI (SOC 2 CC7.1 continuous-vulnerability-management evidence).
+- A weekly scheduled `dast.yml` boots the built application and runs an OWASP ZAP baseline scan against it. CodeQL + Opengrep + the `verify:*` family are the SAST half of the posture; this is the DAST half — see Aikido's [SAST vs DAST](https://www.aikido.dev/blog/sast-vs-dast-what-you-need-to-now) write-up for why both matter. Findings are summarized in the workflow log and the job fails on HIGH-risk alerts; MEDIUM / LOW / INFO are surfaced for triage but non-blocking.
+- A `secret-scan.yml` workflow runs [gitleaks](https://github.com/gitleaks/gitleaks) against the working tree on every PR / push and against the **full git history** on a daily schedule. The gitleaks binary is downloaded from a pinned official release and verified by SHA-256 before execution so the scan does not introduce a new third-party action into the supply chain. Findings block the merge; matched values are redacted from the public log. The rationale (and the remediation playbook for a confirmed leak) follows Aikido's [Secrets Detection guide](https://www.aikido.dev/blog/secret-detection-application-security): a secret in any commit, branch, or tag should be treated as compromised, and detection must consider the entire history — not just the latest snapshot — alongside GitHub-native push protection.
 - No npm publish workflow is generated: this scaffold is a REST API service, not a published package. If you later carve out a reusable library you can opt into npm trusted publishing yourself.
 
 ## Container hardening
@@ -56,11 +59,107 @@ SHA-pinned open-source tooling:
   - All findings are uploaded as SARIF to the GitHub **Code Scanning**
     tab alongside CodeQL.
 
+## Runtime hardening (`docker run`, Compose, Fly machines)
+
+The image build is only half the story. The Aikido
+["Container Security — The Dev Guide"](https://www.aikido.dev/blog/container-security-guide)
+write-up calls out that most container compromises chain a known
+software CVE with a permissive runtime configuration: a container
+launched with the default capability set, no resource limits, and a
+writable root filesystem turns a single RCE into a host compromise.
+Apply these flags wherever you launch the image outside of Kubernetes
+(the **Pod security on Kubernetes** entry below covers the equivalent
+`PodSpec` settings):
+
+- `--read-only` — root filesystem is read-only. The shipped image
+  needs no writable paths at runtime; pair with
+  `--tmpfs /tmp:rw,noexec,nosuid,size=64m` if your app writes
+  temp files.
+- `--cap-drop=ALL` — drop every Linux capability. The Node.js
+  runtime under `tini` needs none of the default set
+  (`CHOWN`, `DAC_OVERRIDE`, `NET_BIND_SERVICE`, …); rebind the
+  listening port to `>= 1024` (the shipped `EXPOSE 3000`
+  already does) so you do not need `NET_BIND_SERVICE` back.
+- `--security-opt=no-new-privileges:true` — block `setuid` /
+  `setgid` / file-capability escalation inside the container, so a
+  compromised handler cannot regain privileges the image dropped.
+- `--security-opt=seccomp=default` — keep Docker's default seccomp
+  profile (it is on by default, but some orchestrators disable it;
+  re-assert it explicitly).
+- `--pids-limit=256` — cap process count. Prevents fork-bomb style
+  DoS from a compromised handler.
+- `--memory=512m --memory-swap=512m --cpus=1.0` — enforce resource
+  limits. The framework's `loadShedding()` middleware refuses
+  requests under event-loop / RSS / heap pressure, but the
+  kernel-side limits are the backstop that makes a runaway
+  handler a `137 OOMKilled` instead of a noisy neighbour.
+- **Never** pass `--privileged`, `-v /var/run/docker.sock:…`, or
+  `--pid=host` / `--network=host` to this image. None of them are
+  needed by a stateless HTTP service and each one converts a
+  container escape into a host takeover.
+
+Equivalent `compose.yml` snippet (drop into the service block your
+deploy uses):
+
+```yaml
+services:
+  app:
+    image: ghcr.io/your-org/your-app:sha-<digest>
+    read_only: true
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,size=64m
+    cap_drop: ["ALL"]
+    security_opt:
+      - "no-new-privileges:true"
+    pids_limit: 256
+    mem_limit: 512m
+    memswap_limit: 512m
+    cpus: 1.0
+    restart: unless-stopped
+```
+
+Fly.io, Render, Railway, and similar PaaS surfaces apply most of these
+defaults for you, but check the platform documentation — `--privileged`
+and host network are still escape hatches you should keep off.
+
+## Cloud posture (operator checklist)
+
+The framework cannot author your cloud configuration for you, but the
+[Aikido "Top 7 Cloud Security Vulnerabilities"](https://www.aikido.dev/blog/top-cloud-security-vulnerabilities)
+write-up maps cleanly onto a short checklist. Adopt these alongside the
+container and CI defaults above:
+
+- **IMDSv2 only.** On EC2 / equivalent, require token-based IMDSv2 and disable
+  IMDSv1 at the launch-template / instance-metadata-options level. Combined
+  with the framework's `fetchGuard()` on user-controlled outbound fetches,
+  this closes the Capital One 2019 / Pandoc CVE-2025-51591 SSRF → IAM chain.
+- **Least-privilege execution role.** Scope the workload's IAM role to the
+  minimum actions and resource ARNs the handler actually calls (e.g.
+  `s3:GetObject` on a single bucket prefix, never `s3:*`). Enable IAM Access
+  Analyzer / unused-permission scans and prune quarterly.
+- **Pod security on Kubernetes.** Deploy with `runAsNonRoot: true`,
+  `readOnlyRootFilesystem: true`, `allowPrivilegeEscalation: false`,
+  `capabilities: { drop: ["ALL"] }`, and `automountServiceAccountToken: false`
+  on pods that do not call the kube API. The shipped `Dockerfile` already
+  runs as non-root UID 1001 with no writable paths required at runtime, so
+  these settings work out of the box.
+- **Network segmentation.** Keep development, staging, and production in
+  separate cloud accounts / projects. Apply default-deny `NetworkPolicy` (k8s)
+  or Security Group egress rules so a compromised workload cannot freely
+  reach the metadata service, the database tier, or the internet.
+- **Log agent isolation.** If you run FluentBit / Vector / Fluentd as a
+  sidecar or DaemonSet, run it under its own ServiceAccount with read-only
+  access to the log path, pin the agent image to a digest, and subscribe to
+  its CVE feed (FluentBit had CVE-2025-12969 auth bypass + CVE-2025-12972
+  path traversal disclosed in 2025). The framework's structured logger
+  already redacts known credential shapes **before** the line leaves the
+  process, so a compromised agent receives pre-redacted data.
+
 ## Required repository settings
 
 Before relying on these files for a company project:
 
 1. Replace `@your-org/security-team` in `.github/CODEOWNERS` or pass `--code-owner` when scaffolding.
-2. Protect the `main` branch and require the CI, CodeQL, Scorecard, and zizmor checks.
+2. Protect the `main` branch and require the CI, CodeQL, Opengrep, Scorecard, and zizmor checks.
 3. Enable GitHub secret scanning and push protection.
 4. Keep `ignore-scripts=true` and the `pnpm-workspace.yaml` supply-chain settings on when using pnpm.

package/templates/_ci/node/_github/CODEOWNERS

@@ -7,6 +7,9 @@
 /.github/                         __CODE_OWNER__
 /.github/workflows/               __CODE_OWNER__
 /.github/workflows/vuln-scan.yml  __CODE_OWNER__
+/.github/workflows/osv-scan.yml   __CODE_OWNER__
+/.github/workflows/dast.yml       __CODE_OWNER__
+/.github/workflows/secret-scan.yml __CODE_OWNER__
 /.github/dependabot.yml           __CODE_OWNER__
 /.github/CODEOWNERS               __CODE_OWNER__
 

package/templates/_ci/node/_github/workflows/container-scan.yml

@@ -1,18 +1,28 @@
-# Container security scan generated by create-daloy --with-ci.
+# Container + IaC security scan generated by create-daloy --with-ci.
 #
 # Inspired by the controls in
-# https://snyk.io/blog/scale-container-security-effortlessly/ — but built
-# only from SHA-pinned, free, open-source GitHub Actions:
+# https://snyk.io/blog/scale-container-security-effortlessly/ and
+# Aikido's "IaC security scanning for Terraform & Kubernetes
+# misconfigurations"
+# (https://www.aikido.dev/blog/iac-security-scanning-terraform-kubernetes-misconfigurations)
+# — but built only from SHA-pinned, free, open-source GitHub Actions:
 #
 #   - hadolint lints the Dockerfile for known anti-patterns and unsafe
 #     instructions (CIS Docker Benchmark coverage).
-#   - Trivy scans the source tree (config + secrets + vulnerable lockfile
-#     entries), then scans the built image for OS + language CVEs.
+#   - Trivy filesystem scan with the `misconfig` scanner enabled catches
+#     IaC misconfigurations in Terraform (`*.tf` / `*.tfvars`),
+#     Kubernetes manifests (`k8s/**`, `deployment.yaml`,
+#     `kustomization*.yaml`), Helm charts, Dockerfiles, and
+#     CloudFormation templates — plus secrets and vulnerable lockfile
+#     entries. This runs even when no Dockerfile is present, so a
+#     project that only ships Terraform / K8s still gets the Aikido-style
+#     IaC posture review on every PR.
+#   - Trivy image scan covers OS + language CVEs once the image is built.
 #   - SARIF results are uploaded to the Code Scanning tab so findings show
 #     up in the same place as CodeQL.
 #
-# The job is a no-op if the project has no Dockerfile at the repo root, so
-# it is safe to keep enabled for templates that disable the container.
+# The Dockerfile-specific steps (hadolint, build, image scan) are a no-op
+# if the project has no Dockerfile at the repo root.
 
 name: Container scan
 
@@ -26,6 +36,17 @@ on:
       - "package-lock.json"
       - "yarn.lock"
       - "bun.lock"
+      - "**/*.tf"
+      - "**/*.tfvars"
+      - "**/*.hcl"
+      - "k8s/**"
+      - "helm/**"
+      - "**/deployment.yaml"
+      - "**/deployment.yml"
+      - "**/kustomization.yaml"
+      - "**/kustomization.yml"
+      - "**/Chart.yaml"
+      - "**/values.yaml"
       - ".github/workflows/container-scan.yml"
   push:
     branches: [main]
@@ -37,6 +58,17 @@ on:
       - "package-lock.json"
       - "yarn.lock"
       - "bun.lock"
+      - "**/*.tf"
+      - "**/*.tfvars"
+      - "**/*.hcl"
+      - "k8s/**"
+      - "helm/**"
+      - "**/deployment.yaml"
+      - "**/deployment.yml"
+      - "**/kustomization.yaml"
+      - "**/kustomization.yml"
+      - "**/Chart.yaml"
+      - "**/values.yaml"
       - ".github/workflows/container-scan.yml"
   schedule:
     # Weekly run catches newly-disclosed base-image CVEs even when the
@@ -130,12 +162,17 @@ jobs:
           sarif_file: hadolint.sarif
           category: hadolint
 
-      - name: Trivy filesystem scan (config + secrets + vulns)
-        if: steps.detect.outputs.present == 'true'
+      - name: Trivy filesystem scan (IaC misconfig + secrets + vulns)
+        # `misconfig` is the IaC posture scanner — Terraform, Kubernetes,
+        # Helm, Dockerfile, CloudFormation — per Aikido's "IaC security
+        # scanning for Terraform & Kubernetes misconfigurations" article.
+        # It runs unconditionally so a project that only ships Terraform
+        # or K8s (no Dockerfile) still gets reviewed on every PR.
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           scan-type: fs
           scan-ref: .
+          scanners: vuln,secret,misconfig
           severity: HIGH,CRITICAL
           ignore-unfixed: true
           format: sarif
@@ -143,7 +180,6 @@ jobs:
           exit-code: "0"
 
       - name: Upload Trivy filesystem SARIF
-        if: steps.detect.outputs.present == 'true'
         uses: github/codeql-action/upload-sarif@52485aec7be33610227643b0fe83936b8b5f061a # v3
         with:
           sarif_file: trivy-fs.sarif

package/templates/_ci/node/_github/workflows/dast.yml

@@ -0,0 +1,177 @@
+# Dynamic Application Security Testing (DAST) generated by
+# create-daloy --with-ci.
+#
+# Why this exists:
+#   The shipped `ci.yml` + `codeql.yml` + `scorecard.yml` + `zizmor.yml`
+#   stack is the SAST half of your security posture — static analysis
+#   of source, dependencies, and workflows. Aikido's "SAST vs DAST:
+#   what you need to know"
+#   (https://www.aikido.dev/blog/sast-vs-dast-what-you-need-to-now)
+#   argues that SAST and DAST catch different bug classes and that you
+#   want both. This workflow adds the dynamic half: it boots your built
+#   application, points OWASP ZAP's baseline scanner at it, and fails
+#   the run on any HIGH-risk finding.
+#
+#   Because Daloy is JSON-first and the framework already enforces
+#   header sanitization, body limits, router path-traversal rejection,
+#   and `secureHeaders()` defaults, the baseline scan usually goes
+#   green out of the box on a fresh scaffold. The value is the
+#   *continuous* probe — newly-disclosed ZAP rules apply to your
+#   unchanged code, and runtime regressions (a misconfigured CORS
+#   policy, a header you set with CRLF in it, a redirect to an
+#   open-redirect target) get caught before they hit production.
+#
+# Trigger surface:
+#   * Weekly cron — continuous coverage against newly-disclosed rules.
+#   * `workflow_dispatch` — on-demand probe for security review.
+#   Deliberately NOT on every PR: a baseline scan takes several
+#   minutes and the same surface is exercised by your test suite on
+#   every PR via `ci.yml`.
+#
+# Customizing:
+#   * The "Start application" step expects `pnpm build` to produce
+#     `dist/index.js` and a `PORT` env var to control the listen port,
+#     matching the shipped `node-basic` template. If your app starts
+#     differently, edit the `nohup` line below.
+#   * If your app needs seed data, secrets, or a database, add them
+#     before the start step (use `vars` / `secrets` in the GitHub
+#     Environment).
+#   * To probe a deployed staging URL instead of a local build, drop
+#     the "Set up …", "Install", "Build", "Start application", and
+#     "Wait for target" steps and point the ZAP `docker run` line at
+#     `https://staging.example.com`.
+
+name: DAST
+
+on:
+  schedule:
+    # 07:42 UTC weekly (Wed) — offset from the other scheduled scans
+    # so they do not all queue at once.
+    - cron: "42 7 * * 3"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: dast-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  zap-baseline:
+    name: ZAP baseline scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+          disable-file-monitoring: false
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@ac6db6d3c1f721f886538a378a2d73e85697340a # v6
+        with:
+          version: 11.1.3
+          run_install: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 24
+
+      - name: Install dependencies (no scripts)
+        run: pnpm install --frozen-lockfile --ignore-scripts
+        env:
+          npm_config_ignore_scripts: "true"
+
+      - name: Build
+        run: pnpm build
+
+      - name: Start application (background)
+        run: |
+          mkdir -p dast-results
+          chmod 777 dast-results
+          nohup node dist/index.js > dast-results/server.log 2>&1 &
+          echo $! > dast-results/server.pid
+        env:
+          PORT: "3000"
+          NODE_ENV: production
+
+      - name: Wait for target to be reachable
+        run: |
+          for i in $(seq 1 30); do
+            if curl -fsS --max-time 2 http://localhost:3000/healthz > /dev/null \
+              || curl -fsS --max-time 2 http://localhost:3000/ > /dev/null; then
+              echo "Target ready after ${i} attempt(s)."
+              exit 0
+            fi
+            sleep 1
+          done
+          echo "::error::DAST target did not become reachable in 30s."
+          cat dast-results/server.log || true
+          exit 1
+
+      - name: Run OWASP ZAP baseline scan
+        run: |
+          docker pull ghcr.io/zaproxy/zaproxy:stable
+          docker run --rm --network host \
+            -v "$PWD/dast-results:/zap/wrk/:rw" \
+            -t ghcr.io/zaproxy/zaproxy:stable \
+            zap-baseline.py \
+              -t http://localhost:3000 \
+              -J zap-report.json \
+              -w zap-report.md \
+              -r zap-report.html \
+              -I \
+              || true
+
+      - name: Stop application
+        if: always()
+        run: |
+          if [ -f dast-results/server.pid ]; then
+            kill "$(cat dast-results/server.pid)" || true
+          fi
+
+      - name: Summarize ZAP findings and fail on HIGH
+        if: always()
+        run: |
+          report=dast-results/zap-report.json
+          if [ ! -f "$report" ]; then
+            echo "::warning::No ZAP JSON report produced (scan may have failed to start)."
+            exit 0
+          fi
+          counts=$(node -e "
+            const r = JSON.parse(require('node:fs').readFileSync(process.argv[1], 'utf8'));
+            const c = { high: 0, medium: 0, low: 0, info: 0 };
+            for (const site of r.site ?? []) {
+              for (const alert of site.alerts ?? []) {
+                const code = String(alert.riskcode);
+                if (code === '3') c.high++;
+                else if (code === '2') c.medium++;
+                else if (code === '1') c.low++;
+                else c.info++;
+              }
+            }
+            process.stdout.write(JSON.stringify(c));
+          " "$report")
+          echo "ZAP findings: ${counts}"
+          high=$(node -e "process.stdout.write(String(JSON.parse(process.argv[1]).high))" "$counts")
+          if [ -f dast-results/zap-report.md ]; then
+            echo "----- ZAP markdown report -----"
+            cat dast-results/zap-report.md
+            echo "----- end report -----"
+          fi
+          if [ "${high}" -gt 0 ]; then
+            echo "::error::ZAP reported ${high} HIGH-risk finding(s) against your application surface."
+            exit 1
+          fi

package/templates/_ci/node/_github/workflows/deploy.yml

@@ -0,0 +1,94 @@
+# Starter deployment workflow generated by create-daloy --with-ci.
+#
+# This workflow is intentionally manual-only so a fresh scaffold does not fail
+# on every push before you wire in secrets, variables, and environment
+# approvals. Once you are ready, add your preferred push/tag trigger.
+#
+__DEPLOY_HEADER__
+
+name: Deploy
+
+on:
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: deploy-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  verify:
+    name: Verify before deploy
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+__SETUP_PACKAGE_MANAGER_STEP__
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        with:
+          node-version: 24
+          # Package-manager caching is intentionally disabled. Shared caches
+          # can bridge fork PRs into trusted branches when mis-keyed.
+
+__SETUP_BUN_RUNTIME_STEP__
+
+      - name: Install dependencies
+        run: __INSTALL_COMMAND__
+        env:
+          npm_config_ignore_scripts: "true"
+
+__DEPLOY_VERIFY_LOCKFILE_STEP__
+
+      - name: Typecheck
+        run: __TYPECHECK_COMMAND__
+
+      - name: Test
+        run: __TEST_COMMAND__
+
+__BUILD_STEP__
+
+  deploy:
+    name: __DEPLOY_JOB_NAME__
+    needs: verify
+__DEPLOY_REF_GUARD__
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    environment:
+      name: production
+    permissions:
+      contents: read
+__DEPLOY_JOB_PERMISSIONS__
+
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2
+        with:
+          egress-policy: audit
+          disable-sudo: true
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
+          show-progress: false
+
+__DEPLOY_SETUP_STEPS__
+
+__DEPLOY_STEPS__