create-daloy 0.34.3 → 0.35.0

package/README.md

@@ -53,7 +53,7 @@ pnpm create daloy@latest my-api \
 | `--template <name>` | `node-basic` (default), `vercel-edge`, `cloudflare-worker`, `bun-basic`, or `deno-basic`. |
 | `--package-manager <pm>` | `pnpm` (default), `npm`, `yarn`, or `bun`. Ignored for `deno-basic`. |
 | `--list-templates` | Print available templates with descriptions. |
-| `--install` / `--no-install` | Install dependencies after scaffolding. Defaults to **Y** for npm/yarn/bun and **N** for pnpm (so first-time runs are not blocked by the 24h `minimumReleaseAge` embargo or the `pnpm.onlyBuiltDependencies` allowlist required by the hardened `.npmrc`). |
+| `--install` / `--no-install` | Install dependencies after scaffolding. Defaults to **Y** for npm/yarn/bun and **N** for pnpm (so first-time runs are not blocked by the 24h `minimumReleaseAge` embargo and so you can review the scaffold's hardened `.npmrc` and `pnpm-workspace.yaml` before the first install). |
 | `--git` / `--no-git` | Initialize a git repository. Defaults to interactive. |
 | `--minimal` | Strip the bookstore demo route and the built-in `/docs` + `/openapi.json` routes so only the framework bootstrap and `/healthz` ship. |
 | `--with-ci` / `--no-ci` | Add the hardened GitHub Actions, Dependabot, CODEOWNERS, SECURITY.md, and lockfile-source verification bundle. **Defaults to Y** so scaffolded projects are secure by default. |
@@ -86,8 +86,7 @@ A minimal Cloudflare Worker bootstrap using `@daloyjs/core/cloudflare` with:
 
 - `wrangler.toml` ready to deploy.
 - `secureHeaders` and `requestId` enabled by default, with smaller edge-friendly body and timeout limits.
-- Zod-validated route exposed as `fetch`.
-- A sample test that exercises `app.request(...)`.
+- A Zod-validated `/healthz` route and contract-first `/books/:id` route exposed via `toFetchHandler(app)`.
 
 ### `vercel-edge`
 
@@ -165,6 +164,40 @@ For Node-style templates, the bundle adds:
   *after* the last PR or push and provides SOC 2 CC7.1
   ([continuous vulnerability management](https://www.aikido.dev/blog/a-guide-to-automating-technical-vulnerability-management-for-soc-2))
   evidence even when developers are not touching the repo.
+- `.github/workflows/osv-scan.yml` — a SECOND, independent SCA source.
+  `vuln-scan.yml` queries the package manager's audit feed (GHSA); this one
+  runs Google's OSV-Scanner against the committed lockfile and cross-references
+  the OpenSSF
+  [malicious-packages](https://github.com/ossf/malicious-packages) corpus, so
+  a malware advisory that lands in OSV.dev before it propagates to GHSA still
+  fails the build. The binary is downloaded from a pinned official release and
+  verified by SHA-256 before execution — no third-party action is added to the
+  supply chain just for this scan. This is the missing layer the Aikido
+  [SAST vs SCA](https://www.aikido.dev/blog/sast-vs-sca) and
+  [npm-audit-guide](https://www.aikido.dev/blog/npm-audit-guide) write-ups
+  warn about, and the Deno scaffold gets it too (Deno has no `audit` built
+  in, so without OSV-Scanner a Deno scaffold would have no scheduled SCA at
+  all).
+- `.github/workflows/secret-scan.yml` — runs [gitleaks](https://github.com/gitleaks/gitleaks)
+  on every PR / push (working tree) and on a daily schedule across the **full
+  git history**, so a credential leaked anywhere in any commit, branch, or tag
+  is surfaced even if GitHub-native push protection missed it. The gitleaks
+  binary is downloaded from a pinned official release and verified by SHA-256
+  before execution — no third-party action is added to the supply chain just
+  for this scan. See Aikido's
+  [Secrets Detection guide](https://www.aikido.dev/blog/secret-detection-application-security)
+  for why history-aware scanning is the floor and not the ceiling.
+- `.github/workflows/opengrep.yml` — a second SAST source alongside CodeQL,
+  using [Opengrep](https://github.com/opengrep/opengrep) (an open-source
+  Semgrep fork) with the same pinned-binary + SHA-256-verified pattern as the
+  OSV and gitleaks scans.
+- `.github/workflows/container-scan.yml` — runs Trivy against the image
+  produced by the template's `_Dockerfile` (filesystem scan on PR, full image
+  scan on push to `main`) so a base-image CVE or a vulnerable layer is
+  surfaced before deploy.
+- `.github/workflows/dast.yml` — a manual-only dynamic-analysis workflow that
+  boots the scaffolded API and runs an OWASP ZAP baseline scan against it,
+  for teams that want a black-box check before promoting a release.
 - CodeQL, OpenSSF Scorecard, zizmor, Dependabot, CODEOWNERS, and `SECURITY.md`.
 - `scripts/verify-lockfile-sources.mjs` plus a `verify:lockfile` package script
   that rejects git dependencies and non-registry tarball URLs in text lockfiles.
@@ -175,8 +208,9 @@ out a reusable package, opt into npm trusted publishing yourself.
 
 For `deno-basic`, `--with-ci` generates a Deno-native CI workflow, a manual-only
 container publish starter for GHCR that is guarded to `main` or a tag by
-default, plus CodeQL, Scorecard, zizmor, Dependabot for GitHub Actions,
-CODEOWNERS, and `SECURITY.md`.
+default, plus CodeQL, Opengrep, **OSV-Scanner** (the only scheduled SCA layer
+a Deno scaffold has, since Deno ships no `audit`), Scorecard, zizmor,
+Dependabot for GitHub Actions, CODEOWNERS, and `SECURITY.md`.
 
 If you want the governance bundle but not the deployment starter, pass
 `--with-ci --no-deploy`. If you only want a deployment starter, pass
@@ -187,12 +221,21 @@ If you omit `--code-owner`, the generated CODEOWNERS file uses
 protection. You should also enable GitHub secret scanning, push protection, and
 required status checks in the repository settings.
 
+## Container-first scaffolds
+
+Every template (Node, Bun, Vercel Edge, Cloudflare Worker, and Deno) ships a
+production-oriented `Dockerfile` and `.dockerignore` with the secure-by-default
+posture from `@daloyjs/core` `0.24.0`: a non-root user, `STOPSIGNAL SIGTERM`,
+`tini` as PID 1, and a `HEALTHCHECK` pointed at `/readyz`. Node-style templates
+also ship an `.env.example`. None of this is required — delete or replace
+whatever you do not need.
+
 ## What the CLI guarantees
 
 - Zero runtime dependencies (uses only Node built-ins) for a clean supply-chain footprint.
 - A modern terminal experience with Unicode/color capability detection and ASCII fallbacks.
 - Templates are copied verbatim from this package's `templates/` directory.
-- Files and folders prefixed with `_` are renamed on copy (`_gitignore` → `.gitignore`, `_npmrc` → `.npmrc`, `_github/` → `.github`, `_agents/` → `.agents/`) to survive npm packing.
+- Files and folders prefixed with `_` are renamed on copy (`_gitignore` → `.gitignore`, `_npmrc` → `.npmrc`, `_github/` → `.github`, `_agents/` → `.agents/`, `_Dockerfile` → `Dockerfile`, `_dockerignore` → `.dockerignore`, `_env.example` → `.env.example`) to survive npm packing.
 - pnpm-specific `.npmrc` hardening is kept only when you choose `pnpm`; other package managers get a clean project without unsupported config warnings.
 - pnpm projects ship with `ignore-scripts=true`, `minimum-release-age=1440`, `verify-store-integrity=true`, `prefer-frozen-lockfile=true`, and `strict-peer-dependencies=true` by default.
 - `--with-ci` projects ship with pinned GitHub Actions workflows, CODEOWNERS, Dependabot, SECURITY.md, and lockfile-source verification.

package/bin/create-daloy.mjs

@@ -329,7 +329,7 @@ ${heading("Options")}
   ${color(COLORS.green, "--template <name>")}          ${TEMPLATES.join(" | ")}  ${color(COLORS.dim, "(default: node-basic)")}
   ${color(COLORS.green, "--package-manager <pm>")}     ${PACKAGE_MANAGERS.join(" | ")}  ${color(COLORS.dim, "(default: pnpm)")}
   ${color(COLORS.green, "--list-templates")}           Print available templates and exit.
-  ${color(COLORS.green, "--install / --no-install")}   Install dependencies after scaffolding. ${color(COLORS.dim, "(default: Y, except pnpm \u2014 N to respect minimumReleaseAge + onlyBuiltDependencies)")}
+  ${color(COLORS.green, "--install / --no-install")}   Install dependencies after scaffolding. ${color(COLORS.dim, "(default: Y, except pnpm \u2014 N to respect minimumReleaseAge + ignore-scripts review)")}
   ${color(COLORS.green, "--git / --no-git")}           Initialize a git repository.
   ${color(COLORS.green, "--minimal")}                  Strip the bookstore + OpenAPI docs demo routes.
   ${color(COLORS.green, "--with-ci / --no-ci")}         Add hardened GitHub Actions + governance files. ${color(COLORS.dim, "(default: Y)")}
@@ -791,11 +791,18 @@ function containerRegistryHeader() {
 # After the image is published, point your platform at GHCR or replace the
 # final push steps with your provider's deploy command.
 #
+# Every pushed image is also signed and attested with Sigstore Cosign
+# (keyless / OIDC) and an SPDX SBOM, so consumers can verify provenance
+# with \`cosign verify\` and \`cosign verify-attestation --type spdxjson\`
+# instead of trusting the registry alone. See Aikido's "Container
+# Security Best Practices" (https://www.aikido.dev/blog/container-security-best-practices)
+# for why signed images + SBOM attestation are the supply-chain floor.
+#
 # Optional container-host handoff examples:
 #   - Fly.io: install flyctl in a later step and run
-#       flyctl deploy --image "$IMAGE_REPO:sha-\${GITHUB_SHA}" --remote-only
+#       flyctl deploy --image "$IMAGE_REPO@\${IMAGE_DIGEST}" --remote-only
 #   - Render: create an image-backed service that tracks
-#       ghcr.io/<owner>/<repo>:sha-\${GITHUB_SHA}`;
+#       ghcr.io/<owner>/<repo>@\${IMAGE_DIGEST}`;
 }
 
 function containerPublishSteps() {
@@ -828,7 +835,60 @@ function containerPublishSteps() {
         run: |
           set -eu
           docker push "$IMAGE_REPO:sha-\${GITHUB_SHA}"
-          docker push "$IMAGE_REPO:latest"`;
+          docker push "$IMAGE_REPO:latest"
+
+      - name: Resolve pushed image digest
+        # Resolve and pin the immutable digest the rest of the workflow
+        # signs and attests against. Signing a mutable tag would let any
+        # later push silently re-point a "verified" tag at attacker
+        # content; binding cosign + the SBOM attestation to
+        # \${IMAGE_REPO}@sha256:<digest> closes that race.
+        run: |
+          set -eu
+          digest="$(docker inspect --format='{{index .RepoDigests 0}}' "$IMAGE_REPO:sha-\${GITHUB_SHA}" | awk -F@ '{print $2}')"
+          if [ -z "$digest" ]; then
+            echo "::error::Failed to resolve image digest for $IMAGE_REPO:sha-\${GITHUB_SHA}" >&2
+            exit 1
+          fi
+          echo "IMAGE_DIGEST=$digest" >> "$GITHUB_ENV"
+          echo "IMAGE_REF=$IMAGE_REPO@$digest" >> "$GITHUB_ENV"
+          echo "::notice::Signed image reference: $IMAGE_REPO@$digest"
+
+      - name: Install Cosign
+        # SHA-pinned per the project's actions-pinning policy. v4.1.2,
+        # commit 6f9f17788090df1f26f669e9d70d6ae9567deba6.
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+
+      - name: Sign image with Cosign (keyless / OIDC)
+        # Keyless signing uses the workflow's \`id-token\` OIDC identity
+        # — no long-lived signing key to leak. Verifiers can pin to
+        # \`--certificate-identity\` matching this workflow URL.
+        env:
+          COSIGN_EXPERIMENTAL: "1"
+        run: |
+          set -eu
+          cosign sign --yes "$IMAGE_REF"
+
+      - name: Generate SPDX SBOM for image
+        # SHA-pinned per the project's actions-pinning policy. v0.24.0,
+        # commit e22c389904149dbc22b58101806040fa8d37a610.
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        with:
+          image: \${{ env.IMAGE_REF }}
+          format: spdx-json
+          output-file: sbom.spdx.json
+          upload-artifact: false
+          upload-release-assets: false
+
+      - name: Attest SBOM with Cosign
+        env:
+          COSIGN_EXPERIMENTAL: "1"
+        run: |
+          set -eu
+          cosign attest --yes \
+            --predicate sbom.spdx.json \
+            --type spdxjson \
+            "$IMAGE_REF"`;
 }
 
 function vercelDeployHeader() {
@@ -904,7 +964,11 @@ function renderDeployConfig({ template, packageManager, needsBunRuntime }) {
   return {
     header: containerRegistryHeader(),
     jobName: "Publish container image",
-    jobPermissions: "      packages: write",
+    // `packages: write` lets us push to GHCR; `id-token: write` lets
+    // Cosign mint a short-lived OIDC identity for keyless image signing
+    // + SBOM attestation. Both are scoped to this single job — the
+    // top-level workflow still has `permissions: {}`.
+    jobPermissions: "      packages: write\n      id-token: write",
     setupSteps: "",
     steps: containerPublishSteps(),
   };
@@ -1005,8 +1069,8 @@ async function replacePlaceholdersInTree(dir, replacements) {
 async function pruneCiBundle(targetDir, flavor, { includeSecurityBundle, includeDeployWorkflow }) {
   if (!includeSecurityBundle) {
     const workflowFiles = flavor === "deno"
-      ? ["ci.yml", "codeql.yml", "container-scan.yml", "dast.yml", "scorecard.yml", "zizmor.yml"]
-      : ["ci.yml", "codeql.yml", "container-scan.yml", "dast.yml", "scorecard.yml", "vuln-scan.yml", "zizmor.yml"];
+      ? ["ci.yml", "codeql.yml", "container-scan.yml", "dast.yml", "opengrep.yml", "osv-scan.yml", "scorecard.yml", "secret-scan.yml", "zizmor.yml"]
+      : ["ci.yml", "codeql.yml", "container-scan.yml", "dast.yml", "opengrep.yml", "osv-scan.yml", "scorecard.yml", "secret-scan.yml", "vuln-scan.yml", "zizmor.yml"];
     for (const file of workflowFiles) {
       await rm(path.join(targetDir, ".github", "workflows", file), { force: true });
     }
@@ -1489,10 +1553,13 @@ function printSummary({ projectName, template, packageManager, installDeps, skip
       `  ${color(COLORS.gray, SYMBOLS.pointer)} ${color(COLORS.dim, "(including a just-released @daloyjs/core) are embargoed for 24 h.")}`,
     );
     console.log(
-      `  ${color(COLORS.gray, SYMBOLS.pointer)} ${color(COLORS.dim, "Lifecycle scripts are blocked by default; allowlist trusted builds in")}`,
+      `  ${color(COLORS.gray, SYMBOLS.pointer)} ${color(COLORS.dim, "Lifecycle scripts stay blocked by default (ignore-scripts=true);")}`,
+    );
+    console.log(
+      `  ${color(COLORS.gray, SYMBOLS.pointer)} ${color(COLORS.dim, "if you later tighten build-script policy, keep exceptions in")}`,
     );
     console.log(
-      `  ${color(COLORS.gray, SYMBOLS.pointer)} ${color(COLORS.dim, "package.json under pnpm.onlyBuiltDependencies if install complains.")}`,
+      `  ${color(COLORS.gray, SYMBOLS.pointer)} ${color(COLORS.dim, "pnpm-workspace.yaml under allowBuilds instead of weakening .npmrc.")}`,
     );
   }
 
@@ -1613,18 +1680,17 @@ async function main() {
       } else if (packageManager === "pnpm") {
         // Deny-by-default for pnpm: the scaffolded `pnpm-workspace.yaml` ships
         // with `minimumReleaseAge: 1440` (24 h embargo on newly-published
-        // versions) and the `.npmrc` blocks lifecycle scripts unless they're
-        // allowlisted in `package.json` under `pnpm.onlyBuiltDependencies`.
-        // Both are security best practices, but they mean a fresh
-        // `pnpm install` can fail until the user (a) waits 24 h for newly
-        // published `@daloyjs/core` versions to clear the embargo, or (b)
-        // allowlists any dep that needs a build script. Defaulting to N
-        // makes that explicit instead of failing the install silently.
+        // versions), and the scaffolded `.npmrc` keeps `ignore-scripts=true`.
+        // Both are security best practices, but they mean the first install
+        // should be a deliberate user choice rather than something the CLI
+        // does implicitly. Defaulting to N makes that explicit, and it also
+        // avoids surprising users when a fresh `@daloyjs/core` release is
+        // still inside the 24 h embargo window.
         if (rl) {
           console.log(
             color(
               COLORS.gray,
-              "  (pnpm install may fail until you set pnpm.onlyBuiltDependencies in package.json and wait 24h for fresh @daloyjs/core releases \u2014 see pnpm-workspace.yaml)",
+              "  (pnpm install may wait out a fresh-release embargo and keeps lifecycle scripts blocked by default \u2014 see .npmrc + pnpm-workspace.yaml)",
             ),
           );
           installDeps = await askYesNo(rl, `Install dependencies with ${packageManager}?`, false);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-daloy",
-  "version": "0.34.3",
+  "version": "0.35.0",
   "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
   "type": "module",
   "license": "MIT",
@@ -45,4 +45,4 @@
   "scripts": {
     "test": "node --test test/**/*.test.mjs"
   }
-}
+}

package/sbom.cdx.json

@@ -1,25 +1,25 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:9fb86079-cf96-5a72-94a8-dd7d3cdc62cc",
+  "serialNumber": "urn:uuid:94862215-9d79-5a0f-9ee1-81c52885d00f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-23T13:34:45.760Z",
+    "timestamp": "2026-05-24T23:40:28.395Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "0.34.3"
+        "version": "0.35.0"
       }
     ],
     "authors": [],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/create-daloy@0.34.3",
+      "bom-ref": "pkg:npm/create-daloy@0.35.0",
       "name": "create-daloy",
-      "version": "0.34.3",
+      "version": "0.35.0",
       "description": "Scaffold a new DaloyJS project. Run with `pnpm create daloy`, `npm create daloy@latest`, `yarn create daloy`, or `bun create daloy`.",
-      "purl": "pkg:npm/create-daloy@0.34.3",
+      "purl": "pkg:npm/create-daloy@0.35.0",
       "licenses": [
         {
           "license": {
@@ -35,12 +35,16 @@
         {
           "type": "website",
           "url": "https://github.com/daloyjs/daloy/tree/main/packages/create-daloy#readme"
+        },
+        {
+          "type": "distribution",
+          "url": "https://www.npmjs.com/package/create-daloy"
         }
       ],
       "swid": {
-        "tagId": "swidtag-create-daloy-0.34.3",
+        "tagId": "swidtag-create-daloy-0.35.0",
         "name": "create-daloy",
-        "version": "0.34.3",
+        "version": "0.35.0",
         "tagVersion": 0,
         "patch": false
       }
@@ -49,7 +53,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/create-daloy@0.34.3",
+      "ref": "pkg:npm/create-daloy@0.35.0",
       "dependsOn": []
     }
   ]

package/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "create-daloy-0.34.3",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-0.34.3-9fb86079-cf96-5a72-94a8-dd7d3cdc62cc",
+  "name": "create-daloy-0.35.0",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/create-daloy-0.35.0-94862215-9d79-5a0f-9ee1-81c52885d00f",
   "creationInfo": {
-    "created": "2026-05-23T13:34:45.760Z",
+    "created": "2026-05-24T23:40:28.395Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package-create-daloy",
       "name": "create-daloy",
-      "versionInfo": "0.34.3",
+      "versionInfo": "0.35.0",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/create-daloy@0.34.3"
+          "referenceLocator": "pkg:npm/create-daloy@0.35.0"
         }
       ]
     }

package/templates/_ci/deno/SECURITY.md

@@ -23,14 +23,43 @@ The `--with-ci` bundle adds these defaults:
 - If the generated project keeps the `Dockerfile`, container scanning lints it
 	with hadolint, scans the source tree and built image with Trivy, and warns
 	when `FROM` lines are not pinned to an immutable `@sha256:` digest.
-- CodeQL, OpenSSF Scorecard, zizmor, Dependabot for GitHub Actions and Docker
+- CodeQL, Opengrep (second SAST engine, Aikido's LGPL-2.1 fork of
+  Semgrep, verified via sigstore cosign before execution), OpenSSF
+  Scorecard, zizmor, Dependabot for GitHub Actions and Docker
 	base images, and CODEOWNERS are generated.
+- A `secret-scan.yml` workflow runs [gitleaks](https://github.com/gitleaks/gitleaks) against the working tree on every PR / push and against the **full git history** on a daily schedule. The gitleaks binary is downloaded from a pinned official release and verified by SHA-256 before execution so the scan does not introduce a new third-party action into the supply chain. Findings block the merge; matched values are redacted from the public log. The rationale (and the remediation playbook for a confirmed leak) follows Aikido's [Secrets Detection guide](https://www.aikido.dev/blog/secret-detection-application-security): a secret in any commit, branch, or tag should be treated as compromised, and detection must consider the entire history — not just the latest snapshot — alongside GitHub-native push protection.
+
+## Cloud posture (operator checklist)
+
+The framework cannot author your cloud configuration for you, but the
+[Aikido "Top 7 Cloud Security Vulnerabilities"](https://www.aikido.dev/blog/top-cloud-security-vulnerabilities)
+write-up maps cleanly onto a short checklist. Adopt these alongside the
+container and CI defaults above:
+
+- **IMDSv2 only.** On EC2 / equivalent, require token-based IMDSv2 and disable
+  IMDSv1. Combined with the framework's `fetchGuard()` on user-controlled
+  outbound fetches, this closes the Capital One 2019 / Pandoc CVE-2025-51591
+  SSRF → IAM chain.
+- **Least-privilege execution role.** Scope the workload's IAM role to the
+  minimum actions and resource ARNs the handler actually calls (e.g.
+  `s3:GetObject` on a single bucket prefix, never `s3:*`).
+- **Pod security on Kubernetes.** `runAsNonRoot: true`,
+  `readOnlyRootFilesystem: true`, `allowPrivilegeEscalation: false`,
+  `capabilities: { drop: ["ALL"] }`, and `automountServiceAccountToken: false`
+  on pods that do not call the kube API.
+- **Network segmentation.** Keep dev / staging / prod in separate accounts /
+  projects. Apply default-deny `NetworkPolicy` or Security Group egress so a
+  compromised workload cannot freely reach the metadata service or the
+  database tier.
+- **Log agent isolation.** Run FluentBit / Vector under its own ServiceAccount
+  with read-only access to the log path, pin the agent image to a digest, and
+  subscribe to its CVE feed.
 
 ## Required repository settings
 
 Before relying on these files for a company project:
 
 1. Replace `@your-org/security-team` in `.github/CODEOWNERS` or pass `--code-owner` when scaffolding.
-2. Protect the `main` branch and require the CI, CodeQL, Scorecard, and zizmor checks.
+2. Protect the `main` branch and require the CI, CodeQL, Opengrep, Scorecard, and zizmor checks.
 3. Enable GitHub secret scanning and push protection.
 4. Keep Deno permissions narrow; do not switch tasks to `--allow-all`.

package/templates/_ci/deno/_github/CODEOWNERS

@@ -6,6 +6,8 @@
 # Workflow / CI / CD.
 /.github/                         __CODE_OWNER__
 /.github/workflows/               __CODE_OWNER__
+/.github/workflows/osv-scan.yml   __CODE_OWNER__
+/.github/workflows/secret-scan.yml __CODE_OWNER__
 /.github/dependabot.yml           __CODE_OWNER__
 /.github/CODEOWNERS               __CODE_OWNER__
 

package/templates/_ci/deno/_github/workflows/container-scan.yml

@@ -1,12 +1,20 @@
-# Container security scan generated by create-daloy --with-ci.
+# Container + IaC security scan generated by create-daloy --with-ci.
 #
-# The Deno template has no npm package manager, but its Dockerfile still
-# deserves the same container review as Node-based scaffolds:
+# The Deno template has no npm package manager, but its Dockerfile and any
+# IaC files (Terraform / Kubernetes / Helm / CloudFormation) the project
+# adds still deserve the same review as Node-based scaffolds. Modeled on
+# Aikido's "IaC security scanning for Terraform & Kubernetes
+# misconfigurations" article
+# (https://www.aikido.dev/blog/iac-security-scanning-terraform-kubernetes-misconfigurations):
 #
 #   - hadolint lints the Dockerfile for known anti-patterns and unsafe
 #     instructions (CIS Docker Benchmark coverage).
-#   - Trivy scans the source tree (config + secrets + vulnerable lockfile
-#     entries), then scans the built image for OS + language CVEs.
+#   - Trivy filesystem scan with the `misconfig` scanner enabled catches
+#     IaC misconfigurations (Terraform, Kubernetes, Helm, Dockerfile,
+#     CloudFormation) plus secrets and vulnerable lockfile entries. It
+#     runs even when no Dockerfile is present, so a project that only
+#     ships Terraform / K8s still gets the Aikido-style posture review.
+#   - Trivy image scan covers OS + language CVEs once the image is built.
 #   - SARIF results are uploaded to the Code Scanning tab so findings show
 #     up in the same place as CodeQL.
 
@@ -19,6 +27,17 @@ on:
       - ".dockerignore"
       - "deno.json"
       - "deno.lock"
+      - "**/*.tf"
+      - "**/*.tfvars"
+      - "**/*.hcl"
+      - "k8s/**"
+      - "helm/**"
+      - "**/deployment.yaml"
+      - "**/deployment.yml"
+      - "**/kustomization.yaml"
+      - "**/kustomization.yml"
+      - "**/Chart.yaml"
+      - "**/values.yaml"
       - ".github/workflows/container-scan.yml"
   push:
     branches: [main]
@@ -27,6 +46,17 @@ on:
       - ".dockerignore"
       - "deno.json"
       - "deno.lock"
+      - "**/*.tf"
+      - "**/*.tfvars"
+      - "**/*.hcl"
+      - "k8s/**"
+      - "helm/**"
+      - "**/deployment.yaml"
+      - "**/deployment.yml"
+      - "**/kustomization.yaml"
+      - "**/kustomization.yml"
+      - "**/Chart.yaml"
+      - "**/values.yaml"
       - ".github/workflows/container-scan.yml"
   schedule:
     # Weekly run catches newly-disclosed base-image CVEs even when the
@@ -114,12 +144,17 @@ jobs:
           sarif_file: hadolint.sarif
           category: hadolint
 
-      - name: Trivy filesystem scan (config + secrets + vulns)
-        if: steps.detect.outputs.present == 'true'
+      - name: Trivy filesystem scan (IaC misconfig + secrets + vulns)
+        # `misconfig` is the IaC posture scanner — Terraform, Kubernetes,
+        # Helm, Dockerfile, CloudFormation — per Aikido's "IaC security
+        # scanning for Terraform & Kubernetes misconfigurations" article.
+        # It runs unconditionally so a project that only ships Terraform
+        # or K8s (no Dockerfile) still gets reviewed on every PR.
         uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           scan-type: fs
           scan-ref: .
+          scanners: vuln,secret,misconfig
           severity: HIGH,CRITICAL
           ignore-unfixed: true
           format: sarif
@@ -127,7 +162,6 @@ jobs:
           exit-code: "0"
 
       - name: Upload Trivy filesystem SARIF
-        if: steps.detect.outputs.present == 'true'
         uses: github/codeql-action/upload-sarif@52485aec7be33610227643b0fe83936b8b5f061a # v3
         with:
           sarif_file: trivy-fs.sarif

package/templates/_ci/deno/_github/workflows/deploy.yml

@@ -9,11 +9,18 @@
 # After the image is published, point your platform at GHCR or replace the
 # final push steps with your provider's deploy command.
 #
+# Every pushed image is also signed and attested with Sigstore Cosign
+# (keyless / OIDC) and an SPDX SBOM, so consumers can verify provenance
+# with `cosign verify` and `cosign verify-attestation --type spdxjson`
+# instead of trusting the registry alone. See Aikido's "Container
+# Security Best Practices" (https://www.aikido.dev/blog/container-security-best-practices)
+# for why signed images + SBOM attestation are the supply-chain floor.
+#
 # Optional container-host handoff examples:
 #   - Fly.io: install flyctl in a later step and run
-#       flyctl deploy --image "$IMAGE_REPO:sha-${GITHUB_SHA}" --remote-only
+#       flyctl deploy --image "$IMAGE_REPO@${IMAGE_DIGEST}" --remote-only
 #   - Render: create an image-backed service that tracks
-#       ghcr.io/<owner>/<repo>:sha-${GITHUB_SHA}
+#       ghcr.io/<owner>/<repo>@${IMAGE_DIGEST}
 
 name: Deploy
 
@@ -71,7 +78,12 @@ jobs:
       name: production
     permissions:
       contents: read
+      # `packages: write` lets us push to GHCR; `id-token: write` lets
+      # Cosign mint a short-lived OIDC identity for keyless image signing
+      # + SBOM attestation. Both are scoped to this single job — the
+      # top-level workflow still has `permissions: {}`.
       packages: write
+      id-token: write
 
     steps:
       - name: Harden runner
@@ -115,4 +127,57 @@ jobs:
         run: |
           set -eu
           docker push "$IMAGE_REPO:sha-${GITHUB_SHA}"
-          docker push "$IMAGE_REPO:latest"
+          docker push "$IMAGE_REPO:latest"
+
+      - name: Resolve pushed image digest
+        # Resolve and pin the immutable digest the rest of the workflow
+        # signs and attests against. Signing a mutable tag would let any
+        # later push silently re-point a "verified" tag at attacker
+        # content; binding cosign + the SBOM attestation to
+        # ${IMAGE_REPO}@sha256:<digest> closes that race.
+        run: |
+          set -eu
+          digest="$(docker inspect --format='{{index .RepoDigests 0}}' "$IMAGE_REPO:sha-${GITHUB_SHA}" | awk -F@ '{print $2}')"
+          if [ -z "$digest" ]; then
+            echo "::error::Failed to resolve image digest for $IMAGE_REPO:sha-${GITHUB_SHA}" >&2
+            exit 1
+          fi
+          echo "IMAGE_DIGEST=$digest" >> "$GITHUB_ENV"
+          echo "IMAGE_REF=$IMAGE_REPO@$digest" >> "$GITHUB_ENV"
+          echo "::notice::Signed image reference: $IMAGE_REPO@$digest"
+
+      - name: Install Cosign
+        # SHA-pinned per the project's actions-pinning policy. v4.1.2,
+        # commit 6f9f17788090df1f26f669e9d70d6ae9567deba6.
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+
+      - name: Sign image with Cosign (keyless / OIDC)
+        # Keyless signing uses the workflow's `id-token` OIDC identity
+        # — no long-lived signing key to leak. Verifiers can pin to
+        # `--certificate-identity` matching this workflow URL.
+        env:
+          COSIGN_EXPERIMENTAL: "1"
+        run: |
+          set -eu
+          cosign sign --yes "$IMAGE_REF"
+
+      - name: Generate SPDX SBOM for image
+        # SHA-pinned per the project's actions-pinning policy. v0.24.0,
+        # commit e22c389904149dbc22b58101806040fa8d37a610.
+        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        with:
+          image: ${{ env.IMAGE_REF }}
+          format: spdx-json
+          output-file: sbom.spdx.json
+          upload-artifact: false
+          upload-release-assets: false
+
+      - name: Attest SBOM with Cosign
+        env:
+          COSIGN_EXPERIMENTAL: "1"
+        run: |
+          set -eu
+          cosign attest --yes \
+            --predicate sbom.spdx.json \
+            --type spdxjson \
+            "$IMAGE_REF"