create-raredays-app 0.1.3 → 0.1.5

package/bin/compose-allow-builds.mjs

@@ -0,0 +1,47 @@
+// Merge per-module build-script approvals into a template's pnpm-workspace.yaml.
+//
+// pnpm 11 blocks dependency build scripts by default and only honors approvals
+// declared as `allowBuilds` in pnpm-workspace.yaml (the package.json `pnpm`
+// field and .npmrc are ignored). Each scaffold fragment (module or vendor) may
+// declare its own `allowBuilds` map in module.json; the scaffolder unions those
+// onto the template's base so a generated app pre-approves exactly the build
+// scripts its selected modules need — no matter which modules are chosen.
+//
+// Pure string transform over the template's pnpm-workspace.yaml: parse the
+// existing `  <pkg>: true|false` entries, union the fragment-contributed ones
+// (later wins, so a fragment can also opt a build OUT with `false`), and
+// re-emit a sorted block while preserving the file's header comment. We avoid a
+// YAML parser dependency on purpose — the block is a flat name->boolean map.
+
+const ENTRY = /^ {2}["']?([^"':\s]+)["']?:\s*(true|false)\s*$/gm;
+
+/**
+ * @param {string} yamlSource - the template's pnpm-workspace.yaml contents
+ * @param {Record<string, boolean>} extra - build approvals contributed by selected fragments
+ * @returns {string} the rewritten pnpm-workspace.yaml contents
+ */
+export function mergeAllowBuilds(yamlSource, extra) {
+  const merged = {};
+  ENTRY.lastIndex = 0;
+  let match;
+  while ((match = ENTRY.exec(yamlSource)) !== null) {
+    merged[match[1]] = match[2] === "true";
+  }
+  for (const [name, value] of Object.entries(extra)) {
+    merged[name] = value === true || value === "true";
+  }
+
+  // Preserve everything before `allowBuilds:` (the header comment block).
+  const marker = yamlSource.indexOf("allowBuilds:");
+  const header = marker > 0 ? yamlSource.slice(0, marker) : "";
+
+  const lines = Object.keys(merged)
+    .sort()
+    .map((name) => {
+      // Quote names that aren't bare identifiers (e.g. scoped "@sentry/cli").
+      const key = /^[a-zA-Z0-9_-]+$/.test(name) ? name : `"${name}"`;
+      return `  ${key}: ${merged[name] ? "true" : "false"}`;
+    });
+
+  return `${header}allowBuilds:\n${lines.join("\n")}\n`;
+}

package/bin/index.js

@@ -7,6 +7,8 @@ import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 import * as p from "@clack/prompts";
 
+import { mergeAllowBuilds } from "./compose-allow-builds.mjs";
+
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const packageRoot = resolve(__dirname, "..");
 const templatesDir = resolve(packageRoot, "templates");
@@ -520,6 +522,7 @@ async function scaffold(opts) {
   // Load + apply selected fragments. Static templates don't have a
   // composition root, so skip module composition entirely there.
   const collectedDeps = {};
+  const collectedBuilds = {};
   const envVars = [];
   const vendorMocks = [];
   if (opts.template !== "static" && opts.selectedModules.length > 0) {
@@ -528,6 +531,7 @@ async function scaffold(opts) {
 
     for (const f of valid) {
       Object.assign(collectedDeps, f.deps ?? {});
+      Object.assign(collectedBuilds, f.allowBuilds ?? {});
       if (f.filesDir) await cp(f.filesDir, targetDir, { recursive: true });
     }
 
@@ -537,6 +541,7 @@ async function scaffold(opts) {
       const vendor = f?.vendors?.find((v) => v.key === vendorKey);
       if (!vendor) continue;
       Object.assign(collectedDeps, vendor.deps ?? {});
+      Object.assign(collectedBuilds, vendor.allowBuilds ?? {});
       for (const v of vendor.env ?? []) envVars.push(v);
       if (vendor.mocks) {
         vendorMocks.push(vendor.mocks);
@@ -550,6 +555,16 @@ async function scaffold(opts) {
     await writeFile(runtimePath, composeRuntime(source, valid));
   }
 
+  // Union module/vendor build-script approvals onto the template's
+  // pnpm-workspace.yaml so the generated app pre-approves exactly what its
+  // selected modules need under pnpm 11. No-op when no fragment declares any.
+  if (Object.keys(collectedBuilds).length > 0) {
+    const wsPath = resolve(targetDir, "pnpm-workspace.yaml");
+    if (existsSync(wsPath)) {
+      await writeFile(wsPath, mergeAllowBuilds(await readFile(wsPath, "utf8"), collectedBuilds));
+    }
+  }
+
   // Compose mocks/handlers.ts for any template that ships it (full-stack + client).
   if (opts.template !== "static") {
     const handlersPath = resolve(targetDir, "mocks/handlers.ts");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-raredays-app",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Scaffold a new RareDays Next.js app.",
   "license": "UNLICENSED",
   "author": "Jeremy Harper <jeremy@raredays.com>",
@@ -14,13 +14,16 @@
     "skillex"
   ],
   "type": "module",
+  "publishConfig": {
+    "access": "public"
+  },
   "dependencies": {
     "@clack/prompts": "1.4.0"
   },
   "devDependencies": {
     "typescript": "5.9.3",
-    "vitest": "4.1.5",
-    "@raredays/lint": "0.1.0"
+    "vitest": "4.1.9",
+    "@raredays/lint": "0.2.0"
   },
   "engines": {
     "node": ">=20"
@@ -34,6 +37,7 @@
     "style": "raredays style",
     "style:fix": "raredays style:fix",
     "fix": "raredays fix",
+    "publint": "publint run --strict",
     "check": "raredays check",
     "test": "vitest run",
     "test:watch": "vitest",

package/templates/client/.node-version

@@ -0,0 +1 @@
+24.15.0

package/templates/client/.semgrepignore

@@ -0,0 +1,12 @@
+# Semgrep ignore — paths excluded from SAST scans.
+#
+# Add specific paths or globs here when a rule produces unavoidable
+# false positives (e.g. mock servers using http://localhost, generated
+# code that trips security patterns).
+#
+# Example:
+#   src/mocks/*.test.ts
+#
+# Prefer inline `// nosemgrep: <rule-id> -- <reason>` over path-level
+# exclusions when the case is local; reserve this file for whole files
+# that legitimately need to be skipped.

package/templates/client/_github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
@@ -20,9 +23,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: { node-version: 24, cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm lint
@@ -32,9 +37,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: { node-version: 24, cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm format:check
@@ -44,9 +51,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: { node-version: 24, cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm style
@@ -56,9 +65,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: { node-version: 24, cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm theme:build
@@ -69,9 +80,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: { node-version: 24, cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm theme:build
@@ -82,9 +95,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: { node-version: 24, cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm build
@@ -93,12 +108,38 @@ jobs:
     name: Storybook build
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    if: hashFiles('.storybook/main.ts', '.storybook/main.js') != ''
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: { node-version: 24, cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm theme:build
       - run: pnpm storybook:build
+
+  # Single aggregation gate — make THIS the only required status check in
+  # branch protection so you don't have to enumerate every job (skipped
+  # jobs are tolerated by the gate).
+  ci-result:
+    name: ci-result
+    needs: [lint, format-check, style, typecheck, test, build, storybook]
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Aggregate CI results
+        env:
+          NEEDS: ${{ toJson(needs) }}
+        run: |
+          echo "$NEEDS" | jq -r 'to_entries[] | "\(.key)\t\(.value.result)"'
+          failed=$(echo "$NEEDS" | jq -r '
+            to_entries[]
+            | select(.value.result == "failure" or .value.result == "cancelled")
+            | .key')
+          if [ -n "$failed" ]; then
+            echo "::error::Failed or cancelled jobs: $failed"
+            exit 1
+          fi
+          echo "All required CI jobs passed (or were skipped)."

package/templates/client/_github/workflows/coverage.yml

@@ -0,0 +1,41 @@
+name: Coverage
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: coverage-${{ github.ref }}
+  cancel-in-progress: true
+
+# Runs Vitest with --coverage and uploads the HTML report as an artifact.
+# Coverage thresholds are not enforced by default — opt in by configuring
+# `test.coverage.thresholds` in vitest.config.ts when your suite is ready.
+
+jobs:
+  coverage:
+    name: Coverage
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with: { node-version: 24, cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm theme:build
+      - run: pnpm coverage
+      - name: Upload coverage report
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: coverage-report
+          path: coverage/
+          retention-days: 14

package/templates/client/_github/workflows/sast.yml

@@ -0,0 +1,42 @@
+name: SAST
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sast-${{ github.ref }}
+  cancel-in-progress: true
+
+# Static Application Security Testing via Semgrep. Scans first-party
+# source against TypeScript, JavaScript, React, and OWASP top-ten
+# rulesets. Findings fail the build — silence false positives with
+# `.semgrepignore` (path-level) or inline `// nosemgrep: <rule-id>` with
+# a justification.
+
+jobs:
+  semgrep:
+    name: Semgrep
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    if: github.actor != 'dependabot[bot]'
+    container:
+      image: semgrep/semgrep:1.168.0@sha256:59fbed6127ea7c5dde3ba6a85142733bb20ea9aaa36120c953904f1539aaf66e
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Run Semgrep
+        run: |
+          semgrep scan \
+            --config=p/typescript \
+            --config=p/javascript \
+            --config=p/react \
+            --config=p/owasp-top-ten \
+            --error \
+            --metrics=off

package/templates/client/_github/workflows/security.yml

@@ -0,0 +1,34 @@
+name: Security
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: security-${{ github.ref }}
+  cancel-in-progress: true
+
+# Audits production dependencies for known vulnerabilities. Fails the
+# build on high or critical severity findings; moderate and low findings
+# appear in the log but don't block merges.
+
+jobs:
+  audit:
+    name: pnpm audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with: { node-version: 24, cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - name: Audit production dependencies
+        run: pnpm audit --audit-level=high --prod

package/templates/client/_github/workflows/zizmor.yml

@@ -0,0 +1,43 @@
+name: Zizmor
+
+on:
+  push:
+    branches: [main]
+    paths: [".github/**"]
+  pull_request:
+    branches: [main]
+    paths: [".github/**"]
+
+permissions: {}
+
+concurrency:
+  group: zizmor-${{ github.ref }}
+  cancel-in-progress: true
+
+# Static security analysis of this app's GitHub Actions workflows
+# (template-injection, unpinned actions, excessive token permissions,
+# credential persistence). Free runner-hosted SAST — no GitHub Advanced
+# Security needed. Findings surface as inline PR annotations. Starts at
+# min-severity: high; lower to medium/low once your workflows are clean.
+
+jobs:
+  zizmor:
+    name: GitHub Actions security (zizmor)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        with:
+          min-severity: high
+          min-confidence: medium
+          # This app's repo may not have GitHub Advanced Security; disable the
+          # SARIF/code-scanning upload (mutually exclusive with annotations) and
+          # surface findings as inline PR annotations instead.
+          advanced-security: false
+          annotations: true

package/templates/client/package.json

@@ -12,6 +12,7 @@
     "theme:build": "node ./scripts/build-theme.mjs",
     "test": "vitest run",
     "test:watch": "vitest",
+    "coverage": "vitest run --coverage",
     "storybook": "storybook dev -p 6006",
     "storybook:build": "storybook build -o storybook-static",
     "lint": "raredays lint",
@@ -48,6 +49,7 @@
     "@types/react": "19.2.14",
     "@types/react-dom": "19.2.3",
     "@vitejs/plugin-react": "6.0.1",
+    "@vitest/coverage-v8": "4.1.5",
     "happy-dom": "15.11.7",
     "storybook": "10.3.6",
     "tailwindcss": "4.2.4",
@@ -57,5 +59,6 @@
   },
   "engines": {
     "node": ">=24"
-  }
+  },
+  "packageManager": "pnpm@11.9.0"
 }

package/templates/client/pnpm-workspace.yaml

@@ -0,0 +1,9 @@
+# pnpm 11 blocks dependency build scripts by default, and its pre-run deps
+# check then aborts every pnpm command (install/build/exec) with
+# ERR_PNPM_IGNORED_BUILDS. Pre-approve the builds this app actually needs so a
+# fresh scaffold works out of the box. (In pnpm 11 `allowBuilds` replaced
+# `onlyBuiltDependencies`; values are booleans, not a list.)
+allowBuilds:
+  esbuild: true
+  msw: true
+  sharp: true

package/templates/full-stack/.node-version

@@ -0,0 +1 @@
+24.15.0

package/templates/full-stack/.semgrepignore

@@ -0,0 +1,12 @@
+# Semgrep ignore — paths excluded from SAST scans.
+#
+# Add specific paths or globs here when a rule produces unavoidable
+# false positives (e.g. mock servers using http://localhost, generated
+# code that trips security patterns).
+#
+# Example:
+#   src/mocks/*.test.ts
+#
+# Prefer inline `// nosemgrep: <rule-id> -- <reason>` over path-level
+# exclusions when the case is local; reserve this file for whole files
+# that legitimately need to be skipped.

package/templates/full-stack/_github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
@@ -24,9 +27,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: { node-version: 24, cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm lint
@@ -36,9 +41,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: { node-version: 24, cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm format:check
@@ -48,9 +55,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: { node-version: 24, cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm style
@@ -60,9 +69,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: { node-version: 24, cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm theme:build
@@ -73,9 +84,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: { node-version: 24, cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm theme:build
@@ -86,9 +99,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: { node-version: 24, cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm build
@@ -97,13 +112,38 @@ jobs:
     name: Storybook build
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    # Only run if storybook is configured.
-    if: hashFiles('.storybook/main.ts', '.storybook/main.js') != ''
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: { node-version: 24, cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm theme:build
       - run: pnpm storybook:build
+
+  # Single aggregation gate — make THIS the only required status check in
+  # branch protection so you don't have to enumerate every job (skipped
+  # jobs are tolerated by the gate).
+  ci-result:
+    name: ci-result
+    needs: [lint, format-check, style, typecheck, test, build, storybook]
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Aggregate CI results
+        env:
+          NEEDS: ${{ toJson(needs) }}
+        run: |
+          echo "$NEEDS" | jq -r 'to_entries[] | "\(.key)\t\(.value.result)"'
+          failed=$(echo "$NEEDS" | jq -r '
+            to_entries[]
+            | select(.value.result == "failure" or .value.result == "cancelled")
+            | .key')
+          if [ -n "$failed" ]; then
+            echo "::error::Failed or cancelled jobs: $failed"
+            exit 1
+          fi
+          echo "All required CI jobs passed (or were skipped)."

package/templates/full-stack/_github/workflows/coverage.yml

@@ -0,0 +1,41 @@
+name: Coverage
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: coverage-${{ github.ref }}
+  cancel-in-progress: true
+
+# Runs Vitest with --coverage and uploads the HTML report as an artifact.
+# Coverage thresholds are not enforced by default — opt in by configuring
+# `test.coverage.thresholds` in vitest.config.ts when your suite is ready.
+
+jobs:
+  coverage:
+    name: Coverage
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with: { node-version: 24, cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm theme:build
+      - run: pnpm coverage
+      - name: Upload coverage report
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: coverage-report
+          path: coverage/
+          retention-days: 14

package/templates/full-stack/_github/workflows/db-check.yml

@@ -19,13 +19,18 @@ on:
       - "package.json"
       - ".github/workflows/db-check.yml"
 
+permissions:
+  contents: read
+
 jobs:
   db-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: pnpm

package/templates/full-stack/_github/workflows/db-migrate.yml

@@ -15,6 +15,9 @@ on:
       - ".github/workflows/db-migrate.yml"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   # Advisory lock at the workflow layer too — defense in depth alongside
   # safeMigrate's per-database advisory lock.
@@ -26,9 +29,11 @@ jobs:
     runs-on: ubuntu-latest
     environment: production
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
           cache: pnpm

package/templates/full-stack/_github/workflows/sast.yml

@@ -0,0 +1,42 @@
+name: SAST
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sast-${{ github.ref }}
+  cancel-in-progress: true
+
+# Static Application Security Testing via Semgrep. Scans first-party
+# source against TypeScript, JavaScript, React, and OWASP top-ten
+# rulesets. Findings fail the build — silence false positives with
+# `.semgrepignore` (path-level) or inline `// nosemgrep: <rule-id>` with
+# a justification.
+
+jobs:
+  semgrep:
+    name: Semgrep
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    if: github.actor != 'dependabot[bot]'
+    container:
+      image: semgrep/semgrep:1.168.0@sha256:59fbed6127ea7c5dde3ba6a85142733bb20ea9aaa36120c953904f1539aaf66e
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Run Semgrep
+        run: |
+          semgrep scan \
+            --config=p/typescript \
+            --config=p/javascript \
+            --config=p/react \
+            --config=p/owasp-top-ten \
+            --error \
+            --metrics=off

package/templates/full-stack/_github/workflows/security.yml

@@ -0,0 +1,34 @@
+name: Security
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: security-${{ github.ref }}
+  cancel-in-progress: true
+
+# Audits production dependencies for known vulnerabilities. Fails the
+# build on high or critical severity findings; moderate and low findings
+# appear in the log but don't block merges.
+
+jobs:
+  audit:
+    name: pnpm audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with: { node-version: 24, cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - name: Audit production dependencies
+        run: pnpm audit --audit-level=high --prod

package/templates/full-stack/_github/workflows/zizmor.yml

@@ -0,0 +1,43 @@
+name: Zizmor
+
+on:
+  push:
+    branches: [main]
+    paths: [".github/**"]
+  pull_request:
+    branches: [main]
+    paths: [".github/**"]
+
+permissions: {}
+
+concurrency:
+  group: zizmor-${{ github.ref }}
+  cancel-in-progress: true
+
+# Static security analysis of this app's GitHub Actions workflows
+# (template-injection, unpinned actions, excessive token permissions,
+# credential persistence). Free runner-hosted SAST — no GitHub Advanced
+# Security needed. Findings surface as inline PR annotations. Starts at
+# min-severity: high; lower to medium/low once your workflows are clean.
+
+jobs:
+  zizmor:
+    name: GitHub Actions security (zizmor)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        with:
+          min-severity: high
+          min-confidence: medium
+          # This app's repo may not have GitHub Advanced Security; disable the
+          # SARIF/code-scanning upload (mutually exclusive with annotations) and
+          # surface findings as inline PR annotations instead.
+          advanced-security: false
+          annotations: true

package/templates/full-stack/package.json

@@ -12,6 +12,7 @@
     "theme:build": "node ./scripts/build-theme.mjs",
     "test": "vitest run",
     "test:watch": "vitest",
+    "coverage": "vitest run --coverage",
     "storybook": "storybook dev -p 6006",
     "storybook:build": "storybook build -o storybook-static",
     "db:generate": "drizzle-kit generate",
@@ -58,6 +59,7 @@
     "@storybook/react-vite": "10.3.6",
     "@tailwindcss/vite": "4.2.4",
     "@vitejs/plugin-react": "6.0.1",
+    "@vitest/coverage-v8": "4.1.5",
     "drizzle-kit": "0.31.10",
     "happy-dom": "15.11.7",
     "storybook": "10.3.6",
@@ -68,5 +70,6 @@
   },
   "engines": {
     "node": ">=24"
-  }
+  },
+  "packageManager": "pnpm@11.9.0"
 }

package/templates/full-stack/pnpm-workspace.yaml

@@ -0,0 +1,9 @@
+# pnpm 11 blocks dependency build scripts by default, and its pre-run deps
+# check then aborts every pnpm command (install/build/exec) with
+# ERR_PNPM_IGNORED_BUILDS. Pre-approve the builds this app actually needs so a
+# fresh scaffold works out of the box. (In pnpm 11 `allowBuilds` replaced
+# `onlyBuiltDependencies`; values are booleans, not a list.)
+allowBuilds:
+  esbuild: true
+  msw: true
+  sharp: true

package/templates/static/.node-version

@@ -0,0 +1 @@
+24.15.0

package/templates/static/.semgrepignore

@@ -0,0 +1,12 @@
+# Semgrep ignore — paths excluded from SAST scans.
+#
+# Add specific paths or globs here when a rule produces unavoidable
+# false positives (e.g. mock servers using http://localhost, generated
+# code that trips security patterns).
+#
+# Example:
+#   src/mocks/*.test.ts
+#
+# Prefer inline `// nosemgrep: <rule-id> -- <reason>` over path-level
+# exclusions when the case is local; reserve this file for whole files
+# that legitimately need to be skipped.

package/templates/static/_github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
@@ -20,9 +23,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: { node-version: 24, cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm lint
@@ -32,9 +37,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: { node-version: 24, cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm format:check
@@ -44,9 +51,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: { node-version: 24, cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm style
@@ -56,9 +65,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: { node-version: 24, cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm theme:build
@@ -69,9 +80,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: { node-version: 24, cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm build
@@ -80,12 +93,38 @@ jobs:
     name: Storybook build
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    if: hashFiles('.storybook/main.ts', '.storybook/main.js') != ''
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: { node-version: 24, cache: pnpm }
       - run: pnpm install --frozen-lockfile
       - run: pnpm theme:build
       - run: pnpm storybook:build
+
+  # Single aggregation gate — make THIS the only required status check in
+  # branch protection so you don't have to enumerate every job (skipped
+  # jobs are tolerated by the gate).
+  ci-result:
+    name: ci-result
+    needs: [lint, format-check, style, typecheck, build, storybook]
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Aggregate CI results
+        env:
+          NEEDS: ${{ toJson(needs) }}
+        run: |
+          echo "$NEEDS" | jq -r 'to_entries[] | "\(.key)\t\(.value.result)"'
+          failed=$(echo "$NEEDS" | jq -r '
+            to_entries[]
+            | select(.value.result == "failure" or .value.result == "cancelled")
+            | .key')
+          if [ -n "$failed" ]; then
+            echo "::error::Failed or cancelled jobs: $failed"
+            exit 1
+          fi
+          echo "All required CI jobs passed (or were skipped)."

package/templates/static/_github/workflows/sast.yml

@@ -0,0 +1,42 @@
+name: SAST
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sast-${{ github.ref }}
+  cancel-in-progress: true
+
+# Static Application Security Testing via Semgrep. Scans first-party
+# source against TypeScript, JavaScript, React, and OWASP top-ten
+# rulesets. Findings fail the build — silence false positives with
+# `.semgrepignore` (path-level) or inline `// nosemgrep: <rule-id>` with
+# a justification.
+
+jobs:
+  semgrep:
+    name: Semgrep
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    if: github.actor != 'dependabot[bot]'
+    container:
+      image: semgrep/semgrep:1.168.0@sha256:59fbed6127ea7c5dde3ba6a85142733bb20ea9aaa36120c953904f1539aaf66e
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Run Semgrep
+        run: |
+          semgrep scan \
+            --config=p/typescript \
+            --config=p/javascript \
+            --config=p/react \
+            --config=p/owasp-top-ten \
+            --error \
+            --metrics=off

package/templates/static/_github/workflows/security.yml

@@ -0,0 +1,34 @@
+name: Security
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: security-${{ github.ref }}
+  cancel-in-progress: true
+
+# Audits production dependencies for known vulnerabilities. Fails the
+# build on high or critical severity findings; moderate and low findings
+# appear in the log but don't block merges.
+
+jobs:
+  audit:
+    name: pnpm audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with: { node-version: 24, cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - name: Audit production dependencies
+        run: pnpm audit --audit-level=high --prod

package/templates/static/_github/workflows/zizmor.yml

@@ -0,0 +1,43 @@
+name: Zizmor
+
+on:
+  push:
+    branches: [main]
+    paths: [".github/**"]
+  pull_request:
+    branches: [main]
+    paths: [".github/**"]
+
+permissions: {}
+
+concurrency:
+  group: zizmor-${{ github.ref }}
+  cancel-in-progress: true
+
+# Static security analysis of this app's GitHub Actions workflows
+# (template-injection, unpinned actions, excessive token permissions,
+# credential persistence). Free runner-hosted SAST — no GitHub Advanced
+# Security needed. Findings surface as inline PR annotations. Starts at
+# min-severity: high; lower to medium/low once your workflows are clean.
+
+jobs:
+  zizmor:
+    name: GitHub Actions security (zizmor)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        with:
+          min-severity: high
+          min-confidence: medium
+          # This app's repo may not have GitHub Advanced Security; disable the
+          # SARIF/code-scanning upload (mutually exclusive with annotations) and
+          # surface findings as inline PR annotations instead.
+          advanced-security: false
+          annotations: true

package/templates/static/package.json

@@ -25,6 +25,7 @@
     "@raredays/components": "^0.1.0",
     "@raredays/core": "^0.1.0",
     "@raredays/style": "^0.1.0",
+    "lucide-react": "1.14.0",
     "next": "16.2.4",
     "react": "19.2.5",
     "react-dom": "19.2.5"
@@ -49,5 +50,6 @@
   },
   "engines": {
     "node": ">=24"
-  }
+  },
+  "packageManager": "pnpm@11.9.0"
 }

package/templates/static/pnpm-workspace.yaml

@@ -0,0 +1,8 @@
+# pnpm 11 blocks dependency build scripts by default, and its pre-run deps
+# check then aborts every pnpm command (install/build/exec) with
+# ERR_PNPM_IGNORED_BUILDS. Pre-approve the builds this app actually needs so a
+# fresh scaffold works out of the box. (In pnpm 11 `allowBuilds` replaced
+# `onlyBuiltDependencies`; values are booleans, not a list.)
+allowBuilds:
+  esbuild: true
+  sharp: true