create-raredays-app 0.1.4 → 0.1.6

package/README.md

@@ -49,7 +49,7 @@ Presets set the template, modules, and brand color. You can still customise disp
 ## What it does
 
 1. Copies `templates/<name>/` into the target directory.
-2. Renames stub files (`_gitignore` -> `.gitignore`, `_npmrc` -> `.npmrc`).
+2. Renames stub files (`_gitignore` -> `.gitignore`, `_github` -> `.github`).
 3. Sets `package.json:name` to the project slug.
 4. Substitutes `__SLUG__` in `site.spec.ts` and applies display name, domain, and brand color.
 5. Loads scaffold fragments for selected modules (imports, config, ports, file overlays).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-raredays-app",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Scaffold a new RareDays Next.js app.",
   "license": "UNLICENSED",
   "author": "Jeremy Harper <jeremy@raredays.com>",
@@ -14,13 +14,16 @@
     "skillex"
   ],
   "type": "module",
+  "publishConfig": {
+    "access": "public"
+  },
   "dependencies": {
     "@clack/prompts": "1.4.0"
   },
   "devDependencies": {
     "typescript": "5.9.3",
-    "vitest": "4.1.5",
-    "@raredays/lint": "0.1.0"
+    "vitest": "4.1.9",
+    "@raredays/lint": "0.2.0"
   },
   "engines": {
     "node": ">=20"
@@ -34,6 +37,7 @@
     "style": "raredays style",
     "style:fix": "raredays style:fix",
     "fix": "raredays fix",
+    "publint": "publint run --strict",
     "check": "raredays check",
     "test": "vitest run",
     "test:watch": "vitest",

package/templates/client/.node-version

@@ -0,0 +1 @@
+24.15.0

package/templates/client/.semgrepignore

@@ -0,0 +1,12 @@
+# Semgrep ignore — paths excluded from SAST scans.
+#
+# Add specific paths or globs here when a rule produces unavoidable
+# false positives (e.g. mock servers using http://localhost, generated
+# code that trips security patterns).
+#
+# Example:
+#   src/mocks/*.test.ts
+#
+# Prefer inline `// nosemgrep: <rule-id> -- <reason>` over path-level
+# exclusions when the case is local; reserve this file for whole files
+# that legitimately need to be skipped.

package/templates/client/_github/actions/setup/action.yml

@@ -0,0 +1,37 @@
+name: Setup
+description: >-
+  Install pnpm and Node, authenticate to the private @raredays npm registry, then
+  install dependencies. The @raredays/* packages are published with restricted
+  access, so the registry token must be present before install. pnpm ignores
+  ${VAR} interpolation in a committed project .npmrc (it could leak the token to
+  an attacker-controlled registry), so the token is written to the user-level
+  ~/.npmrc at runtime instead.
+
+inputs:
+  node-auth-token:
+    description: >-
+      npm token with read access to the private @raredays registry. Pass it from
+      the NODE_AUTH_TOKEN repository secret.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+    - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      with:
+        node-version: 24
+        cache: pnpm
+    - name: Authenticate to the npm registry
+      shell: bash
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.node-auth-token }}
+      run: |
+        if [ -z "$NODE_AUTH_TOKEN" ]; then
+          echo "::error::NODE_AUTH_TOKEN is empty. Add a repository secret with an npm token that has read access to the private @raredays registry."
+          exit 1
+        fi
+        echo "//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}" >> ~/.npmrc
+    - name: Install dependencies
+      shell: bash
+      run: pnpm install --frozen-lockfile

package/templates/client/_github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
@@ -20,11 +23,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with: { node-version: 24, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
       - run: pnpm lint
 
   format-check:
@@ -32,11 +36,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with: { node-version: 24, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
       - run: pnpm format:check
 
   style:
@@ -44,11 +49,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with: { node-version: 24, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
       - run: pnpm style
 
   typecheck:
@@ -56,11 +62,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with: { node-version: 24, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
       - run: pnpm theme:build
       - run: pnpm typecheck
 
@@ -69,11 +76,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with: { node-version: 24, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
       - run: pnpm theme:build
       - run: pnpm test
 
@@ -82,23 +90,49 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with: { node-version: 24, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
       - run: pnpm build
 
   storybook:
     name: Storybook build
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    if: hashFiles('.storybook/main.ts', '.storybook/main.js') != ''
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with: { node-version: 24, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
       - run: pnpm theme:build
       - run: pnpm storybook:build
+
+  # Single aggregation gate — make THIS the only required status check in
+  # branch protection so you don't have to enumerate every job (skipped
+  # jobs are tolerated by the gate).
+  ci-result:
+    name: ci-result
+    needs: [lint, format-check, style, typecheck, test, build, storybook]
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Aggregate CI results
+        env:
+          NEEDS: ${{ toJson(needs) }}
+        run: |
+          echo "$NEEDS" | jq -r 'to_entries[] | "\(.key)\t\(.value.result)"'
+          failed=$(echo "$NEEDS" | jq -r '
+            to_entries[]
+            | select(.value.result == "failure" or .value.result == "cancelled")
+            | .key')
+          if [ -n "$failed" ]; then
+            echo "::error::Failed or cancelled jobs: $failed"
+            exit 1
+          fi
+          echo "All required CI jobs passed (or were skipped)."

package/templates/client/_github/workflows/coverage.yml

@@ -0,0 +1,40 @@
+name: Coverage
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: coverage-${{ github.ref }}
+  cancel-in-progress: true
+
+# Runs Vitest with --coverage and uploads the HTML report as an artifact.
+# Coverage thresholds are not enforced by default — opt in by configuring
+# `test.coverage.thresholds` in vitest.config.ts when your suite is ready.
+
+jobs:
+  coverage:
+    name: Coverage
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
+      - run: pnpm theme:build
+      - run: pnpm coverage
+      - name: Upload coverage report
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: coverage-report
+          path: coverage/
+          retention-days: 14

package/templates/client/_github/workflows/sast.yml

@@ -0,0 +1,42 @@
+name: SAST
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sast-${{ github.ref }}
+  cancel-in-progress: true
+
+# Static Application Security Testing via Semgrep. Scans first-party
+# source against TypeScript, JavaScript, React, and OWASP top-ten
+# rulesets. Findings fail the build — silence false positives with
+# `.semgrepignore` (path-level) or inline `// nosemgrep: <rule-id>` with
+# a justification.
+
+jobs:
+  semgrep:
+    name: Semgrep
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    if: github.actor != 'dependabot[bot]'
+    container:
+      image: semgrep/semgrep:1.168.0@sha256:59fbed6127ea7c5dde3ba6a85142733bb20ea9aaa36120c953904f1539aaf66e
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Run Semgrep
+        run: |
+          semgrep scan \
+            --config=p/typescript \
+            --config=p/javascript \
+            --config=p/react \
+            --config=p/owasp-top-ten \
+            --error \
+            --metrics=off

package/templates/client/_github/workflows/security.yml

@@ -0,0 +1,33 @@
+name: Security
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: security-${{ github.ref }}
+  cancel-in-progress: true
+
+# Audits production dependencies for known vulnerabilities. Fails the
+# build on high or critical severity findings; moderate and low findings
+# appear in the log but don't block merges.
+
+jobs:
+  audit:
+    name: pnpm audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
+      - name: Audit production dependencies
+        run: pnpm audit --audit-level=high --prod

package/templates/client/_github/workflows/zizmor.yml

@@ -0,0 +1,43 @@
+name: Zizmor
+
+on:
+  push:
+    branches: [main]
+    paths: [".github/**"]
+  pull_request:
+    branches: [main]
+    paths: [".github/**"]
+
+permissions: {}
+
+concurrency:
+  group: zizmor-${{ github.ref }}
+  cancel-in-progress: true
+
+# Static security analysis of this app's GitHub Actions workflows
+# (template-injection, unpinned actions, excessive token permissions,
+# credential persistence). Free runner-hosted SAST — no GitHub Advanced
+# Security needed. Findings surface as inline PR annotations. Starts at
+# min-severity: high; lower to medium/low once your workflows are clean.
+
+jobs:
+  zizmor:
+    name: GitHub Actions security (zizmor)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        with:
+          min-severity: high
+          min-confidence: medium
+          # This app's repo may not have GitHub Advanced Security; disable the
+          # SARIF/code-scanning upload (mutually exclusive with annotations) and
+          # surface findings as inline PR annotations instead.
+          advanced-security: false
+          annotations: true

package/templates/client/package.json

@@ -12,6 +12,7 @@
     "theme:build": "node ./scripts/build-theme.mjs",
     "test": "vitest run",
     "test:watch": "vitest",
+    "coverage": "vitest run --coverage",
     "storybook": "storybook dev -p 6006",
     "storybook:build": "storybook build -o storybook-static",
     "lint": "raredays lint",
@@ -48,6 +49,7 @@
     "@types/react": "19.2.14",
     "@types/react-dom": "19.2.3",
     "@vitejs/plugin-react": "6.0.1",
+    "@vitest/coverage-v8": "4.1.5",
     "happy-dom": "15.11.7",
     "storybook": "10.3.6",
     "tailwindcss": "4.2.4",
@@ -57,5 +59,6 @@
   },
   "engines": {
     "node": ">=24"
-  }
+  },
+  "packageManager": "pnpm@11.9.0"
 }

package/templates/full-stack/.node-version

@@ -0,0 +1 @@
+24.15.0

package/templates/full-stack/.semgrepignore

@@ -0,0 +1,12 @@
+# Semgrep ignore — paths excluded from SAST scans.
+#
+# Add specific paths or globs here when a rule produces unavoidable
+# false positives (e.g. mock servers using http://localhost, generated
+# code that trips security patterns).
+#
+# Example:
+#   src/mocks/*.test.ts
+#
+# Prefer inline `// nosemgrep: <rule-id> -- <reason>` over path-level
+# exclusions when the case is local; reserve this file for whole files
+# that legitimately need to be skipped.

package/templates/full-stack/_github/actions/setup/action.yml

@@ -0,0 +1,37 @@
+name: Setup
+description: >-
+  Install pnpm and Node, authenticate to the private @raredays npm registry, then
+  install dependencies. The @raredays/* packages are published with restricted
+  access, so the registry token must be present before install. pnpm ignores
+  ${VAR} interpolation in a committed project .npmrc (it could leak the token to
+  an attacker-controlled registry), so the token is written to the user-level
+  ~/.npmrc at runtime instead.
+
+inputs:
+  node-auth-token:
+    description: >-
+      npm token with read access to the private @raredays registry. Pass it from
+      the NODE_AUTH_TOKEN repository secret.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+    - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      with:
+        node-version: 24
+        cache: pnpm
+    - name: Authenticate to the npm registry
+      shell: bash
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.node-auth-token }}
+      run: |
+        if [ -z "$NODE_AUTH_TOKEN" ]; then
+          echo "::error::NODE_AUTH_TOKEN is empty. Add a repository secret with an npm token that has read access to the private @raredays registry."
+          exit 1
+        fi
+        echo "//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}" >> ~/.npmrc
+    - name: Install dependencies
+      shell: bash
+      run: pnpm install --frozen-lockfile

package/templates/full-stack/_github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
@@ -24,11 +27,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with: { node-version: 24, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
       - run: pnpm lint
 
   format-check:
@@ -36,11 +40,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with: { node-version: 24, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
       - run: pnpm format:check
 
   style:
@@ -48,11 +53,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with: { node-version: 24, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
       - run: pnpm style
 
   typecheck:
@@ -60,11 +66,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with: { node-version: 24, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
       - run: pnpm theme:build
       - run: pnpm typecheck
 
@@ -73,11 +80,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with: { node-version: 24, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
       - run: pnpm theme:build
       - run: pnpm test
 
@@ -86,24 +94,49 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with: { node-version: 24, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
       - run: pnpm build
 
   storybook:
     name: Storybook build
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    # Only run if storybook is configured.
-    if: hashFiles('.storybook/main.ts', '.storybook/main.js') != ''
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with: { node-version: 24, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
       - run: pnpm theme:build
       - run: pnpm storybook:build
+
+  # Single aggregation gate — make THIS the only required status check in
+  # branch protection so you don't have to enumerate every job (skipped
+  # jobs are tolerated by the gate).
+  ci-result:
+    name: ci-result
+    needs: [lint, format-check, style, typecheck, test, build, storybook]
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Aggregate CI results
+        env:
+          NEEDS: ${{ toJson(needs) }}
+        run: |
+          echo "$NEEDS" | jq -r 'to_entries[] | "\(.key)\t\(.value.result)"'
+          failed=$(echo "$NEEDS" | jq -r '
+            to_entries[]
+            | select(.value.result == "failure" or .value.result == "cancelled")
+            | .key')
+          if [ -n "$failed" ]; then
+            echo "::error::Failed or cancelled jobs: $failed"
+            exit 1
+          fi
+          echo "All required CI jobs passed (or were skipped)."

package/templates/full-stack/_github/workflows/coverage.yml

@@ -0,0 +1,40 @@
+name: Coverage
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: coverage-${{ github.ref }}
+  cancel-in-progress: true
+
+# Runs Vitest with --coverage and uploads the HTML report as an artifact.
+# Coverage thresholds are not enforced by default — opt in by configuring
+# `test.coverage.thresholds` in vitest.config.ts when your suite is ready.
+
+jobs:
+  coverage:
+    name: Coverage
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
+      - run: pnpm theme:build
+      - run: pnpm coverage
+      - name: Upload coverage report
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: coverage-report
+          path: coverage/
+          retention-days: 14

package/templates/full-stack/_github/workflows/db-check.yml

@@ -19,17 +19,19 @@ on:
       - "package.json"
       - ".github/workflows/db-check.yml"
 
+permissions:
+  contents: read
+
 jobs:
   db-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
         with:
-          node-version: 24
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
       - name: Validate migrations
         env:
           DATABASE_URL: ${{ secrets.DATABASE_URL_STAGING }}

package/templates/full-stack/_github/workflows/db-migrate.yml

@@ -15,6 +15,9 @@ on:
       - ".github/workflows/db-migrate.yml"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 concurrency:
   # Advisory lock at the workflow layer too — defense in depth alongside
   # safeMigrate's per-database advisory lock.
@@ -26,13 +29,12 @@ jobs:
     runs-on: ubuntu-latest
     environment: production
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
         with:
-          node-version: 24
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
       - name: Apply migrations
         env:
           DATABASE_URL: ${{ secrets.DATABASE_URL }}

package/templates/full-stack/_github/workflows/sast.yml

@@ -0,0 +1,42 @@
+name: SAST
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sast-${{ github.ref }}
+  cancel-in-progress: true
+
+# Static Application Security Testing via Semgrep. Scans first-party
+# source against TypeScript, JavaScript, React, and OWASP top-ten
+# rulesets. Findings fail the build — silence false positives with
+# `.semgrepignore` (path-level) or inline `// nosemgrep: <rule-id>` with
+# a justification.
+
+jobs:
+  semgrep:
+    name: Semgrep
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    if: github.actor != 'dependabot[bot]'
+    container:
+      image: semgrep/semgrep:1.168.0@sha256:59fbed6127ea7c5dde3ba6a85142733bb20ea9aaa36120c953904f1539aaf66e
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Run Semgrep
+        run: |
+          semgrep scan \
+            --config=p/typescript \
+            --config=p/javascript \
+            --config=p/react \
+            --config=p/owasp-top-ten \
+            --error \
+            --metrics=off

package/templates/full-stack/_github/workflows/security.yml

@@ -0,0 +1,33 @@
+name: Security
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: security-${{ github.ref }}
+  cancel-in-progress: true
+
+# Audits production dependencies for known vulnerabilities. Fails the
+# build on high or critical severity findings; moderate and low findings
+# appear in the log but don't block merges.
+
+jobs:
+  audit:
+    name: pnpm audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
+      - name: Audit production dependencies
+        run: pnpm audit --audit-level=high --prod

package/templates/full-stack/_github/workflows/zizmor.yml

@@ -0,0 +1,43 @@
+name: Zizmor
+
+on:
+  push:
+    branches: [main]
+    paths: [".github/**"]
+  pull_request:
+    branches: [main]
+    paths: [".github/**"]
+
+permissions: {}
+
+concurrency:
+  group: zizmor-${{ github.ref }}
+  cancel-in-progress: true
+
+# Static security analysis of this app's GitHub Actions workflows
+# (template-injection, unpinned actions, excessive token permissions,
+# credential persistence). Free runner-hosted SAST — no GitHub Advanced
+# Security needed. Findings surface as inline PR annotations. Starts at
+# min-severity: high; lower to medium/low once your workflows are clean.
+
+jobs:
+  zizmor:
+    name: GitHub Actions security (zizmor)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        with:
+          min-severity: high
+          min-confidence: medium
+          # This app's repo may not have GitHub Advanced Security; disable the
+          # SARIF/code-scanning upload (mutually exclusive with annotations) and
+          # surface findings as inline PR annotations instead.
+          advanced-security: false
+          annotations: true

package/templates/full-stack/package.json

@@ -12,6 +12,7 @@
     "theme:build": "node ./scripts/build-theme.mjs",
     "test": "vitest run",
     "test:watch": "vitest",
+    "coverage": "vitest run --coverage",
     "storybook": "storybook dev -p 6006",
     "storybook:build": "storybook build -o storybook-static",
     "db:generate": "drizzle-kit generate",
@@ -58,6 +59,7 @@
     "@storybook/react-vite": "10.3.6",
     "@tailwindcss/vite": "4.2.4",
     "@vitejs/plugin-react": "6.0.1",
+    "@vitest/coverage-v8": "4.1.5",
     "drizzle-kit": "0.31.10",
     "happy-dom": "15.11.7",
     "storybook": "10.3.6",
@@ -68,5 +70,6 @@
   },
   "engines": {
     "node": ">=24"
-  }
+  },
+  "packageManager": "pnpm@11.9.0"
 }

package/templates/static/.node-version

@@ -0,0 +1 @@
+24.15.0

package/templates/static/.semgrepignore

@@ -0,0 +1,12 @@
+# Semgrep ignore — paths excluded from SAST scans.
+#
+# Add specific paths or globs here when a rule produces unavoidable
+# false positives (e.g. mock servers using http://localhost, generated
+# code that trips security patterns).
+#
+# Example:
+#   src/mocks/*.test.ts
+#
+# Prefer inline `// nosemgrep: <rule-id> -- <reason>` over path-level
+# exclusions when the case is local; reserve this file for whole files
+# that legitimately need to be skipped.

package/templates/static/_github/actions/setup/action.yml

@@ -0,0 +1,37 @@
+name: Setup
+description: >-
+  Install pnpm and Node, authenticate to the private @raredays npm registry, then
+  install dependencies. The @raredays/* packages are published with restricted
+  access, so the registry token must be present before install. pnpm ignores
+  ${VAR} interpolation in a committed project .npmrc (it could leak the token to
+  an attacker-controlled registry), so the token is written to the user-level
+  ~/.npmrc at runtime instead.
+
+inputs:
+  node-auth-token:
+    description: >-
+      npm token with read access to the private @raredays registry. Pass it from
+      the NODE_AUTH_TOKEN repository secret.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+    - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      with:
+        node-version: 24
+        cache: pnpm
+    - name: Authenticate to the npm registry
+      shell: bash
+      env:
+        NODE_AUTH_TOKEN: ${{ inputs.node-auth-token }}
+      run: |
+        if [ -z "$NODE_AUTH_TOKEN" ]; then
+          echo "::error::NODE_AUTH_TOKEN is empty. Add a repository secret with an npm token that has read access to the private @raredays registry."
+          exit 1
+        fi
+        echo "//registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}" >> ~/.npmrc
+    - name: Install dependencies
+      shell: bash
+      run: pnpm install --frozen-lockfile

package/templates/static/_github/workflows/ci.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
@@ -20,11 +23,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with: { node-version: 24, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
       - run: pnpm lint
 
   format-check:
@@ -32,11 +36,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with: { node-version: 24, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
       - run: pnpm format:check
 
   style:
@@ -44,11 +49,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with: { node-version: 24, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
       - run: pnpm style
 
   typecheck:
@@ -56,11 +62,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with: { node-version: 24, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
       - run: pnpm theme:build
       - run: pnpm typecheck
 
@@ -69,23 +76,49 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with: { node-version: 24, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
       - run: pnpm build
 
   storybook:
     name: Storybook build
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    if: hashFiles('.storybook/main.ts', '.storybook/main.js') != ''
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with: { node-version: 24, cache: pnpm }
-      - run: pnpm install --frozen-lockfile
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
       - run: pnpm theme:build
       - run: pnpm storybook:build
+
+  # Single aggregation gate — make THIS the only required status check in
+  # branch protection so you don't have to enumerate every job (skipped
+  # jobs are tolerated by the gate).
+  ci-result:
+    name: ci-result
+    needs: [lint, format-check, style, typecheck, build, storybook]
+    if: ${{ !cancelled() }}
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Aggregate CI results
+        env:
+          NEEDS: ${{ toJson(needs) }}
+        run: |
+          echo "$NEEDS" | jq -r 'to_entries[] | "\(.key)\t\(.value.result)"'
+          failed=$(echo "$NEEDS" | jq -r '
+            to_entries[]
+            | select(.value.result == "failure" or .value.result == "cancelled")
+            | .key')
+          if [ -n "$failed" ]; then
+            echo "::error::Failed or cancelled jobs: $failed"
+            exit 1
+          fi
+          echo "All required CI jobs passed (or were skipped)."

package/templates/static/_github/workflows/sast.yml

@@ -0,0 +1,42 @@
+name: SAST
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sast-${{ github.ref }}
+  cancel-in-progress: true
+
+# Static Application Security Testing via Semgrep. Scans first-party
+# source against TypeScript, JavaScript, React, and OWASP top-ten
+# rulesets. Findings fail the build — silence false positives with
+# `.semgrepignore` (path-level) or inline `// nosemgrep: <rule-id>` with
+# a justification.
+
+jobs:
+  semgrep:
+    name: Semgrep
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    if: github.actor != 'dependabot[bot]'
+    container:
+      image: semgrep/semgrep:1.168.0@sha256:59fbed6127ea7c5dde3ba6a85142733bb20ea9aaa36120c953904f1539aaf66e
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Run Semgrep
+        run: |
+          semgrep scan \
+            --config=p/typescript \
+            --config=p/javascript \
+            --config=p/react \
+            --config=p/owasp-top-ten \
+            --error \
+            --metrics=off

package/templates/static/_github/workflows/security.yml

@@ -0,0 +1,33 @@
+name: Security
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: security-${{ github.ref }}
+  cancel-in-progress: true
+
+# Audits production dependencies for known vulnerabilities. Fails the
+# build on high or critical severity findings; moderate and low findings
+# appear in the log but don't block merges.
+
+jobs:
+  audit:
+    name: pnpm audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup
+        with:
+          node-auth-token: ${{ secrets.NODE_AUTH_TOKEN }}
+      - name: Audit production dependencies
+        run: pnpm audit --audit-level=high --prod

package/templates/static/_github/workflows/zizmor.yml

@@ -0,0 +1,43 @@
+name: Zizmor
+
+on:
+  push:
+    branches: [main]
+    paths: [".github/**"]
+  pull_request:
+    branches: [main]
+    paths: [".github/**"]
+
+permissions: {}
+
+concurrency:
+  group: zizmor-${{ github.ref }}
+  cancel-in-progress: true
+
+# Static security analysis of this app's GitHub Actions workflows
+# (template-injection, unpinned actions, excessive token permissions,
+# credential persistence). Free runner-hosted SAST — no GitHub Advanced
+# Security needed. Findings surface as inline PR annotations. Starts at
+# min-severity: high; lower to medium/low once your workflows are clean.
+
+jobs:
+  zizmor:
+    name: GitHub Actions security (zizmor)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        with:
+          min-severity: high
+          min-confidence: medium
+          # This app's repo may not have GitHub Advanced Security; disable the
+          # SARIF/code-scanning upload (mutually exclusive with annotations) and
+          # surface findings as inline PR annotations instead.
+          advanced-security: false
+          annotations: true

package/templates/static/package.json

@@ -25,6 +25,7 @@
     "@raredays/components": "^0.1.0",
     "@raredays/core": "^0.1.0",
     "@raredays/style": "^0.1.0",
+    "lucide-react": "1.14.0",
     "next": "16.2.4",
     "react": "19.2.5",
     "react-dom": "19.2.5"
@@ -49,5 +50,6 @@
   },
   "engines": {
     "node": ">=24"
-  }
+  },
+  "packageManager": "pnpm@11.9.0"
 }