javi-forge 1.22.1 → 1.22.3

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 JNZader
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/commands/ci.js

@@ -734,8 +734,8 @@ async function runStep(options) {
                 "the image must be resolved before any step runs");
         }
         const workdir = runner.directory !== "."
-            ? `/home/runner/work/${runner.directory}`
-            : "/home/runner/work";
+            ? `${CONTAINER_WORKDIR}/${runner.directory}`
+            : CONTAINER_WORKDIR;
         const result = await runInContainer({
             projectDir,
             image,

package/dist/lib/common.d.ts

@@ -10,8 +10,6 @@ export declare function backupIfExists(filePath: string): Promise<boolean>;
 export declare function ensureDirExists(dirPath: string): Promise<void>;
 /** Check if a directory is a git repository */
 export declare function isGitRepo(dir: string): Promise<boolean>;
-/** Resolve the forge assets root (the package root directory) */
-export declare function getForgeRoot(): string;
 /** Stack display names */
 export declare const STACK_LABELS: Record<Stack, string>;
 //# sourceMappingURL=common.d.ts.map

package/dist/lib/common.js

@@ -100,12 +100,6 @@ export async function ensureDirExists(dirPath) {
 export async function isGitRepo(dir) {
     return fs.pathExists(path.join(dir, ".git"));
 }
-/** Resolve the forge assets root (the package root directory) */
-export function getForgeRoot() {
-    // When running from dist/, go up one level
-    const thisDir = path.dirname(new URL(import.meta.url).pathname);
-    return path.resolve(thisDir, "..");
-}
 /** Stack display names */
 export const STACK_LABELS = {
     node: "Node.js / TypeScript",

package/dist/lib/docker.js

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
 import crypto from "node:crypto";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 import fs from "fs-extra";
 import { execFileAsync } from "./exec.js";
 // =============================================================================
@@ -139,7 +140,7 @@ export async function ensureImage(options) {
     else {
         imageName = getImageName(stack);
         const dockerDir = dockerfilesDir ??
-            path.join(path.dirname(new URL(import.meta.url).pathname), "../../ci-local/docker");
+            path.join(path.dirname(fileURLToPath(import.meta.url)), "../../ci-local/docker");
         dockerfilePath = path.join(dockerDir, `${stack}.Dockerfile`);
         contextDir = dockerDir;
         // Write Dockerfile if it doesn't exist yet (first run)

package/modules/engram/install-engram.sh

@@ -153,20 +153,31 @@ fi
 CHECKSUM_URL="https://github.com/${REPO}/releases/download/${VERSION}/checksums.txt"
 if curl -fsSL -o "${TMP_DIR}/checksums.txt" "$CHECKSUM_URL" 2>/dev/null; then
     echo -e "${CYAN}Verifying checksum...${NC}"
+    CHECKSUM_RAN=false
     pushd "$TMP_DIR" > /dev/null
     if command -v sha256sum &>/dev/null; then
         sha256sum -c checksums.txt --ignore-missing || {
             echo -e "${RED}Checksum verification failed!${NC}"
             exit 1
         }
+        CHECKSUM_RAN=true
     elif command -v shasum &>/dev/null; then
         shasum -a 256 -c checksums.txt --ignore-missing || {
             echo -e "${RED}Checksum verification failed!${NC}"
             exit 1
         }
+        CHECKSUM_RAN=true
     fi
     popd > /dev/null
-    echo -e "${GREEN}Checksum verified${NC}"
+    if [[ "$CHECKSUM_RAN" == "true" ]]; then
+        echo -e "${GREEN}Checksum verified${NC}"
+    elif [[ "$NO_VERIFY" == "true" ]]; then
+        echo -e "${YELLOW}WARNING: neither sha256sum nor shasum found; skipping checksum verification (--no-verify)${NC}"
+    else
+        echo -e "${RED}Error: neither sha256sum nor shasum is available. Cannot verify download integrity.${NC}"
+        echo -e "${YELLOW}Install coreutils (sha256sum) or perl (shasum), or use --no-verify to skip verification (NOT RECOMMENDED).${NC}"
+        exit 1
+    fi
 else
     if [[ "$NO_VERIFY" == "true" ]]; then
         echo -e "${YELLOW}WARNING: Skipping checksum verification (--no-verify)${NC}"

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "javi-forge",
-	"version": "1.22.1",
+	"version": "1.22.3",
 	"description": "Project scaffolding and AI-ready CI bootstrap",
 	"type": "module",
 	"bin": {

package/templates/github/ci-go.yml

@@ -34,7 +34,7 @@ concurrency:
 
 jobs:
   build:
-    uses: JNZader/javi-forge/.github/workflows/reusable-build-go.yml@main
+    uses: JNZader/javi-forge/.github/workflows/reusable-build-go.yml@667908ddb5e1aeb8e44ec65e84e4bc0e4f936d6c # main@2026-08-10
     with:
       go-version: '1.23'  # Change to: 1.22, 1.23
       run-lint: true

package/templates/github/ci-java.yml

@@ -37,7 +37,7 @@ concurrency:
 
 jobs:
   build:
-    uses: JNZader/javi-forge/.github/workflows/reusable-build-java.yml@main
+    uses: JNZader/javi-forge/.github/workflows/reusable-build-java.yml@667908ddb5e1aeb8e44ec65e84e4bc0e4f936d6c # main@2026-08-10
     with:
       java-version: '21'  # Change to your version: 17, 21, 25
       run-spotless: true

package/templates/github/ci-node.yml

@@ -34,7 +34,7 @@ concurrency:
 
 jobs:
   build:
-    uses: JNZader/javi-forge/.github/workflows/reusable-build-node.yml@main
+    uses: JNZader/javi-forge/.github/workflows/reusable-build-node.yml@667908ddb5e1aeb8e44ec65e84e4bc0e4f936d6c # main@2026-08-10
     with:
       node-version: '20'  # Change to: 18, 20, 22
       package-manager: 'npm'  # Change to: npm, yarn, pnpm

package/templates/github/ci-python.yml

@@ -34,7 +34,7 @@ concurrency:
 
 jobs:
   build:
-    uses: JNZader/javi-forge/.github/workflows/reusable-build-python.yml@main
+    uses: JNZader/javi-forge/.github/workflows/reusable-build-python.yml@667908ddb5e1aeb8e44ec65e84e4bc0e4f936d6c # main@2026-08-10
     with:
       python-version: '3.12'  # Change to: 3.10, 3.11, 3.12
       package-manager: 'pip'  # Change to: pip, poetry, uv

package/templates/github/ci-rust.yml

@@ -34,7 +34,7 @@ concurrency:
 
 jobs:
   build:
-    uses: JNZader/javi-forge/.github/workflows/reusable-build-rust.yml@main
+    uses: JNZader/javi-forge/.github/workflows/reusable-build-rust.yml@667908ddb5e1aeb8e44ec65e84e4bc0e4f936d6c # main@2026-08-10
     with:
       toolchain: 'stable'  # Change to: stable, beta, nightly
       run-clippy: true

package/templates/github/deploy-docker-zero-downtime.yml

@@ -55,10 +55,10 @@ jobs:
     outputs:
       image_tag: ${{ steps.meta.outputs.tags }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Log in to Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -66,7 +66,7 @@ jobs:
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
@@ -74,7 +74,7 @@ jobs:
             type=raw,value=latest
 
       - name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
         with:
           context: .
           push: true
@@ -88,11 +88,16 @@ jobs:
     environment: production
     steps:
       - name: Deploy via SSH + docker rollout
-        uses: appleboy/ssh-action@v1
+        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
+        env:
+          # Expression-injection hardening: the workflow_dispatch input is passed
+          # as an env var (never interpolated into the shell script text).
+          SERVICE: ${{ github.event.inputs.service || '__SERVICE_NAME__' }}
         with:
           host: ${{ env.DEPLOY_HOST }}
           username: ${{ env.DEPLOY_USER }}
           key: ${{ secrets.DEPLOY_KEY }}
+          envs: SERVICE
           script: |
             set -euo pipefail
 
@@ -102,7 +107,6 @@ jobs:
             docker compose pull
 
             # Zero-downtime rollout for the target service
-            SERVICE="${{ github.event.inputs.service || '__SERVICE_NAME__' }}"
             echo "::group::Rolling out ${SERVICE}"
             docker rollout "${SERVICE}"
             echo "::endgroup::"
@@ -111,15 +115,19 @@ jobs:
             docker image prune -f
 
       - name: Verify deployment
-        uses: appleboy/ssh-action@v1
+        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
+        env:
+          # Expression-injection hardening: the workflow_dispatch input is passed
+          # as an env var (never interpolated into the shell script text).
+          SERVICE: ${{ github.event.inputs.service || '__SERVICE_NAME__' }}
         with:
           host: ${{ env.DEPLOY_HOST }}
           username: ${{ env.DEPLOY_USER }}
           key: ${{ secrets.DEPLOY_KEY }}
+          envs: SERVICE
           script: |
             set -euo pipefail
             cd ${{ secrets.DEPLOY_DIR || '~/app' }}
-            SERVICE="${{ github.event.inputs.service || '__SERVICE_NAME__' }}"
 
             # Wait for healthcheck (max 60s)
             TIMEOUT=60

package/templates/github/ghagga-review.yml

@@ -21,7 +21,9 @@ jobs:
   review:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      # TODO(pin): ghagga has no v1 tag upstream (releases start at v2) — this
+      # ref cannot be SHA-pinned as-is; pick a real released tag and pin it.
       - uses: JNZader/ghagga@v1
         with:
           mode: simple

package/templates/local-ai/.env.example

@@ -1,17 +1,24 @@
 # Local AI Stack — Environment Variables
 # Copy to .env in your project: cp .env.example .env
+#
+# Secure defaults: all ports bind to 127.0.0.1 (loopback), WebUI auth is ON,
+# and SUPABASE_DB_PASSWORD is REQUIRED (no default) for the "full" profile.
 
 # ── Ollama ──────────────────────────────────────────────────────────────────
 OLLAMA_PORT=11434
 
 # ── Open WebUI ──────────────────────────────────────────────────────────────
 WEBUI_PORT=3000
-WEBUI_AUTH=false
+# Auth is ON by default (create the admin account on first visit).
+# Set to false ONLY if you accept an unauthenticated local UI.
+WEBUI_AUTH=true
 
 # ── n8n ─────────────────────────────────────────────────────────────────────
 N8N_PORT=5678
 
 # ── Supabase (Postgres) ────────────────────────────────────────────────────
 SUPABASE_DB_PORT=5432
-SUPABASE_DB_PASSWORD=postgres
+# CHANGE ME — required, no default (Postgres refuses to start if unset). Generate one:
+#   openssl rand -base64 24
+SUPABASE_DB_PASSWORD=
 SUPABASE_DB_NAME=app

package/templates/local-ai/docker-compose.yml

@@ -18,7 +18,9 @@ services:
     container_name: ollama
     restart: unless-stopped
     ports:
-      - "${OLLAMA_PORT:-11434}:11434"
+      # Bound to loopback by default — this is a LOCAL dev stack. To expose on
+      # your LAN, change 127.0.0.1 to your interface IP (opt-in, not default).
+      - "127.0.0.1:${OLLAMA_PORT:-11434}:11434"
     volumes:
       - ollama_data:/root/.ollama
     environment:
@@ -45,12 +47,14 @@ services:
     profiles: ["ui", "auto", "full"]
     restart: unless-stopped
     ports:
-      - "${WEBUI_PORT:-3000}:8080"
+      - "127.0.0.1:${WEBUI_PORT:-3000}:8080"
     volumes:
       - open_webui_data:/app/backend/data
     environment:
       - OLLAMA_BASE_URL=http://ollama:11434
-      - WEBUI_AUTH=${WEBUI_AUTH:-false}
+      # Auth ON by default. Set WEBUI_AUTH=false in .env only if you accept an
+      # unauthenticated UI (loopback-only mitigates, but any local process can reach it).
+      - WEBUI_AUTH=${WEBUI_AUTH:-true}
     depends_on:
       ollama:
         condition: service_healthy
@@ -62,7 +66,7 @@ services:
     profiles: ["auto", "full"]
     restart: unless-stopped
     ports:
-      - "${N8N_PORT:-5678}:5678"
+      - "127.0.0.1:${N8N_PORT:-5678}:5678"
     volumes:
       - n8n_data:/home/node/.n8n
     environment:
@@ -76,11 +80,15 @@ services:
     profiles: ["full"]
     restart: unless-stopped
     ports:
-      - "${SUPABASE_DB_PORT:-5432}:5432"
+      - "127.0.0.1:${SUPABASE_DB_PORT:-5432}:5432"
     volumes:
       - supabase_db_data:/var/lib/postgresql/data
     environment:
-      POSTGRES_PASSWORD: ${SUPABASE_DB_PASSWORD:-postgres}
+      # No insecure default — REQUIRED. If unset/empty, Postgres refuses to
+      # initialize ("superuser password is not specified"): set it in .env.
+      # Note: a compose-level `:?` guard would also break the core (ollama-only)
+      # profile at parse time, so the check is delegated to the postgres image.
+      POSTGRES_PASSWORD: ${SUPABASE_DB_PASSWORD}
       POSTGRES_DB: ${SUPABASE_DB_NAME:-app}
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U postgres"]