javi-forge 1.22.2 → 1.22.3

package/modules/engram/install-engram.sh

@@ -153,20 +153,31 @@ fi
 CHECKSUM_URL="https://github.com/${REPO}/releases/download/${VERSION}/checksums.txt"
 if curl -fsSL -o "${TMP_DIR}/checksums.txt" "$CHECKSUM_URL" 2>/dev/null; then
     echo -e "${CYAN}Verifying checksum...${NC}"
+    CHECKSUM_RAN=false
     pushd "$TMP_DIR" > /dev/null
     if command -v sha256sum &>/dev/null; then
         sha256sum -c checksums.txt --ignore-missing || {
             echo -e "${RED}Checksum verification failed!${NC}"
             exit 1
         }
+        CHECKSUM_RAN=true
     elif command -v shasum &>/dev/null; then
         shasum -a 256 -c checksums.txt --ignore-missing || {
             echo -e "${RED}Checksum verification failed!${NC}"
             exit 1
         }
+        CHECKSUM_RAN=true
     fi
     popd > /dev/null
-    echo -e "${GREEN}Checksum verified${NC}"
+    if [[ "$CHECKSUM_RAN" == "true" ]]; then
+        echo -e "${GREEN}Checksum verified${NC}"
+    elif [[ "$NO_VERIFY" == "true" ]]; then
+        echo -e "${YELLOW}WARNING: neither sha256sum nor shasum found; skipping checksum verification (--no-verify)${NC}"
+    else
+        echo -e "${RED}Error: neither sha256sum nor shasum is available. Cannot verify download integrity.${NC}"
+        echo -e "${YELLOW}Install coreutils (sha256sum) or perl (shasum), or use --no-verify to skip verification (NOT RECOMMENDED).${NC}"
+        exit 1
+    fi
 else
     if [[ "$NO_VERIFY" == "true" ]]; then
         echo -e "${YELLOW}WARNING: Skipping checksum verification (--no-verify)${NC}"

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "javi-forge",
-	"version": "1.22.2",
+	"version": "1.22.3",
 	"description": "Project scaffolding and AI-ready CI bootstrap",
 	"type": "module",
 	"bin": {

package/templates/github/ci-go.yml

@@ -34,7 +34,7 @@ concurrency:
 
 jobs:
   build:
-    uses: JNZader/javi-forge/.github/workflows/reusable-build-go.yml@main
+    uses: JNZader/javi-forge/.github/workflows/reusable-build-go.yml@667908ddb5e1aeb8e44ec65e84e4bc0e4f936d6c # main@2026-08-10
     with:
       go-version: '1.23'  # Change to: 1.22, 1.23
       run-lint: true

package/templates/github/ci-java.yml

@@ -37,7 +37,7 @@ concurrency:
 
 jobs:
   build:
-    uses: JNZader/javi-forge/.github/workflows/reusable-build-java.yml@main
+    uses: JNZader/javi-forge/.github/workflows/reusable-build-java.yml@667908ddb5e1aeb8e44ec65e84e4bc0e4f936d6c # main@2026-08-10
     with:
       java-version: '21'  # Change to your version: 17, 21, 25
       run-spotless: true

package/templates/github/ci-node.yml

@@ -34,7 +34,7 @@ concurrency:
 
 jobs:
   build:
-    uses: JNZader/javi-forge/.github/workflows/reusable-build-node.yml@main
+    uses: JNZader/javi-forge/.github/workflows/reusable-build-node.yml@667908ddb5e1aeb8e44ec65e84e4bc0e4f936d6c # main@2026-08-10
     with:
       node-version: '20'  # Change to: 18, 20, 22
       package-manager: 'npm'  # Change to: npm, yarn, pnpm

package/templates/github/ci-python.yml

@@ -34,7 +34,7 @@ concurrency:
 
 jobs:
   build:
-    uses: JNZader/javi-forge/.github/workflows/reusable-build-python.yml@main
+    uses: JNZader/javi-forge/.github/workflows/reusable-build-python.yml@667908ddb5e1aeb8e44ec65e84e4bc0e4f936d6c # main@2026-08-10
     with:
       python-version: '3.12'  # Change to: 3.10, 3.11, 3.12
       package-manager: 'pip'  # Change to: pip, poetry, uv

package/templates/github/ci-rust.yml

@@ -34,7 +34,7 @@ concurrency:
 
 jobs:
   build:
-    uses: JNZader/javi-forge/.github/workflows/reusable-build-rust.yml@main
+    uses: JNZader/javi-forge/.github/workflows/reusable-build-rust.yml@667908ddb5e1aeb8e44ec65e84e4bc0e4f936d6c # main@2026-08-10
     with:
       toolchain: 'stable'  # Change to: stable, beta, nightly
       run-clippy: true

package/templates/github/deploy-docker-zero-downtime.yml

@@ -55,10 +55,10 @@ jobs:
     outputs:
       image_tag: ${{ steps.meta.outputs.tags }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Log in to Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -66,7 +66,7 @@ jobs:
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
@@ -74,7 +74,7 @@ jobs:
             type=raw,value=latest
 
       - name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
         with:
           context: .
           push: true
@@ -88,11 +88,16 @@ jobs:
     environment: production
     steps:
       - name: Deploy via SSH + docker rollout
-        uses: appleboy/ssh-action@v1
+        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
+        env:
+          # Expression-injection hardening: the workflow_dispatch input is passed
+          # as an env var (never interpolated into the shell script text).
+          SERVICE: ${{ github.event.inputs.service || '__SERVICE_NAME__' }}
         with:
           host: ${{ env.DEPLOY_HOST }}
           username: ${{ env.DEPLOY_USER }}
           key: ${{ secrets.DEPLOY_KEY }}
+          envs: SERVICE
           script: |
             set -euo pipefail
 
@@ -102,7 +107,6 @@ jobs:
             docker compose pull
 
             # Zero-downtime rollout for the target service
-            SERVICE="${{ github.event.inputs.service || '__SERVICE_NAME__' }}"
             echo "::group::Rolling out ${SERVICE}"
             docker rollout "${SERVICE}"
             echo "::endgroup::"
@@ -111,15 +115,19 @@ jobs:
             docker image prune -f
 
       - name: Verify deployment
-        uses: appleboy/ssh-action@v1
+        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1.2.5
+        env:
+          # Expression-injection hardening: the workflow_dispatch input is passed
+          # as an env var (never interpolated into the shell script text).
+          SERVICE: ${{ github.event.inputs.service || '__SERVICE_NAME__' }}
         with:
           host: ${{ env.DEPLOY_HOST }}
           username: ${{ env.DEPLOY_USER }}
           key: ${{ secrets.DEPLOY_KEY }}
+          envs: SERVICE
           script: |
             set -euo pipefail
             cd ${{ secrets.DEPLOY_DIR || '~/app' }}
-            SERVICE="${{ github.event.inputs.service || '__SERVICE_NAME__' }}"
 
             # Wait for healthcheck (max 60s)
             TIMEOUT=60

package/templates/github/ghagga-review.yml

@@ -21,7 +21,9 @@ jobs:
   review:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      # TODO(pin): ghagga has no v1 tag upstream (releases start at v2) — this
+      # ref cannot be SHA-pinned as-is; pick a real released tag and pin it.
       - uses: JNZader/ghagga@v1
         with:
           mode: simple

package/templates/local-ai/.env.example

@@ -1,17 +1,24 @@
 # Local AI Stack — Environment Variables
 # Copy to .env in your project: cp .env.example .env
+#
+# Secure defaults: all ports bind to 127.0.0.1 (loopback), WebUI auth is ON,
+# and SUPABASE_DB_PASSWORD is REQUIRED (no default) for the "full" profile.
 
 # ── Ollama ──────────────────────────────────────────────────────────────────
 OLLAMA_PORT=11434
 
 # ── Open WebUI ──────────────────────────────────────────────────────────────
 WEBUI_PORT=3000
-WEBUI_AUTH=false
+# Auth is ON by default (create the admin account on first visit).
+# Set to false ONLY if you accept an unauthenticated local UI.
+WEBUI_AUTH=true
 
 # ── n8n ─────────────────────────────────────────────────────────────────────
 N8N_PORT=5678
 
 # ── Supabase (Postgres) ────────────────────────────────────────────────────
 SUPABASE_DB_PORT=5432
-SUPABASE_DB_PASSWORD=postgres
+# CHANGE ME — required, no default (Postgres refuses to start if unset). Generate one:
+#   openssl rand -base64 24
+SUPABASE_DB_PASSWORD=
 SUPABASE_DB_NAME=app

package/templates/local-ai/docker-compose.yml

@@ -18,7 +18,9 @@ services:
     container_name: ollama
     restart: unless-stopped
     ports:
-      - "${OLLAMA_PORT:-11434}:11434"
+      # Bound to loopback by default — this is a LOCAL dev stack. To expose on
+      # your LAN, change 127.0.0.1 to your interface IP (opt-in, not default).
+      - "127.0.0.1:${OLLAMA_PORT:-11434}:11434"
     volumes:
       - ollama_data:/root/.ollama
     environment:
@@ -45,12 +47,14 @@ services:
     profiles: ["ui", "auto", "full"]
     restart: unless-stopped
     ports:
-      - "${WEBUI_PORT:-3000}:8080"
+      - "127.0.0.1:${WEBUI_PORT:-3000}:8080"
     volumes:
       - open_webui_data:/app/backend/data
     environment:
       - OLLAMA_BASE_URL=http://ollama:11434
-      - WEBUI_AUTH=${WEBUI_AUTH:-false}
+      # Auth ON by default. Set WEBUI_AUTH=false in .env only if you accept an
+      # unauthenticated UI (loopback-only mitigates, but any local process can reach it).
+      - WEBUI_AUTH=${WEBUI_AUTH:-true}
     depends_on:
       ollama:
         condition: service_healthy
@@ -62,7 +66,7 @@ services:
     profiles: ["auto", "full"]
     restart: unless-stopped
     ports:
-      - "${N8N_PORT:-5678}:5678"
+      - "127.0.0.1:${N8N_PORT:-5678}:5678"
     volumes:
       - n8n_data:/home/node/.n8n
     environment:
@@ -76,11 +80,15 @@ services:
     profiles: ["full"]
     restart: unless-stopped
     ports:
-      - "${SUPABASE_DB_PORT:-5432}:5432"
+      - "127.0.0.1:${SUPABASE_DB_PORT:-5432}:5432"
     volumes:
       - supabase_db_data:/var/lib/postgresql/data
     environment:
-      POSTGRES_PASSWORD: ${SUPABASE_DB_PASSWORD:-postgres}
+      # No insecure default — REQUIRED. If unset/empty, Postgres refuses to
+      # initialize ("superuser password is not specified"): set it in .env.
+      # Note: a compose-level `:?` guard would also break the core (ollama-only)
+      # profile at parse time, so the check is delegated to the postgres image.
+      POSTGRES_PASSWORD: ${SUPABASE_DB_PASSWORD}
       POSTGRES_DB: ${SUPABASE_DB_NAME:-app}
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U postgres"]