template-git-repo 0.1.23 → 0.1.25

package/README.md

@@ -9,6 +9,15 @@
     <a href="https://www.npmjs.com/package/template-git-repo"><img src="https://img.shields.io/npm/types/template-git-repo" alt="TypeScript types" /></a>
     <a href="https://packagephobia.com/result?p=template-git-repo"><img src="https://packagephobia.com/badge?p=template-git-repo" alt="Install size" /></a>
     <a href="https://app.codecov.io/gh/OpenSourceAGI/dev-tools-starter-agent/flags"><img src="https://img.shields.io/codecov/c/github/OpenSourceAGI/dev-tools-starter-agent?flag=template-git-repo&label=template-git-repo%20coverage&logo=codecov&logoColor=white" alt="Coverage" /></a>
+    <br />
+    <a href="https://github.com/OpenSourceAGI/dev-tools-starter-agent/stargazers"><img src="https://img.shields.io/github/stars/OpenSourceAGI/dev-tools-starter-agent" alt="GitHub Stars" /></a>
+    <a href="https://github.com/OpenSourceAGI/dev-tools-starter-agent/issues"><img src="https://img.shields.io/github/issues/OpenSourceAGI/dev-tools-starter-agent?logo=github" alt="GitHub Issues" /></a>
+    <a href="https://github.com/OpenSourceAGI/dev-tools-starter-agent/pulls"><img src="https://img.shields.io/github/issues-pr/OpenSourceAGI/dev-tools-starter-agent?logo=github&label=PRs" alt="Open Pull Requests" /></a>
+    <a href="https://github.com/OpenSourceAGI/dev-tools-starter-agent/pulls?q=is%3Apr+is%3Aclosed"><img src="https://img.shields.io/github/issues-pr-closed/OpenSourceAGI/dev-tools-starter-agent?logo=github&label=PRs%20merged&color=8957e5" alt="Merged Pull Requests" /></a>
+    <a href="https://github.com/OpenSourceAGI/dev-tools-starter-agent/discussions"><img src="https://img.shields.io/github/discussions/OpenSourceAGI/dev-tools-starter-agent" alt="GitHub Discussions" /></a>
+    <a href="https://github.com/OpenSourceAGI/dev-tools-starter-agent/commits/master/"><img src="https://img.shields.io/github/last-commit/OpenSourceAGI/dev-tools-starter-agent.svg" alt="GitHub last commit" /></a>
+    <br />
+    <img src="https://img.shields.io/badge/Bun-14151A?logo=bun&logoColor=white" alt="Bun" /> <img src="https://img.shields.io/badge/Vitest-6E9F18?logo=vitest&logoColor=white" alt="Vitest" />
 </p>
 <!-- template-git-repo:badges:end -->
 

package/bin/template-git-repo.js

@@ -53,6 +53,7 @@ Context (all optional — detected where possible)
 
 Badge inputs (each enables the badge that needs it)
   --doi <10.5281/...>        --docs <url>          --api <url>
+  --website <url>
   --youtube <url>            --uptime <url>        --test-report <url>
   --discord-id <id>          --discord-invite <url>
   --stack <A,B,C>            --cloudflare-deploy
@@ -108,6 +109,7 @@ function overridesFrom(flags) {
     npmPackage: text('npm-package'),
     workflowFile: text('workflow'),
     doi: text('doi'),
+    websiteUrl: text('website'),
     docsUrl: text('docs'),
     apiUrl: text('api'),
     youtubeUrl: text('youtube'),

package/docs/BADGES.md

@@ -23,12 +23,20 @@ package or finish setting up Codecov.
 | --- | --- | --- |
 | [Zenodo DOI](#doi) `doi` | doi | `--doi <10.5281/zenodo.NNNNNNN>` |
 | [Ask DeepWiki](#deepwiki) `deepwiki` | — | on by default |
+| [Live app](#website) `website` | websiteUrl | `--website <url>` |
 | [Documentation](#docs) `docs` | docsUrl | `--docs <url>` |
 | [API reference](#api) `api` | apiUrl | `--api <url>` |
 | [YouTube demo](#youtube) `youtube` | youtubeUrl | `--youtube <url>` |
 | [Deploy to Cloudflare Workers](#deploy-cloudflare) `deploy-cloudflare` | cloudflareDeploy | `--cloudflare-deploy` |
 | [Open in StackBlitz](#stackblitz) `stackblitz` | stackblitzUrl | `--stackblitz <url>` |
+| [Open in GitHub Codespaces](#codespaces) `codespaces` | — | on by default |
 | [GitHub stars](#stars) `stars` | — | on by default |
+| [GitHub forks](#forks) `forks` | — | on by default |
+| [Contributors](#contributors) `contributors` | — | on by default |
+| [Open issues](#issues) `issues` | — | on by default |
+| [Open pull requests](#pull-requests) `pull-requests` | — | on by default |
+| [Merged pull requests](#prs-merged) `prs-merged` | — | on by default |
+| [GitHub Discussions](#discussions) `discussions` | — | on by default |
 | [npm monthly downloads](#npm-downloads) `npm-downloads` | npmPackage | `--npm-package <name>` |
 | [npm version](#npm-version) `npm-version` | npmPackage | `--npm-package <name>` |
 | [npm total downloads](#npm-total-downloads) `npm-total-downloads` | npmPackage | `--npm-package <name>` |
@@ -64,6 +72,14 @@ Nothing to configure for a public repo — visit deepwiki.com/<owner>/<repo> onc
 
 Included by default — no configuration needed.
 
+### website
+
+**Live app**
+
+The deployed thing, not the repo. It is first in the row on purpose: a visitor who can click through to a running app decides in seconds whether to read the rest. Static badge — nothing checks that the URL is up, which is what the uptime badge is for.
+
+Enable with: `--website <url>`
+
 ### docs
 
 **Documentation**
@@ -104,6 +120,14 @@ Nothing to configure — StackBlitz imports a public repo straight from a URL: `
 
 Enable with: `--stackblitz <url>`
 
+### codespaces
+
+**Open in GitHub Codespaces**
+
+Nothing to configure — the link boots the repo in a default container. Add a `.devcontainer/devcontainer.json` if the default image is missing something your install needs, because the visitor sees the failure, not you. Codespaces bills the visitor's own free hours, so the button costs you nothing.
+
+Included by default — no configuration needed.
+
 ## Quality — is it working, is it tested, is it shipped
 
 ### npm-downloads
@@ -196,6 +220,54 @@ Nothing to configure. Public repos only — shields.io cannot read a private rep
 
 Included by default — no configuration needed.
 
+### forks
+
+**GitHub forks**
+
+Nothing to configure. Counts direct forks only, not forks of forks, so it undercounts a repo that has been forked along a chain. Public repos only.
+
+Included by default — no configuration needed.
+
+### contributors
+
+**Contributors**
+
+Nothing to configure, but it counts commit authors GitHub could match to an account — commits made with an unregistered email are attributed to nobody and do not appear here. Use `contributors-anon` instead if your history has many of those.
+
+Included by default — no configuration needed.
+
+### issues
+
+**Open issues**
+
+Nothing to configure beyond having Issues enabled (Settings → Features). Read it as a work-in-flight number, not a defect count: shields.io asks GitHub Search, which counts pull requests as issues unless the badge path excludes them — this one uses the `/issues/` path, which already does.
+
+Included by default — no configuration needed.
+
+### pull-requests
+
+**Open pull requests**
+
+Nothing to configure. Counts open PRs including drafts. Pair it with the merged count below — an open count alone reads the same whether the queue moves in a day or has been stuck for a year.
+
+Included by default — no configuration needed.
+
+### prs-merged
+
+**Merged pull requests**
+
+Nothing to configure. shields.io has no "merged" endpoint — `issues-pr-closed` counts every PR that is no longer open, so PRs closed without merging are in this number too. On a repo that closes a lot of stale PRs, label it "PRs closed" instead of overstating what landed.
+
+Included by default — no configuration needed.
+
+### discussions
+
+**GitHub Discussions**
+
+Discussions has to be turned on (Settings → Features → Discussions) or the badge reads "repo not found" — which looks identical to a private repo. Turn it on before adding the badge, not after.
+
+Included by default — no configuration needed.
+
 ### commit-activity
 
 **Commit activity**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "template-git-repo",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "description": "One command to set up a repo with GitHub Actions, README badges, Turborepo and Codecov — the CI setup from qwksearch-research-agent, as a template",
   "type": "module",
   "bin": {

package/src/badges.js

@@ -63,6 +63,19 @@ export const BADGES = [
     setup:
       'Nothing to configure for a public repo — visit deepwiki.com/<owner>/<repo> once to trigger the first index. Private repos need the DeepWiki GitHub App installed.',
   },
+  {
+    id: 'website',
+    title: 'Live app',
+    group: 'identity',
+    needs: ['websiteUrl'],
+    alt: 'Website',
+    href: (c) => c.websiteUrl,
+    img: () =>
+      shieldsBadge('App', 'blueviolet', { style: 'for-the-badge', logo: 'googlechrome', logoColor: 'white' }),
+    setup:
+      'The deployed thing, not the repo. It is first in the row on purpose: a visitor who can click through to a running app decides in seconds whether to read the rest. Static badge — nothing checks that the URL is up, which is what the uptime badge is for.',
+    height: '20px',
+  },
   {
     id: 'docs',
     title: 'Documentation',
@@ -119,6 +132,18 @@ export const BADGES = [
       'Nothing to configure — StackBlitz imports a public repo straight from a URL: `https://stackblitz.com/github/<owner>/<repo>/tree/<branch>/<path>`. Point it at a directory that boots on its own (a package with its own package.json, or an `examples/` folder), because StackBlitz installs from the manifest at that path and a bare monorepo root will not run. Node APIs need the WebContainer runtime, which means the directory must be ESM and its deps must be installable from npm.',
     height: '20px',
   },
+  {
+    id: 'codespaces',
+    title: 'Open in GitHub Codespaces',
+    group: 'identity',
+    needs: [],
+    alt: 'Open in GitHub Codespaces',
+    href: (c) => `https://codespaces.new/${c.repoSlug}`,
+    img: () => 'https://github.com/codespaces/badge.svg',
+    setup:
+      'Nothing to configure — the link boots the repo in a default container. Add a `.devcontainer/devcontainer.json` if the default image is missing something your install needs, because the visitor sees the failure, not you. Codespaces bills the visitor\'s own free hours, so the button costs you nothing.',
+    height: '20px',
+  },
   {
     id: 'stars',
     title: 'GitHub stars',
@@ -129,6 +154,73 @@ export const BADGES = [
     img: (c) => `https://img.shields.io/github/stars/${c.repoSlug}`,
     setup: 'Nothing to configure. Public repos only — shields.io cannot read a private repo.',
   },
+  {
+    id: 'forks',
+    title: 'GitHub forks',
+    group: 'community',
+    needs: [],
+    alt: 'GitHub Forks',
+    href: (c) => `https://github.com/${c.repoSlug}/forks`,
+    img: (c) => `https://img.shields.io/github/forks/${c.repoSlug}`,
+    setup:
+      'Nothing to configure. Counts direct forks only, not forks of forks, so it undercounts a repo that has been forked along a chain. Public repos only.',
+  },
+  {
+    id: 'contributors',
+    title: 'Contributors',
+    group: 'community',
+    needs: [],
+    alt: 'Contributors',
+    href: (c) => `https://github.com/${c.repoSlug}/graphs/contributors`,
+    img: (c) => `https://img.shields.io/github/contributors/${c.repoSlug}`,
+    setup:
+      'Nothing to configure, but it counts commit authors GitHub could match to an account — commits made with an unregistered email are attributed to nobody and do not appear here. Use `contributors-anon` instead if your history has many of those.',
+  },
+  {
+    id: 'issues',
+    title: 'Open issues',
+    group: 'community',
+    needs: [],
+    alt: 'GitHub Issues',
+    href: (c) => `https://github.com/${c.repoSlug}/issues`,
+    img: (c) => `https://img.shields.io/github/issues/${c.repoSlug}?logo=github`,
+    setup:
+      'Nothing to configure beyond having Issues enabled (Settings → Features). Read it as a work-in-flight number, not a defect count: shields.io asks GitHub Search, which counts pull requests as issues unless the badge path excludes them — this one uses the `/issues/` path, which already does.',
+  },
+  {
+    id: 'pull-requests',
+    title: 'Open pull requests',
+    group: 'community',
+    needs: [],
+    alt: 'Open Pull Requests',
+    href: (c) => `https://github.com/${c.repoSlug}/pulls`,
+    img: (c) => `https://img.shields.io/github/issues-pr/${c.repoSlug}?logo=github&label=PRs`,
+    setup:
+      'Nothing to configure. Counts open PRs including drafts. Pair it with the merged count below — an open count alone reads the same whether the queue moves in a day or has been stuck for a year.',
+  },
+  {
+    id: 'prs-merged',
+    title: 'Merged pull requests',
+    group: 'community',
+    needs: [],
+    alt: 'Merged Pull Requests',
+    href: (c) => `https://github.com/${c.repoSlug}/pulls?q=is%3Apr+is%3Aclosed`,
+    img: (c) =>
+      `https://img.shields.io/github/issues-pr-closed/${c.repoSlug}?logo=github&label=PRs%20merged&color=8957e5`,
+    setup:
+      'Nothing to configure. shields.io has no "merged" endpoint — `issues-pr-closed` counts every PR that is no longer open, so PRs closed without merging are in this number too. On a repo that closes a lot of stale PRs, label it "PRs closed" instead of overstating what landed.',
+  },
+  {
+    id: 'discussions',
+    title: 'GitHub Discussions',
+    group: 'community',
+    needs: [],
+    alt: 'GitHub Discussions',
+    href: (c) => `https://github.com/${c.repoSlug}/discussions`,
+    img: (c) => `https://img.shields.io/github/discussions/${c.repoSlug}`,
+    setup:
+      'Discussions has to be turned on (Settings → Features → Discussions) or the badge reads "repo not found" — which looks identical to a private repo. Turn it on before adding the badge, not after.',
+  },
   {
     id: 'npm-downloads',
     title: 'npm monthly downloads',
@@ -309,18 +401,90 @@ export const BADGES = [
   },
 ];
 
-/** Brand colors for the stack chips, so the common ones look right by default. */
+/**
+ * Brand colors for the stack chips, so the common ones look right by default.
+ *
+ * Keyed by the lowercased chip name. Anything not listed falls back to a
+ * neutral grey, which is a perfectly good chip — this map is a nicety, not a
+ * gate on what you can name.
+ */
 const STACK_COLORS = {
   claude: 'D97757',
   cloudflare: 'F38020',
+  'cloudflare workers': 'F38020',
+  d1: 'F38020',
+  r2: 'F38020',
+  wrangler: 'F38020',
   'next.js': 'black',
   react: '20232A',
+  svelte: 'FF3E00',
+  'vue.js': '4FC08D',
   typescript: '3178C6',
+  javascript: 'F7DF1E',
+  'node.js': '5FA04E',
   bun: '14151A',
+  npm: 'CB3837',
+  pnpm: 'F69220',
+  turborepo: 'EF4444',
   vite: '646CFF',
+  vitest: '6E9F18',
+  jest: 'C21325',
+  playwright: '2EAD33',
+  biome: '60A5FA',
   vercel: 'black',
   postgresql: '4169E1',
+  sqlite: '003B57',
+  'drizzle orm': 'C5F74F',
   tailwindcss: '06B6D4',
+  'tailwind css': '06B6D4',
+  'shadcn/ui': '000000',
+  'radix ui': '161618',
+  'better-auth': '000000',
+  hono: 'E36002',
+  stripe: '635BFF',
+  zod: '3E67B1',
+  tauri: '24C8D8',
+  electron: '47848F',
+  prosemirror: '000000',
+  tiptap: '000000',
+  fumadocs: '000000',
+  mcp: '000000',
+  'vercel ai sdk': 'black',
+  openai: '412991',
+  python: '3776AB',
+  docker: '2496ED',
+  'github actions': '2088FF',
+};
+
+/**
+ * simple-icons slugs for chips whose name does not reduce to one.
+ *
+ * `?logo=` takes a simpleicons.org slug, and the derivation below (lowercase,
+ * drop dots, spaces and slashes) gets most of them right — `Next.js` really is
+ * `nextjs`. It gets a handful wrong, and a wrong slug renders a chip with a
+ * blank square where the logo should be, so those are written out.
+ *
+ * A name with no icon at all (`better-auth`, `MCP`) maps to the empty string:
+ * the chip renders as plain text rather than carrying someone else's logo.
+ */
+const STACK_LOGOS = {
+  'cloudflare workers': 'cloudflareworkers',
+  d1: 'cloudflare',
+  r2: 'cloudflare',
+  'drizzle orm': 'drizzle',
+  'tailwind css': 'tailwindcss',
+  'vue.js': 'vuedotjs',
+  'node.js': 'nodedotjs',
+  'next.js': 'nextdotjs',
+  'radix ui': 'radixui',
+  'github actions': 'githubactions',
+  'vercel ai sdk': 'vercel',
+  claude: 'claude',
+  'better-auth': '',
+  mcp: '',
+  prosemirror: '',
+  fumadocs: '',
+  zod: 'zod',
 };
 
 /**
@@ -328,10 +492,13 @@ const STACK_COLORS = {
  * @returns {string} an `<img>` chip for one stack entry
  */
 export function stackChip(name) {
-  const key = name.trim().toLowerCase();
+  const label = name.trim();
+  const key = label.toLowerCase();
   const color = STACK_COLORS[key] ?? '555555';
-  const logo = key.replace(/[.\s]/g, '');
-  return `<img src="${shieldsBadge(name.trim(), color, { logo, logoColor: 'white' })}" alt="${name.trim()}" />`;
+  const logo = STACK_LOGOS[key] ?? key.replace(/[.\s/]/g, '');
+
+  const params = logo ? { logo, logoColor: 'white' } : {};
+  return `<img src="${shieldsBadge(label, color, params)}" alt="${label}" />`;
 }
 
 /**

package/src/context.js

@@ -160,6 +160,146 @@ export function detectNpmPackage(root, packagesDir) {
   return undefined;
 }
 
+/**
+ * Dependency name -> the stack chip it implies, in the order the chips should
+ * read: language and runtime first, then framework, then the things bolted onto
+ * it, then the test runner.
+ *
+ * Keyed on the dependency rather than on a guess about the project, because the
+ * manifest is the one place that cannot lie about what a package is built with.
+ * A hand-written stack row goes stale the week someone swaps a framework out and
+ * nobody remembers the README says otherwise.
+ *
+ * Several entries collapse many packages into one chip — a ProseMirror app
+ * depends on eight `prosemirror-*` modules and is built with ProseMirror once.
+ * Duplicates are removed by `detectStack`, so listing every alias is safe.
+ */
+const STACK_BY_DEPENDENCY = [
+  ['typescript', 'TypeScript'],
+  ['next', 'Next.js'],
+  ['react', 'React'],
+  ['svelte', 'Svelte'],
+  ['vue', 'Vue.js'],
+  ['@tauri-apps/api', 'Tauri'],
+  ['@tauri-apps/cli', 'Tauri'],
+  ['electron', 'Electron'],
+  ['wrangler', 'Cloudflare Workers'],
+  ['hono', 'Hono'],
+  ['tailwindcss', 'Tailwind CSS'],
+  ['@radix-ui/react-dialog', 'shadcn/ui'],
+  ['drizzle-orm', 'Drizzle ORM'],
+  ['better-auth', 'better-auth'],
+  ['stripe', 'Stripe'],
+  ['ai', 'Vercel AI SDK'],
+  ['@modelcontextprotocol/sdk', 'MCP'],
+  ['@tiptap/core', 'TipTap'],
+  ['prosemirror-state', 'ProseMirror'],
+  ['prosemirror-view', 'ProseMirror'],
+  ['zod', 'Zod'],
+  ['fumadocs-ui', 'Fumadocs'],
+  ['vite', 'Vite'],
+  ['turbo', 'Turborepo'],
+  ['vitest', 'Vitest'],
+  ['jest', 'Jest'],
+  ['@playwright/test', 'Playwright'],
+];
+
+/** The chip for each package manager, so the runtime shows up even with no deps. */
+const STACK_BY_PACKAGE_MANAGER = { bun: 'Bun', pnpm: 'pnpm', yarn: 'Yarn', npm: 'npm' };
+
+/**
+ * De-duplicate chips and put them back in catalog order.
+ *
+ * Needed because the workspace union collects chips manifest by manifest, and
+ * alphabetical directory order is not a sensible reading order for a stack row —
+ * it lands on "Drizzle ORM, Vitest, TypeScript, React". Anything not in the
+ * catalog (a `prepend` like Claude) keeps its position at the front.
+ *
+ * @param {string[]} chips
+ * @returns {string[]}
+ */
+function orderChips(chips) {
+  const order = STACK_BY_DEPENDENCY.map(([, chip]) => chip);
+  const rank = (chip) => {
+    const index = order.indexOf(chip);
+    return index === -1 ? -1 : index;
+  };
+
+  const unique = [...new Set(chips)];
+  const leading = unique.filter((chip) => rank(chip) === -1);
+  const known = unique.filter((chip) => rank(chip) !== -1).sort((a, b) => rank(a) - rank(b));
+
+  return [...leading, ...known];
+}
+
+/**
+ * The stack chips for one manifest, read off its dependencies.
+ *
+ * Returns a comma-separated string because that is what the `stack` badge takes
+ * and what `--stack` passes on the command line. An empty result means the
+ * manifest declared nothing recognizable, and the badge is skipped — better
+ * than a row asserting a framework the package does not use.
+ *
+ * @param {Record<string, any> | null} manifest
+ * @param {{ prepend?: string[], packageManager?: string }} [options]
+ * @returns {string | undefined}
+ */
+export function detectStack(manifest, options = {}) {
+  const { prepend = [], packageManager } = options;
+
+  const declared = new Set([
+    ...Object.keys(manifest?.dependencies ?? {}),
+    ...Object.keys(manifest?.devDependencies ?? {}),
+    ...Object.keys(manifest?.peerDependencies ?? {}),
+  ]);
+
+  const chips = [...prepend];
+
+  const runtime = packageManager ? STACK_BY_PACKAGE_MANAGER[packageManager] : undefined;
+  if (runtime) chips.push(runtime);
+
+  for (const [dependency, chip] of STACK_BY_DEPENDENCY) {
+    if (declared.has(dependency)) chips.push(chip);
+  }
+
+  const ordered = orderChips(chips);
+  return ordered.length > 0 ? ordered.join(',') : undefined;
+}
+
+/**
+ * The stack for a whole workspace: the union of every member's chips.
+ *
+ * A monorepo root manifest lists turbo and little else, so reading it alone
+ * describes the build tooling and none of the product. This walks the workspace
+ * directory instead, which is what the root README's stack row should say.
+ *
+ * @param {string} root
+ * @param {{ packagesDirs?: string[], prepend?: string[], packageManager?: string }} [options]
+ * @returns {string | undefined}
+ */
+export function detectWorkspaceStack(root, options = {}) {
+  const { packagesDirs = ['packages', 'apps'], prepend = [], packageManager } = options;
+
+  const manifests = [readJson(path.join(root, 'package.json'))];
+
+  for (const dir of packagesDirs) {
+    const parent = path.join(root, dir);
+    if (!fs.existsSync(parent)) continue;
+
+    for (const entry of fs.readdirSync(parent, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue;
+      manifests.push(readJson(path.join(parent, entry.name, 'package.json')));
+    }
+  }
+
+  const merged = manifests.filter(Boolean).flatMap((manifest) =>
+    (detectStack(manifest, { packageManager }) ?? '').split(',').filter(Boolean),
+  );
+
+  const ordered = orderChips([...prepend, ...merged]);
+  return ordered.length > 0 ? ordered.join(',') : undefined;
+}
+
 /**
  * Everything the templates and badges need, detected then overridden by flags.
  *
@@ -194,6 +334,7 @@ export function buildContext(options = {}) {
     // Everything below has no sensible default — a badge that needs one of
     // these is skipped until it is passed in.
     doi: overrides.doi,
+    websiteUrl: overrides.websiteUrl,
     docsUrl: overrides.docsUrl,
     apiUrl: overrides.apiUrl,
     youtubeUrl: overrides.youtubeUrl,

package/src/index.js

@@ -19,6 +19,8 @@ export {
   detectNpmPackage,
   detectPackageManager,
   detectPackagesDir,
+  detectStack,
+  detectWorkspaceStack,
   findRepoRoot,
   parseRepoSlug,
   substitute,

package/template/{scripts → .github/scripts}/list-test-packages.mjs

@@ -22,7 +22,7 @@
  * `empty` exists because GitHub fails a job whose matrix has no entries, which
  * would make a repo with no test suites look broken rather than untested.
  *
- * Usage: node scripts/list-test-packages.mjs [rootDir]
+ * Usage: node .github/scripts/list-test-packages.mjs [rootDir]
  */
 import fs from 'node:fs';
 import path from 'node:path';

package/template/{scripts → .github/scripts}/next-free-version.mjs

@@ -23,7 +23,7 @@
  * ones — the exact numbers `latest` cannot see. The union of the two is the
  * taken set.
  *
- * Usage: node scripts/next-free-version.mjs <package-name> <local-version>
+ * Usage: node .github/scripts/next-free-version.mjs <package-name> <local-version>
  *   Prints the next free version, always strictly above <local-version>. If
  *   the registry says nothing about the package (a first publish, or an
  *   unreachable registry) that is just <local-version> plus a patch.
@@ -161,7 +161,7 @@ if (import.meta.url === pathToFileURL(process.argv[1] || '').href) {
   const [name, local] = process.argv.slice(2);
 
   if (!name || !local) {
-    console.error('Usage: node scripts/next-free-version.mjs <package-name> <local-version>');
+    console.error('Usage: node .github/scripts/next-free-version.mjs <package-name> <local-version>');
     process.exit(2);
   }
 

package/template/{scripts → .github/scripts}/pin-workspace-deps.mjs

@@ -15,7 +15,7 @@
  * The edit is deliberately left in the working tree — `restore-pinned-deps.mjs`
  * takes it back out after the publish, keeping only any version bump.
  *
- * Usage: node scripts/pin-workspace-deps.mjs [packageDir] [workspaceRoot]
+ * Usage: node .github/scripts/pin-workspace-deps.mjs [packageDir] [workspaceRoot]
  *   Both default to what the publish loop needs: the current directory, and its
  *   parent as the directory holding sibling packages.
  */

package/template/{scripts → .github/scripts}/restore-pinned-deps.mjs

@@ -13,7 +13,7 @@
  * string back in keeps the committed diff to one line per bumped package, and
  * keeps each file's original formatting.
  *
- * Usage: node scripts/restore-pinned-deps.mjs [packagesRoot...]
+ * Usage: node .github/scripts/restore-pinned-deps.mjs [packagesRoot...]
  *   Defaults to `packages`.
  */
 import fs from 'node:fs';

package/template/{scripts → .github/scripts}/workspace-build-order.mjs

@@ -13,7 +13,7 @@
  *
  *   Cannot find module '<sibling>' or its corresponding type declarations.
  *
- * Usage: node scripts/workspace-build-order.mjs [rootDir]
+ * Usage: node .github/scripts/workspace-build-order.mjs [rootDir]
  *   rootDir defaults to `packages`. Prints one directory per line, with a
  *   trailing slash, e.g. `packages/my-lib/`.
  */

package/template/.github/workflows/npm-publish.yml

@@ -150,7 +150,7 @@ jobs:
           unattempted_packages=""
           auth_broken=""
 
-          build_order=$(node scripts/workspace-build-order.mjs)
+          build_order=$(node .github/scripts/workspace-build-order.mjs)
           echo "📋 Build order:"
           echo "$build_order" | sed 's/^/   /'
 
@@ -189,7 +189,7 @@ jobs:
               # from the referenced local package; drop deps on local packages
               # that are not published. Only committed back if the version is
               # bumped.
-              node "$repo_root/scripts/pin-workspace-deps.mjs"
+              node "$repo_root/.github/scripts/pin-workspace-deps.mjs"
 
               # Build before deciding anything: the tarball comparison below
               # needs real dist output, and a package whose build fails is never
@@ -238,7 +238,7 @@ jobs:
                 # any version staged by an interrupted publish, and npm answers
                 # a PUT for one of those with E409 "Cannot publish over
                 # previously staged version".
-                next=$(node "$repo_root/scripts/next-free-version.mjs" "$name" "$version")
+                next=$(node "$repo_root/.github/scripts/next-free-version.mjs" "$name" "$version")
                 echo "🔼 $name content changed since $version — bumping to $next"
                 # --no-workspaces stops npm from doing workspace-aware
                 # processing over bun's symlinks, which trips
@@ -275,7 +275,7 @@ jobs:
                   exit 1
                 fi
 
-                next=$(node "$repo_root/scripts/next-free-version.mjs" "$name" "$version")
+                next=$(node "$repo_root/.github/scripts/next-free-version.mjs" "$name" "$version")
                 echo "↩ npm has $name@$version reserved — retrying as $next"
                 npm version "$next" --no-git-tag-version --no-workspaces
                 version="$next"
@@ -313,7 +313,7 @@ jobs:
           # Bumps made during publish must land back in the repo so the next run
           # sees them. The workspace:* pinning done for the tarballs must not —
           # restore everything except the "version" field.
-          node scripts/restore-pinned-deps.mjs
+          node .github/scripts/restore-pinned-deps.mjs
           git add '{{PACKAGES_GLOB}}/package.json'
           git diff --staged --quiet && echo "No version changes to commit" && exit 0
           git commit -m "chore: bump published package versions [skip ci]"

package/template/.github/workflows/tests.yml

@@ -38,7 +38,7 @@ jobs:
 
       - id: list
         name: List packages with a test script
-        run: node scripts/list-test-packages.mjs >> "$GITHUB_OUTPUT"
+        run: node .github/scripts/list-test-packages.mjs >> "$GITHUB_OUTPUT"
 
   test:
     name: ${{ matrix.flag }}