chore(release): promote main to release - #90
Merged
Merged
Conversation
Extend bungkus beyond frontend-only scaffolding with two opt-in, registry-driven categories (Closes #79). Both default to none, so the tool stays a frontend scaffold unless asked otherwise. - --backend none|hono|elysia: standalone server entry + dev:server script - --orm none|drizzle|prisma, --db none|sqlite|postgres|mysql: db client, drizzle.config/prisma schema, .env.example. Drizzle driver selected by a cross-cutting rule from the orm+db combo; prisma bundles its own. Wired through registry.json, config enums, packagejson merge, create flags (+ --db-requires-orm guard), the TUI wizard, and templates. Table-driven tests cover the combos, driver selection, and validation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
--db d1 wires the built-in drizzle-orm/d1 driver: a d1-http drizzle.config, a request-scoped getDb(binding) client, and Cloudflare D1 env creds. Only @cloudflare/workers-types is added (the binding is provided by the Workers runtime) — no node driver. Pairs with --deploy cloudflare-workers. Prisma + d1 is rejected with a clear error rather than emitting a half-working template. Supabase needs no dedicated option: --db postgres with either ORM covers it via the connection string. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Refs #81. Adds a --layout flag (flat default, monorepo opt-in). In monorepo mode the scaffolder emits a pragmatic-layered pnpm workspace: apps/web frontend + its own package.json/tooling apps/api backend (hono/elysia + orm/db) + package.json + tsconfig packages/domain shared contract (zod schemas when --validation zod, else types) package.json private workspace root with recursive dev/build scripts pnpm-workspace.yaml gains a packages: block; root .gitignore for hoisted deps Scaffold is now layout-aware: FE templates route to apps/web, backend/orm to apps/api, shared tooling + manifest to the root. The frontend package omits backend/orm deps (they move to apps/api) and gains a workspace dep on domain; web/api both depend on domain via workspace:*. Flat layout is unchanged. Guarded to --pm pnpm for now. TUI stays flat-only (layout isn't registry-backed). Table-driven tests cover the package split, api/domain/root builders, and layout validation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
# Conflicts: # cmd/create.go # internal/tui/wizard.go # pkg/config.go # pkg/packagejson.go
Refs #81. A selected --backend now implies --layout monorepo unless the user passed --layout explicitly, and only when pnpm is in use (monorepo requires it). --backend with a non-pnpm PM, or an explicit --layout flat, stays flat. Applied via ProjectConfig.ApplyDefaultLayout so the CLI and TUI share one rule. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The wizard auto-upgrades to monorepo when a backend is selected; surface the resolved layout on the confirmation screen so it isn't a silent change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Refs #81. The wizard now has two tabs — Frontend (base, tooling, frontend libraries, PM, advanced) and Backend (backend framework, ORM, database) — so backend config is no longer mixed into the frontend LIBRARIES panel. Switch with ] (to backend) and [ (to frontend); a tab bar shows the active screen and the Backend tab notes that a selection produces a pnpm monorepo. Selections still flow through collectConfig + ApplyDefaultLayout unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Summary backspace now returns to the tab the user confirmed from (frontend or backend), via a remembered prevScreen, instead of always the frontend tab. - q quits the wizard from the backend and summary screens, and from the frontend screen when focus is not in the project-name input (so typing "q" into the name still works). Footers advertise q/esc. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The footer previously showed "] backend tab" and "[ frontend tab" in different positions, making the two keys look unrelated. Frontend is the left tab and Backend the right, so [ / ] map left/right; show them as one "[ / ] switch tab" hint in the same leading position on both footers. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Closes #88. Code: - T-2-1 (V2 2.2.1, L1): validate the project name / destination directory. New pkg.ValidateProjectName (npm-name rules) + pkg.ValidateDest (filepath.IsLocal) reject path traversal, absolute paths, and invalid package names at the CLI arg path and the TUI confirm path. Adds a table test. `create .` and valid names behave as before. - T-15-3 (V15 15.3.2, L2): the bump HTTP client no longer follows redirects off the pinned registry host (CheckRedirect -> ErrUseLastResponse). - T-15-4 (V15 15.2.3, L2): gate the maintainer `bump` command behind a //go:build bump tag so it is excluded from released binaries; the bump workflow now runs with -tags bump. Verification: - T-15-1 (V15 15.2.1, L1): govulncheck is clean; added a govulncheck step to run-tests.yml (and made that job actually build + test). Bumped golang.org/x/sys 0.42.0 -> 0.47.0 to clear GO-2026-5024 (uncalled). Docs: - T-15-2/5/6 + T-13-1: new SECURITY.md (dependency remediation policy, external-communication profile, dangerous-functionality map, risky-component review) and .github/dependabot.yml (gomod + github-actions). - T-2-2: documented the project-name rule in `create --help`. Out of scope: T-13-2 (SLACK_WEBHOOK_URL rotation) needs GitHub secret-console access. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
security: remediate ASVS 5.0 audit findings (input validation + supply-chain hardening)
Refs #81. After scaffolding a monorepo, PrintSuccess now explains the pnpm-workspace layout instead of the flat instructions: notes that `pnpm dev` runs apps/web + apps/api, lists the workspace packages, and (when an ORM is selected) shows the apps/api database setup steps. Deploy instructions target `pnpm --filter web run deploy` in monorepo mode since the deploy script lives in apps/web. Flat-layout output is unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Refs #81. Selecting --db postgres or --db mysql (with an ORM) now scaffolds a local docker-compose.yml at the project/workspace root, with service credentials that match the generated .env.example DATABASE_URL so it works out of the box. sqlite/d1 get no compose file. The get-started box gains a `docker compose up -d` step before db:migrate for those databases, and the DB setup section now shows for flat layouts too (not just monorepo). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Refs #81. End-to-end verification of all new backend combos (hono/elysia × drizzle{sqlite,postgres,mysql,d1} / prisma{sqlite,postgres,mysql}, backend-only, and flat orm-only) surfaced three template bugs that broke a fresh scaffold: - pnpm install hard-failed (ERR_PNPM_IGNORED_BUILDS / ERR_PNPM_TRUST_DOWNGRADE): the workspace allowBuilds allowlist omitted the DB native/postinstall scripts, and @types/node's undici-types tripped trustPolicy: no-downgrade. Added better-sqlite3 (drizzle+sqlite) and prisma build approvals, and an undici-types trust exclusion — gated to when a backend/orm is selected. - api `tsc` build failed with "Cannot find name 'process'": the api package relied on @types/node being pulled in transitively (it wasn't, for prisma). Added @types/node to the api devDependencies. - the d1 tsconfig restricted types to @cloudflare/workers-types, which excluded node globals and broke the server typecheck. Added "node" to that list. Verified per combo: pnpm install, drizzle-kit generate / prisma generate, `tsc --noEmit`, and the server booting + responding. Also ran a full docker end-to-end (docker compose up → drizzle db:migrate → users table created in a real postgres, matching .env creds). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Refs #81. The common husky setup (prepare: husky + husky devDep) was landing in apps/web while the .husky hooks and .git live at the workspace root, so `pnpm install` ran husky from the wrong directory (".git can't be found"). In monorepo mode the prepare script + husky devDep now go to the root package.json and are stripped from apps/web; the flat layout is unchanged. Verified: install runs `. prepare: husky` cleanly and git core.hooksPath is set at the root. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The Vulnerability scan step failed on stdlib advisories (crypto/tls GO-2026-5856, net/textproto GO-2026-5039, crypto/x509 GO-2026-5037) because setup-go pinned exactly go 1.25.0 (from go.mod), whose standard library is unpatched. govulncheck reports stdlib vulns against the exact toolchain, so build/scan on go-version 1.25.x (latest patch, which includes the fixes). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
fix(ci): build/scan on latest 1.25 Go patch to clear stdlib govulncheck failures
feat: add backend framework and ORM/DB add-on categories
Combines the open Dependabot PRs into one verified change: go modules: - charm.land/bubbles/v2 2.1.0 -> 2.1.1 - charm.land/bubbletea/v2 2.0.2 -> 2.0.8 - charm.land/lipgloss/v2 2.0.2 -> 2.0.5 - golang.org/x/mod 0.14.0 -> 0.38.0 github actions: - actions/checkout v4 -> v7 - actions/upload-artifact v4 -> v7 - actions/download-artifact v4 -> v8 - peter-evans/create-pull-request v6 -> v8 - cycjimmy/semantic-release-action v4 -> v6 Verified: go build (default + bump tag), go test ./..., and govulncheck all pass. Supersedes #91-#99. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
chore(deps): batch Dependabot updates (go modules + github actions)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated promotion PR. Merge with a merge commit (do NOT squash) so the
feat:/fix:commits reachreleaseintact — semantic-release reads them to cut the stable version + tag. Squashing collapses them into one non-conventional commit and no release is cut.