chore: modernize template builds, security, and dependencies

.changeset/config.json

@@ -1,8 +1,11 @@
 {
-  "$schema": "https://unpkg.com/@changesets/config@3.1.2/schema.json",
+  "$schema": "https://unpkg.com/@changesets/config@4.0.1/schema.json",
   "changelog": [
-    "@svitejs/changesets-changelog-github-compact",
-    { "repo": "TanStack/template" }
+    "@changesets/changelog-github",
+    {
+      "repo": "TanStack/template",
+      "disableThanks": true
+    }
   ],
   "commit": false,
   "access": "public",
@@ -13,5 +16,9 @@
   "ignore": [],
   "___experimentalUnsafeOptions_WILL_CHANGE_IN_PATCH": {
     "onlyUpdatePeerDependentsWhenOutOfRange": true
+  },
+  "privatePackages": {
+    "version": false,
+    "tag": false
   }
 }

.coderabbit.yaml

@@ -0,0 +1,13 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+reviews:
+  request_changes_workflow: false
+  slop_detection:
+    enabled: true
+  auto_review:
+    drafts: false
+knowledge_base:
+  code_guidelines:
+    enabled: true
+    filePatterns:
+      - CONTRIBUTING.md
+      - AGENTS.md

.gitattributes

@@ -0,0 +1,2 @@
+# Auto detect text files and normalize line endings across platforms.
+* text=auto eol=lf

.github/CODEOWNERS

@@ -0,0 +1,16 @@
+# Security-sensitive automation and build configuration require core-team review.
+# New libraries must update this team and enable code-owner review in their ruleset.
+/.github/ @TanStack/tanstack-core
+/.nx/ @TanStack/tanstack-core
+/nx.json @TanStack/tanstack-core
+/.changeset/config.json @TanStack/tanstack-core
+/scripts/ @TanStack/tanstack-core
+/.npmrc @TanStack/tanstack-core
+/.nvmrc @TanStack/tanstack-core
+/pnpm-workspace.yaml @TanStack/tanstack-core
+/pnpm-lock.yaml @TanStack/tanstack-core
+**/package.json @TanStack/tanstack-core
+**/tsdown.config.* @TanStack/tanstack-core
+**/tsconfig*.json @TanStack/tanstack-core
+**/eslint.config.* @TanStack/tanstack-core
+/AGENTS.md @TanStack/tanstack-core

.github/SECURITY_SETUP.md

@@ -0,0 +1,40 @@
+# Security setup for new libraries
+
+A GitHub template copies repository files. Treat the following repository settings, app installations, and publishing configuration as a separate setup step. Committing these files does not activate branch protection or enable GitHub security products.
+
+## Controls included in the scaffold
+
+| Control                          | Configuration                                                                                                                                                            |
+| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| GitHub Actions security analysis | `workflows/zizmor.yml`: PR and main-branch scans, annotations, SHA-pinned action, no write permissions or repository secrets                                             |
+| Dependency provenance            | `workflows/pr.yml`: fail on provenance downgrades                                                                                                                        |
+| Dependency install policy        | `pnpm-workspace.yaml`: 24-hour minimum release age, provenance trust policy, blocked exotic subdependencies, explicit install-script allowlist                           |
+| Dependency updates               | `renovate.json`: action digest pinning, manual review for action updates, npm release-age delay, lockfile maintenance; TypeScript remains an intentional pin             |
+| Sensitive-file ownership         | `CODEOWNERS`: workflows, dependency manifests/lockfile, build configs, scripts, and agent instructions                                                                   |
+| Token access                     | Read-only workflow defaults; write/OIDC permissions scoped to the jobs that need them; checkout credentials are not persisted; Nx tokens are limited to test/build steps |
+| Package contents                 | Strict publint and checks against real tarballs reject unpublished exports, source files, source maps, CommonJS, and unresolved workspace dependencies                   |
+| Review and formatting            | CodeRabbit reads contribution/agent guidance; autofix regenerates docs and formatting; `.gitattributes` normalizes line endings                                          |
+| Local secrets                    | `.gitignore` excludes `.env` and `.env.*`, with explicit exceptions for example files; keep real credentials out of examples too                                         |
+| Release activation               | `workflows/release.yml` requires `ENABLE_RELEASES=true` and never cancels an in-progress release in favor of a newer run                                                 |
+
+Zizmor's `advanced-security: false` reports findings as CI annotations and fails the check without requiring GitHub code-scanning upload permissions. It does not disable the scan. Zizmor checks workflow security; it does not replace application code scanning or secret scanning.
+
+## Required GitHub setup
+
+1. **Ownership and branch rules.** Update `CODEOWNERS` to a team with write access to the new repository. After the initial CI run creates the checks, import `rulesets/protected-branches.json` in **Settings → Rules → Rulesets**. This starter blocks deletion and force pushes, requires pull requests/code-owner review and resolved conversations, and requires `Test`, `Run zizmor`, and `Provenance`. Check the exact check names and bind their expected GitHub App source where available. Review automation-specific bypass requirements explicitly; the starter intentionally has no inherited app IDs or bypass actors. GitHub does not load this JSON file automatically.
+2. **Actions permissions.** Set the default `GITHUB_TOKEN` permissions to read-only, require full-SHA action pinning, and require approval for workflows from outside contributors. Allow only the actions needed by the project. Never execute pull-request code under `pull_request_target` with privileged credentials. Enable Actions-created pull requests only if the new library's release automation needs it.
+3. **Security features.** Enable secret scanning and push protection, the dependency graph, and Dependabot alerts. Enable CodeQL default setup for JavaScript/TypeScript or verify the equivalent organization-managed workflow and its results. Coordinate dependency remediation with Renovate before enabling overlapping Dependabot security-update PRs. These settings must be checked in the new repository; a scanner's configuration file or a copied badge is not evidence that it is active.
+4. **Private reporting.** Enable private vulnerability reporting and add a `SECURITY.md` with the project's verified private reporting channel and support policy. Do not invent an email address or direct vulnerability details to public issues. Verify the reporting link before documenting it.
+5. **GitHub Apps.** Install or grant repository access to Renovate, Socket, autofix.ci, and CodeRabbit as appropriate. Verify each app's checks appear on a test PR; copied config cannot install an app. Keep security dependency analysis independent of optional AI review.
+6. **Nx Cloud.** Replace the copied Nx Cloud workspace ID and configure tokens for the new repository. Use a read-only cache token for untrusted PR builds and restrict write tokens to trusted branches. If using distributed execution, configure its agents separately; the template does not copy Table's infrastructure.
+7. **Publishing, for a new library only.** Configure npm trusted publishing for each package's repository, workflow, and any protected GitHub environment. Use OIDC/provenance rather than a long-lived npm token. Review who can change the workflow and environment. Only then enable `ENABLE_RELEASES`. The TanStack Template repository itself never releases packages, adds changesets, or enables publishing.
+
+Inspect the effective repository rules, not only legacy branch-protection settings: the reference repositories use rulesets. CODEOWNERS alone requests review; it does not require approval until a ruleset or branch protection enables that requirement.
+
+## Keeping the baseline current
+
+When updating Table, Hotkeys, or Pacer's build/security tooling, compare the template's workflows, action pins, dependency policies, ownership rules, and this setup guide. Keep exceptions limited to exact reviewed packages/versions; do not disable a policy to make an upgrade install.
+
+Run Zizmor against `.github/workflows`, validate Renovate configuration, run the normal package checks, and verify the actual PR checks. After configuring GitHub settings, verify branch rules, enabled scanners, and app results separately.
+
+References: [GitHub templates](https://docs.github.com/en/repositories/creating-and-managing-repositories/creating-a-template-repository), [code owners](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners), [Renovate action pinning](https://docs.renovatebot.com/modules/manager/github-actions/).

.github/pull_request_template.md

@@ -9,5 +9,4 @@
 
 ## 🚀 Release Impact
 
-- [ ] This change affects published code, and I have generated a [changeset](https://github.com/changesets/changesets/blob/main/docs/adding-a-changeset.md).
-- [ ] This change is docs/CI/dev-only (no release).
+This template repository does not release packages. Do not add changesets or bump package versions.

.github/renovate.json

@@ -10,11 +10,22 @@
     ":disablePeerDependencies",
     ":maintainLockFilesMonthly",
     ":semanticCommits",
-    ":semanticCommitTypeAll(chore)"
+    ":semanticCommitTypeAll(chore)",
+    "helpers:pinGitHubActionDigests"
   ],
   "ignorePresets": [":ignoreModulesAndTests"],
   "labels": ["dependencies"],
   "rangeStrategy": "bump",
   "postUpdateOptions": ["pnpmDedupe"],
-  "ignoreDeps": ["@types/node", "node"]
+  "ignoreDeps": ["@types/node", "node", "typescript"],
+  "packageRules": [
+    {
+      "matchManagers": ["npm"],
+      "minimumReleaseAge": "1 day"
+    },
+    {
+      "matchManagers": ["github-actions"],
+      "automerge": false
+    }
+  ]
 }

.github/rulesets/protected-branches.json

@@ -0,0 +1,42 @@
+{
+  "name": "Protect default and release branches",
+  "target": "branch",
+  "enforcement": "active",
+  "bypass_actors": [],
+  "conditions": {
+    "ref_name": {
+      "include": [
+        "~DEFAULT_BRANCH",
+        "refs/heads/alpha",
+        "refs/heads/beta",
+        "refs/heads/rc"
+      ],
+      "exclude": []
+    }
+  },
+  "rules": [
+    { "type": "deletion" },
+    { "type": "non_fast_forward" },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 0,
+        "dismiss_stale_reviews_on_push": false,
+        "require_code_owner_review": true,
+        "require_last_push_approval": false,
+        "required_review_thread_resolution": true
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": true,
+        "required_status_checks": [
+          { "context": "Test" },
+          { "context": "Run zizmor" },
+          { "context": "Provenance" }
+        ]
+      }
+    }
+  ]
+}

.github/workflows/autofix.yml

@@ -18,14 +18,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Tools
-        uses: TanStack/config/.github/setup@main
+        uses: TanStack/config/.github/setup@7bbdf583c2fc1a7f596283cd01e0e44c43f574f2 # main
       - name: Fix formatting
         run: pnpm run format
       - name: Regenerate docs
         run: pnpm build:all && pnpm generate-docs
       - name: Apply fixes
-        uses: autofix-ci/action@635ffb0c9798bd160680f18fd73371e355b85f27
+        uses: autofix-ci/action@635ffb0c9798bd160680f18fd73371e355b85f27 # v1.3.2
         with:
           commit-message: 'ci: apply automated fixes'

.github/workflows/pr.yml

@@ -7,61 +7,70 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
   cancel-in-progress: true
 
-env:
-  NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
-
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
   test:
     name: Test
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Setup Tools
-        uses: TanStack/config/.github/setup@main
+        uses: TanStack/config/.github/setup@7bbdf583c2fc1a7f596283cd01e0e44c43f574f2 # main
       - name: Get base and head commits for `nx affected`
-        uses: nrwl/nx-set-shas@v4.4.0
+        uses: nrwl/nx-set-shas@afb73a62d26e41464e9254689e1fd6122ee683c1 # v5.0.1
         with:
           main-branch-name: main
       - name: Run Checks
+        env:
+          NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
         run: pnpm run test:pr
   preview:
     name: Preview
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Setup Tools
-        uses: TanStack/config/.github/setup@main
+        uses: TanStack/config/.github/setup@7bbdf583c2fc1a7f596283cd01e0e44c43f574f2 # main
       - name: Build Packages
+        env:
+          NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
         run: pnpm run build:all
       - name: Publish Previews
-        run: pnpx pkg-pr-new publish --pnpm './packages/*' --template './examples/*/*'
+        run: pnpm run preview:publish
   provenance:
     name: Provenance
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Check Provenance
-        uses: danielroe/provenance-action@v0.1.1
+        uses: danielroe/provenance-action@fcc45fd5a5b818c477432b32c838dcd0c79cd2dd # v0.2.0
         with:
           fail-on-downgrade: true
   version-preview:
+    permissions:
+      contents: read
+      pull-requests: write # Post the changeset version preview.
     name: Version Preview
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Tools
-        uses: TanStack/config/.github/setup@main
+        uses: TanStack/config/.github/setup@7bbdf583c2fc1a7f596283cd01e0e44c43f574f2 # main
       - name: Changeset Preview
-        uses: TanStack/config/.github/changeset-preview@main
+        uses: TanStack/config/.github/changeset-preview@7bbdf583c2fc1a7f596283cd01e0e44c43f574f2 # main

.github/workflows/release.yml

@@ -6,40 +6,45 @@ on:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
-  cancel-in-progress: true
-
-env:
-  NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
+  cancel-in-progress: false
 
 permissions:
-  contents: write
-  id-token: write
-  pull-requests: write
+  contents: read
 
 jobs:
   release:
     name: Release
-    if: github.repository_owner == 'TanStack'
+    # New libraries explicitly enable publishing after configuring their release setup.
+    if: github.repository_owner == 'TanStack' && vars.ENABLE_RELEASES == 'true'
+    permissions:
+      contents: write # Commit version changes, create tags and GitHub releases.
+      id-token: write # Authenticate npm trusted publishing with OIDC.
+      pull-requests: write # Create/update version PRs and release comments.
+      issues: write # Comment on linked issues after publishing.
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Setup Tools
-        uses: TanStack/config/.github/setup@main
+        uses: TanStack/config/.github/setup@7bbdf583c2fc1a7f596283cd01e0e44c43f574f2 # main
       - name: Run Tests
+        env:
+          NX_CLOUD_ACCESS_TOKEN: ${{ secrets.NX_CLOUD_ACCESS_TOKEN }}
         run: pnpm run test:ci
       - name: Run Changesets (version or publish)
         id: changesets
-        uses: changesets/action@v1.7.0
+        uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2
         with:
-          version: pnpm run changeset:version
-          publish: pnpm run changeset:publish
-          commit: 'ci: Version Packages'
-          title: 'ci: Version Packages'
+          version-script: pnpm run changeset:version
+          publish-script: pnpm run changeset:publish
+          commit-message: 'ci: Version Packages'
+          pr-title: 'ci: Version Packages'
+          github-token: ${{ secrets.GITHUB_TOKEN }}
       - name: Comment on PRs about release
         if: steps.changesets.outputs.published == 'true'
-        uses: TanStack/config/.github/comment-on-release@main
+        uses: TanStack/config/.github/comment-on-release@7bbdf583c2fc1a7f596283cd01e0e44c43f574f2 # main
         with:
-          published-packages: ${{ steps.changesets.outputs.publishedPackages }}
+          published-packages: ${{ steps.changesets.outputs.published-packages }}

.github/workflows/zizmor.yml

@@ -0,0 +1,30 @@
+name: GitHub Actions Security Analysis
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: ['**']
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        with:
+          advanced-security: false
+          annotations: true

.gitignore

@@ -19,10 +19,9 @@ coverage
 # misc
 .DS_Store
 .env
-.env.local
-.env.development.local
-.env.test.local
-.env.production.local
+.env.*
+!.env.example
+!.env.*.example
 .next
 .svelte-kit
 

.npmrc

@@ -1,2 +1 @@
 provenance=true
-use-node-version=24.14.1

.nvmrc

@@ -1 +1 @@
-24.8.0
+24.21.0