Skip to content

TypeScript npm package template with Biome, node:test and npm provenance

A package for npm in TypeScript on Node 24, with the tools that Node brings itself where they are enough.

Start one

uvx --from copier==9.18.2 copier copy --data project_type=node-package gh:Dennis-Otto/repo-blueprint my-package
cd my-package
python3 .github/blueprint.py create

With uv and the GitHub CLI, as the quick start shows. Copier asks for the name, the owner and the other answers, and create makes the repository on GitHub, applies the settings as code and prints the checklist.

What you get

  • The example: src/index.ts, built into dist/, the tests in test/, tsconfig.json and tsconfig.build.json, biome.jsonc, and package.json with its lock file. Replace it with the real code; its tests show how.
  • The steps of scripts/check.sh for this kind, the same on your machine and in the CI: Biome for the lint and the format, tsc for the types, node:test with every line, branch and function covered and its report in the PR coach, and npm pack; npm installs without the scripts of the packages.
  • The steps of every kind: the text files, the diagrams, the pages in one column, the fragments of the changelog, the version, the Git hooks, ShellCheck for the shell scripts and the strict build of the website.
  • Everything that every repository gets: the PR coach and the fix bot, the release bot, Renovate, the settings as code, the issue assistant, the website in English and German, the security checks and the blueprint bot, as the guide lists them.

The checks that a pull request needs

The ruleset Protect main of .github/repository.toml lets a pull request merge once these checks pass:

  • check (node): scripts/check.sh with the tools of Node.
  • lint, diagrams, docs, conventional title, codeql, dependency-review and gitleaks, which every kind needs: every linter in one job, the pictures of the diagrams, the strict build of the website, the title of the pull request with its entry in the changelog, CodeQL, the review of new dependencies and the secret scan.

Delivery

Merging the release pull request publishes the package on npm with provenance, by trusted publishing from the environment npm, without a token, and attaches it to the release with its SBOM and the signed provenance of SLSA Build Level 3.

Once by hand

python3 .github/blueprint.py checklist ticks off each step that it can see and names the rest, each with its link: the release app of the owner with its private key, as your own account shows, the token of the issue assistant unless its AI is off, OpenSSF Best Practices, the REUSE API and the social preview.

This kind adds these steps:

A real repository

No public repository of this kind follows the blueprint yet. The Variants workflow of the blueprint makes one from every change and runs its checks with their real tools, and updates one from the latest release as its blueprint bot would.

How the blueprint compares with other templates: the comparison.