Local setup, npm scripts, Husky and security hooks, CI expectations, and PR version-bump rules for this boilerplate.
npm install at the repo root. There is no separate build or bundle step.npm start executes node ./bin/www. Port and stack config come from config/<NODE_ENV>.js (default development if NODE_ENV is unset).npx eslint . uses .eslintrc.js. There is no lint npm script; invoke ESLint directly.npm run pre-commit installs Husky and marks executable. The pre-commit hook runs () and ; both CLIs must be installed locally. Set to bypass (document why if you use this in automation)..husky/pre-commitsnyk test --all-projectsSKIP_HOOK=1package.json to change when certain paths change (e.g. app.js, bin/, config/, middlewares/, models/, public/, routes/, views/, schemaNentries/) and the new version must be greater than the latest git tag. Doc-only or .github-only changes skip the check per that workflow.