Skip to content

Conversation

@karrui
Copy link
Collaborator

@karrui karrui commented Oct 10, 2025

TODOs:

  • Kysely
  • Standardized logging
  • Storybook setup
  • CI/CD deployment setup for AWS
  • start.open.gov.sg refresh
  • Examples for server side data fetching

Starter Kit

A technical kit to quickly build new products from
Open Government Products, Singapore.

Features

  • 🗼 Monorepo setup with Turborepo
  • 🧙‍♂️ E2E typesafety with tRPC v11
  • ⚡ Full-stack React with Next.js v15
  • 🌈 Database with Prisma
  • ⚙️ VSCode extensions
  • 🎨 ESLint + Prettier
  • 💚 CI setup using GitHub Actions:
  • 🔐 Env var validation

Project structure

.github
  └─ workflows
        └─ CI with pnpm cache setup
.vscode
  └─ Recommended extensions and settings for VSCode users
apps
  └─ web
      ├─ Next.js 15
      ├─ React 19
      ├─ Tailwind CSS v4
      └─ E2E Typesafe API Server & Client
packages
  ├─ db
  │   └─ Typesafe db calls using Prisma (+ Kysely)
  └─ ui
      └─ Start of a UI package for the webapp using react-aria-components + @opengovsg/oui
tooling
  ├─ eslint
  │   └─ shared, fine-grained, eslint presets
  ├─ prettier
  │   └─ shared prettier configuration
  ├─ tailwind
  │   └─ shared tailwind theme and configuration
  └─ typescript
      └─ shared tsconfig you can extend from

Working on your product

You may work on the codebase with:

Using GitHub Codespaces

Follow the official GitHub guide
for developing with a codespace.

Using your local developer environment

In summary:

Running the app locally

1. Setup dependencies

# Install dependencies
pnpm i

# Configure environment variables
# There is an `.env.example` in the root directory you can use for reference
cp .env.example .env.local

# Start docker containers
# use `docker compose down` to stop the containers afterwards
docker compose up -d

# Push the Prisma schema to the database
pnpm db:push

Optionally set POSTMAN_API_KEY to send login OTP emails via Postman.
If not set, OTP emails will be logged to the console instead.

Retrieving client-side environment variables in code

⚠️ When adding client-only environment variables in NextJS, you must prefix the variable with NEXT_PUBLIC_ to ensure that the variable is exposed to the browser. For example, if you want to add a variable called MY_ENV_VAR, you should add it to your .env file as NEXT_PUBLIC_MY_ENV_VAR.

You will also need to update the various environment files (like apps/web/src/env.ts or packages/db/src/env.ts) to explicitly reference the variable so NextJS will correctly bundle the environment variable into the client-side bundle.

2. Adding a new package

To add a new package, simply run pnpm turbo gen init in the monorepo root. This will prompt you for a package name as well as if you want to install any dependencies to the new package (of course you can also do this yourself later).

The generator sets up the package.json, tsconfig.json and a index.ts, as well as configures all the necessary configurations for tooling around your package such as formatting, linting and typechecking. When the package is created, you're ready to go build out the package.

Deployment

Follow these instructions if you are familiar with building applications,
and/or are in a hurry to prepare an environment to work on your product.

If you are new, see our Getting Started guide.

If you are exploring what else you can do with Starter Kit,
a more comprehensive set of documentation, including guides
and tutorials, can be found here.

The Vercel deployment outlined below is optimised for quick prototyping and development. It is not recommended for serious production use.

For serious production use cases, consider directly deploying Starter Kit to AWS. We provide a command line interface (CLI) tool (for internal use only) that can help you deploy Starter Kit to a standardised AWS infrastructure.

Nonetheless, on low-risk production use cases, Vercel can still be used as a production deployment. We have a document on when one might want to migrate to AWS here.

Deploy to Vercel

Let's deploy the Next.js application to Vercel. If you've never deployed a Turborepo app there, don't worry, the steps are quite straightforward. You can also read the official Turborepo guide on deploying to Vercel.

  1. Create a new project on Vercel, select the apps/web folder as the root directory. Vercel's zero-config system should handle all configurations for you.

  2. Add the prerequisite environment variables outlined in the Prerequisites section.

  3. Done! Your app should successfully deploy.

Prerequisites

The deployment needs a few environment variables to be set for it to function. They are:

Name What It Is Example
DATABASE_URL The connection string for your database. This should have been obtained from Neon postgresql://user:[email protected]/app?sslmode=require
POSTMAN_API_KEY An API key to send email via Postman asdfn_v1_6DBRljleevjsd9DHPThsKDVDSenssCwW9zfA8W2ddf/T
SESSION_SECRET A sequence of random characters used to protect session identifiers, generated by running npx uuid from your terminal 66a21b98-fb17-4259-ac4f-e94d303ac894

@vercel
Copy link

vercel bot commented Oct 10, 2025

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Preview Comments Updated (UTC)
starter-kit Ready Ready Preview Comment Nov 14, 2025 5:14am

@socket-security
Copy link

socket-security bot commented Oct 10, 2025

@socket-security
Copy link

socket-security bot commented Oct 10, 2025

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm registry-auth-token is 94.0% likely obfuscated

Confidence: 0.94

Location: Package overview

From: pnpm-lock.yamlnpm/@turbo/[email protected]npm/[email protected]

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at [email protected].

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/[email protected]. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@qin-guan
Copy link

qin-guan commented Oct 11, 2025

sst

Copy link
Collaborator Author

karrui commented Nov 6, 2025

This stack of pull requests is managed by Graphite. Learn more about stacking.

@karrui karrui merged commit 93b0291 into main Nov 14, 2025
15 of 16 checks passed
@karrui karrui deleted the v3 branch November 14, 2025 05:51
@seaerchin
Copy link
Contributor

aura

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants