landing pages - Moses Yebei

The Problem

Clients want a quick way to spin up a polished landing page that can be deployed independently, yet share a consistent design language and technology stack. They need a folder‑per‑site structure that avoids cross‑project dependency bleed and allows each team to iterate on its own brand assets, routes, and build scripts.

What This Does

The repo contains four self‑contained Next.js 16 projects (ficelle, passeline, aparte, ecrin). Each project has its own package.json, lockfile, and Tailwind + shadcn/ui setup. The showcase/ folder holds preview images that link to the live Vercel deployments. The top‑level README.md explains how to clone, run, and add new projects.

The aparte subproject is a good example. It ships a full‑stack Next.js app with:

app/page.tsx – the home page layout.
app/for‑merchants/page.tsx – a merchant signup form.
app/for‑merchants/actions.ts – a server action that receives the submitted FormData, validates it, and forwards it to the backend API.
components/edito/* – reusable UI fragments (header, footer, FAQ accordion).
app/(legal)/privacy/page.tsx – static legal pages.

All assets (fonts, icons, CSS) are stored under app/. The project uses a single next.config.ts for routing tweaks and a globals.css for Tailwind global styles.

How It Is Wired

Execution starts in Next.js’s server runtime when a request is routed to a page component. For /, the runtime loads app/layout.tsx → app/page.tsx. Rendering proceeds through the component tree, pulling in components/edito/site-header.tsx and components/edito/site-footer.tsx. No external database is touched; data is either hard‑coded or fetched from an API via fetch.

When a merchant submits the form on /for‑merchants, the browser sends a POST to the server action exported from app/for‑merchants/actions.ts. That function runs on the server, parses FormData, calls await fetch('https://api.lndev.me/partners', {method: 'POST', body: formData}), and returns a JSON response. The client then redirects or shows a success message. This single function is the only place in the repo that reaches out over the network; all other files are purely UI or static content.

The app/(legal)/ pages are static; they are built into the site bundle and served from the public directory. No runtime logic touches them after build.

How To Use It

Clone ``bash git clone https://github.com/moses-y/landing-pages cd landing-pages/ficelle # or passeline, aparte, ecrin ``
Install – each folder uses pnpm. ``bash pnpm install ``
Run locally – the dev server starts on http://localhost:3000. ``bash pnpm dev ` The README.md` in each folder lists any optional environment variables (none exist for the current projects).

Deploy – on Vercel, import the repo and set Root Directory to the chosen folder. No extra configuration is required.

Real‑World Use

A marketing team can copy the ficelle folder, rename it (my‑product), adjust the app/ contents (logo, colors, text), and add a new showcase/my‑product.jpg. The updated README and package.json allow them to spin up a new landing page in minutes and push it to Vercel with a single click. The same process applies to any of the other projects.

Code Health & Issues

Severity (Medium) – No test files – 0 test files across 410 files.
Severity (Medium) – No CI/CD pipeline – no .github/ or ci/ folder.
Severity (Low) – No environment variables – no .env or env.example files.
Severity (Low) – No documentation beyond README – only 6 doc files, all generic.

The repository has no linting or type‑checking errors reported by a static analysis tool, but the lack of automated tests and CI creates a risk for regressions when adding new features.

The Bottom Line

The repo is a clean, folder‑per‑project template that lets teams generate marketing sites quickly with Next.js, Tailwind, and shadcn/ui. It excels at modularity and ease of deployment. However, it lacks automated testing and CI, so teams should add those pipelines before using it in production or scaling it across many projects.

What the analyser found

Deployment readiness

4/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

410 files

TSX230
TypeScript48
Markdown13
JSON12
YAML8
CSS4

ReactNext.jsSpring

Module dependencies

The 10 most depended-upon modules of 288, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_onents_illustrations_palette["palette"] n1_omponents_illustrations_gift["gift"] n2_omponents_illustrations_city["city"] n3_ponents_illustrations_person["person"] n4_celle_components_colis_stamp["stamp"] n5_ponents_illustrations_layers["layers"] n6_nts_illustrations_cargo_bike["cargo-bike"] n7_lle_components_colis_barcode["barcode"] n8__illustrations_street_scenes["street-scenes"] n9_components_colis_mobile_menu["mobile-menu"] n6_nts_illustrations_cargo_bike --> n1_omponents_illustrations_gift n6_nts_illustrations_cargo_bike --> n0_onents_illustrations_palette n2_omponents_illustrations_city --> n0_onents_illustrations_palette n1_omponents_illustrations_gift --> n0_onents_illustrations_palette n3_ponents_illustrations_person --> n0_onents_illustrations_palette n8__illustrations_street_scenes --> n6_nts_illustrations_cargo_bike n8__illustrations_street_scenes --> n2_omponents_illustrations_city n8__illustrations_street_scenes --> n1_omponents_illustrations_gift n8__illustrations_street_scenes --> n5_ponents_illustrations_layers n8__illustrations_street_scenes --> n0_onents_illustrations_palette n8__illustrations_street_scenes --> n3_ponents_illustrations_person

Dependencies

3 of 22 declared dependencies are a major version behind. Resolved 22 of 22 against the registry.

Package	Declared	Latest	Behind
`@types/node`	^20	26.2.0	6 major
`typescript`	^5	7.0.2	2 major
`eslint`	^9	10.8.1	1 major

Findings

MediumNo test files detected - untested code paths repository-wide
MediumNo CI/CD pipeline detected - no automated build/test gate .github/ or CI config

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high3

medium1

low1

Upgrade the pinned dependency carrying a published advisoryhigh6 occurrences

next@16.3.6 CVE-2026-94483 (high) +5 more

The pinned version is the one that installs, so a published advisory against it describes this deployment rather than a hypothetical one, and the advisory is also a public description of how to exploit it.

Fix: Upgrade to the fixed version named in the advisory, then commit the lockfile.

Add a test suite; this repository has nonehigh288 occurrences

288 source files, no test files

Any change ships with no signal that existing behaviour still holds, so a regression reaches production undetected.

Fix: Add one test per public entry point, then a CI step that runs them.

Add a workflow that builds and tests this repositoryhigh

288 source files, no CI configuration

Every change merges with nobody having run the build once, which across this estate is 499 repositories.

Fix: Add a workflow running the project build and test command on push and pull_request.

Enable Dependabot or Renovatemedium

4 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.