code-foundry 0.1.0

package/.github/scripts/ci.sh

@@ -0,0 +1,245 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ -d .venv/bin ]; then export PATH="$PWD/.venv/bin:$PATH"; fi
+
+has_script() {
+  [ -f package.json ] && node -e 'const p=require("./package.json"); process.exit(p.scripts?.[process.argv[1]] ? 0 : 1)' "$1"
+}
+
+has_bun_native_coverage() {
+  [ -f package.json ] && node -e 'const p=require("./package.json"); process.exit(p.scripts?.["test:coverage"]?.includes("bun test") ? 0 : 1)'
+}
+
+has_javascript() {
+  git ls-files -- '*.js' '*.jsx' '*.ts' '*.tsx' | grep -q .
+}
+
+has_python() {
+  [ -f pyproject.toml ] || [ -f requirements.txt ] || [ -f requirements-dev.txt ] || \
+    git ls-files -- '*.py' ':!.github/**' | grep -q .
+}
+
+has_graph_project() {
+  [ -f package.json ] && node -e 'const p=require("./package.json"); process.exit(p.devDependencies?.["@graphprotocol/graph-cli"] ? 0 : 1)'
+}
+
+package_manager() {
+  if [ -f bun.lock ] || [ -f bun.lockb ]; then echo bun
+  elif [ -f pnpm-lock.yaml ]; then echo pnpm
+  elif [ -f yarn.lock ]; then echo yarn
+  elif [ -f package-lock.json ]; then echo npm
+  else echo bun
+  fi
+}
+
+run_script() {
+  if ! has_script "$1"; then echo "Skipping $1 (script not defined)"; return; fi
+  case "$(package_manager)" in
+    bun) bun run "$1" ;;
+    pnpm) corepack pnpm run "$1" ;;
+    yarn) corepack yarn run "$1" ;;
+    npm) npm run "$1" ;;
+  esac
+}
+
+run_package_tool() {
+  case "$(package_manager)" in
+    bun) bunx --no-install "$@" ;;
+    pnpm) corepack pnpm exec "$@" ;;
+    yarn) corepack yarn exec "$@" ;;
+    npm) npx --no-install "$@" ;;
+  esac
+}
+
+run_bun_coverage() {
+  local log_file coverage_line functions lines minimum
+  log_file="$(mktemp)"
+  if ! run_script test:coverage 2>&1 | tee "$log_file"; then
+    rm -f "$log_file"
+    return 1
+  fi
+  coverage_line="$(grep -E '^All files[[:space:]]*\|' "$log_file" | tail -n 1 || true)"
+  if [ -z "$coverage_line" ]; then
+    echo "Coverage summary not found in test:coverage output" >&2
+    rm -f "$log_file"
+    return 1
+  fi
+  read -r functions lines < <(printf '%s\n' "$coverage_line" | awk -F'|' '{for (i = 1; i <= NF; i++) gsub(/[[:space:]]/, "", $i); if (NF >= 5) print $4, $5; else if (NF >= 3) print $2, $3}')
+  minimum="${BUN_COVERAGE_MIN:-80}"
+  if ! awk -v functions="$functions" -v lines="$lines" -v minimum="$minimum" \
+    'BEGIN { exit !(functions + 0 >= minimum && lines + 0 >= minimum) }'; then
+    echo "Coverage below ${minimum}%: functions=${functions}% lines=${lines}%" >&2
+    rm -f "$log_file"
+    return 1
+  fi
+  echo "Coverage threshold passed: functions=${functions}% lines=${lines}% (minimum ${minimum}%)"
+  rm -f "$log_file"
+}
+
+python_coverage_args() {
+  if [ -f pyproject.toml ]; then
+    python - <<'PY'
+import tomllib
+from pathlib import Path
+
+config = tomllib.loads(Path("pyproject.toml").read_text())
+for source in config.get("tool", {}).get("coverage", {}).get("run", {}).get("source", []):
+    print(f"--cov={source}")
+PY
+  fi
+}
+
+install() {
+  if [ -f package.json ]; then
+    case "$(package_manager)" in
+      bun) bun install --frozen-lockfile ;;
+      pnpm) corepack pnpm install --frozen-lockfile ;;
+      yarn) corepack yarn install --immutable ;;
+      npm) npm ci ;;
+    esac
+  fi
+  if [ -f Cargo.toml ]; then cargo fetch --locked; fi
+  if has_python; then python -m venv .venv; .venv/bin/python -m pip install --disable-pip-version-check --quiet ruff; fi
+  if [ -f requirements.txt ]; then .venv/bin/python -m pip install --disable-pip-version-check -r requirements.txt; fi
+  if [ -f requirements-dev.txt ]; then .venv/bin/python -m pip install --disable-pip-version-check -r requirements-dev.txt; fi
+}
+
+rust_component() {
+  local component="$1"
+  if command -v rustup >/dev/null 2>&1; then
+    local toolchain="${RUSTUP_TOOLCHAIN:-$(rustup show active-toolchain | awk '{print $1}')}"
+    rustup component add --toolchain "$toolchain" "$component" >/dev/null
+  fi
+}
+
+has_rust_target() {
+  local kind="$1"
+  cargo metadata --no-deps --format-version 1 |
+    jq -e --arg kind "$kind" 'any(.packages[].targets[]; (.kind | index($kind)) != null)' >/dev/null
+}
+
+format() {
+  if has_script format:check; then run_script format:check
+  elif has_javascript; then run_package_tool prettier --check .
+  else echo "Skipping JavaScript/TypeScript formatting (no formatter script or source found)"; fi
+  if [ -f Cargo.toml ]; then rust_component rustfmt; cargo fmt --check; fi
+  if has_python && command -v ruff >/dev/null 2>&1; then ruff format --check .; fi
+}
+
+lint() {
+  if has_script lint; then run_script lint
+  elif has_javascript; then run_package_tool eslint .
+  else echo "Skipping JavaScript/TypeScript lint (no lint script or source found)"; fi
+  if [ -f Cargo.toml ]; then rust_component clippy; cargo clippy --all-targets -- -D warnings; fi
+  if has_python && command -v ruff >/dev/null 2>&1; then ruff check .; fi
+}
+
+type_check() {
+  if has_graph_project; then
+    echo "Skipping TypeScript type-check (Graph AssemblyScript project uses graph build/codegen)"
+  elif has_script type-check; then run_script type-check
+  elif has_script typecheck; then run_script typecheck
+  else echo "Skipping type-check (script not defined)"; fi
+  if [ -f Cargo.toml ]; then cargo check; fi
+  if has_python && command -v python >/dev/null 2>&1; then
+    py_dirs=()
+    for dir in tests src scripts; do [ -d "$dir" ] && py_dirs+=("$dir"); done
+    if [ "${#py_dirs[@]}" -gt 0 ]; then python -m compileall -q "${py_dirs[@]}"; fi
+  fi
+}
+
+build() {
+  # Some frameworks validate session secrets while statically collecting pages.
+  # Keep CI builds deterministic without weakening runtime/deployment validation.
+  if [ "${CI:-}" = true ] && [ -z "${NEXTAUTH_SECRET:-}" ]; then
+    export NEXTAUTH_SECRET="ci-only-build-secret-not-for-runtime-0123456789"
+  fi
+  run_script build
+  if [ -f Cargo.toml ]; then cargo build --all-targets --all-features; fi
+}
+
+unit() {
+  # Bun repositories should expose test scripts backed by Bun's native runner.
+  # Specialized repositories may keep their native runner (for example Matchstick or Hardhat).
+  if has_script test:unit; then
+    run_script test:unit
+  elif has_script test:coverage; then
+    if [ "$(package_manager)" = bun ] && has_bun_native_coverage; then
+      run_bun_coverage
+    else
+      run_script test:coverage
+    fi
+  elif has_script test && ! has_script test:integration; then
+    run_script test
+  else
+    echo "Skipping JavaScript/TypeScript unit tests (script not defined)"
+  fi
+  if [ -f Cargo.toml ]; then
+    if has_rust_target lib; then cargo test --lib --all-features
+    elif has_rust_target bin; then cargo test --bins --all-features
+    else echo "Skipping Rust unit tests (no library or binary target)"; fi
+  fi
+  if [ -d tests/unit ] && python -c 'import importlib.util; raise SystemExit(importlib.util.find_spec("pytest") is None)' 2>/dev/null; then
+    coverage_args=()
+    while IFS= read -r arg; do [ -n "$arg" ] && coverage_args+=("$arg"); done < <(python_coverage_args)
+    [ "${#coverage_args[@]}" -gt 0 ] || coverage_args=(--cov)
+    env -u MISE_GITHUB_TOKEN -u MISE_TRUSTED_CONFIG_PATHS -u MISE_YES -u MISE_LOG_LEVEL -u PYTHONHOME PYTHONPATH="$PWD/.github/scripts" python -m pytest -q tests/unit "${coverage_args[@]}" --cov-report=term-missing --cov-fail-under="${PYTHON_COVERAGE_MIN:-80}"
+  elif [ -d tests ] && [ ! -d tests/integration ] && python -c 'import importlib.util; raise SystemExit(importlib.util.find_spec("pytest") is None)' 2>/dev/null; then
+    coverage_args=()
+    while IFS= read -r arg; do [ -n "$arg" ] && coverage_args+=("$arg"); done < <(python_coverage_args)
+    [ "${#coverage_args[@]}" -gt 0 ] || coverage_args=(--cov)
+    env -u MISE_GITHUB_TOKEN -u MISE_TRUSTED_CONFIG_PATHS -u MISE_YES -u MISE_LOG_LEVEL -u PYTHONHOME PYTHONPATH="$PWD/.github/scripts" python -m pytest -q tests "${coverage_args[@]}" --cov-report=term-missing --cov-fail-under="${PYTHON_COVERAGE_MIN:-80}"
+  else
+    echo "Skipping Python unit tests (no unit suite detected)"
+  fi
+}
+
+integration() {
+  if has_script test:integration; then
+    run_script test:integration
+  else
+    echo "Skipping JavaScript/TypeScript integration tests (script not defined)"
+  fi
+  if [ -f Cargo.toml ] && [ -d tests ]; then cargo test --tests --all-features; fi
+  if [ -d tests/integration ] && python -c 'import importlib.util; raise SystemExit(importlib.util.find_spec("pytest") is None)' 2>/dev/null; then
+    python -m pytest -q tests/integration
+  else
+    echo "Skipping Python integration tests (tests/integration not found)"
+  fi
+}
+
+e2e() {
+  if has_script test:e2e; then
+    run_script test:e2e
+  elif has_script e2e; then
+    run_script e2e
+  else
+    echo "Skipping JavaScript/TypeScript E2E tests (script not defined)"
+  fi
+  if [ -d tests/e2e ] && python -c 'import importlib.util; raise SystemExit(importlib.util.find_spec("pytest") is None)' 2>/dev/null; then
+    python -m pytest -q tests/e2e
+  else
+    echo "Skipping Python E2E tests (tests/e2e not found)"
+  fi
+}
+
+smoke() {
+  if has_script test:smoke; then
+    run_script test:smoke
+  elif has_script smoke; then
+    run_script smoke
+  else
+    echo "Skipping JavaScript/TypeScript smoke tests (script not defined)"
+  fi
+  if [ -d tests/smoke ] && python -c 'import importlib.util; raise SystemExit(importlib.util.find_spec("pytest") is None)' 2>/dev/null; then
+    python -m pytest -q tests/smoke
+  else
+    echo "Skipping Python smoke tests (tests/smoke not found)"
+  fi
+}
+
+case "${1:-}" in
+  install|format|lint|type_check|build|unit|integration|e2e|smoke) "$1" ;;
+  *) echo "usage: $0 {install|format|lint|type_check|build|unit|integration|e2e|smoke}" >&2; exit 2 ;;
+esac

package/.github/scripts/codeql-languages.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+languages=()
+if find .github/workflows -type f \( -name '*.yml' -o -name '*.yaml' \) -print -quit | grep -q .; then languages+=(actions); fi
+configured=""
+if [ -f .github/template.yml ]; then
+  configured="$(awk -F': ' '/^languages:/ {print $2; exit}' .github/template.yml)"
+fi
+
+if [ "$configured" = auto ] || [ "$configured" = all ] || [ -z "$configured" ]; then
+  if git ls-files -- '*.ts' '*.tsx' '*.js' '*.jsx' 'package.json' 'tsconfig*.json' | grep -q .; then languages+=(javascript-typescript); fi
+  if git ls-files -- '*.py' 'pyproject.toml' 'requirements*.txt' 'setup.py' ':!.github/**' | grep -q .; then languages+=(python); fi
+  if git ls-files -- '*.rs' 'Cargo.toml' 'Cargo.lock' | grep -q .; then languages+=(rust); fi
+else
+  case ",$configured," in *,typescript,*) languages+=(javascript-typescript) ;; esac
+  case ",$configured," in *,python,*) languages+=(python) ;; esac
+  case ",$configured," in *,rust,*) languages+=(rust) ;; esac
+fi
+
+json=$(printf '%s\n' "${languages[@]}" | jq -Rsc 'split("\n") | map(select(length > 0) | {language: ., name: (if . == "javascript-typescript" then "TypeScript" elif . == "actions" then "Actions" else (. | ascii_upcase[0:1] + .[1:]) end), "build-mode": "none"})')
+printf 'languages=%s\n' "$json" >> "$GITHUB_OUTPUT"

package/.github/scripts/doctor.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+errors=0
+
+configured_features="all"
+if [ -f .github/template.yml ]; then
+  configured_features="$(awk -F': ' '/^features:/ {print $2; exit}' .github/template.yml)"
+  [ -n "$configured_features" ] || configured_features="all"
+fi
+
+feature_enabled() {
+  [ "$configured_features" = all ] && return 0
+  case " $(printf '%s' "$configured_features" | tr ',' ' ') " in
+    *" $1 "*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+error() {
+  printf 'ERROR: %s\n' "$1" >&2
+  errors=$((errors + 1))
+}
+
+warn() {
+  printf 'WARN: %s\n' "$1" >&2
+}
+
+if [ ! -f .mise.toml ]; then
+  error ".mise.toml is missing"
+fi
+
+if [ "$(git config --get core.hooksPath || true)" != ".githooks" ]; then
+  warn "Git hooks are not enabled; run bash .github/scripts/bootstrap.sh"
+fi
+
+if [ -f package.json ]; then
+  node -e 'JSON.parse(require("fs").readFileSync("package.json", "utf8"))'
+  lockfiles=0
+  for lockfile in bun.lock bun.lockb pnpm-lock.yaml yarn.lock package-lock.json; do
+    if [ -f "$lockfile" ]; then lockfiles=$((lockfiles + 1)); fi
+  done
+  if [ "$lockfiles" -eq 0 ]; then
+    if node -e 'const p=require("./package.json"); const groups=[p.dependencies,p.devDependencies,p.optionalDependencies,p.peerDependencies]; process.exit(groups.some((g)=>g && Object.keys(g).length) ? 0 : 1)' 2>/dev/null; then
+      error "package.json exists but no supported lockfile was found"
+    else
+      printf '%s\n' "INFO: package.json has no dependencies; a lockfile is optional"
+    fi
+  elif [ "$lockfiles" -gt 1 ]; then
+    error "multiple JavaScript lockfiles found; keep one package manager"
+  fi
+  if node -e 'const p=require("./package.json"); process.exit(p.packageManager ? 0 : 1)' 2>/dev/null; then
+    declared="$(node -p 'require("./package.json").packageManager.split("@")[0]')"
+    actual=""
+    [ -f bun.lock ] || [ -f bun.lockb ] && actual="bun"
+    [ -f pnpm-lock.yaml ] && actual="pnpm"
+    [ -f yarn.lock ] && actual="yarn"
+    [ -f package-lock.json ] && actual="npm"
+    [ -n "$actual" ] && [ "$declared" != "$actual" ] && error "packageManager ($declared) does not match $actual lockfile"
+  fi
+  if git ls-files -- '*.ts' '*.tsx' '*.js' '*.jsx' | grep -q .; then
+    if ! node -e 'const p=require("./package.json"); const s=p.scripts||{}; process.exit(s.test||s["test:unit"]||s["test:integration"] ? 0 : 1)' 2>/dev/null; then
+      warn "JavaScript/TypeScript sources found but no test or test:unit/test:integration script is defined"
+    fi
+  fi
+  if [ -f bunfig.toml ] && node -e 'const p=require("./package.json"); process.exit(p.scripts?.["test:coverage"] ? 0 : 1)' 2>/dev/null; then
+    if ! grep -q 'coverageThreshold' bunfig.toml; then
+      if [ -x .github/scripts/ci.sh ]; then
+        printf '%s\n' "INFO: shared CI enforces the Bun aggregate coverage threshold"
+      else
+        error "Bun coverage is enabled by test:coverage but no coverage policy is configured"
+      fi
+    fi
+  fi
+fi
+
+if [ -f Cargo.toml ]; then
+  command -v cargo >/dev/null 2>&1 || error "Cargo is required for this repository"
+  cargo metadata --no-deps --format-version 1 >/dev/null
+fi
+
+if [ -f pyproject.toml ] || [ -f requirements.txt ] || [ -f requirements-dev.txt ]; then
+  if ! command -v python >/dev/null 2>&1 && [ ! -x .venv/bin/python ]; then
+    error "Python is required for this repository"
+  fi
+fi
+
+for workflow in ci codeql security test draft-pr release-pr release; do
+  if feature_enabled "$workflow"; then
+    [ -f ".github/workflows/$workflow.yml" ] || error "missing enabled workflow: $workflow.yml"
+  fi
+done
+
+for script in ci.sh codeql-languages.sh security.sh doctor.sh bootstrap.sh sync-template.sh init-repo.sh sync-protection.sh; do
+  [ -x ".github/scripts/$script" ] || error "missing executable script: .github/scripts/$script"
+done
+
+if [ "$errors" -gt 0 ]; then
+  printf '%s\n' "Repository doctor found $errors error(s)." >&2
+  exit 1
+fi
+
+printf '%s\n' "Repository doctor passed."

package/.github/scripts/init-repo.sh

@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+source="https://github.com/0xPlayerOne/template-repo.git"
+ref="main"
+protection=false
+dry_run=false
+prune=false
+languages="auto"
+features="all"
+package_manager="auto"
+tool_dir=""
+
+cleanup() {
+  if [ -n "$tool_dir" ]; then rm -rf "$tool_dir"; fi
+}
+trap cleanup EXIT
+
+usage() {
+  cat <<'EOF'
+Usage: init-repo.sh [options]
+
+Initialize or synchronize a repository from the shared baseline.
+
+Options:
+  --source PATH_OR_URL       Template source (default: 0xPlayerOne/template-repo)
+  --ref REF                  Template branch or tag (default: main)
+  --languages LIST           auto or comma-separated: typescript,rust,python,solidity
+  --features LIST            all or comma-separated optional features:
+                             ci,codeql,security,test,draft-pr,release-pr,release,dependabot
+  --package-manager NAME     auto, bun, pnpm, yarn, or npm
+  --dry-run                  Preview changes without writing files
+  --prune                    Remove disabled standard workflows (never custom workflows)
+  --protection               Synchronize main branch required checks
+  -h, --help                 Show this help
+
+Examples:
+  bash .github/scripts/init-repo.sh --languages typescript,python
+  bash .github/scripts/init-repo.sh --languages rust --features ci,codeql,security,test
+  bash .github/scripts/init-repo.sh --features all --dry-run
+EOF
+}
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --source) source="${2:?missing source path or URL}"; shift 2 ;;
+    --ref) ref="${2:?missing ref}"; shift 2 ;;
+    --languages) languages="${2:?missing language list}"; shift 2 ;;
+    --features) features="${2:?missing feature list}"; shift 2 ;;
+    --package-manager) package_manager="${2:?missing package manager}"; shift 2 ;;
+    --dry-run) dry_run=true; shift ;;
+    --prune) prune=true; shift ;;
+    --protection) protection=true; shift ;;
+    -h|--help) usage; exit 0 ;;
+    *)
+      printf 'Unknown option: %s\n' "$1" >&2
+      exit 2
+      ;;
+  esac
+done
+
+case "$package_manager" in
+  auto|bun|pnpm|yarn|npm) ;;
+  *) printf 'Unsupported package manager: %s\n' "$package_manager" >&2; exit 2 ;;
+esac
+
+script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" 2>/dev/null && pwd || true)"
+if [ -f "$script_dir/sync-template.sh" ]; then
+  sync_script="$script_dir/sync-template.sh"
+elif [ -d "$source" ] && [ -f "$source/.github/scripts/sync-template.sh" ]; then
+  sync_script="$source/.github/scripts/sync-template.sh"
+else
+  command -v git >/dev/null 2>&1 || { echo "git is required" >&2; exit 1; }
+  tool_dir="$(mktemp -d)"
+  git clone --quiet --depth 1 --branch "$ref" "$source" "$tool_dir/template-repo"
+  sync_script="$tool_dir/template-repo/.github/scripts/sync-template.sh"
+fi
+
+sync_args=(
+  --source "$source"
+  --ref "$ref"
+  --languages "$languages"
+  --features "$features"
+)
+if [ "$dry_run" = true ]; then sync_args+=(--check); else sync_args+=(--apply); fi
+if [ "$prune" = true ]; then sync_args+=(--prune); fi
+bash "$sync_script" "${sync_args[@]}"
+
+if [ "$dry_run" = true ]; then
+  printf '%s\n' 'Dry run complete; no files were changed.'
+  exit 0
+fi
+
+mkdir -p .github
+cat > .github/template.yml <<EOF
+version: 1
+languages: $languages
+features: $features
+package_manager: $package_manager
+EOF
+
+bash .github/scripts/bootstrap.sh
+
+if [ "$protection" = true ]; then
+  remote="$(git remote get-url origin 2>/dev/null || true)"
+  repo="$(printf '%s\n' "$remote" | sed -E 's#.*github.com[:/]([^/]+/[^/.]+)(\.git)?$#\1#')"
+  [ -n "$repo" ] || { echo 'Could not determine GitHub repository from origin' >&2; exit 1; }
+  bash .github/scripts/sync-protection.sh --repo "$repo" --apply
+fi

package/.github/scripts/security.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+audits=0
+
+package_manager() {
+  if [ -f bun.lock ] || [ -f bun.lockb ]; then echo bun
+  elif [ -f pnpm-lock.yaml ]; then echo pnpm
+  elif [ -f yarn.lock ]; then echo yarn
+  elif [ -f package-lock.json ]; then echo npm
+  else echo none
+  fi
+}
+
+if [ -f package.json ]; then
+  audit_args=(--audit-level=high)
+  if [ -f .github/security-audit-allowlist.txt ]; then
+    while IFS= read -r advisory; do
+      [[ -z "$advisory" || "$advisory" == \#* ]] && continue
+      audit_args+=(--ignore "$advisory")
+    done < .github/security-audit-allowlist.txt
+  fi
+  case "$(package_manager)" in
+    bun) audits=$((audits + 1)); bun audit "${audit_args[@]}" ;;
+    pnpm) audits=$((audits + 1)); corepack pnpm audit --audit-level high ;;
+    yarn) audits=$((audits + 1)); corepack yarn npm audit --all --recursive ;;
+    npm) audits=$((audits + 1)); npm audit --audit-level=high ;;
+  esac
+else
+  echo "Skipping JavaScript/TypeScript audit (package.json not found)"
+fi
+
+if [ -f Cargo.toml ]; then
+  audits=$((audits + 1))
+  if ! command -v cargo-audit >/dev/null 2>&1; then cargo install cargo-audit --locked --quiet; fi
+  cargo audit
+else
+  echo "Skipping Rust audit (Cargo.toml not found)"
+fi
+
+if [ -f requirements.txt ] || [ -f requirements-dev.txt ] || [ -f pyproject.toml ]; then
+  audits=$((audits + 1))
+  python -m pip install --disable-pip-version-check --quiet pip-audit
+  if [ -f requirements.txt ]; then python -m pip_audit -r requirements.txt; fi
+  if [ -f requirements-dev.txt ]; then python -m pip_audit -r requirements-dev.txt; fi
+  if [ -f pyproject.toml ] && [ ! -f requirements.txt ] && [ ! -f requirements-dev.txt ]; then python -m pip_audit; fi
+else
+  echo "Skipping Python audit (Python dependency manifest not found)"
+fi
+
+if [ "$audits" -eq 0 ]; then echo "No supported dependency manifests found; nothing to audit"; fi

package/.github/scripts/sitecustomize.py

@@ -0,0 +1,17 @@
+"""Keep coverage.py usable with runners that ship malformed sysconfig schemes."""
+
+import sysconfig
+
+_get_paths = sysconfig.get_paths
+
+
+def get_paths(scheme=None, vars=None, expand=True):
+    try:
+        return _get_paths(scheme, vars, expand)
+    except ValueError as error:
+        if "Single '}' encountered in format string" not in str(error):
+            raise
+        return {}
+
+
+sysconfig.get_paths = get_paths

package/.github/scripts/sync-protection.sh

@@ -0,0 +1,124 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+branch="main"
+repo=""
+mode="check"
+configured_features="all"
+configured_languages="auto"
+
+if [ -f .github/template.yml ]; then
+  configured_features="$(awk -F': ' '/^features:/ {print $2; exit}' .github/template.yml)"
+  configured_languages="$(awk -F': ' '/^languages:/ {print $2; exit}' .github/template.yml)"
+  [ -n "$configured_features" ] || configured_features="all"
+  [ -n "$configured_languages" ] || configured_languages="auto"
+fi
+
+feature_enabled() {
+  [ "$configured_features" = all ] && return 0
+  case " $(printf '%s' "$configured_features" | tr ',' ' ') " in
+    *" $1 "*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+language_enabled() {
+  [ "$configured_languages" = auto ] || [ "$configured_languages" = all ] && return 0
+  case " $(printf '%s' "$configured_languages" | tr ',' ' ') " in
+    *" $1 "*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+usage() {
+  printf '%s\n' 'Usage: sync-protection.sh --repo OWNER/REPO [--branch main] [--check] [--apply]'
+}
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --repo) repo="${2:?missing OWNER/REPO}"; shift 2 ;;
+    --branch) branch="${2:?missing branch}"; shift 2 ;;
+    --check) mode="check"; shift ;;
+    --apply) mode="apply"; shift ;;
+    -h|--help) usage; exit 0 ;;
+    *) usage >&2; exit 2 ;;
+  esac
+done
+
+[ -n "$repo" ] || { usage >&2; exit 2; }
+command -v gh >/dev/null 2>&1 || { echo "gh is required" >&2; exit 1; }
+
+is_private="$(gh repo view "$repo" --json isPrivate --jq '.isPrivate')"
+contexts=()
+if feature_enabled ci; then contexts+=(Format Lint Type-Check Build); fi
+if feature_enabled test; then contexts+=(Unit Integration E2E Smoke); fi
+if feature_enabled security; then contexts+=('Dependency Audit'); fi
+if feature_enabled codeql; then contexts+=(Detect); fi
+
+if [ "$is_private" != true ] && feature_enabled codeql; then
+  contexts+=("Analyze (Actions)")
+  if language_enabled typescript && git ls-files -- '*.ts' '*.tsx' '*.js' '*.jsx' package.json tsconfig\*.json | grep -q .; then contexts+=("Analyze (TypeScript)"); fi
+  if language_enabled python && git ls-files -- '*.py' pyproject.toml requirements\*.txt setup.py ':!.github/**' | grep -q .; then contexts+=("Analyze (Python)"); fi
+  if language_enabled rust && git ls-files -- '*.rs' Cargo.toml Cargo.lock | grep -q .; then contexts+=("Analyze (Rust)"); fi
+fi
+
+protection="$(gh api "repos/$repo/branches/$branch/protection" 2>/dev/null || true)"
+if ! jq -e 'type == "object" and (.required_status_checks | type == "object")' >/dev/null 2>&1 <<< "$protection"; then
+  if [ "$mode" = apply ]; then
+    echo "Cannot read branch protection for $repo:$branch (repository plan or permissions may not allow it)." >&2
+    exit 1
+  fi
+  existing=""
+else
+  existing="$(jq -r '.required_status_checks.contexts[]?' <<< "$protection")"
+fi
+preserved=()
+while IFS= read -r context; do
+  [ -n "$context" ] || continue
+  case "$context" in
+    'Slither / Analyze') continue ;; # removed from the standard workflow set
+    'CI / '*|'Test / '*|'Security / '*|'CodeQL / '*) ;;
+    *) preserved+=("$context") ;;
+  esac
+done <<< "$existing"
+
+payload="$(printf '%s\n' "${preserved[@]-}" "${contexts[@]}" | jq -Rsc 'split("\n") | map(select(length > 0)) | unique | {strict: true, contexts: .}')"
+
+if [ "$mode" = check ]; then
+  printf '%s\n' "$payload" | jq .
+  exit 0
+fi
+
+current="$protection"
+full_payload="$(jq --argjson checks "$payload" '
+  {
+    required_status_checks: $checks,
+    enforce_admins: .enforce_admins.enabled,
+    required_pull_request_reviews: (
+      if .required_pull_request_reviews == null then null else {
+        dismiss_stale_reviews: .required_pull_request_reviews.dismiss_stale_reviews,
+        require_code_owner_reviews: .required_pull_request_reviews.require_code_owner_reviews,
+        required_approving_review_count: .required_pull_request_reviews.required_approving_review_count,
+        require_last_push_approval: .required_pull_request_reviews.require_last_push_approval
+      } end
+    ),
+    restrictions: (
+      if .restrictions == null then null else {
+        users: [.restrictions.users[].login],
+        teams: [.restrictions.teams[].slug],
+        apps: [.restrictions.apps[].slug]
+      } end
+    ),
+    required_linear_history: .required_linear_history.enabled,
+    allow_force_pushes: .allow_force_pushes.enabled,
+    allow_deletions: .allow_deletions.enabled,
+    block_creations: .block_creations.enabled,
+    required_conversation_resolution: .required_conversation_resolution.enabled,
+    lock_branch: .lock_branch.enabled,
+    allow_fork_syncing: .allow_fork_syncing.enabled
+  }
+' <<< "$current")"
+
+gh api --method PUT "repos/$repo/branches/$branch/protection" \
+  --input - <<< "$full_payload" >/dev/null
+printf 'Updated required checks for %s:%s\n' "$repo" "$branch"