code-foundry 0.1.0

package/.github/scripts/sync-template.sh

@@ -0,0 +1,242 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage: sync-template.sh --source PATH_OR_URL [options]
+
+Synchronize the repository-owned baseline without replacing project-specific
+README files, mise tool selections, or additional workflows.
+
+Options:
+  --languages LIST  auto or comma-separated: typescript,rust,python,solidity
+  --features LIST   all or comma-separated standard features
+  --check           Preview changes (default)
+  --apply           Apply changes
+  --prune           Remove disabled standard workflows
+EOF
+}
+
+source_ref="main"
+mode="check"
+source=""
+temp_dir=""
+languages="auto"
+features="all"
+prune=false
+languages_set=false
+features_set=false
+
+valid_languages="typescript rust python solidity"
+valid_features="ci codeql security test draft-pr release-pr release dependabot"
+
+contains_word() {
+  case " $1 " in *" $2 "*) return 0 ;; *) return 1 ;; esac
+}
+
+normalize_csv() {
+  printf '%s' "$1" | tr ',' ' ' | awk '{$1=$1; print}'
+}
+
+validate_list() {
+  local kind="$1" value="$2" valid="$3" item
+  [ "$value" = auto ] || [ "$value" = all ] || {
+    for item in $(normalize_csv "$value"); do
+      contains_word "$valid" "$item" || { echo "Unsupported $kind: $item" >&2; exit 2; }
+    done
+  }
+}
+
+workflow_enabled() {
+  local workflow="$1" list
+  [ "$features" = all ] && return 0
+  list="$(normalize_csv "$features")"
+  contains_word "$list" "$workflow"
+}
+
+cleanup() {
+  if [ -n "$temp_dir" ]; then rm -rf "$temp_dir"; fi
+}
+trap cleanup EXIT
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --source) source="${2:?missing source path or URL}"; shift 2 ;;
+    --ref) source_ref="${2:?missing ref}"; shift 2 ;;
+    --languages) languages="${2:?missing language list}"; languages_set=true; shift 2 ;;
+    --features) features="${2:?missing feature list}"; features_set=true; shift 2 ;;
+    --check) mode="check"; shift ;;
+    --apply) mode="apply"; shift ;;
+    --prune) prune=true; shift ;;
+    -h|--help) usage; exit 0 ;;
+    *) usage >&2; exit 2 ;;
+  esac
+done
+
+[ -n "$source" ] || { usage >&2; exit 2; }
+if [ -f .github/template.yml ]; then
+  if [ "$languages_set" = false ]; then
+    configured_languages="$(awk -F': ' '/^languages:/ {print $2; exit}' .github/template.yml)"
+    [ -n "$configured_languages" ] && languages="$configured_languages"
+  fi
+  if [ "$features_set" = false ]; then
+    configured_features="$(awk -F': ' '/^features:/ {print $2; exit}' .github/template.yml)"
+    [ -n "$configured_features" ] && features="$configured_features"
+  fi
+fi
+validate_list language "$languages" "$valid_languages"
+validate_list feature "$features" "$valid_features"
+
+if [ -d "$source" ] && [ -f "$source/.github/scripts/sync-template.sh" ]; then
+  template_root="$source"
+else
+  command -v git >/dev/null 2>&1 || { echo "git is required" >&2; exit 1; }
+  temp_dir="$(mktemp -d)"
+  git clone --quiet --depth 1 --branch "$source_ref" "$source" "$temp_dir/template-repo"
+  template_root="$temp_dir/template-repo"
+fi
+
+files=(
+  .editorconfig
+  .gitattributes
+  .gitignore
+  .githooks/pre-commit
+  AGENTS.md
+  LICENSE
+  NOTICE
+  ruff.toml
+  .prettierrc
+  .github/CODEOWNERS
+  .github/template.yml.example
+  .github/CODE_OF_CONDUCT.md
+  .github/CONTRIBUTING.md
+  .github/PULL_REQUEST_TEMPLATE.md
+  .github/SECURITY.md
+  .github/dependabot.yml
+  .github/ISSUE_TEMPLATE/bug_report.yml
+  .github/ISSUE_TEMPLATE/config.yml
+  .github/ISSUE_TEMPLATE/feature_request.yml
+  .github/actions/setup/action.yml
+  .github/scripts/bootstrap.sh
+  .github/scripts/ci.sh
+  .github/scripts/codeql-languages.sh
+  .github/scripts/doctor.sh
+  .github/scripts/security.sh
+  .github/scripts/sitecustomize.py
+  .github/scripts/sync-template.sh
+  .github/scripts/init-repo.sh
+  .github/scripts/sync-protection.sh
+  .github/workflows/ci.yml
+  .github/workflows/codeql.yml
+  .github/workflows/draft-pr.yml
+  .github/workflows/release-pr.yml
+  .github/workflows/release.yml
+  .github/workflows/security.yml
+  .github/workflows/test.yml
+)
+
+filtered_files=()
+for file in "${files[@]}"; do
+  case "$file" in
+    .github/dependabot.yml) workflow_enabled dependabot && filtered_files+=("$file") ;;
+    .github/workflows/ci.yml) workflow_enabled ci && filtered_files+=("$file") ;;
+    .github/workflows/codeql.yml) workflow_enabled codeql && filtered_files+=("$file") ;;
+    .github/workflows/security.yml) workflow_enabled security && filtered_files+=("$file") ;;
+    .github/workflows/test.yml) workflow_enabled test && filtered_files+=("$file") ;;
+    .github/workflows/draft-pr.yml) workflow_enabled draft-pr && filtered_files+=("$file") ;;
+    .github/workflows/release-pr.yml) workflow_enabled release-pr && filtered_files+=("$file") ;;
+    .github/workflows/release.yml) workflow_enabled release && filtered_files+=("$file") ;;
+    *) filtered_files+=("$file") ;;
+  esac
+done
+files=("${filtered_files[@]}")
+
+optional_files=(.mise.toml)
+
+# Workflows outside the standard baseline are repository-owned extensions.
+# The sync operation never deletes or replaces them; surface them explicitly
+# so maintainers can verify custom deployment, indexing, or security flows.
+standard_workflow() {
+  case "$1" in
+    ci.yml|codeql.yml|draft-pr.yml|release-pr.yml|release.yml|security.yml|test.yml) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+custom_workflows=()
+if [ -d .github/workflows ]; then
+  while IFS= read -r workflow; do
+    workflow="${workflow#./}"
+    workflow="${workflow#.github/workflows/}"
+    standard_workflow "$workflow" || custom_workflows+=("$workflow")
+  done < <(find .github/workflows -maxdepth 1 -type f -print | sort)
+fi
+if [ "${#custom_workflows[@]}" -gt 0 ]; then
+  printf 'Preserving custom workflows: %s\n' "${custom_workflows[*]}"
+fi
+
+changed=0
+for file in "${files[@]}"; do
+  template_file="$template_root/$file"
+  # npm renames .gitignore to .npmignore when installing a package. Treat the
+  # renamed file as the same template asset so packaged initialization works.
+  if [ "$file" = .gitignore ] && [ ! -f "$template_file" ] && [ -f "$template_root/.npmignore" ]; then
+    template_file="$template_root/.npmignore"
+  fi
+  if [ ! -f "$template_file" ]; then
+    echo "Template file missing: $file" >&2
+    exit 1
+  fi
+  if [ ! -f "$file" ] || ! cmp -s "$template_file" "$file"; then
+    changed=$((changed + 1))
+    if [ "$mode" = "check" ]; then
+      printf 'Would sync %s\n' "$file"
+    else
+      mkdir -p "$(dirname "$file")"
+      cp "$template_file" "$file"
+      case "$file" in
+        .githooks/*|.github/scripts/*) chmod +x "$file" ;;
+      esac
+      printf 'Synced %s\n' "$file"
+    fi
+  fi
+done
+
+for file in "${optional_files[@]}"; do
+  if [ ! -f "$file" ]; then
+    changed=$((changed + 1))
+    if [ "$mode" = "check" ]; then
+      printf 'Would initialize %s\n' "$file"
+    else
+      cp "$template_root/$file" "$file"
+      printf 'Initialized %s\n' "$file"
+    fi
+  fi
+done
+
+if [ "$mode" = "apply" ]; then
+  git config core.hooksPath .githooks
+  mkdir -p .github
+  cat > .github/template.yml <<EOF
+version: 1
+languages: $languages
+features: $features
+EOF
+fi
+
+if [ "$prune" = true ]; then
+  for workflow in ci codeql security test draft-pr release-pr release; do
+    file=".github/workflows/$workflow.yml"
+    if [ -f "$file" ] && ! workflow_enabled "$workflow"; then
+      changed=$((changed + 1))
+      if [ "$mode" = "check" ]; then
+        printf 'Would remove disabled standard workflow %s\n' "$file"
+      else
+        rm "$file"
+        printf 'Removed disabled standard workflow %s\n' "$file"
+      fi
+    fi
+  done
+fi
+
+printf '%s\n' "$changed baseline file(s) differ."

package/.github/template.yml.example

@@ -0,0 +1,5 @@
+# Repository-specific settings for the shared initializer and sync scripts.
+version: 1
+languages: auto
+features: all
+package_manager: auto

package/.github/workflows/ci.yml

@@ -0,0 +1,72 @@
+name: CI
+
+on:
+  push:
+    branches: [main, staging]
+  pull_request:
+    branches: [staging]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  format:
+    name: Format
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Setup
+        uses: ./.github/actions/setup
+        with:
+          install: true
+      - name: Format
+        run: bash .github/scripts/ci.sh format
+
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Setup
+        uses: ./.github/actions/setup
+        with:
+          install: true
+      - name: Lint
+        run: bash .github/scripts/ci.sh lint
+
+  type-check:
+    name: Type-Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Setup
+        uses: ./.github/actions/setup
+        with:
+          install: true
+      - name: Type-Check
+        run: bash .github/scripts/ci.sh type_check
+
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Setup
+        uses: ./.github/actions/setup
+        with:
+          install: true
+      - name: Build
+        run: bash .github/scripts/ci.sh build

package/.github/workflows/codeql.yml

@@ -0,0 +1,56 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main, staging]
+  pull_request:
+    branches: [staging]
+  schedule:
+    - cron: '31 6 * * 1'
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  packages: read
+  security-events: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  detect:
+    name: Detect
+    runs-on: ubuntu-latest
+    outputs:
+      languages: ${{ steps.languages.outputs.languages }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - id: languages
+        name: Detect languages
+        run: bash .github/scripts/codeql-languages.sh
+
+  analyze:
+    name: Analyze (${{ matrix.name }})
+    needs: detect
+    if: ${{ !github.event.repository.private }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      max-parallel: 4
+      matrix:
+        include: ${{ fromJSON(needs.detect.outputs.languages) }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Initialize
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+      - name: Analyze
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: /language:${{ matrix.language }}

package/.github/workflows/draft-pr.yml

@@ -0,0 +1,62 @@
+name: Draft PR
+
+on:
+  push:
+    branches:
+      - 'feat/*'
+      - 'fix/*'
+      - 'chore/*'
+      - 'refactor/*'
+      - 'docs/*'
+      - 'style/*'
+      - 'test/*'
+
+permissions:
+  contents: read
+  pull-requests: write
+
+env:
+  GH_TOKEN: ${{ github.token }}
+
+jobs:
+  create-draft-pr:
+    name: Create
+    runs-on: ubuntu-latest
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: true
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Check
+        id: check-pr
+        run: |
+          BRANCH="${{ github.ref_name }}"
+          EXISTING=$(gh pr list --base staging --head "$BRANCH" --state open --json number,title 2>/dev/null | jq 'length')
+          echo "existing=$EXISTING" >> "$GITHUB_OUTPUT"
+
+      - name: Create
+        if: steps.check-pr.outputs.existing == '0'
+        run: |
+          BRANCH="${{ github.ref_name }}"
+          gh pr create \
+            --base staging \
+            --head "$BRANCH" \
+            --draft \
+            --title "[WIP] $BRANCH" \
+            --body "Draft PR created automatically by CI.
+
+            This PR is a draft and should not be merged until CI passes and a reviewer (or the Daily Review agent) marks it ready.
+
+            **CI Status:** Pending — this workflow triggered on push to \`$BRANCH\`."
+
+      - name: Mark ready
+        if: steps.check-pr.outputs.existing == '0'
+        run: |
+          BRANCH="${{ github.ref_name }}"
+          PR_NUMBER=$(gh pr list --base staging --head "$BRANCH" --state open --json number 2>/dev/null | jq '.[0].number')
+          if [ -n "$PR_NUMBER" ]; then
+            gh pr ready "$PR_NUMBER"
+          fi

package/.github/workflows/publish.yml

@@ -0,0 +1,25 @@
+name: Publish Package
+
+on:
+  push:
+    tags: ['v*.*.*']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    name: Publish
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+      - name: Publish
+        run: npm publish --provenance --access public

package/.github/workflows/release-pr.yml

@@ -0,0 +1,61 @@
+name: Release PR
+
+on:
+  push:
+    branches: [staging]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+env:
+  GH_TOKEN: ${{ github.token }}
+
+jobs:
+  create-release-pr:
+    name: Create
+    runs-on: ubuntu-latest
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: true
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Check
+        id: check-pr
+        run: |
+          EXISTING=$(gh pr list --base main --head staging --state open --json number 2>/dev/null | jq 'length')
+          echo "existing=$EXISTING" >> "$GITHUB_OUTPUT"
+
+      - name: Create
+        if: steps.check-pr.outputs.existing == '0'
+        run: |
+          DATE=$(date +%Y-%m-%d)
+          BODY_FILE="$RUNNER_TEMP/release-pr.md"
+          COMMITS=$(git log --no-merges --pretty=format:'- %s (%h)' origin/main..HEAD)
+          if [ -z "$COMMITS" ]; then
+            COMMITS='- No commits found since main.'
+          fi
+
+          cat > "$BODY_FILE" <<EOF
+          ## Release summary
+
+          Automated release PR from \`staging\` into \`main\` created on $DATE.
+
+          ### Changes since main
+
+          $COMMITS
+
+          ### Validation
+
+          - CI and security checks must pass before merge.
+          - Review migrations, configuration changes, and rollback notes.
+          EOF
+
+          gh pr create \
+            --base main \
+            --head staging \
+            --title "Release: staging -> main ($DATE)" \
+            --body-file "$BODY_FILE"

package/.github/workflows/release.yml

@@ -0,0 +1,23 @@
+name: Release
+
+on:
+  push:
+    tags: ['v*.*.*']
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    name: Publish
+    runs-on: ubuntu-latest
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@v7
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release create "${GITHUB_REF_NAME}" --generate-notes --verify-tag

package/.github/workflows/security.yml

@@ -0,0 +1,38 @@
+name: Security
+
+on:
+  push:
+    branches: [main, staging]
+  pull_request:
+    branches: [staging]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  dependency-audit:
+    name: Dependency Audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Setup
+        uses: ./.github/actions/setup
+      - name: Audit dependencies
+        run: bash .github/scripts/security.sh
+
+  dependency-review:
+    name: Dependency Review
+    if: ${{ github.event_name == 'pull_request' && !github.event.repository.private }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Review
+        uses: actions/dependency-review-action@v5
+        with:
+          fail-on-severity: high
+          license-check: true

package/.github/workflows/test.yml

@@ -0,0 +1,84 @@
+name: Test
+
+on:
+  push:
+    branches: [main, staging]
+  pull_request:
+    branches: [staging]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  unit:
+    name: Unit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Setup
+        uses: ./.github/actions/setup
+        with:
+          install: true
+      - name: Unit
+        run: bash .github/scripts/ci.sh unit
+      - name: Upload coverage
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-unit-${{ github.run_id }}
+          path: |
+            coverage/**
+            htmlcov/**
+            .coverage*
+            target/llvm-cov/**
+          if-no-files-found: ignore
+          retention-days: 14
+
+  integration:
+    name: Integration
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Setup
+        uses: ./.github/actions/setup
+        with:
+          install: true
+      - name: Integration
+        run: bash .github/scripts/ci.sh integration
+
+  e2e:
+    name: E2E
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Setup
+        uses: ./.github/actions/setup
+        with:
+          install: true
+      - name: E2E
+        run: bash .github/scripts/ci.sh e2e
+
+  smoke:
+    name: Smoke
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Setup
+        uses: ./.github/actions/setup
+        with:
+          install: true
+      - name: Smoke
+        run: bash .github/scripts/ci.sh smoke