code-foundry 0.1.0

package/README.md

@@ -0,0 +1,94 @@
+# Repo Foundry
+
+`repo-foundry` is a repository factory for TypeScript, Rust, Python, Solidity,
+and mixed-language projects. It installs agent-ready instructions, fast native
+testing, security automation, release workflows, hooks, and repository policy
+from one versioned package.
+
+## Quick start
+
+```bash
+npx repo-foundry init
+```
+
+Or select the project profile explicitly:
+
+```bash
+npx repo-foundry init \
+  --languages typescript,python \
+  --features all \
+  --package-manager bun
+```
+
+Use `repo-foundry sync` to update an existing repository and
+`repo-foundry doctor` to validate it. Add `--dry-run` to preview changes.
+
+## Setup
+
+1. Install [mise](https://mise.jdx.dev/).
+2. Run `bash .github/scripts/bootstrap.sh` to install the pinned toolchain, enable hooks, and validate the repository.
+3. Add the repository's standard scripts (`format:check`, `lint`, `type-check`, `build`, `test:unit`, `test:integration`, `test:e2e`, and `test:smoke`) when available. The shared scripts also recognize legacy aliases and skip checks that do not apply to the repository's languages or package manager.
+
+## Applying the baseline to an existing repository
+
+Run the sync script from the repository root. It updates shared workflows, GitHub forms, hooks, policy files, and tool configuration while preserving the repository's README, `.mise.toml` selections, extra workflows, and application code.
+
+```bash
+bash .github/scripts/init-repo.sh
+```
+
+Use `bash .github/scripts/sync-template.sh --source ... --check` to preview differences. For local template development, pass the template checkout as `--source` and `--ref staging`.
+
+The initializer is intentionally flag-driven so the same baseline can be used as a small repository package. Language selection controls CodeQL and records the repository profile; feature selection controls which standard workflows are installed. `auto` detects supported languages, while `all` enables every standard workflow.
+
+```bash
+# Preview a TypeScript + Python repository without changing files
+bash .github/scripts/init-repo.sh \
+  --languages typescript,python \
+  --features all \
+  --dry-run
+
+# Initialize a Rust repository with only the core automation
+bash .github/scripts/init-repo.sh \
+  --languages rust \
+  --features ci,codeql,security,test
+```
+
+Supported languages are `typescript`, `rust`, `python`, and `solidity`. Supported feature flags are `ci`, `codeql`, `security`, `test`, `draft-pr`, `release-pr`, `release`, and `dependabot`. Use `--prune` only when you explicitly want disabled standard workflows removed; custom workflows are always preserved. The selected profile is stored in `.github/template.yml`, which makes later syncs repeatable and lets workflows consume repository-specific settings without duplicating the template scripts.
+
+For a repository that does not yet contain the scripts, the initializer can be invoked directly from the published template checkout or a downloaded copy of `init-repo.sh`; it fetches the matching sync helper automatically. The generated `.github/template.yml` is the stable configuration contract for a future npm/package wrapper around these same operations.
+
+Branch protection is an administrator operation and is opt-in:
+
+```bash
+bash .github/scripts/init-repo.sh --protection
+```
+
+The protection helper preserves unrelated provider checks, replaces stale template check names, and skips CodeQL analysis checks for private repositories where the workflow is intentionally skipped.
+
+The repository name, owner, branch names, and release metadata are resolved by GitHub Actions at runtime through `${{ github.* }}` values. Keep organization-specific details out of this baseline.
+
+CI and hooks use Prettier and ESLint for JavaScript/TypeScript, default `rustfmt` and Clippy with warnings-as-errors for Rust, and Ruff formatting/linting for Python.
+
+Coverage is enforced at 80% for Python and Bun test suites when those ecosystems expose coverage support. Rust projects must keep their native test suites green; repositories with `cargo-llvm-cov` should enforce the same 80% line target in their Cargo coverage configuration.
+
+## Test runner standard
+
+For TypeScript and JavaScript tests, use Bun's native test runner by default. Do not add Vitest to projects based on this template. Preserve specialized native runners such as Matchstick for The Graph and Hardhat for smart contracts.
+
+## Optional Turborepo remote caching
+
+Turborepo repositories can use Vercel Remote Caching without changing the workflows. Add these repository settings:
+
+- Secret: `TURBO_TOKEN`
+- Repository variable: `TURBO_TEAM`
+
+CI and Test pass those values to every job. Non-Turborepo repositories and repositories without the settings simply use their normal local cache behavior. This does not require the repository to deploy to Vercel.
+
+## License
+
+Unless a repository says otherwise, new material is licensed under the GNU Affero General Public License v3.0-or-later. See [LICENSE](LICENSE) and [NOTICE](NOTICE).
+
+## GitHub security behavior
+
+The CodeQL workflow uses GitHub's official CodeQL actions, detects Actions, TypeScript, Python, and Rust automatically, and runs each language in parallel. It runs automatically for public repositories and skips itself for private repositories unless GitHub Code Security is enabled. Dependency Review is isolated in the Security workflow and runs only for public pull requests.

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "code-foundry",
+  "version": "0.1.0",
+  "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
+  "type": "module",
+  "license": "AGPL-3.0-or-later",
+  "packageManager": "bun@1.3.14",
+  "bin": {
+    "code-foundry": "src/cli.mjs"
+  },
+  "files": [
+    "src",
+    ".github",
+    ".githooks",
+    ".editorconfig",
+    ".gitattributes",
+    ".gitignore",
+    ".mise.toml",
+    ".prettierrc",
+    ".env.example",
+    "AGENTS.md",
+    "LICENSE",
+    "NOTICE",
+    "README.md",
+    "ruff.toml"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "node --check src/cli.mjs",
+    "format:check": "node --check src/cli.mjs",
+    "lint": "node --check src/cli.mjs",
+    "test": "node --check src/cli.mjs",
+    "type-check": "node --check src/cli.mjs",
+    "pack:check": "npm pack --dry-run",
+    "prepublishOnly": "npm test && npm run pack:check"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/ruff.toml

@@ -0,0 +1,6 @@
+target-version = "py311"
+line-length = 100
+
+[lint]
+select = ["E", "F", "W", "I", "UP", "B", "SIM"]
+ignore = ["E501"]

package/src/cli.mjs

@@ -0,0 +1,134 @@
+#!/usr/bin/env node
+
+import { existsSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { fileURLToPath } from 'node:url'
+
+const packageRoot = resolve(fileURLToPath(new URL('..', import.meta.url)))
+
+const usage = `repo-foundry — initialize and maintain agent-ready repositories
+
+Usage:
+  repo-foundry init [options]
+  repo-foundry sync [options]
+  repo-foundry doctor [--target PATH]
+
+Init/sync options:
+  --target PATH             Repository directory (default: current directory)
+  --source PATH_OR_URL      Template source override
+  --ref REF                 Template branch or tag (default: main)
+  --languages LIST          auto or typescript,rust,python,solidity
+  --features LIST           all or ci,codeql,security,test,draft-pr,release-pr,release,dependabot
+  --package-manager NAME    auto, bun, pnpm, yarn, or npm
+  --dry-run                 Preview changes without writing files
+  --prune                   Remove disabled standard workflows
+  --protection              Synchronize main branch protections (init only)
+  --no-bootstrap            Skip mise/hooks/doctor bootstrap after init
+  -h, --help                Show this help
+`
+
+function fail(message) {
+  console.error(`repo-foundry: ${message}`)
+  process.exit(2)
+}
+
+function parseArgs(argv) {
+  const command = argv[0] && !argv[0].startsWith('-') ? argv.shift() : 'init'
+  const options = {
+    target: process.cwd(),
+    source: packageRoot,
+    ref: 'main',
+    languages: 'auto',
+    features: 'all',
+    packageManager: 'auto',
+    dryRun: false,
+    prune: false,
+    protection: false,
+    bootstrap: true,
+  }
+  const values = new Map([
+    ['--target', 'target'],
+    ['--source', 'source'],
+    ['--ref', 'ref'],
+    ['--languages', 'languages'],
+    ['--features', 'features'],
+    ['--package-manager', 'packageManager'],
+  ])
+
+  while (argv.length) {
+    const arg = argv.shift()
+    if (arg === '-h' || arg === '--help') {
+      console.log(usage)
+      process.exit(0)
+    }
+    if (values.has(arg)) {
+      const value = argv.shift()
+      if (!value || value.startsWith('-')) fail(`${arg} requires a value`)
+      options[values.get(arg)] = value
+      continue
+    }
+    if (arg === '--dry-run') options.dryRun = true
+    else if (arg === '--prune') options.prune = true
+    else if (arg === '--protection') options.protection = true
+    else if (arg === '--no-bootstrap') options.bootstrap = false
+    else fail(`unknown option: ${arg}`)
+  }
+
+  return { command, options }
+}
+
+function run(script, args, target) {
+  const scriptPath = resolve(packageRoot, '.github/scripts', script)
+  if (!existsSync(scriptPath)) fail(`package is missing ${script}`)
+  const result = spawnSync('bash', [scriptPath, ...args], {
+    cwd: target,
+    stdio: 'inherit',
+    env: process.env,
+  })
+  if (result.error) fail(result.error.message)
+  if (result.status !== 0) process.exit(result.status ?? 1)
+}
+
+function main() {
+  const { command, options } = parseArgs(process.argv.slice(2))
+  const target = resolve(options.target)
+  const common = [
+    '--source', options.source,
+    '--ref', options.ref,
+    '--languages', options.languages,
+    '--features', options.features,
+  ]
+  if (options.prune) common.push('--prune')
+  if (options.dryRun) common.push('--check')
+  else common.push('--apply')
+
+  if (command === 'init') {
+    const initArgs = [...common]
+    if (options.protection) initArgs.push('--protection')
+    if (!options.bootstrap) {
+      // The shell initializer is intentionally composable; sync first and let
+      // callers run bootstrap separately when installing into a CI image.
+      run('sync-template.sh', initArgs, target)
+    } else {
+      run('init-repo.sh', [
+        '--source', options.source,
+        '--ref', options.ref,
+        '--languages', options.languages,
+        '--features', options.features,
+        '--package-manager', options.packageManager,
+        ...(options.dryRun ? ['--dry-run'] : []),
+        ...(options.prune ? ['--prune'] : []),
+        ...(options.protection ? ['--protection'] : []),
+      ], target)
+    }
+  } else if (command === 'sync') {
+    run('sync-template.sh', common, target)
+  } else if (command === 'doctor') {
+    run('doctor.sh', [], target)
+  } else {
+    fail(`unknown command: ${command}`)
+  }
+}
+
+main()