code-foundry 0.1.3 → 0.2.0

package/.github/scripts/doctor.sh

@@ -91,7 +91,7 @@ for workflow in ci codeql security test draft-pr release-pr release; do
   fi
 done
 
-for script in ci.sh codeql-languages.sh security.sh doctor.sh bootstrap.sh sync-template.sh init-repo.sh sync-protection.sh; do
+for script in ci.sh codeql-languages.sh profile.sh security.sh doctor.sh bootstrap.sh sync-template.sh init-repo.sh sync-protection.sh sync-codeowners.sh; do
   [ -x ".github/scripts/$script" ] || error "missing executable script: .github/scripts/$script"
 done
 

package/.github/scripts/format-fast-path.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Bootstrap only the formatter for Bun projects whose repository-owned format
+# script directly invokes Prettier. The workflow keeps a full-install fallback
+# because formatter configs may import arbitrary repository dependencies.
+
+set_output() {
+  printf '%s=%s\n' "$1" "$2" >> "${GITHUB_OUTPUT:-/dev/null}"
+}
+
+set_output hit false
+
+[ -f package.json ] || exit 0
+[ -f bun.lock ] || [ -f bun.lockb ] || exit 0
+
+project_profile="$(node <<'NODE'
+const fs = require('node:fs');
+const packageJson = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+process.stdout.write(Array.isArray(packageJson.workspaces) ||
+  (packageJson.workspaces && typeof packageJson.workspaces === 'object') ? 'workspace' : 'standalone');
+NODE
+)"
+lock_file='bun.lock'
+[ -f "$lock_file" ] || lock_file='bun.lockb'
+lock_bytes="$(wc -c < "$lock_file")"
+# A temporary npm formatter install has fixed overhead. For small standalone
+# projects, the normal Bun install is usually faster; workspace graphs and
+# larger lockfiles still benefit materially from avoiding their full tree.
+if [ "$project_profile" = standalone ] && [ "$lock_bytes" -le 524288 ]; then
+  exit 0
+fi
+
+format_script="$(node <<'NODE'
+const fs = require('node:fs');
+const packageJson = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+console.log(packageJson.scripts?.['format:check'] || packageJson.scripts?.format || '');
+NODE
+)"
+if ! grep -Eiq '(^|[[:space:];&|])prettier([[:space:]]|$)' <<<"$format_script" ||
+  grep -Eiq '(^|[[:space:];&|])turbo([[:space:]]|$)' <<<"$format_script"; then
+  exit 0
+fi
+
+prettier_version="$(node <<'NODE'
+const fs = require('node:fs');
+const packageJson = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+for (const group of [packageJson.devDependencies, packageJson.dependencies, packageJson.optionalDependencies]) {
+  const value = group?.prettier;
+  const match = typeof value === 'string' && value.match(/(\d+\.\d+\.\d+)/);
+  if (match) {
+    console.log(match[1]);
+    break;
+  }
+}
+NODE
+)"
+[ -n "$prettier_version" ] || exit 0
+
+tool_home="${RUNNER_TEMP:-/tmp}/repo-foundry-format"
+install_log="$(mktemp)"
+cleanup() { rm -f "$install_log"; }
+trap cleanup EXIT
+
+if ! npm install --prefix "$tool_home" --no-save --ignore-scripts --no-audit --no-fund \
+  "prettier@${prettier_version}" >"$install_log" 2>&1; then
+  echo 'Format Probe: formatter bootstrap unavailable; using full install'
+  exit 0
+fi
+
+tool_bin="$tool_home/node_modules/.bin"
+if [ ! -x "$tool_bin/prettier" ]; then
+  echo 'Format Probe: formatter binary unavailable; using full install'
+  exit 0
+fi
+
+echo "$tool_bin" >> "${GITHUB_PATH:-/dev/null}"
+printf 'REPO_FOUNDRY_FORMAT_FAST=true\n' >> "${GITHUB_ENV:-/dev/null}"
+echo "Format Probe: using Prettier ${prettier_version} without project install"
+set_output hit true

package/.github/scripts/init-repo.sh

@@ -1,15 +1,18 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-source="https://github.com/0xPlayerOne/repo-foundry.git"
+source="${REPO_FOUNDRY_SOURCE:-https://github.com/${GITHUB_REPOSITORY_OWNER:-OWNER}/code-foundry.git}"
 ref="main"
+profile="${REPO_FOUNDRY_PROFILE:-auto}"
 protection=false
 dry_run=false
 prune=false
-languages="auto"
-features="all"
-package_manager="auto"
+languages="${REPO_FOUNDRY_LANGUAGES:-auto}"
+features="${REPO_FOUNDRY_FEATURES:-all}"
+package_manager="${REPO_FOUNDRY_PACKAGE_MANAGER:-auto}"
 bootstrap=true
+release_type="${REPO_FOUNDRY_RELEASE_TYPE:-auto}"
+npm_publish="${REPO_FOUNDRY_NPM_PUBLISH:-false}"
 tool_dir=""
 
 cleanup() {
@@ -24,12 +27,15 @@ Usage: init-repo.sh [options]
 Initialize or synchronize a repository from the shared baseline.
 
 Options:
-  --source PATH_OR_URL       Template source (default: 0xPlayerOne/template-repo)
+  --source PATH_OR_URL       Template source (default: REPO_FOUNDRY_SOURCE or GitHub owner)
   --ref REF                  Template branch or tag (default: main)
+  --profile NAME             auto, application, monorepo, or minimal
   --languages LIST           auto or comma-separated: typescript,rust,python,solidity
   --features LIST            all or comma-separated optional features:
                              ci,codeql,security,test,draft-pr,release-pr,release,dependabot
   --package-manager NAME     auto, bun, pnpm, yarn, or npm
+  --release-type NAME        auto, node, python, rust, or simple
+  --npm-publish              Enable npm publication in the release workflow
   --dry-run                  Preview changes without writing files
   --prune                    Remove disabled standard workflows (never custom workflows)
   --protection               Synchronize main branch required checks
@@ -47,9 +53,12 @@ while [ "$#" -gt 0 ]; do
   case "$1" in
     --source) source="${2:?missing source path or URL}"; shift 2 ;;
     --ref) ref="${2:?missing ref}"; shift 2 ;;
+    --profile) profile="${2:?missing profile}"; shift 2 ;;
     --languages) languages="${2:?missing language list}"; shift 2 ;;
     --features) features="${2:?missing feature list}"; shift 2 ;;
     --package-manager) package_manager="${2:?missing package manager}"; shift 2 ;;
+    --release-type) release_type="${2:?missing release type}"; shift 2 ;;
+    --npm-publish) npm_publish=true; shift ;;
     --dry-run) dry_run=true; shift ;;
     --prune) prune=true; shift ;;
     --protection) protection=true; shift ;;
@@ -66,6 +75,10 @@ case "$package_manager" in
   auto|bun|pnpm|yarn|npm) ;;
   *) printf 'Unsupported package manager: %s\n' "$package_manager" >&2; exit 2 ;;
 esac
+case "$release_type" in
+  auto|node|python|rust|simple|none) ;;
+  *) printf 'Unsupported release type: %s\n' "$release_type" >&2; exit 2 ;;
+esac
 
 script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" 2>/dev/null && pwd || true)"
 if [ -f "$script_dir/sync-template.sh" ]; then
@@ -82,8 +95,10 @@ fi
 sync_args=(
   --source "$source"
   --ref "$ref"
+  --profile "$profile"
   --languages "$languages"
   --features "$features"
+  --package-manager "$package_manager"
 )
 if [ "$dry_run" = true ]; then sync_args+=(--check); else sync_args+=(--apply); fi
 if [ "$prune" = true ]; then sync_args+=(--prune); fi
@@ -95,12 +110,25 @@ if [ "$dry_run" = true ]; then
 fi
 
 mkdir -p .github
-cat > .github/template.yml <<EOF
-version: 1
-languages: $languages
-features: $features
-package_manager: $package_manager
-EOF
+template_ref="$(awk -F': ' '/^template:/ {print $2; exit}' .github/template.yml 2>/dev/null || true)"
+profile="$(awk -F': ' '/^profile:/ {print $2; exit}' .github/template.yml 2>/dev/null || true)"
+languages="$(awk -F': ' '/^languages:/ {print $2; exit}' .github/template.yml 2>/dev/null || true)"
+features="$(awk -F': ' '/^features:/ {print $2; exit}' .github/template.yml 2>/dev/null || true)"
+package_manager="$(awk -F': ' '/^package_manager:/ {print $2; exit}' .github/template.yml 2>/dev/null || true)"
+release_type="$(awk -F': ' '/^release_type:/ {print $2; exit}' .github/template.yml 2>/dev/null || true)"
+npm_publish="$(awk -F': ' '/^npm_publish:/ {print $2; exit}' .github/template.yml 2>/dev/null || true)"
+{
+  printf 'version: 1\n'
+  if [ -n "$template_ref" ]; then
+    printf 'template: %s\n' "$template_ref"
+  fi
+  printf 'profile: %s\n' "$profile"
+  printf 'languages: %s\n' "$languages"
+  printf 'features: %s\n' "$features"
+  printf 'package_manager: %s\n' "$package_manager"
+  printf 'release_type: %s\n' "$release_type"
+  printf 'npm_publish: %s\n' "$npm_publish"
+} > .github/template.yml
 
 if [ "$bootstrap" = false ]; then
   printf '%s\n' 'Bootstrap skipped.'

package/.github/scripts/profile.sh

@@ -0,0 +1,179 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Resolve repository settings with this precedence:
+# explicit REPO_FOUNDRY_* values (CLI callers can export them), then
+# .github/template.yml, then detected defaults.
+
+root="${REPO_FOUNDRY_ROOT:-$PWD}"
+command="detect"
+requested_key=""
+
+usage() {
+  cat <<'EOF'
+Usage: profile.sh [detect|env|get KEY] [--root PATH]
+
+Commands:
+  detect       Print the resolved profile as key=value lines (default)
+  env          Print REPO_FOUNDRY_* assignments
+  get KEY      Print one resolved profile value
+EOF
+}
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    detect|env) command="$1"; shift ;;
+    get) command=get; requested_key="${2:?missing profile key}"; shift 2 ;;
+    --root) root="${2:?missing root path}"; shift 2 ;;
+    -h|--help) usage; exit 0 ;;
+    *) printf 'Unknown option: %s\n' "$1" >&2; exit 2 ;;
+  esac
+done
+
+cd "$root"
+template_file=.github/template.yml
+
+config_value() {
+  local key="$1"
+  [ -f "$template_file" ] || return 0
+  awk -F': *' -v key="$key" '$1 == key { print substr($0, index($0, ":") + 1); exit }' "$template_file" |
+    sed -e 's/^ *//' -e 's/ *$//' -e 's/^['"'"'"]//' -e 's/['"'"'"]$//'
+}
+
+env_value() {
+  local key="$1" env_key
+  env_key="REPO_FOUNDRY_$(printf '%s' "$key" | tr '[:lower:]-' '[:upper:]_')"
+  if [ -n "${!env_key+x}" ] && [ -n "${!env_key}" ]; then
+    printf '%s\n' "${!env_key}"
+  fi
+}
+
+raw_value() {
+  local key="$1" default="${2:-}" value
+  value="$(env_value "$key" || true)"
+  [ -n "$value" ] || value="$(config_value "$key" || true)"
+  [ -n "$value" ] && printf '%s\n' "$value" || printf '%s\n' "$default"
+}
+
+has_source() {
+  find . -path './.git' -prune -o -type f -print |
+    awk -v pattern="(^|/)[^/]+\\.($1)$" '$0 ~ pattern { found=1; exit } END { exit !found }'
+}
+
+detect_languages() {
+  local detected=()
+  if [ -f package.json ] || has_source 'js|jsx|mjs|cjs|ts|tsx|mts|cts' ||
+    [ -f bun.lock ] || [ -f bun.lockb ] || [ -f pnpm-lock.yaml ] ||
+    [ -f yarn.lock ] || [ -f package-lock.json ]; then
+    detected+=(typescript)
+  fi
+  if [ -f Cargo.toml ] || has_source 'rs'; then detected+=(rust); fi
+  if [ -f pyproject.toml ] || [ -f requirements.txt ] || [ -f requirements-dev.txt ] || has_source 'py'; then
+    detected+=(python)
+  fi
+  if find . -path './.git' -prune -o -type f -name '*.sol' -print -quit | grep -q .; then
+    detected+=(solidity)
+  fi
+  (IFS=,; printf '%s\n' "${detected[*]:-none}")
+}
+
+detect_package_manager() {
+  if [ -f bun.lock ] || [ -f bun.lockb ]; then echo bun
+  elif [ -f pnpm-lock.yaml ]; then echo pnpm
+  elif [ -f yarn.lock ]; then echo yarn
+  elif [ -f package-lock.json ]; then echo npm
+  elif [ -f package.json ]; then echo bun
+  else echo none
+  fi
+}
+
+detect_profile() {
+  if [ -f turbo.json ] || [ -f pnpm-workspace.yaml ] ||
+    ( [ -f package.json ] && node -e 'const p=require("./package.json"); process.exit(Array.isArray(p.workspaces) || (p.workspaces && typeof p.workspaces === "object") ? 0 : 1)' 2>/dev/null ); then
+    echo monorepo
+  elif [ -f package.json ] || [ -f pyproject.toml ] || [ -f Cargo.toml ]; then
+    echo application
+  else
+    echo minimal
+  fi
+}
+
+resolve_languages() {
+  local value
+  value="$(raw_value languages auto)"
+  [ "$value" = auto ] && value="$(detect_languages)"
+  printf '%s\n' "$value"
+}
+
+resolve_profile() {
+  local value
+  value="$(raw_value profile auto)"
+  [ "$value" = auto ] && value="$(detect_profile)"
+  printf '%s\n' "$value"
+}
+
+resolve_package_manager() {
+  local value
+  value="$(raw_value package_manager auto)"
+  [ "$value" = auto ] && value="$(detect_package_manager)"
+  printf '%s\n' "$value"
+}
+
+resolve_release_type() {
+  local value
+  value="$(raw_value release_type auto)"
+  if [ "$value" = auto ]; then
+    if [ -f package.json ]; then value=node
+    elif [ -f pyproject.toml ]; then value=python
+    elif [ -f Cargo.toml ]; then value=rust
+    elif [ -f version.txt ]; then value=simple
+    else value=none
+    fi
+  fi
+  printf '%s\n' "$value"
+}
+
+resolve_npm_publish() {
+  local value release_type
+  value="$(raw_value npm_publish false)"
+  release_type="$(resolve_release_type)"
+  [ "$release_type" = node ] || value=false
+  printf '%s\n' "$value"
+}
+
+detect() {
+  local profile languages package_manager release_type npm_publish features runner unit_runner
+  profile="$(resolve_profile)"
+  languages="$(resolve_languages)"
+  package_manager="$(resolve_package_manager)"
+  release_type="$(resolve_release_type)"
+  npm_publish="$(resolve_npm_publish)"
+  features="$(raw_value features all)"
+  runner="$(raw_value runner ubuntu-latest)"
+  unit_runner="$(raw_value unit_runner ubuntu-slim)"
+  printf 'profile=%s\n' "$profile"
+  printf 'languages=%s\n' "$languages"
+  printf 'features=%s\n' "$features"
+  printf 'package_manager=%s\n' "$package_manager"
+  printf 'release_type=%s\n' "$release_type"
+  printf 'npm_publish=%s\n' "$npm_publish"
+  printf 'runner=%s\n' "$runner"
+  printf 'unit_runner=%s\n' "$unit_runner"
+  printf 'cache_packages=%s\n' "$(raw_value cache_packages auto)"
+  printf 'cache_build=%s\n' "$(raw_value cache_build auto)"
+  printf 'coverage_minimum=%s\n' "$(raw_value coverage_minimum 80)"
+  printf 'turbo_remote=%s\n' "$(raw_value turbo_remote auto)"
+}
+
+case "$command" in
+  detect) detect ;;
+  get)
+    detect | awk -F= -v key="$requested_key" '$1 == key { print substr($0, index($0, "=") + 1); found=1 } END { exit !found }'
+    ;;
+  env)
+    detect | while IFS='=' read -r key value; do
+      env_key="REPO_FOUNDRY_$(printf '%s' "$key" | tr '[:lower:]-' '[:upper:]_')"
+      printf '%s=%q\n' "$env_key" "$value"
+    done
+    ;;
+esac

package/.github/scripts/security.sh

@@ -1,9 +1,116 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+source .github/scripts/changed-files.sh
+
+has_javascript_dependencies() {
+  [ -f bun.lock ] || [ -f bun.lockb ] || [ -f pnpm-lock.yaml ] ||
+    [ -f yarn.lock ] || [ -f package-lock.json ] ||
+    { [ -f package.json ] && node -e 'const p=require("./package.json"); const groups=[p.dependencies,p.devDependencies,p.optionalDependencies,p.peerDependencies]; process.exit(groups.some((g)=>g && Object.keys(g).length) ? 0 : 1)' 2>/dev/null; }
+}
+
+has_python_manifest() {
+  [ -f pyproject.toml ] || [ -f uv.lock ] ||
+    git ls-files | grep -Eq '(^|/)requirements[^/]*\.txt$'
+}
+
+has_dependency_manifest() {
+  has_javascript_dependencies || [ -f Cargo.toml ] || has_python_manifest
+}
+
+should_run() {
+  if repo_foundry_governance_only; then
+    printf '%s\n' 'applicable=false'
+    return 0
+  fi
+  if repo_foundry_pr_dependencies_unchanged "${1:-all}"; then
+    return 1
+  fi
+  case "${1:-all}" in
+    javascript) has_javascript_dependencies || return 1 ;;
+    rust) [ -f Cargo.toml ] || return 1 ;;
+    python) has_python_manifest || return 1 ;;
+    all) has_dependency_manifest || return 1 ;;
+    *) echo "unknown ecosystem: ${1:-}" >&2; return 2 ;;
+  esac
+  printf '%s\n' 'applicable=true'
+}
+
+if [ "${1:-audit}" = should_run ]; then
+  if should_run "${2:-all}"; then
+    exit 0
+  else
+    status=$?
+    [ "$status" -eq 1 ] && printf '%s\n' 'applicable=false' && exit 0
+    exit "$status"
+  fi
+fi
+
+if [ "${1:-}" = profile ]; then
+  python_requirements='["none"]'
+  if has_python_manifest && ! repo_foundry_governance_only && ! repo_foundry_pr_dependencies_unchanged python; then
+    python_requirements="$(
+      git ls-files -z '*requirements*.txt' |
+        node -e 'let data=""; process.stdin.on("data", (chunk) => { data += chunk; }).on("end", () => process.stdout.write(JSON.stringify(data.split("\0").filter(Boolean))));'
+    )"
+    [ "$python_requirements" = "[]" ] && python_requirements='["project"]'
+  fi
+  for ecosystem in javascript rust python; do
+    if should_run "$ecosystem"; then
+      printf '%s=true\n' "$ecosystem"
+    else
+      status=$?
+      [ "$status" -eq 1 ] && printf '%s=false\n' "$ecosystem" && continue
+      exit "$status"
+    fi
+  done
+  printf 'python_requirements=%s\n' "$python_requirements"
+  exit 0
+fi
+
+mode="${1:-audit}"
+if [ "$mode" = audit ] && [ -n "${2:-}" ]; then mode="$2"; fi
+case "$mode" in
+  audit|all|javascript|rust|python) ;;
+  *)
+    echo "usage: $0 [audit|should_run] [javascript|rust|python|all]" >&2
+    exit 2
+    ;;
+esac
+
 audits=0
 
+wait_for_parallel() {
+  local status=0 pid
+  for pid in "$@"; do
+    if ! wait "$pid"; then status=1; fi
+  done
+  return "$status"
+}
+
+run_parallel() {
+  local status=0 pid task
+  local -a pids=()
+  for task in "$@"; do
+    "$task" &
+    pids+=("$!")
+  done
+  for pid in "${pids[@]}"; do
+    if ! wait "$pid"; then status=1; fi
+  done
+  return "$status"
+}
+
 package_manager() {
+  local configured=""
+  if [ -x .github/scripts/profile.sh ]; then
+    configured="$(bash .github/scripts/profile.sh get package_manager 2>/dev/null || true)"
+  elif [ -f .github/template.yml ]; then
+    configured="$(awk -F': ' '/^package_manager:/ {print $2; exit}' .github/template.yml)"
+  fi
+  case "$configured" in
+    bun|pnpm|yarn|npm) echo "$configured"; return ;;
+  esac
   if [ -f bun.lock ] || [ -f bun.lockb ]; then echo bun
   elif [ -f pnpm-lock.yaml ]; then echo pnpm
   elif [ -f yarn.lock ]; then echo yarn
@@ -12,7 +119,11 @@ package_manager() {
   fi
 }
 
-if [ -f package.json ]; then
+audit_javascript() {
+  if ! has_javascript_dependencies; then
+    echo "Skipping JavaScript/TypeScript audit (dependency inputs not found)"
+    return
+  fi
   audit_args=(--audit-level=high)
   if [ -f .github/security-audit-allowlist.txt ]; then
     while IFS= read -r advisory; do
@@ -26,26 +137,75 @@ if [ -f package.json ]; then
     yarn) audits=$((audits + 1)); corepack yarn npm audit --all --recursive ;;
     npm) audits=$((audits + 1)); npm audit --audit-level=high ;;
   esac
-else
-  echo "Skipping JavaScript/TypeScript audit (package.json not found)"
-fi
+}
 
-if [ -f Cargo.toml ]; then
-  audits=$((audits + 1))
-  if ! command -v cargo-audit >/dev/null 2>&1; then cargo install cargo-audit --locked --quiet; fi
-  cargo audit
-else
-  echo "Skipping Rust audit (Cargo.toml not found)"
-fi
+audit_rust() {
+  if [ -f Cargo.toml ]; then
+    audits=$((audits + 1))
+    if ! command -v cargo-audit >/dev/null 2>&1; then cargo install cargo-audit --locked --quiet; fi
+    cargo audit
+  else
+    echo "Skipping Rust audit (Cargo.toml not found)"
+  fi
+}
+
+audit_python() {
+  local pip_audit_version='2.10.1'
+  requirement_files=()
+  if [ -n "${REPO_FOUNDRY_PYTHON_REQUIREMENT:-}" ] && [ "$REPO_FOUNDRY_PYTHON_REQUIREMENT" != project ] && [ "$REPO_FOUNDRY_PYTHON_REQUIREMENT" != none ]; then
+    if ! git ls-files --error-unmatch -- "${REPO_FOUNDRY_PYTHON_REQUIREMENT}" >/dev/null 2>&1; then
+      echo "Python requirement file is not tracked: ${REPO_FOUNDRY_PYTHON_REQUIREMENT}" >&2
+      return 1
+    fi
+    requirement_files+=( "$REPO_FOUNDRY_PYTHON_REQUIREMENT" )
+  else
+    while IFS= read -r requirement_file; do
+      [ -n "$requirement_file" ] && requirement_files+=( "$requirement_file" )
+    done < <(git ls-files '*requirements*.txt')
+  fi
+  if [ "${#requirement_files[@]}" -gt 0 ] || [ -f pyproject.toml ]; then
+    audits=$((audits + 1))
+    if command -v uv >/dev/null 2>&1; then
+      local uv_audit_cache="${REPO_FOUNDRY_UV_AUDIT_CACHE:-$HOME/.cache/uv-audit}"
+      pip_audit() {
+        if [ "${REPO_FOUNDRY_UV_AUDIT_OFFLINE:-false}" = true ]; then
+          if UV_CACHE_DIR="$uv_audit_cache" uv tool run --offline --from "pip-audit==${pip_audit_version}" pip-audit "$@"; then
+            return 0
+          fi
+          echo 'Offline pip-audit cache was incomplete; retrying online.' >&2
+        fi
+        REPO_FOUNDRY_UV_AUDIT_OFFLINE=false UV_CACHE_DIR="$uv_audit_cache" uv tool run --from "pip-audit==${pip_audit_version}" pip-audit "$@"
+      }
+    else
+      python -m pip install --disable-pip-version-check --quiet "pip-audit==${pip_audit_version}"
+      pip_audit() { python -m pip_audit "$@"; }
+    fi
+    if [ "${#requirement_files[@]}" -gt 0 ]; then
+      pids=()
+      for requirement_file in "${requirement_files[@]}"; do
+        pip_audit -r "$requirement_file" &
+        pids+=( "$!" )
+      done
+      wait_for_parallel "${pids[@]}"
+    else
+      pip_audit
+    fi
+  else
+    echo "Skipping Python audit (Python dependency manifest not found)"
+  fi
+}
+
+case "$mode" in
+  audit|all)
+    run_parallel audit_javascript audit_rust audit_python
+    ;;
+  javascript) audit_javascript ;;
+  rust) audit_rust ;;
+  python) audit_python ;;
+esac
 
-if [ -f requirements.txt ] || [ -f requirements-dev.txt ] || [ -f pyproject.toml ]; then
-  audits=$((audits + 1))
-  python -m pip install --disable-pip-version-check --quiet pip-audit
-  if [ -f requirements.txt ]; then python -m pip_audit -r requirements.txt; fi
-  if [ -f requirements-dev.txt ]; then python -m pip_audit -r requirements-dev.txt; fi
-  if [ -f pyproject.toml ] && [ ! -f requirements.txt ] && [ ! -f requirements-dev.txt ]; then python -m pip_audit; fi
-else
-  echo "Skipping Python audit (Python dependency manifest not found)"
+if [ "$audits" -eq 0 ] && ! has_dependency_manifest; then
+  echo "No supported dependency manifests found; nothing to audit"
 fi
 
-if [ "$audits" -eq 0 ]; then echo "No supported dependency manifests found; nothing to audit"; fi
+exit 0

package/.github/scripts/sync-codeowners.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+mode=check
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --check) mode=check; shift ;;
+    --apply) mode=apply; shift ;;
+    -h|--help)
+      printf '%s\n' 'Usage: sync-codeowners.sh [--check|--apply]'
+      exit 0
+      ;;
+    *) printf 'Unknown option: %s\n' "$1" >&2; exit 2 ;;
+  esac
+done
+
+codeowners_file=.github/CODEOWNERS
+mkdir -p .github
+remote="$(git remote get-url origin 2>/dev/null || true)"
+repo="$(printf '%s\n' "$remote" | sed -E 's#.*github.com[:/]([^/]+/[^/.]+)(\.git)?$#\1#')"
+owners=()
+
+if [ -n "$repo" ] && command -v gh >/dev/null 2>&1; then
+  owner_json="$(gh repo view "$repo" --json owner 2>/dev/null || true)"
+  owner_login="$(jq -r '.owner.login // empty' <<< "$owner_json" 2>/dev/null || true)"
+  owner_type="$(jq -r '.owner.type // empty' <<< "$owner_json" 2>/dev/null || true)"
+  if [ "$owner_type" = User ] && [ -n "$owner_login" ]; then
+    owners+=("@$owner_login")
+  fi
+  admins="$(gh api --paginate "repos/$repo/collaborators?per_page=100" \
+    --jq '.[] | select(.permissions.admin == true) | .login' 2>/dev/null || true)"
+  while IFS= read -r admin; do
+    [ -n "$admin" ] && owners+=("@$admin")
+  done <<< "$admins"
+fi
+
+if [ "${#owners[@]}" -gt 0 ]; then
+  owner_line="$(printf '%s\n' "${owners[@]}" | awk '!seen[$0]++' | paste -sd ' ' -)"
+else
+  owner_line='@OWNER'
+  printf '%s\n' 'GitHub owner/admin discovery unavailable; retaining @OWNER placeholder.' >&2
+fi
+
+existing_file=""
+if [ -f "$codeowners_file" ]; then
+  existing_file="$(mktemp)"
+  cp "$codeowners_file" "$existing_file"
+fi
+
+if [ "$mode" = check ]; then
+  if [ -f "$codeowners_file" ] && grep -q "^\* $owner_line$" "$codeowners_file"; then
+    printf '%s\n' 'CODEOWNERS is current.'
+  else
+    printf 'Would update %s with %s\n' "$codeowners_file" "$owner_line"
+  fi
+  [ -n "$existing_file" ] && unlink "$existing_file"
+  exit 0
+fi
+
+tmp_file="$(mktemp)"
+{
+  printf '%s\n' '# Managed by code-foundry. Repository owners/admins are discovered during initialization.'
+  printf '* %s\n' "$owner_line"
+  if [ -n "$existing_file" ]; then
+    awk '
+      /^# Managed by code-foundry\./ { managed=1; next }
+      managed && /^\* / { managed=0; next }
+      managed { next }
+      /^\* @(OWNER|[^[:space:]]+)/ { next }
+      { print }
+    ' "$existing_file"
+  fi
+} > "$tmp_file"
+mv "$tmp_file" "$codeowners_file"
+[ -n "$existing_file" ] && unlink "$existing_file"
+printf 'Updated %s with %s\n' "$codeowners_file" "$owner_line"