code-foundry 0.1.3 → 0.2.0

package/.github/scripts/sync-protection.sh

@@ -49,13 +49,19 @@ done
 command -v gh >/dev/null 2>&1 || { echo "gh is required" >&2; exit 1; }
 
 is_private="$(gh repo view "$repo" --json isPrivate --jq '.isPrivate')"
+code_security_status="disabled"
+if [ "$is_private" = true ]; then
+  code_security_status="$(gh api "repos/$repo" --jq '.security_and_analysis.code_security.status // "disabled"' 2>/dev/null || printf 'disabled')"
+fi
 contexts=()
 if feature_enabled ci; then contexts+=(Format Lint Type-Check Build); fi
 if feature_enabled test; then contexts+=(Unit Integration E2E Smoke); fi
-if feature_enabled security; then contexts+=('Dependency Audit'); fi
+if feature_enabled security; then
+  contexts+=(Profile 'Dependency Audit (JavaScript)' 'Dependency Audit (Rust)' 'Dependency Audit (Python)')
+fi
 if feature_enabled codeql; then contexts+=(Detect); fi
 
-if [ "$is_private" != true ] && feature_enabled codeql; then
+if { [ "$is_private" != true ] || [ "$code_security_status" = enabled ]; } && feature_enabled codeql; then
   contexts+=("Analyze (Actions)")
   if language_enabled typescript && git ls-files -- '*.ts' '*.tsx' '*.js' '*.jsx' package.json tsconfig\*.json | grep -q .; then contexts+=("Analyze (TypeScript)"); fi
   if language_enabled python && git ls-files -- '*.py' pyproject.toml requirements\*.txt setup.py ':!.github/**' | grep -q .; then contexts+=("Analyze (Python)"); fi
@@ -77,6 +83,13 @@ while IFS= read -r context; do
   [ -n "$context" ] || continue
   case "$context" in
     'Slither / Analyze') continue ;; # removed from the standard workflow set
+    # Remove both the current concise job names and older workflow-prefixed
+    # names before rebuilding the standard set. This prevents stale required
+    # checks from remaining required after a repository changes visibility or
+    # template version.
+    'Dependency Audit'|'Dependency Audit ('*|'Profile'|'Test Profile'|\
+    'Format'|'Lint'|'Type-Check'|'Build'|'Unit'|'Integration'|'E2E'|'Smoke'|\
+    'Detect'|'Analyze'|'Analyze ('*|\
     'CI / '*|'Test / '*|'Security / '*|'CodeQL / '*) ;;
     *) preserved+=("$context") ;;
   esac

package/.github/scripts/sync-template.sh

@@ -9,8 +9,10 @@ Synchronize the repository-owned baseline without replacing project-specific
 README files, mise tool selections, or additional workflows.
 
 Options:
+  --profile NAME    auto, application, monorepo, or minimal
   --languages LIST  auto or comma-separated: typescript,rust,python,solidity
   --features LIST   all or comma-separated standard features
+  --package-manager NAME  auto, bun, pnpm, yarn, or npm
   --check           Preview changes (default)
   --apply           Apply changes
   --prune           Remove disabled standard workflows
@@ -21,17 +23,39 @@ source_ref="main"
 mode="check"
 source=""
 temp_dir=""
-languages="auto"
-features="all"
+profile="${REPO_FOUNDRY_PROFILE:-auto}"
+languages="${REPO_FOUNDRY_LANGUAGES:-auto}"
+features="${REPO_FOUNDRY_FEATURES:-all}"
 prune=false
 languages_set=false
+profile_set=false
 features_set=false
-package_manager=""
+[ -n "${REPO_FOUNDRY_LANGUAGES:-}" ] && languages_set=true
+[ -n "${REPO_FOUNDRY_PROFILE:-}" ] && profile_set=true
+[ -n "${REPO_FOUNDRY_FEATURES:-}" ] && features_set=true
+package_manager="${REPO_FOUNDRY_PACKAGE_MANAGER:-}"
+package_manager_set=false
+[ -n "${REPO_FOUNDRY_PACKAGE_MANAGER:-}" ] && package_manager_set=true
+template_ref=""
+release_type="${REPO_FOUNDRY_RELEASE_TYPE:-auto}"
+npm_publish="${REPO_FOUNDRY_NPM_PUBLISH:-false}"
+release_type_set=false
+npm_publish_set=false
+[ -n "${REPO_FOUNDRY_RELEASE_TYPE:-}" ] && release_type_set=true
+[ -n "${REPO_FOUNDRY_NPM_PUBLISH:-}" ] && npm_publish_set=true
+node_version="24.18.0"
+bun_version="1.3.14"
+python_version="3.13"
+rust_version="1.97.1"
+uv_version="0.11.32"
+ruff_version="0.16.0"
 gitignore_backup=""
 custom_ignores=""
 
 valid_languages="typescript rust python solidity"
 valid_features="ci codeql security test draft-pr release-pr release dependabot"
+valid_profiles="auto application monorepo minimal"
+valid_release_types="auto node python rust simple none"
 
 contains_word() {
   case " $1 " in *" $2 "*) return 0 ;; *) return 1 ;; esac
@@ -68,8 +92,10 @@ while [ "$#" -gt 0 ]; do
   case "$1" in
     --source) source="${2:?missing source path or URL}"; shift 2 ;;
     --ref) source_ref="${2:?missing ref}"; shift 2 ;;
+    --profile) profile="${2:?missing profile}"; profile_set=true; shift 2 ;;
     --languages) languages="${2:?missing language list}"; languages_set=true; shift 2 ;;
     --features) features="${2:?missing feature list}"; features_set=true; shift 2 ;;
+    --package-manager) package_manager="${2:?missing package manager}"; package_manager_set=true; shift 2 ;;
     --check) mode="check"; shift ;;
     --apply) mode="apply"; shift ;;
     --prune) prune=true; shift ;;
@@ -80,6 +106,10 @@ done
 
 [ -n "$source" ] || { usage >&2; exit 2; }
 if [ -f .github/template.yml ]; then
+  if [ "$profile_set" = false ]; then
+    configured_profile="$(awk -F': ' '/^profile:/ {print $2; exit}' .github/template.yml)"
+    [ -n "$configured_profile" ] && profile="$configured_profile"
+  fi
   if [ "$languages_set" = false ]; then
     configured_languages="$(awk -F': ' '/^languages:/ {print $2; exit}' .github/template.yml)"
     [ -n "$configured_languages" ] && languages="$configured_languages"
@@ -88,10 +118,34 @@ if [ -f .github/template.yml ]; then
     configured_features="$(awk -F': ' '/^features:/ {print $2; exit}' .github/template.yml)"
     [ -n "$configured_features" ] && features="$configured_features"
   fi
-  package_manager="$(awk -F': ' '/^package_manager:/ {print $2; exit}' .github/template.yml)"
+  if [ "$package_manager_set" = false ]; then
+    package_manager="$(awk -F': ' '/^package_manager:/ {print $2; exit}' .github/template.yml)"
+  fi
+  template_ref="$(awk -F': ' '/^template:/ {print $2; exit}' .github/template.yml)"
+  if [ "$release_type_set" != true ]; then
+    configured_release_type="$(awk -F': ' '/^release_type:/ {print $2; exit}' .github/template.yml)"
+    [ -n "$configured_release_type" ] && release_type="$configured_release_type"
+  fi
+  if [ "$npm_publish_set" != true ]; then
+    configured_npm_publish="$(awk -F': ' '/^npm_publish:/ {print $2; exit}' .github/template.yml)"
+    [ -n "$configured_npm_publish" ] && npm_publish="$configured_npm_publish"
+  fi
 fi
+[ -n "$package_manager" ] || package_manager=auto
+case "$package_manager" in
+  auto|bun|pnpm|yarn|npm) ;;
+  *) printf 'Unsupported package manager: %s\n' "$package_manager" >&2; exit 2 ;;
+esac
 validate_list language "$languages" "$valid_languages"
 validate_list feature "$features" "$valid_features"
+contains_word "$valid_profiles" "$profile" || {
+  printf 'Unsupported profile: %s\n' "$profile" >&2
+  exit 2
+}
+contains_word "$valid_release_types" "$release_type" || {
+  printf 'Unsupported release type: %s\n' "$release_type" >&2
+  exit 2
+}
 
 if [ -d "$source" ] && [ -f "$source/.github/scripts/sync-template.sh" ]; then
   template_root="$source"
@@ -102,10 +156,36 @@ else
   template_root="$temp_dir/template-repo"
 fi
 
+# Resolve the effective profile after the template is available. This gives
+# CLI flags and GitHub repository variables priority over template defaults,
+# while making automatic detection concrete in the generated profile.
+if [ -f "$template_root/.github/scripts/profile.sh" ]; then
+  profile_output="$(
+    REPO_FOUNDRY_PROFILE="$profile" \
+    REPO_FOUNDRY_LANGUAGES="$languages" \
+    REPO_FOUNDRY_FEATURES="$features" \
+    REPO_FOUNDRY_PACKAGE_MANAGER="$package_manager" \
+    REPO_FOUNDRY_RELEASE_TYPE="$release_type" \
+    REPO_FOUNDRY_NPM_PUBLISH="$npm_publish" \
+    bash "$template_root/.github/scripts/profile.sh" detect --root "$PWD"
+  )"
+  profile="$(printf '%s\n' "$profile_output" | awk -F= '$1 == "profile" {print substr($0, index($0, "=") + 1)}')"
+  languages="$(printf '%s\n' "$profile_output" | awk -F= '$1 == "languages" {print substr($0, index($0, "=") + 1)}')"
+  package_manager="$(printf '%s\n' "$profile_output" | awk -F= '$1 == "package_manager" {print substr($0, index($0, "=") + 1)}')"
+  release_type="$(printf '%s\n' "$profile_output" | awk -F= '$1 == "release_type" {print substr($0, index($0, "=") + 1)}')"
+  npm_publish="$(printf '%s\n' "$profile_output" | awk -F= '$1 == "npm_publish" {print substr($0, index($0, "=") + 1)}')"
+fi
+
+if [ -f "$template_root/package.json" ]; then
+  template_version="$(awk -F'"' '/"version"[[:space:]]*:/ {print $4; exit}' "$template_root/package.json")"
+  [ -n "$template_version" ] && template_ref="code-foundry@$template_version"
+fi
+
 files=(
   .editorconfig
   .gitattributes
   .gitignore
+  release-please-config.json
   .githooks/pre-commit
   AGENTS.md
   LICENSE
@@ -123,7 +203,11 @@ files=(
   .github/ISSUE_TEMPLATE/config.yml
   .github/ISSUE_TEMPLATE/feature_request.yml
   .github/actions/setup/action.yml
+  .github/actions/cache/action.yml
+  .github/actions/codeql/action.yml
+  .github/scripts/profile.sh
   .github/scripts/bootstrap.sh
+  .github/scripts/changed-files.sh
   .github/scripts/ci.sh
   .github/scripts/codeql-languages.sh
   .github/scripts/doctor.sh
@@ -131,6 +215,7 @@ files=(
   .github/scripts/sitecustomize.py
   .github/scripts/sync-template.sh
   .github/scripts/init-repo.sh
+  .github/scripts/sync-codeowners.sh
   .github/scripts/sync-protection.sh
   .github/workflows/ci.yml
   .github/workflows/codeql.yml
@@ -157,8 +242,6 @@ for file in "${files[@]}"; do
 done
 files=("${filtered_files[@]}")
 
-optional_files=(.mise.toml)
-
 # Workflows outside the standard baseline are repository-owned extensions.
 # The sync operation never deletes or replaces them; surface them explicitly
 # so maintainers can verify custom deployment, indexing, or security flows.
@@ -193,6 +276,9 @@ for file in "${files[@]}"; do
     echo "Template file missing: $file" >&2
     exit 1
   fi
+  if [ "$file" = .github/CODEOWNERS ] && [ -f "$file" ]; then
+    continue
+  fi
   if [ ! -f "$file" ] || ! cmp -s "$template_file" "$file"; then
     changed=$((changed + 1))
     if [ "$mode" = "check" ]; then
@@ -229,28 +315,149 @@ for file in "${files[@]}"; do
   fi
 done
 
-for file in "${optional_files[@]}"; do
-  if [ ! -f "$file" ]; then
-    changed=$((changed + 1))
-    if [ "$mode" = "check" ]; then
-      printf 'Would initialize %s\n' "$file"
-    else
-      cp "$template_root/$file" "$file"
-      printf 'Initialized %s\n' "$file"
+# Release Please owns changelog updates after initialization. Preserve an
+# existing project history, but give new repositories the expected file.
+if [ ! -f CHANGELOG.md ]; then
+  changed=$((changed + 1))
+  if [ "$mode" = "check" ]; then
+    printf '%s\n' 'Would initialize CHANGELOG.md'
+  else
+    cat > CHANGELOG.md <<'EOF'
+# Changelog
+
+All notable changes to this project are documented here.
+EOF
+    printf '%s\n' 'Initialized CHANGELOG.md'
+  fi
+fi
+
+detect_languages() {
+  local detected=()
+  if [ -f package.json ] || git ls-files -- '*.js' '*.jsx' '*.ts' '*.tsx' | grep -q .; then
+    detected+=(typescript)
+  fi
+  if [ -f Cargo.toml ] || git ls-files -- '*.rs' | grep -q .; then
+    detected+=(rust)
+  fi
+  if [ -f pyproject.toml ] || [ -f requirements.txt ] || [ -f requirements-dev.txt ] ||
+    git ls-files -- '*.py' ':!.github/**' | grep -q .; then
+    detected+=(python)
+  fi
+  if find . -path './.git' -prune -o -type f -name '*.sol' -print | grep -q .; then
+    detected+=(solidity)
+  fi
+  printf '%s\n' "${detected[*]}"
+}
+
+initialize_mise() {
+  local selected_languages="$1"
+  local language selected_package_manager
+  if [ -f .mise.toml ]; then
+    return
+  fi
+  if [ "$selected_languages" = auto ]; then
+    selected_languages="$(detect_languages)"
+  fi
+  selected_package_manager="$package_manager"
+  if [ "$selected_package_manager" = auto ]; then
+    if [ -f bun.lock ] || [ -f bun.lockb ]; then selected_package_manager=bun
+    elif [ -f pnpm-lock.yaml ]; then selected_package_manager=pnpm
+    elif [ -f yarn.lock ]; then selected_package_manager=yarn
+    elif [ -f package-lock.json ]; then selected_package_manager=npm
+    else selected_package_manager=bun
     fi
   fi
-done
+  changed=$((changed + 1))
+  if [ "$mode" = check ]; then
+    printf '%s\n' 'Would initialize .mise.toml'
+    return
+  fi
+  {
+    printf '%s\n' '[tools]'
+    for language in $(normalize_csv "$selected_languages"); do
+      case "$language" in
+        typescript|solidity)
+          printf 'node = "%s"\n' "$node_version"
+          if [ "$selected_package_manager" = bun ]; then
+            printf 'bun = "%s"\n' "$bun_version"
+          fi
+          ;;
+        python)
+          printf 'python = "%s"\n' "$python_version"
+          printf 'uv = "%s"\n' "$uv_version"
+          printf 'ruff = "%s"\n' "$ruff_version"
+          ;;
+        rust)
+          printf 'rust = { version = "%s", components = ["rustfmt", "clippy"] }\n' "$rust_version"
+          ;;
+      esac
+    done | awk '!seen[$0]++'
+    printf '\n%s\n' '[settings]'
+    printf '%s\n' 'experimental = true'
+  } > .mise.toml
+  printf '%s\n' 'Initialized .mise.toml'
+}
+
+initialize_mise "$languages"
+
+initialize_mise_lock() {
+  if [ ! -f .mise.toml ] || [ -f mise.lock ]; then
+    return
+  fi
+  if ! command -v mise >/dev/null 2>&1; then
+    return
+  fi
+  changed=$((changed + 1))
+  if [ "$mode" = check ]; then
+    printf '%s\n' 'Would initialize mise.lock'
+    return
+  fi
+  if MISE_TRUSTED_CONFIG_PATHS="$PWD" mise lock >/dev/null 2>&1; then
+    printf '%s\n' 'Initialized mise.lock'
+  else
+    printf '%s\n' 'Warning: mise.lock could not be generated; CI will resolve pinned tools normally.' >&2
+  fi
+}
+
+initialize_mise_lock
+
+if [ -x .github/scripts/sync-codeowners.sh ]; then
+  if [ "$mode" = "check" ]; then
+    bash .github/scripts/sync-codeowners.sh --check
+  else
+    bash .github/scripts/sync-codeowners.sh --apply
+  fi
+fi
+
+# Release Please's simple strategy needs a version file. Initialize one only
+# for Solidity-only repositories, where no package manifest owns the version.
+if [ ! -f version.txt ] && find . -path './.git' -prune -o -type f -name '*.sol' -print | grep -q . &&
+  [ ! -f package.json ] && [ ! -f Cargo.toml ] && [ ! -f pyproject.toml ]; then
+  changed=$((changed + 1))
+  if [ "$mode" = "check" ]; then
+    printf '%s\n' 'Would initialize version.txt'
+  else
+    printf '%s\n' '0.1.0' > version.txt
+    printf '%s\n' 'Initialized version.txt'
+  fi
+fi
 
 if [ "$mode" = "apply" ]; then
   git config core.hooksPath .githooks
   mkdir -p .github
   {
     printf 'version: 1\n'
+    if [ -n "$template_ref" ]; then
+      printf 'template: %s\n' "$template_ref"
+    fi
+    printf 'profile: %s\n' "$profile"
     printf 'languages: %s\n' "$languages"
     printf 'features: %s\n' "$features"
     if [ -n "$package_manager" ]; then
       printf 'package_manager: %s\n' "$package_manager"
     fi
+    printf 'release_type: %s\n' "$release_type"
+    printf 'npm_publish: %s\n' "$npm_publish"
   } > .github/template.yml
 fi
 

package/.github/scripts/turbo-cache-probe.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# A Turbo remote-cache hit can be resolved from package manifests alone. This
+# probe lets CI skip the full dependency install when every executable task is
+# already cached. It is deliberately conservative: only Bun projects with a
+# pinned Turbo version are eligible, and synthetic dependency-only tasks are
+# excluded from the hit decision.
+
+task="${1:?task name required}"
+
+set_output() {
+  printf '%s=%s\n' "$1" "$2" >> "${GITHUB_OUTPUT:-/dev/null}"
+}
+
+set_output hit false
+
+[ -n "${TURBO_TOKEN:-}" ] || exit 0
+[ -n "${TURBO_TEAM:-}" ] || exit 0
+[ -f package.json ] || exit 0
+[ -f bun.lock ] || [ -f bun.lockb ] || exit 0
+
+turbo_version="$(node <<'NODE'
+const fs = require('node:fs');
+const packageJson = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+const groups = [
+  packageJson.devDependencies,
+  packageJson.dependencies,
+  packageJson.optionalDependencies,
+  packageJson.pnpm?.overrides,
+];
+for (const group of groups) {
+  const value = group?.turbo;
+  const match = typeof value === 'string' && value.match(/(\d+\.\d+\.\d+)/);
+  if (match) {
+    console.log(match[1]);
+    break;
+  }
+}
+NODE
+)"
+[ -n "$turbo_version" ] || exit 0
+
+turbo_home="${RUNNER_TEMP:-/tmp}/repo-foundry-turbo"
+probe_file="$(mktemp)"
+install_file="$(mktemp)"
+result_file="$(mktemp)"
+cleanup() { rm -f "$probe_file" "$install_file" "$result_file"; }
+trap cleanup EXIT
+
+if ! npm install --prefix "$turbo_home" --no-save --ignore-scripts --no-audit --no-fund \
+  "turbo@${turbo_version}" >"$install_file" 2>&1; then
+  echo "Turbo Probe: CLI unavailable; using full install"
+  exit 0
+fi
+
+turbo_bin="$turbo_home/node_modules/.bin/turbo"
+if [ ! -x "$turbo_bin" ]; then
+  echo "Turbo Probe: CLI unavailable; using full install"
+  exit 0
+fi
+
+if ! "$turbo_bin" run "$task" \
+  --dry=json --cache=remote:r --output-logs=none >"$probe_file" 2>&1; then
+  echo "Turbo Probe: CLI unavailable; using full install"
+  exit 0
+fi
+
+node - "$probe_file" >"$result_file" <<'NODE'
+const fs = require('node:fs');
+const file = process.argv[2];
+const text = fs.readFileSync(file, 'utf8');
+const start = text.indexOf('{');
+if (start < 0) {
+  console.log('invalid-json');
+  process.exit(0);
+}
+let report;
+try {
+  report = JSON.parse(text.slice(start));
+} catch {
+  console.log('invalid-json');
+  process.exit(0);
+}
+const runnable = (report.tasks || []).filter((entry) =>
+  entry.command !== '<NONEXISTENT>' && entry.resolvedTaskDefinition?.cache !== false,
+);
+const hits = runnable.filter((entry) => entry.cache?.status === 'HIT').length;
+const hit = runnable.length > 0 && hits === runnable.length;
+console.log(`tasks=${report.tasks?.length || 0} runnable=${runnable.length} hits=${hits} hit=${hit}`);
+NODE
+probe_result="$(cat "$result_file")"
+echo "Turbo Probe: $probe_result"
+if ! grep -q 'hit=true' <<<"$probe_result"; then
+  echo "Turbo Probe: remote cache incomplete; using full install"
+  exit 0
+fi
+
+turbo_bin_dir="${turbo_bin%/*}"
+echo "$turbo_bin_dir" >> "${GITHUB_PATH:-/dev/null}"
+printf 'REPO_FOUNDRY_TURBO_REMOTE_ONLY=true\n' >> "${GITHUB_ENV:-/dev/null}"
+set_output hit true

package/.github/template.yml

@@ -0,0 +1,14 @@
+version: 1
+template: code-foundry@latest
+profile: auto
+languages: typescript
+features: all
+package_manager: bun
+release_type: node
+npm_publish: true
+runner: ubuntu-latest
+unit_runner: ubuntu-slim
+cache_packages: auto
+cache_build: auto
+coverage_minimum: 80
+turbo_remote: auto

package/.github/template.yml.example

@@ -1,5 +1,15 @@
 # Repository-specific settings for the shared initializer and sync scripts.
 version: 1
+template: code-foundry@latest
+profile: auto
 languages: auto
 features: all
 package_manager: auto
+release_type: auto
+npm_publish: false
+runner: ubuntu-latest
+unit_runner: ubuntu-slim
+cache_packages: auto
+cache_build: auto
+coverage_minimum: 80
+turbo_remote: auto

package/.github/workflows/ci.yml

@@ -13,60 +13,161 @@ permissions:
 env:
   TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
   TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
+  REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
+  REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
+  REPO_FOUNDRY_PACKAGE_MANAGER: ${{ vars.REPO_FOUNDRY_PACKAGE_MANAGER }}
+  REPO_FOUNDRY_RUNNER: ${{ vars.REPO_FOUNDRY_RUNNER }}
+  REPO_FOUNDRY_CACHE_PACKAGES: ${{ vars.REPO_FOUNDRY_CACHE_PACKAGES || 'auto' }}
+  REPO_FOUNDRY_CACHE_BUILD: ${{ vars.REPO_FOUNDRY_CACHE_BUILD || 'auto' }}
+  REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:
   format:
     name: Format
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.REPO_FOUNDRY_RUNNER || vars.REPO_FOUNDRY_FAST_RUNNER || 'ubuntu-latest' }}
+    timeout-minutes: 15
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          fetch-depth: 2
+      - name: Detect
+        id: applicability
+        run: bash .github/scripts/ci.sh should_run format >> "$GITHUB_OUTPUT"
+      - name: Format Probe
+        id: format-probe
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/format-fast-path.sh
       - name: Setup
+        if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
         with:
-          install: true
+          install: ${{ steps.format-probe.outputs.hit != 'true' }}
+          install-python: false
+          install-rust: false
+          cache-build: false
+          # Warm the format cache on branch pushes without adding archive
+          # time to pull-request checks.
+          cache-save: ${{ github.event_name == 'push' }}
+          cache-format: true
+          task: format
       - name: Format
+        if: steps.applicability.outputs.applicable == 'true'
+        id: format-fast
+        continue-on-error: ${{ steps.format-probe.outputs.hit == 'true' }}
+        run: bash .github/scripts/ci.sh format
+      - name: Setup Fallback
+        if: >-
+          steps.applicability.outputs.applicable == 'true' &&
+          steps.format-probe.outputs.hit == 'true' &&
+          steps.format-fast.outcome == 'failure'
+        uses: ./.github/actions/setup
+        with:
+          install: true
+          install-python: false
+          install-rust: false
+          cache-build: false
+          cache-save: false
+          cache-format: true
+          task: format
+      - name: Format Fallback
+        if: >-
+          steps.applicability.outputs.applicable == 'true' &&
+          steps.format-probe.outputs.hit == 'true' &&
+          steps.format-fast.outcome == 'failure'
         run: bash .github/scripts/ci.sh format
 
   lint:
     name: Lint
-    runs-on: ubuntu-latest
+    runs-on: ${{ vars.REPO_FOUNDRY_RUNNER || vars.REPO_FOUNDRY_FAST_RUNNER || 'ubuntu-latest' }}
+    timeout-minutes: 20
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          fetch-depth: 2
+      - name: Detect
+        id: applicability
+        run: bash .github/scripts/ci.sh should_run lint >> "$GITHUB_OUTPUT"
+      - name: Turbo Probe
+        id: turbo
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/turbo-cache-probe.sh lint
       - name: Setup
+        if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
         with:
-          install: true
+          install: ${{ steps.turbo.outputs.hit != 'true' }}
+          install-python: false
+          cache-build: false
+          # Warm the lint cache on branch pushes without adding archive time
+          # to pull-request checks.
+          cache-save: ${{ github.event_name == 'push' }}
+          cache-lint: true
+          task: lint
       - name: Lint
+        if: steps.applicability.outputs.applicable == 'true'
         run: bash .github/scripts/ci.sh lint
 
   type-check:
     name: Type-Check
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          fetch-depth: 2
+      - name: Detect
+        id: applicability
+        run: bash .github/scripts/ci.sh should_run type_check >> "$GITHUB_OUTPUT"
+      - name: Turbo Probe
+        id: turbo
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/turbo-cache-probe.sh type-check
       - name: Setup
+        if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
         with:
-          install: true
+          install: ${{ steps.turbo.outputs.hit != 'true' }}
+          install-python: false
+          cache-build: ${{ steps.applicability.outputs.rust == 'true' || vars.REPO_FOUNDRY_CACHE_BUILD == 'true' }}
+          cache-save: ${{ github.event_name == 'push' }}
+          task: type_check
       - name: Type-Check
+        if: steps.applicability.outputs.applicable == 'true'
         run: bash .github/scripts/ci.sh type_check
 
   build:
     name: Build
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          fetch-depth: 2
+      - name: Detect
+        id: applicability
+        run: bash .github/scripts/ci.sh should_run build >> "$GITHUB_OUTPUT"
+      - name: Turbo Probe
+        id: turbo
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/turbo-cache-probe.sh build
       - name: Setup
+        if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
         with:
-          install: true
+          install: ${{ steps.turbo.outputs.hit != 'true' }}
+          install-python: false
+          cache-build: ${{ steps.applicability.outputs.rust == 'true' || vars.REPO_FOUNDRY_CACHE_BUILD == 'true' }}
+          cache-save: ${{ github.event_name == 'push' }}
+          task: build
       - name: Build
+        if: steps.applicability.outputs.applicable == 'true'
         run: bash .github/scripts/ci.sh build