code-foundry 0.1.3 → 0.2.0

package/.github/workflows/codeql.yml

@@ -15,42 +15,151 @@ permissions:
   packages: read
   security-events: write
 
+env:
+  REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
+  REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
+  REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
+
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:
   detect:
     name: Detect
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
+    timeout-minutes: 10
     outputs:
       languages: ${{ steps.languages.outputs.languages }}
+      code_security: ${{ steps.security.outputs.status }}
+      actions_available: ${{ steps.languages.outputs.actions_available }}
+      actions_changed: ${{ steps.languages.outputs.actions_changed }}
+      actions_build_mode: ${{ steps.languages.outputs.actions_build_mode }}
+      javascript_available: ${{ steps.languages.outputs.javascript_available }}
+      javascript_changed: ${{ steps.languages.outputs.javascript_changed }}
+      javascript_build_mode: ${{ steps.languages.outputs.javascript_build_mode }}
+      python_available: ${{ steps.languages.outputs.python_available }}
+      python_changed: ${{ steps.languages.outputs.python_changed }}
+      python_build_mode: ${{ steps.languages.outputs.python_build_mode }}
+      rust_available: ${{ steps.languages.outputs.rust_available }}
+      rust_changed: ${{ steps.languages.outputs.rust_changed }}
+      rust_build_mode: ${{ steps.languages.outputs.rust_build_mode }}
     steps:
+      - name: Detect Code Security
+        id: security
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          status="disabled"
+          if [ "${{ github.event.repository.private }}" != "true" ]; then
+            status="enabled"
+          else
+            status="$(gh api "repos/${GITHUB_REPOSITORY}" --jq '.security_and_analysis.code_security.status // "disabled"' 2>/dev/null || printf 'disabled')"
+          fi
+          printf 'status=%s\n' "$status" >> "$GITHUB_OUTPUT"
       - name: Checkout
+        if: ${{ !github.event.repository.private || steps.security.outputs.status == 'enabled' }}
         uses: actions/checkout@v7
+        with:
+          fetch-depth: 2
+          # Detection only reads Git trees, paths, and small profile files;
+          # defer source blob transfer until the analyzer jobs.
+          filter: blob:none
+          sparse-checkout: |
+            .github
+            .mise.toml
+            mise.lock
+            package.json
+            bun.lock
+            bun.lockb
+            pnpm-lock.yaml
+            yarn.lock
+            package-lock.json
       - id: languages
         name: Detect languages
-        run: bash .github/scripts/codeql-languages.sh
+        env:
+          CODEQL_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
+          REPO_FOUNDRY_CODE_SECURITY: ${{ steps.security.outputs.status }}
+          REPO_FOUNDRY_PRIVATE: ${{ github.event.repository.private }}
+        run: |
+          if [ "$REPO_FOUNDRY_PRIVATE" = "true" ] && [ "$REPO_FOUNDRY_CODE_SECURITY" != "enabled" ]; then
+            echo 'languages=[]' >> "$GITHUB_OUTPUT"
+          else
+            bash .github/scripts/codeql-languages.sh
+          fi
+
+  analyze-actions:
+    name: Analyze (Actions)
+    needs: detect
+    if: >-
+      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
+      needs.detect.outputs.actions_available == 'true' &&
+      needs.detect.outputs.actions_changed == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Analyze
+        uses: ./.github/actions/codeql
+        with:
+          language: actions
+          build-mode: ${{ needs.detect.outputs.actions_build_mode }}
+          category: /language:actions
+
+  analyze-typescript:
+    name: Analyze (TypeScript)
+    needs: detect
+    if: >-
+      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
+      needs.detect.outputs.javascript_available == 'true' &&
+      needs.detect.outputs.javascript_changed == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Analyze
+        uses: ./.github/actions/codeql
+        with:
+          language: javascript-typescript
+          build-mode: ${{ needs.detect.outputs.javascript_build_mode }}
+          category: /language:javascript-typescript
 
-  analyze:
-    name: Analyze (${{ matrix.name }})
+  analyze-python:
+    name: Analyze (Python)
     needs: detect
-    if: ${{ !github.event.repository.private }}
+    if: >-
+      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
+      needs.detect.outputs.python_available == 'true' &&
+      needs.detect.outputs.python_changed == 'true'
     runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      max-parallel: 4
-      matrix:
-        include: ${{ fromJSON(needs.detect.outputs.languages) }}
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@v7
-      - name: Initialize
-        uses: github/codeql-action/init@v4
+      - name: Analyze
+        uses: ./.github/actions/codeql
         with:
-          languages: ${{ matrix.language }}
-          build-mode: ${{ matrix.build-mode }}
+          language: python
+          build-mode: ${{ needs.detect.outputs.python_build_mode }}
+          category: /language:python
+
+  analyze-rust:
+    name: Analyze (Rust)
+    needs: detect
+    if: >-
+      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
+      needs.detect.outputs.rust_available == 'true' &&
+      needs.detect.outputs.rust_changed == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
       - name: Analyze
-        uses: github/codeql-action/analyze@v4
+        uses: ./.github/actions/codeql
         with:
-          category: /language:${{ matrix.language }}
+          language: rust
+          build-mode: ${{ needs.detect.outputs.rust_build_mode }}
+          category: /language:rust

package/.github/workflows/draft-pr.yml

@@ -21,20 +21,17 @@ env:
 jobs:
   create-draft-pr:
     name: Create
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
+    timeout-minutes: 10
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
       - name: Check
         id: check-pr
         run: |
           BRANCH="${{ github.ref_name }}"
-          EXISTING=$(gh pr list --base staging --head "$BRANCH" --state open --json number,title 2>/dev/null | jq 'length')
+          EXISTING=$(gh pr list --limit 1 --base staging --head "$BRANCH" --state open --json number,title 2>/dev/null | jq 'length')
           echo "existing=$EXISTING" >> "$GITHUB_OUTPUT"
 
       - name: Create
@@ -56,7 +53,7 @@ jobs:
         if: steps.check-pr.outputs.existing == '0'
         run: |
           BRANCH="${{ github.ref_name }}"
-          PR_NUMBER=$(gh pr list --base staging --head "$BRANCH" --state open --json number 2>/dev/null | jq '.[0].number')
+          PR_NUMBER=$(gh pr list --limit 1 --base staging --head "$BRANCH" --state open --json number 2>/dev/null | jq '.[0].number')
           if [ -n "$PR_NUMBER" ]; then
             gh pr ready "$PR_NUMBER"
           fi

package/.github/workflows/release-pr.yml

@@ -14,19 +14,23 @@ env:
 jobs:
   create-release-pr:
     name: Create
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
+    timeout-minutes: 10
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
       - name: Check
         id: check-pr
         run: |
-          EXISTING=$(gh pr list --base main --head staging --state open --json number 2>/dev/null | jq 'length')
+          set -euo pipefail
+          EXISTING=$(gh pr list \
+            --repo "$GITHUB_REPOSITORY" \
+            --limit 1 \
+            --base main \
+            --head staging \
+            --state open \
+            --json number | jq 'length')
           echo "existing=$EXISTING" >> "$GITHUB_OUTPUT"
 
       - name: Create
@@ -34,7 +38,15 @@ jobs:
         run: |
           DATE=$(date +%Y-%m-%d)
           BODY_FILE="$RUNNER_TEMP/release-pr.md"
-          COMMITS=$(git log --no-merges --pretty=format:'- %s (%h)' origin/main..HEAD)
+          COMPARE_URL="repos/${GITHUB_REPOSITORY}/compare/main...staging"
+          COMPARE_FILE="$RUNNER_TEMP/release-compare.json"
+          gh api "$COMPARE_URL?per_page=100" > "$COMPARE_FILE"
+          TOTAL_COMMITS=$(jq -r '.total_commits // 0' "$COMPARE_FILE")
+          if [ "$TOTAL_COMMITS" -gt 100 ]; then
+            LAST_PAGE=$(( (TOTAL_COMMITS + 99) / 100 ))
+            gh api "$COMPARE_URL?per_page=100&page=$LAST_PAGE" > "$COMPARE_FILE"
+          fi
+          COMMITS=$(jq -r '.commits[] | "- \(.commit.message | split("\\n")[0]) (\(.sha[0:7]))"' "$COMPARE_FILE")
           if [ -z "$COMMITS" ]; then
             COMMITS='- No commits found since main.'
           fi
@@ -55,6 +67,7 @@ jobs:
           EOF
 
           gh pr create \
+            --repo "$GITHUB_REPOSITORY" \
             --base main \
             --head staging \
             --title "Release: staging -> main ($DATE)" \

package/.github/workflows/release.yml

@@ -2,22 +2,114 @@ name: Release
 
 on:
   push:
-    tags: ['v*.*.*']
+    branches: [main]
   workflow_dispatch:
 
 permissions:
   contents: write
+  issues: write
+  pull-requests: write
+
+env:
+  REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
+  REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
+  REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
+  REPO_FOUNDRY_PACKAGE_MANAGER: ${{ vars.REPO_FOUNDRY_PACKAGE_MANAGER }}
+  REPO_FOUNDRY_RELEASE_TYPE: ${{ vars.REPO_FOUNDRY_RELEASE_TYPE }}
+  REPO_FOUNDRY_NPM_PUBLISH: ${{ vars.REPO_FOUNDRY_NPM_PUBLISH }}
 
 jobs:
   release:
-    name: Publish
-    runs-on: ubuntu-latest
+    name: Release / Version
+    runs-on: ubuntu-slim
+    timeout-minutes: 20
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}
       cancel-in-progress: false
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created || 'false' }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+      npm_publish: ${{ steps.profile.outputs.npm_publish }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          # Release Please reads release metadata and manifests; defer source
+          # blob transfer until a package file is actually needed.
+          filter: blob:none
+      - name: Detect release profile
+        id: profile
+        shell: bash
+        run: |
+          if [ -x .github/scripts/profile.sh ]; then
+            release_type="$(bash .github/scripts/profile.sh get release_type)"
+            npm_publish="$(bash .github/scripts/profile.sh get npm_publish)"
+          else
+            release_type="$(awk -F': ' '/^release_type:/ {print $2; exit}' .github/template.yml 2>/dev/null || true)"
+            npm_publish="$(awk -F': ' '/^npm_publish:/ {print $2; exit}' .github/template.yml 2>/dev/null || true)"
+          fi
+          [ -n "$release_type" ] || release_type=auto
+          [ -n "$npm_publish" ] || npm_publish=false
+
+          if [ "$release_type" = auto ]; then
+            if [ -f package.json ]; then release_type=node
+            elif [ -f pyproject.toml ]; then release_type=python
+            elif [ -f Cargo.toml ]; then release_type=rust
+            elif [ -f version.txt ]; then release_type=simple
+            else release_type=none
+            fi
+          fi
+
+          case "$release_type" in
+            node|python|rust|simple) ;;
+            none) npm_publish=false ;;
+            *) echo "Unsupported release_type: $release_type" >&2; exit 2 ;;
+          esac
+          if [ ! -f package.json ]; then npm_publish=false; fi
+          printf 'release_type=%s\n' "$release_type" >> "$GITHUB_OUTPUT"
+          printf 'npm_publish=%s\n' "$npm_publish" >> "$GITHUB_OUTPUT"
+      - name: Release Please
+        id: release
+        if: steps.profile.outputs.release_type != 'none'
+        uses: googleapis/release-please-action@v5
+        with:
+          # Use a PAT or GitHub App token when GITHUB_TOKEN cannot create PRs.
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }}
+          config-file: release-please-config.json
+          release-type: ${{ steps.profile.outputs.release_type }}
+
+  npm:
+    name: Release / Publish npm
+    needs: release
+    if: needs.release.outputs.release_created == 'true' && needs.release.outputs.npm_publish == 'true'
+    runs-on: ubuntu-slim
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
     steps:
-      - uses: actions/checkout@v7
-      - name: Create GitHub release
+      - name: Checkout release
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ needs.release.outputs.tag_name }}
+      - name: Setup Node (trusted)
+        if: env.NPM_TOKEN == ''
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - name: Setup Node (token)
+        if: env.NPM_TOKEN != ''
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+      - name: Publish npm with token
+        if: env.NPM_TOKEN != ''
         env:
-          GH_TOKEN: ${{ github.token }}
-        run: gh release create "${GITHUB_REF_NAME}" --generate-notes --verify-tag
+          NODE_AUTH_TOKEN: ${{ env.NPM_TOKEN }}
+        run: npm publish --provenance --access public
+      - name: Publish npm with trusted publishing
+        if: env.NPM_TOKEN == ''
+        run: npm publish --provenance --access public

package/.github/workflows/security.yml

@@ -10,26 +10,221 @@ on:
 permissions:
   contents: read
 
+env:
+  REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
+  REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
+  REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
+  REPO_FOUNDRY_PACKAGE_MANAGER: ${{ vars.REPO_FOUNDRY_PACKAGE_MANAGER }}
+  REPO_FOUNDRY_CACHE_PACKAGES: ${{ vars.REPO_FOUNDRY_CACHE_PACKAGES || 'auto' }}
+  REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
+
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.ref }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
   cancel-in-progress: true
 
 jobs:
-  dependency-audit:
-    name: Dependency Audit
-    runs-on: ubuntu-latest
+  profile:
+    name: Profile
+    runs-on: ubuntu-slim
+    timeout-minutes: 10
+    outputs:
+      javascript: ${{ steps.profile.outputs.javascript }}
+      rust: ${{ steps.profile.outputs.rust }}
+      python: ${{ steps.profile.outputs.python }}
+      python_requirements: ${{ steps.profile.outputs.python_requirements }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 2
+          filter: blob:none
+          sparse-checkout: |
+            .github
+            .mise.toml
+            mise.lock
+            .npmrc
+            .pnpmfile.cjs
+            .yarnrc*
+            **/package.json
+            **/bun.lock
+            **/bun.lockb
+            **/pnpm-lock.yaml
+            **/yarn.lock
+            **/package-lock.json
+            **/Cargo.toml
+            **/Cargo.lock
+            **/.cargo/**
+            **/pyproject.toml
+            **/requirements*.txt
+            **/setup.py
+            **/setup.cfg
+            **/Pipfile
+            **/Pipfile.lock
+            **/poetry.lock
+            **/uv.lock
+          sparse-checkout-cone-mode: false
+      - name: Detect
+        id: profile
+        run: bash .github/scripts/security.sh profile >> "$GITHUB_OUTPUT"
+
+  dependency-audit-javascript:
+    name: Dependency Audit (JavaScript)
+    runs-on: ubuntu-slim
+    timeout-minutes: 20
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          # JavaScript audits only need manifests, lockfiles, and audit config.
+          filter: blob:none
+          sparse-checkout: |
+            .github
+            .mise.toml
+            mise.lock
+            .npmrc
+            .pnpmfile.cjs
+            .yarnrc*
+            **/package.json
+            **/bun.lock
+            **/bun.lockb
+            **/pnpm-lock.yaml
+            **/yarn.lock
+            **/package-lock.json
+          sparse-checkout-cone-mode: false
+      - name: Detect
+        id: applicability
+        run: bash .github/scripts/security.sh should_run javascript >> "$GITHUB_OUTPUT"
       - name: Setup
+        if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
+        with:
+          mise-scope: javascript
+          cache-save: ${{ github.event_name != 'pull_request' }}
       - name: Audit dependencies
-        run: bash .github/scripts/security.sh
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/security.sh audit javascript
+
+  dependency-audit-rust:
+    name: Dependency Audit (Rust)
+    # ubuntu-latest ships with Cargo/Rust; use it for the audit-only job and
+    # fall back to the repository toolchain when the image lacks Rust.
+    runs-on: ${{ vars.REPO_FOUNDRY_RUST_AUDIT_RUNNER || 'ubuntu-latest' }}
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          # Rust audits only need manifests, Cargo configuration, and audit config.
+          filter: blob:none
+          sparse-checkout: |
+            .github
+            .mise.toml
+            mise.lock
+            **/Cargo.toml
+            **/Cargo.lock
+            **/.cargo/**
+          sparse-checkout-cone-mode: false
+      - name: Detect
+        id: applicability
+        run: bash .github/scripts/security.sh should_run rust >> "$GITHUB_OUTPUT"
+      - name: Check Rust
+        id: system-rust
+        if: steps.applicability.outputs.applicable == 'true'
+        shell: bash
+        run: |
+          if command -v cargo >/dev/null 2>&1 && command -v rustc >/dev/null 2>&1; then
+            cargo --version
+            rustc --version
+            echo 'available=true' >> "$GITHUB_OUTPUT"
+          else
+            echo 'available=false' >> "$GITHUB_OUTPUT"
+          fi
+      - name: Setup
+        if: >-
+          steps.applicability.outputs.applicable == 'true' &&
+          steps.system-rust.outputs.available != 'true'
+        uses: ./.github/actions/setup
+        with:
+          mise-scope: rust
+          cache-save: ${{ github.event_name != 'pull_request' }}
+      - name: Install cargo-audit
+        if: steps.applicability.outputs.applicable == 'true'
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-audit
+      - name: Audit dependencies
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/security.sh audit rust
+
+  dependency-audit-python:
+    name: Dependency Audit (Python) / ${{ matrix.requirement }}
+    needs: profile
+    if: >-
+      ${{ needs.profile.result == 'success' &&
+      needs.profile.outputs.python == 'true' &&
+      needs.profile.outputs.python_requirements != '["none"]' }}
+    strategy:
+      fail-fast: false
+      max-parallel: 8
+      matrix:
+        requirement: ${{ fromJSON(needs.profile.outputs.python_requirements) }}
+    runs-on: ubuntu-slim
+    timeout-minutes: 20
+    env:
+      REPO_FOUNDRY_PYTHON_REQUIREMENT: ${{ matrix.requirement }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          # Python audits only need manifests, lockfiles, and audit config.
+          filter: blob:none
+          sparse-checkout: |
+            .github
+            .mise.toml
+            mise.lock
+            **/pyproject.toml
+            **/requirements*.txt
+            **/setup.py
+            **/setup.cfg
+            **/Pipfile
+            **/Pipfile.lock
+            **/poetry.lock
+            **/uv.lock
+          sparse-checkout-cone-mode: false
+      - name: Setup
+        uses: ./.github/actions/setup
+        with:
+          mise-scope: python
+          cache-save: ${{ github.event_name != 'pull_request' }}
+      - name: Audit dependencies
+        run: bash .github/scripts/security.sh audit python
+
+  dependency-audit-python-gate:
+    name: Dependency Audit (Python)
+    needs: [profile, dependency-audit-python]
+    if: always()
+    runs-on: ubuntu-slim
+    timeout-minutes: 5
+    steps:
+      - name: Gate
+        env:
+          PROFILE_RESULT: ${{ needs.profile.result }}
+          AUDIT_RESULT: ${{ needs.dependency-audit-python.result }}
+        run: |
+          if [ "$PROFILE_RESULT" != success ]; then
+            echo "Python audit profile failed: $PROFILE_RESULT" >&2
+            exit 1
+          fi
+          case "$AUDIT_RESULT" in
+            success|skipped) exit 0 ;;
+            *) echo "Python dependency audit failed: $AUDIT_RESULT" >&2; exit 1 ;;
+          esac
 
   dependency-review:
     name: Dependency Review
     if: ${{ github.event_name == 'pull_request' && !github.event.repository.private }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
+    timeout-minutes: 10
     steps:
       - name: Review
         uses: actions/dependency-review-action@v5