code-foundry 0.1.4

package/.github/scripts/codeql-languages.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+languages=()
+changed_files=""
+
+# Scheduled and manually dispatched scans are always full scans. For pushes
+# and pull requests, a shallow commit diff lets the matrix skip analyzers for
+# languages untouched by the change while keeping every matrix check visible.
+case "${GITHUB_EVENT_NAME:-}" in
+  schedule|workflow_dispatch) ;;
+  *)
+    base_sha="${CODEQL_BASE_SHA:-}"
+    if [ -n "$base_sha" ] && [ "$base_sha" != "0000000000000000000000000000000000000000" ]; then
+      if ! git cat-file -e "$base_sha^{commit}" 2>/dev/null; then
+        git fetch --no-tags --filter=blob:none --depth=1 origin "$base_sha" >/dev/null 2>&1 || true
+      fi
+      changed_files="$(git diff --name-only "$base_sha" "${GITHUB_SHA:-HEAD}" 2>/dev/null || true)"
+    fi
+    [ -n "$changed_files" ] || changed_files="$(git diff --name-only HEAD^ HEAD 2>/dev/null || true)"
+    ;;
+esac
+
+if find .github/workflows -type f \( -name '*.yml' -o -name '*.yaml' \) -print -quit | grep -q .; then languages+=(actions); fi
+configured=""
+if [ -f .github/template.yml ]; then
+  configured="$(awk -F': ' '/^languages:/ {print $2; exit}' .github/template.yml)"
+fi
+
+if [ "$configured" = auto ] || [ "$configured" = all ] || [ -z "$configured" ]; then
+  tracked_files="$(git ls-files)"
+  if printf '%s\n' "$tracked_files" | grep -Eq '(^|/)([^/]+\.(ts|tsx|js|jsx)|package\.json|tsconfig[^/]*\.json)$'; then
+    languages+=(javascript-typescript)
+  fi
+  if printf '%s\n' "$tracked_files" | awk '!/^\.github\// && /(^|\/)([^\/]+\.py|pyproject\.toml|requirements[^\/]*\.txt|setup\.py)$/ { found=1; exit } END { exit !found }'; then
+    languages+=(python)
+  fi
+  if printf '%s\n' "$tracked_files" | grep -Eq '(^|/)([^/]+\.rs|Cargo\.toml|Cargo\.lock)$'; then
+    languages+=(rust)
+  fi
+else
+  case ",$configured," in *,typescript,*) languages+=(javascript-typescript) ;; esac
+  case ",$configured," in *,python,*) languages+=(python) ;; esac
+  case ",$configured," in *,rust,*) languages+=(rust) ;; esac
+fi
+
+changed_json="$(printf '%s\n' "$changed_files" | jq -Rsc 'split("\n") | map(select(length > 0))')"
+json=$(printf '%s\n' "${languages[@]}" | jq -Rsc --argjson changed "$changed_json" '
+  split("\n")
+  | map(select(length > 0) | {
+      language: .,
+      name: (if . == "javascript-typescript" then "TypeScript" elif . == "actions" then "Actions" else (. | ascii_upcase[0:1] + .[1:]) end),
+      "build-mode": "none",
+      changed: (
+        if ($changed | length) == 0 then true
+        elif . == "actions" then any($changed[]; test("(^|/)(\\.github/workflows/|action\\.yml$)"))
+        elif . == "javascript-typescript" then any($changed[]; test("(^|/)(.*\\.(js|jsx|mjs|cjs|ts|tsx|mts|cts)|package\\.json|tsconfig[^/]*\\.json|((bun|pnpm|yarn|package-lock)\\.lock))$"))
+        elif . == "python" then any($changed[]; test("(^|/)(.*\\.py|pyproject\\.toml|requirements[^/]*\\.txt|setup\\.py|Pipfile\\.lock|poetry\\.lock)$"))
+        elif . == "rust" then any($changed[]; test("(^|/)(.*\\.rs|Cargo\\.toml|Cargo\\.lock)$"))
+        else true
+        end
+      )
+    })
+')
+printf 'languages=%s\n' "$json" >> "$GITHUB_OUTPUT"
+
+# Expose stable, shell-friendly outputs for explicit analyzer jobs. Keeping
+# these separate from the JSON matrix lets workflow-level conditions avoid
+# allocating a runner for languages that are absent or unchanged.
+for codeql_language in actions javascript-typescript python rust; do
+  output_prefix="$codeql_language"
+  case "$codeql_language" in
+    javascript-typescript) output_prefix="javascript" ;;
+  esac
+
+  entry="$(jq -c --arg language "$codeql_language" '.[] | select(.language == $language)' <<< "$json")"
+  if [ -n "$entry" ]; then
+    printf '%s_available=true\n' "$output_prefix" >> "$GITHUB_OUTPUT"
+    printf '%s_changed=%s\n' "$output_prefix" "$(jq -r '.changed' <<< "$entry")" >> "$GITHUB_OUTPUT"
+    printf '%s_build_mode=%s\n' "$output_prefix" "$(jq -r '."build-mode"' <<< "$entry")" >> "$GITHUB_OUTPUT"
+  else
+    printf '%s_available=false\n' "$output_prefix" >> "$GITHUB_OUTPUT"
+    printf '%s_changed=false\n' "$output_prefix" >> "$GITHUB_OUTPUT"
+    printf '%s_build_mode=none\n' "$output_prefix" >> "$GITHUB_OUTPUT"
+  fi
+done

package/.github/scripts/doctor.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+errors=0
+
+configured_features="all"
+if [ -f .github/template.yml ]; then
+  configured_features="$(awk -F': ' '/^features:/ {print $2; exit}' .github/template.yml)"
+  [ -n "$configured_features" ] || configured_features="all"
+fi
+
+feature_enabled() {
+  [ "$configured_features" = all ] && return 0
+  case " $(printf '%s' "$configured_features" | tr ',' ' ') " in
+    *" $1 "*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+error() {
+  printf 'ERROR: %s\n' "$1" >&2
+  errors=$((errors + 1))
+}
+
+warn() {
+  printf 'WARN: %s\n' "$1" >&2
+}
+
+if [ ! -f .mise.toml ]; then
+  error ".mise.toml is missing"
+fi
+
+if [ "$(git config --get core.hooksPath || true)" != ".githooks" ]; then
+  warn "Git hooks are not enabled; run bash .github/scripts/bootstrap.sh"
+fi
+
+if [ -f package.json ]; then
+  node -e 'JSON.parse(require("fs").readFileSync("package.json", "utf8"))'
+  lockfiles=0
+  for lockfile in bun.lock bun.lockb pnpm-lock.yaml yarn.lock package-lock.json; do
+    if [ -f "$lockfile" ]; then lockfiles=$((lockfiles + 1)); fi
+  done
+  if [ "$lockfiles" -eq 0 ]; then
+    if node -e 'const p=require("./package.json"); const groups=[p.dependencies,p.devDependencies,p.optionalDependencies,p.peerDependencies]; process.exit(groups.some((g)=>g && Object.keys(g).length) ? 0 : 1)' 2>/dev/null; then
+      error "package.json exists but no supported lockfile was found"
+    else
+      printf '%s\n' "INFO: package.json has no dependencies; a lockfile is optional"
+    fi
+  elif [ "$lockfiles" -gt 1 ]; then
+    error "multiple JavaScript lockfiles found; keep one package manager"
+  fi
+  if node -e 'const p=require("./package.json"); process.exit(p.packageManager ? 0 : 1)' 2>/dev/null; then
+    declared="$(node -p 'require("./package.json").packageManager.split("@")[0]')"
+    actual=""
+    [ -f bun.lock ] || [ -f bun.lockb ] && actual="bun"
+    [ -f pnpm-lock.yaml ] && actual="pnpm"
+    [ -f yarn.lock ] && actual="yarn"
+    [ -f package-lock.json ] && actual="npm"
+    [ -n "$actual" ] && [ "$declared" != "$actual" ] && error "packageManager ($declared) does not match $actual lockfile"
+  fi
+  if git ls-files -- '*.ts' '*.tsx' '*.js' '*.jsx' | grep -q .; then
+    if ! node -e 'const p=require("./package.json"); const s=p.scripts||{}; process.exit(s.test||s["test:unit"]||s["test:integration"] ? 0 : 1)' 2>/dev/null; then
+      warn "JavaScript/TypeScript sources found but no test or test:unit/test:integration script is defined"
+    fi
+  fi
+  if [ -f bunfig.toml ] && node -e 'const p=require("./package.json"); process.exit(p.scripts?.["test:coverage"] ? 0 : 1)' 2>/dev/null; then
+    if ! grep -q 'coverageThreshold' bunfig.toml; then
+      if [ -x .github/scripts/ci.sh ]; then
+        printf '%s\n' "INFO: shared CI enforces the Bun aggregate coverage threshold"
+      else
+        error "Bun coverage is enabled by test:coverage but no coverage policy is configured"
+      fi
+    fi
+  fi
+fi
+
+if [ -f Cargo.toml ]; then
+  command -v cargo >/dev/null 2>&1 || error "Cargo is required for this repository"
+  cargo metadata --no-deps --format-version 1 >/dev/null
+fi
+
+if [ -f pyproject.toml ] || [ -f requirements.txt ] || [ -f requirements-dev.txt ]; then
+  if ! command -v python >/dev/null 2>&1 && [ ! -x .venv/bin/python ]; then
+    error "Python is required for this repository"
+  fi
+fi
+
+for workflow in ci codeql security test draft-pr release-pr release; do
+  if feature_enabled "$workflow"; then
+    [ -f ".github/workflows/$workflow.yml" ] || error "missing enabled workflow: $workflow.yml"
+  fi
+done
+
+for script in ci.sh codeql-languages.sh security.sh doctor.sh bootstrap.sh sync-template.sh init-repo.sh sync-protection.sh sync-codeowners.sh; do
+  [ -x ".github/scripts/$script" ] || error "missing executable script: .github/scripts/$script"
+done
+
+if [ "$errors" -gt 0 ]; then
+  printf '%s\n' "Repository doctor found $errors error(s)." >&2
+  exit 1
+fi
+
+printf '%s\n' "Repository doctor passed."

package/.github/scripts/format-fast-path.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Bootstrap only the formatter for Bun projects whose repository-owned format
+# script directly invokes Prettier. The workflow keeps a full-install fallback
+# because formatter configs may import arbitrary repository dependencies.
+
+set_output() {
+  printf '%s=%s\n' "$1" "$2" >> "${GITHUB_OUTPUT:-/dev/null}"
+}
+
+set_output hit false
+
+[ -f package.json ] || exit 0
+[ -f bun.lock ] || [ -f bun.lockb ] || exit 0
+
+project_profile="$(node <<'NODE'
+const fs = require('node:fs');
+const packageJson = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+process.stdout.write(Array.isArray(packageJson.workspaces) ||
+  (packageJson.workspaces && typeof packageJson.workspaces === 'object') ? 'workspace' : 'standalone');
+NODE
+)"
+lock_file='bun.lock'
+[ -f "$lock_file" ] || lock_file='bun.lockb'
+lock_bytes="$(wc -c < "$lock_file")"
+# A temporary npm formatter install has fixed overhead. For small standalone
+# projects, the normal Bun install is usually faster; workspace graphs and
+# larger lockfiles still benefit materially from avoiding their full tree.
+if [ "$project_profile" = standalone ] && [ "$lock_bytes" -le 524288 ]; then
+  exit 0
+fi
+
+format_script="$(node <<'NODE'
+const fs = require('node:fs');
+const packageJson = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+console.log(packageJson.scripts?.['format:check'] || packageJson.scripts?.format || '');
+NODE
+)"
+if ! grep -Eiq '(^|[[:space:];&|])prettier([[:space:]]|$)' <<<"$format_script" ||
+  grep -Eiq '(^|[[:space:];&|])turbo([[:space:]]|$)' <<<"$format_script"; then
+  exit 0
+fi
+
+prettier_version="$(node <<'NODE'
+const fs = require('node:fs');
+const packageJson = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+for (const group of [packageJson.devDependencies, packageJson.dependencies, packageJson.optionalDependencies]) {
+  const value = group?.prettier;
+  const match = typeof value === 'string' && value.match(/(\d+\.\d+\.\d+)/);
+  if (match) {
+    console.log(match[1]);
+    break;
+  }
+}
+NODE
+)"
+[ -n "$prettier_version" ] || exit 0
+
+tool_home="${RUNNER_TEMP:-/tmp}/repo-foundry-format"
+install_log="$(mktemp)"
+cleanup() { rm -f "$install_log"; }
+trap cleanup EXIT
+
+if ! npm install --prefix "$tool_home" --no-save --ignore-scripts --no-audit --no-fund \
+  "prettier@${prettier_version}" >"$install_log" 2>&1; then
+  echo 'Format Probe: formatter bootstrap unavailable; using full install'
+  exit 0
+fi
+
+tool_bin="$tool_home/node_modules/.bin"
+if [ ! -x "$tool_bin/prettier" ]; then
+  echo 'Format Probe: formatter binary unavailable; using full install'
+  exit 0
+fi
+
+echo "$tool_bin" >> "${GITHUB_PATH:-/dev/null}"
+printf 'REPO_FOUNDRY_FORMAT_FAST=true\n' >> "${GITHUB_ENV:-/dev/null}"
+echo "Format Probe: using Prettier ${prettier_version} without project install"
+set_output hit true

package/.github/scripts/init-repo.sh

@@ -0,0 +1,134 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+source="${REPO_FOUNDRY_SOURCE:-https://github.com/${GITHUB_REPOSITORY_OWNER:-OWNER}/code-foundry.git}"
+ref="main"
+protection=false
+dry_run=false
+prune=false
+languages="auto"
+features="all"
+package_manager="auto"
+bootstrap=true
+release_type="auto"
+npm_publish="false"
+tool_dir=""
+
+cleanup() {
+  if [ -n "$tool_dir" ]; then rm -rf "$tool_dir"; fi
+}
+trap cleanup EXIT
+
+usage() {
+  cat <<'EOF'
+Usage: init-repo.sh [options]
+
+Initialize or synchronize a repository from the shared baseline.
+
+Options:
+  --source PATH_OR_URL       Template source (default: REPO_FOUNDRY_SOURCE or GitHub owner)
+  --ref REF                  Template branch or tag (default: main)
+  --languages LIST           auto or comma-separated: typescript,rust,python,solidity
+  --features LIST            all or comma-separated optional features:
+                             ci,codeql,security,test,draft-pr,release-pr,release,dependabot
+  --package-manager NAME     auto, bun, pnpm, yarn, or npm
+  --release-type NAME        auto, node, python, rust, or simple
+  --npm-publish              Enable npm publication in the release workflow
+  --dry-run                  Preview changes without writing files
+  --prune                    Remove disabled standard workflows (never custom workflows)
+  --protection               Synchronize main branch required checks
+  --no-bootstrap             Skip mise/hooks/doctor bootstrap after init
+  -h, --help                 Show this help
+
+Examples:
+  bash .github/scripts/init-repo.sh --languages typescript,python
+  bash .github/scripts/init-repo.sh --languages rust --features ci,codeql,security,test
+  bash .github/scripts/init-repo.sh --features all --dry-run
+EOF
+}
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --source) source="${2:?missing source path or URL}"; shift 2 ;;
+    --ref) ref="${2:?missing ref}"; shift 2 ;;
+    --languages) languages="${2:?missing language list}"; shift 2 ;;
+    --features) features="${2:?missing feature list}"; shift 2 ;;
+    --package-manager) package_manager="${2:?missing package manager}"; shift 2 ;;
+    --release-type) release_type="${2:?missing release type}"; shift 2 ;;
+    --npm-publish) npm_publish=true; shift ;;
+    --dry-run) dry_run=true; shift ;;
+    --prune) prune=true; shift ;;
+    --protection) protection=true; shift ;;
+    --no-bootstrap) bootstrap=false; shift ;;
+    -h|--help) usage; exit 0 ;;
+    *)
+      printf 'Unknown option: %s\n' "$1" >&2
+      exit 2
+      ;;
+  esac
+done
+
+case "$package_manager" in
+  auto|bun|pnpm|yarn|npm) ;;
+  *) printf 'Unsupported package manager: %s\n' "$package_manager" >&2; exit 2 ;;
+esac
+case "$release_type" in
+  auto|node|python|rust|simple|none) ;;
+  *) printf 'Unsupported release type: %s\n' "$release_type" >&2; exit 2 ;;
+esac
+
+script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" 2>/dev/null && pwd || true)"
+if [ -f "$script_dir/sync-template.sh" ]; then
+  sync_script="$script_dir/sync-template.sh"
+elif [ -d "$source" ] && [ -f "$source/.github/scripts/sync-template.sh" ]; then
+  sync_script="$source/.github/scripts/sync-template.sh"
+else
+  command -v git >/dev/null 2>&1 || { echo "git is required" >&2; exit 1; }
+  tool_dir="$(mktemp -d)"
+  git clone --quiet --depth 1 --branch "$ref" "$source" "$tool_dir/template-repo"
+  sync_script="$tool_dir/template-repo/.github/scripts/sync-template.sh"
+fi
+
+sync_args=(
+  --source "$source"
+  --ref "$ref"
+  --languages "$languages"
+  --features "$features"
+  --package-manager "$package_manager"
+)
+if [ "$dry_run" = true ]; then sync_args+=(--check); else sync_args+=(--apply); fi
+if [ "$prune" = true ]; then sync_args+=(--prune); fi
+bash "$sync_script" "${sync_args[@]}"
+
+if [ "$dry_run" = true ]; then
+  printf '%s\n' 'Dry run complete; no files were changed.'
+  exit 0
+fi
+
+mkdir -p .github
+template_ref="$(awk -F': ' '/^template:/ {print $2; exit}' .github/template.yml 2>/dev/null || true)"
+{
+  printf 'version: 1\n'
+  if [ -n "$template_ref" ]; then
+    printf 'template: %s\n' "$template_ref"
+  fi
+  printf 'languages: %s\n' "$languages"
+  printf 'features: %s\n' "$features"
+  printf 'package_manager: %s\n' "$package_manager"
+  printf 'release_type: %s\n' "$release_type"
+  printf 'npm_publish: %s\n' "$npm_publish"
+} > .github/template.yml
+
+if [ "$bootstrap" = false ]; then
+  printf '%s\n' 'Bootstrap skipped.'
+  exit 0
+fi
+
+bash .github/scripts/bootstrap.sh
+
+if [ "$protection" = true ]; then
+  remote="$(git remote get-url origin 2>/dev/null || true)"
+  repo="$(printf '%s\n' "$remote" | sed -E 's#.*github.com[:/]([^/]+/[^/.]+)(\.git)?$#\1#')"
+  [ -n "$repo" ] || { echo 'Could not determine GitHub repository from origin' >&2; exit 1; }
+  bash .github/scripts/sync-protection.sh --repo "$repo" --apply
+fi

package/.github/scripts/security.sh

@@ -0,0 +1,209 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+source .github/scripts/changed-files.sh
+
+has_javascript_dependencies() {
+  [ -f bun.lock ] || [ -f bun.lockb ] || [ -f pnpm-lock.yaml ] ||
+    [ -f yarn.lock ] || [ -f package-lock.json ] ||
+    { [ -f package.json ] && node -e 'const p=require("./package.json"); const groups=[p.dependencies,p.devDependencies,p.optionalDependencies,p.peerDependencies]; process.exit(groups.some((g)=>g && Object.keys(g).length) ? 0 : 1)' 2>/dev/null; }
+}
+
+has_python_manifest() {
+  [ -f pyproject.toml ] || [ -f uv.lock ] ||
+    git ls-files | grep -Eq '(^|/)requirements[^/]*\.txt$'
+}
+
+has_dependency_manifest() {
+  has_javascript_dependencies || [ -f Cargo.toml ] || has_python_manifest
+}
+
+should_run() {
+  if repo_foundry_governance_only; then
+    printf '%s\n' 'applicable=false'
+    return 0
+  fi
+  if repo_foundry_pr_dependencies_unchanged "${1:-all}"; then
+    return 1
+  fi
+  case "${1:-all}" in
+    javascript) has_javascript_dependencies || return 1 ;;
+    rust) [ -f Cargo.toml ] || return 1 ;;
+    python) has_python_manifest || return 1 ;;
+    all) has_dependency_manifest || return 1 ;;
+    *) echo "unknown ecosystem: ${1:-}" >&2; return 2 ;;
+  esac
+  printf '%s\n' 'applicable=true'
+}
+
+if [ "${1:-audit}" = should_run ]; then
+  if should_run "${2:-all}"; then
+    exit 0
+  else
+    status=$?
+    [ "$status" -eq 1 ] && printf '%s\n' 'applicable=false' && exit 0
+    exit "$status"
+  fi
+fi
+
+if [ "${1:-}" = profile ]; then
+  python_requirements='["none"]'
+  if has_python_manifest && ! repo_foundry_governance_only && ! repo_foundry_pr_dependencies_unchanged python; then
+    python_requirements="$(
+      git ls-files -z '*requirements*.txt' |
+        node -e 'let data=""; process.stdin.on("data", (chunk) => { data += chunk; }).on("end", () => process.stdout.write(JSON.stringify(data.split("\0").filter(Boolean))));'
+    )"
+    [ "$python_requirements" = "[]" ] && python_requirements='["project"]'
+  fi
+  for ecosystem in javascript rust python; do
+    if should_run "$ecosystem"; then
+      printf '%s=true\n' "$ecosystem"
+    else
+      status=$?
+      [ "$status" -eq 1 ] && printf '%s=false\n' "$ecosystem" && continue
+      exit "$status"
+    fi
+  done
+  printf 'python_requirements=%s\n' "$python_requirements"
+  exit 0
+fi
+
+mode="${1:-audit}"
+if [ "$mode" = audit ] && [ -n "${2:-}" ]; then mode="$2"; fi
+case "$mode" in
+  audit|all|javascript|rust|python) ;;
+  *)
+    echo "usage: $0 [audit|should_run] [javascript|rust|python|all]" >&2
+    exit 2
+    ;;
+esac
+
+audits=0
+
+wait_for_parallel() {
+  local status=0 pid
+  for pid in "$@"; do
+    if ! wait "$pid"; then status=1; fi
+  done
+  return "$status"
+}
+
+run_parallel() {
+  local status=0 pid task
+  local -a pids=()
+  for task in "$@"; do
+    "$task" &
+    pids+=("$!")
+  done
+  for pid in "${pids[@]}"; do
+    if ! wait "$pid"; then status=1; fi
+  done
+  return "$status"
+}
+
+package_manager() {
+  local configured=""
+  if [ -f .github/template.yml ]; then
+    configured="$(awk -F': ' '/^package_manager:/ {print $2; exit}' .github/template.yml)"
+    case "$configured" in
+      bun|pnpm|yarn|npm) echo "$configured"; return ;;
+    esac
+  fi
+  if [ -f bun.lock ] || [ -f bun.lockb ]; then echo bun
+  elif [ -f pnpm-lock.yaml ]; then echo pnpm
+  elif [ -f yarn.lock ]; then echo yarn
+  elif [ -f package-lock.json ]; then echo npm
+  else echo none
+  fi
+}
+
+audit_javascript() {
+  if ! has_javascript_dependencies; then
+    echo "Skipping JavaScript/TypeScript audit (dependency inputs not found)"
+    return
+  fi
+  audit_args=(--audit-level=high)
+  if [ -f .github/security-audit-allowlist.txt ]; then
+    while IFS= read -r advisory; do
+      [[ -z "$advisory" || "$advisory" == \#* ]] && continue
+      audit_args+=(--ignore "$advisory")
+    done < .github/security-audit-allowlist.txt
+  fi
+  case "$(package_manager)" in
+    bun) audits=$((audits + 1)); bun audit "${audit_args[@]}" ;;
+    pnpm) audits=$((audits + 1)); corepack pnpm audit --audit-level high ;;
+    yarn) audits=$((audits + 1)); corepack yarn npm audit --all --recursive ;;
+    npm) audits=$((audits + 1)); npm audit --audit-level=high ;;
+  esac
+}
+
+audit_rust() {
+  if [ -f Cargo.toml ]; then
+    audits=$((audits + 1))
+    if ! command -v cargo-audit >/dev/null 2>&1; then cargo install cargo-audit --locked --quiet; fi
+    cargo audit
+  else
+    echo "Skipping Rust audit (Cargo.toml not found)"
+  fi
+}
+
+audit_python() {
+  local pip_audit_version='2.10.1'
+  requirement_files=()
+  if [ -n "${REPO_FOUNDRY_PYTHON_REQUIREMENT:-}" ] && [ "$REPO_FOUNDRY_PYTHON_REQUIREMENT" != project ] && [ "$REPO_FOUNDRY_PYTHON_REQUIREMENT" != none ]; then
+    if ! git ls-files --error-unmatch -- "${REPO_FOUNDRY_PYTHON_REQUIREMENT}" >/dev/null 2>&1; then
+      echo "Python requirement file is not tracked: ${REPO_FOUNDRY_PYTHON_REQUIREMENT}" >&2
+      return 1
+    fi
+    requirement_files+=( "$REPO_FOUNDRY_PYTHON_REQUIREMENT" )
+  else
+    while IFS= read -r requirement_file; do
+      [ -n "$requirement_file" ] && requirement_files+=( "$requirement_file" )
+    done < <(git ls-files '*requirements*.txt')
+  fi
+  if [ "${#requirement_files[@]}" -gt 0 ] || [ -f pyproject.toml ]; then
+    audits=$((audits + 1))
+    if command -v uv >/dev/null 2>&1; then
+      local uv_audit_cache="${REPO_FOUNDRY_UV_AUDIT_CACHE:-$HOME/.cache/uv-audit}"
+      pip_audit() {
+        if [ "${REPO_FOUNDRY_UV_AUDIT_OFFLINE:-false}" = true ]; then
+          if UV_CACHE_DIR="$uv_audit_cache" uv tool run --offline --from "pip-audit==${pip_audit_version}" pip-audit "$@"; then
+            return 0
+          fi
+          echo 'Offline pip-audit cache was incomplete; retrying online.' >&2
+        fi
+        REPO_FOUNDRY_UV_AUDIT_OFFLINE=false UV_CACHE_DIR="$uv_audit_cache" uv tool run --from "pip-audit==${pip_audit_version}" pip-audit "$@"
+      }
+    else
+      python -m pip install --disable-pip-version-check --quiet "pip-audit==${pip_audit_version}"
+      pip_audit() { python -m pip_audit "$@"; }
+    fi
+    if [ "${#requirement_files[@]}" -gt 0 ]; then
+      pids=()
+      for requirement_file in "${requirement_files[@]}"; do
+        pip_audit -r "$requirement_file" &
+        pids+=( "$!" )
+      done
+      wait_for_parallel "${pids[@]}"
+    else
+      pip_audit
+    fi
+  else
+    echo "Skipping Python audit (Python dependency manifest not found)"
+  fi
+}
+
+case "$mode" in
+  audit|all)
+    run_parallel audit_javascript audit_rust audit_python
+    ;;
+  javascript) audit_javascript ;;
+  rust) audit_rust ;;
+  python) audit_python ;;
+esac
+
+if [ "$audits" -eq 0 ] && ! has_dependency_manifest; then
+  echo "No supported dependency manifests found; nothing to audit"
+fi
+
+exit 0

package/.github/scripts/sitecustomize.py

@@ -0,0 +1,17 @@
+"""Keep coverage.py usable with runners that ship malformed sysconfig schemes."""
+
+import sysconfig
+
+_get_paths = sysconfig.get_paths
+
+
+def get_paths(scheme=None, vars=None, expand=True):
+    try:
+        return _get_paths(scheme, vars, expand)
+    except ValueError as error:
+        if "Single '}' encountered in format string" not in str(error):
+            raise
+        return {}
+
+
+sysconfig.get_paths = get_paths