code-foundry 0.1.4

package/.github/scripts/sync-codeowners.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+mode=check
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --check) mode=check; shift ;;
+    --apply) mode=apply; shift ;;
+    -h|--help)
+      printf '%s\n' 'Usage: sync-codeowners.sh [--check|--apply]'
+      exit 0
+      ;;
+    *) printf 'Unknown option: %s\n' "$1" >&2; exit 2 ;;
+  esac
+done
+
+codeowners_file=.github/CODEOWNERS
+mkdir -p .github
+remote="$(git remote get-url origin 2>/dev/null || true)"
+repo="$(printf '%s\n' "$remote" | sed -E 's#.*github.com[:/]([^/]+/[^/.]+)(\.git)?$#\1#')"
+owners=()
+
+if [ -n "$repo" ] && command -v gh >/dev/null 2>&1; then
+  owner_json="$(gh repo view "$repo" --json owner 2>/dev/null || true)"
+  owner_login="$(jq -r '.owner.login // empty' <<< "$owner_json" 2>/dev/null || true)"
+  owner_type="$(jq -r '.owner.type // empty' <<< "$owner_json" 2>/dev/null || true)"
+  if [ "$owner_type" = User ] && [ -n "$owner_login" ]; then
+    owners+=("@$owner_login")
+  fi
+  admins="$(gh api --paginate "repos/$repo/collaborators?per_page=100" \
+    --jq '.[] | select(.permissions.admin == true) | .login' 2>/dev/null || true)"
+  while IFS= read -r admin; do
+    [ -n "$admin" ] && owners+=("@$admin")
+  done <<< "$admins"
+fi
+
+if [ "${#owners[@]}" -gt 0 ]; then
+  owner_line="$(printf '%s\n' "${owners[@]}" | awk '!seen[$0]++' | paste -sd ' ' -)"
+else
+  owner_line='@OWNER'
+  printf '%s\n' 'GitHub owner/admin discovery unavailable; retaining @OWNER placeholder.' >&2
+fi
+
+existing_file=""
+if [ -f "$codeowners_file" ]; then
+  existing_file="$(mktemp)"
+  cp "$codeowners_file" "$existing_file"
+fi
+
+if [ "$mode" = check ]; then
+  if [ -f "$codeowners_file" ] && grep -q "^\* $owner_line$" "$codeowners_file"; then
+    printf '%s\n' 'CODEOWNERS is current.'
+  else
+    printf 'Would update %s with %s\n' "$codeowners_file" "$owner_line"
+  fi
+  [ -n "$existing_file" ] && unlink "$existing_file"
+  exit 0
+fi
+
+tmp_file="$(mktemp)"
+{
+  printf '%s\n' '# Managed by code-foundry. Repository owners/admins are discovered during initialization.'
+  printf '* %s\n' "$owner_line"
+  if [ -n "$existing_file" ]; then
+    awk '
+      /^# Managed by code-foundry\./ { managed=1; next }
+      managed && /^\* / { managed=0; next }
+      managed { next }
+      /^\* @(OWNER|[^[:space:]]+)/ { next }
+      { print }
+    ' "$existing_file"
+  fi
+} > "$tmp_file"
+mv "$tmp_file" "$codeowners_file"
+[ -n "$existing_file" ] && unlink "$existing_file"
+printf 'Updated %s with %s\n' "$codeowners_file" "$owner_line"

package/.github/scripts/sync-protection.sh

@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+branch="main"
+repo=""
+mode="check"
+configured_features="all"
+configured_languages="auto"
+
+if [ -f .github/template.yml ]; then
+  configured_features="$(awk -F': ' '/^features:/ {print $2; exit}' .github/template.yml)"
+  configured_languages="$(awk -F': ' '/^languages:/ {print $2; exit}' .github/template.yml)"
+  [ -n "$configured_features" ] || configured_features="all"
+  [ -n "$configured_languages" ] || configured_languages="auto"
+fi
+
+feature_enabled() {
+  [ "$configured_features" = all ] && return 0
+  case " $(printf '%s' "$configured_features" | tr ',' ' ') " in
+    *" $1 "*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+language_enabled() {
+  [ "$configured_languages" = auto ] || [ "$configured_languages" = all ] && return 0
+  case " $(printf '%s' "$configured_languages" | tr ',' ' ') " in
+    *" $1 "*) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+usage() {
+  printf '%s\n' 'Usage: sync-protection.sh --repo OWNER/REPO [--branch main] [--check] [--apply]'
+}
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --repo) repo="${2:?missing OWNER/REPO}"; shift 2 ;;
+    --branch) branch="${2:?missing branch}"; shift 2 ;;
+    --check) mode="check"; shift ;;
+    --apply) mode="apply"; shift ;;
+    -h|--help) usage; exit 0 ;;
+    *) usage >&2; exit 2 ;;
+  esac
+done
+
+[ -n "$repo" ] || { usage >&2; exit 2; }
+command -v gh >/dev/null 2>&1 || { echo "gh is required" >&2; exit 1; }
+
+is_private="$(gh repo view "$repo" --json isPrivate --jq '.isPrivate')"
+code_security_status="disabled"
+if [ "$is_private" = true ]; then
+  code_security_status="$(gh api "repos/$repo" --jq '.security_and_analysis.code_security.status // "disabled"' 2>/dev/null || printf 'disabled')"
+fi
+contexts=()
+if feature_enabled ci; then contexts+=(Format Lint Type-Check Build); fi
+if feature_enabled test; then contexts+=(Unit Integration E2E Smoke); fi
+if feature_enabled security; then
+  contexts+=(Profile 'Dependency Audit (JavaScript)' 'Dependency Audit (Rust)' 'Dependency Audit (Python)')
+fi
+if feature_enabled codeql; then contexts+=(Detect); fi
+
+if { [ "$is_private" != true ] || [ "$code_security_status" = enabled ]; } && feature_enabled codeql; then
+  contexts+=("Analyze (Actions)")
+  if language_enabled typescript && git ls-files -- '*.ts' '*.tsx' '*.js' '*.jsx' package.json tsconfig\*.json | grep -q .; then contexts+=("Analyze (TypeScript)"); fi
+  if language_enabled python && git ls-files -- '*.py' pyproject.toml requirements\*.txt setup.py ':!.github/**' | grep -q .; then contexts+=("Analyze (Python)"); fi
+  if language_enabled rust && git ls-files -- '*.rs' Cargo.toml Cargo.lock | grep -q .; then contexts+=("Analyze (Rust)"); fi
+fi
+
+protection="$(gh api "repos/$repo/branches/$branch/protection" 2>/dev/null || true)"
+if ! jq -e 'type == "object" and (.required_status_checks | type == "object")' >/dev/null 2>&1 <<< "$protection"; then
+  if [ "$mode" = apply ]; then
+    echo "Cannot read branch protection for $repo:$branch (repository plan or permissions may not allow it)." >&2
+    exit 1
+  fi
+  existing=""
+else
+  existing="$(jq -r '.required_status_checks.contexts[]?' <<< "$protection")"
+fi
+preserved=()
+while IFS= read -r context; do
+  [ -n "$context" ] || continue
+  case "$context" in
+    'Slither / Analyze') continue ;; # removed from the standard workflow set
+    # Remove both the current concise job names and older workflow-prefixed
+    # names before rebuilding the standard set. This prevents stale required
+    # checks from remaining required after a repository changes visibility or
+    # template version.
+    'Dependency Audit'|'Dependency Audit ('*|'Profile'|'Test Profile'|\
+    'Format'|'Lint'|'Type-Check'|'Build'|'Unit'|'Integration'|'E2E'|'Smoke'|\
+    'Detect'|'Analyze'|'Analyze ('*|\
+    'CI / '*|'Test / '*|'Security / '*|'CodeQL / '*) ;;
+    *) preserved+=("$context") ;;
+  esac
+done <<< "$existing"
+
+payload="$(printf '%s\n' "${preserved[@]-}" "${contexts[@]}" | jq -Rsc 'split("\n") | map(select(length > 0)) | unique | {strict: true, contexts: .}')"
+
+if [ "$mode" = check ]; then
+  printf '%s\n' "$payload" | jq .
+  exit 0
+fi
+
+current="$protection"
+full_payload="$(jq --argjson checks "$payload" '
+  {
+    required_status_checks: $checks,
+    enforce_admins: .enforce_admins.enabled,
+    required_pull_request_reviews: (
+      if .required_pull_request_reviews == null then null else {
+        dismiss_stale_reviews: .required_pull_request_reviews.dismiss_stale_reviews,
+        require_code_owner_reviews: .required_pull_request_reviews.require_code_owner_reviews,
+        required_approving_review_count: .required_pull_request_reviews.required_approving_review_count,
+        require_last_push_approval: .required_pull_request_reviews.require_last_push_approval
+      } end
+    ),
+    restrictions: (
+      if .restrictions == null then null else {
+        users: [.restrictions.users[].login],
+        teams: [.restrictions.teams[].slug],
+        apps: [.restrictions.apps[].slug]
+      } end
+    ),
+    required_linear_history: .required_linear_history.enabled,
+    allow_force_pushes: .allow_force_pushes.enabled,
+    allow_deletions: .allow_deletions.enabled,
+    block_creations: .block_creations.enabled,
+    required_conversation_resolution: .required_conversation_resolution.enabled,
+    lock_branch: .lock_branch.enabled,
+    allow_fork_syncing: .allow_fork_syncing.enabled
+  }
+' <<< "$current")"
+
+gh api --method PUT "repos/$repo/branches/$branch/protection" \
+  --input - <<< "$full_payload" >/dev/null
+printf 'Updated required checks for %s:%s\n' "$repo" "$branch"

package/.github/scripts/sync-template.sh

@@ -0,0 +1,432 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  cat <<'EOF'
+Usage: sync-template.sh --source PATH_OR_URL [options]
+
+Synchronize the repository-owned baseline without replacing project-specific
+README files, mise tool selections, or additional workflows.
+
+Options:
+  --languages LIST  auto or comma-separated: typescript,rust,python,solidity
+  --features LIST   all or comma-separated standard features
+  --package-manager NAME  auto, bun, pnpm, yarn, or npm
+  --check           Preview changes (default)
+  --apply           Apply changes
+  --prune           Remove disabled standard workflows
+EOF
+}
+
+source_ref="main"
+mode="check"
+source=""
+temp_dir=""
+languages="auto"
+features="all"
+prune=false
+languages_set=false
+features_set=false
+package_manager=""
+package_manager_set=false
+template_ref=""
+release_type="auto"
+npm_publish="false"
+node_version="24.18.0"
+bun_version="1.3.14"
+python_version="3.13"
+rust_version="1.97.1"
+uv_version="0.11.32"
+ruff_version="0.16.0"
+gitignore_backup=""
+custom_ignores=""
+
+valid_languages="typescript rust python solidity"
+valid_features="ci codeql security test draft-pr release-pr release dependabot"
+valid_release_types="auto node python rust simple none"
+
+contains_word() {
+  case " $1 " in *" $2 "*) return 0 ;; *) return 1 ;; esac
+}
+
+normalize_csv() {
+  printf '%s' "$1" | tr ',' ' ' | awk '{$1=$1; print}'
+}
+
+validate_list() {
+  local kind="$1" value="$2" valid="$3" item
+  [ "$value" = auto ] || [ "$value" = all ] || {
+    for item in $(normalize_csv "$value"); do
+      contains_word "$valid" "$item" || { echo "Unsupported $kind: $item" >&2; exit 2; }
+    done
+  }
+}
+
+workflow_enabled() {
+  local workflow="$1" list
+  [ "$features" = all ] && return 0
+  list="$(normalize_csv "$features")"
+  contains_word "$list" "$workflow"
+}
+
+cleanup() {
+  if [ -n "$temp_dir" ]; then rm -rf "$temp_dir"; fi
+  if [ -n "$gitignore_backup" ]; then rm -f "$gitignore_backup"; fi
+  if [ -n "$custom_ignores" ]; then rm -f "$custom_ignores"; fi
+}
+trap cleanup EXIT
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --source) source="${2:?missing source path or URL}"; shift 2 ;;
+    --ref) source_ref="${2:?missing ref}"; shift 2 ;;
+    --languages) languages="${2:?missing language list}"; languages_set=true; shift 2 ;;
+    --features) features="${2:?missing feature list}"; features_set=true; shift 2 ;;
+    --package-manager) package_manager="${2:?missing package manager}"; package_manager_set=true; shift 2 ;;
+    --check) mode="check"; shift ;;
+    --apply) mode="apply"; shift ;;
+    --prune) prune=true; shift ;;
+    -h|--help) usage; exit 0 ;;
+    *) usage >&2; exit 2 ;;
+  esac
+done
+
+[ -n "$source" ] || { usage >&2; exit 2; }
+if [ -f .github/template.yml ]; then
+  if [ "$languages_set" = false ]; then
+    configured_languages="$(awk -F': ' '/^languages:/ {print $2; exit}' .github/template.yml)"
+    [ -n "$configured_languages" ] && languages="$configured_languages"
+  fi
+  if [ "$features_set" = false ]; then
+    configured_features="$(awk -F': ' '/^features:/ {print $2; exit}' .github/template.yml)"
+    [ -n "$configured_features" ] && features="$configured_features"
+  fi
+  if [ "$package_manager_set" = false ]; then
+    package_manager="$(awk -F': ' '/^package_manager:/ {print $2; exit}' .github/template.yml)"
+  fi
+  template_ref="$(awk -F': ' '/^template:/ {print $2; exit}' .github/template.yml)"
+  configured_release_type="$(awk -F': ' '/^release_type:/ {print $2; exit}' .github/template.yml)"
+  configured_npm_publish="$(awk -F': ' '/^npm_publish:/ {print $2; exit}' .github/template.yml)"
+  [ -n "$configured_release_type" ] && release_type="$configured_release_type"
+  [ -n "$configured_npm_publish" ] && npm_publish="$configured_npm_publish"
+fi
+[ -n "$package_manager" ] || package_manager=auto
+case "$package_manager" in
+  auto|bun|pnpm|yarn|npm) ;;
+  *) printf 'Unsupported package manager: %s\n' "$package_manager" >&2; exit 2 ;;
+esac
+validate_list language "$languages" "$valid_languages"
+validate_list feature "$features" "$valid_features"
+contains_word "$valid_release_types" "$release_type" || {
+  printf 'Unsupported release type: %s\n' "$release_type" >&2
+  exit 2
+}
+
+if [ -d "$source" ] && [ -f "$source/.github/scripts/sync-template.sh" ]; then
+  template_root="$source"
+else
+  command -v git >/dev/null 2>&1 || { echo "git is required" >&2; exit 1; }
+  temp_dir="$(mktemp -d)"
+  git clone --quiet --depth 1 --branch "$source_ref" "$source" "$temp_dir/template-repo"
+  template_root="$temp_dir/template-repo"
+fi
+
+if [ -f "$template_root/package.json" ]; then
+  template_version="$(awk -F'"' '/"version"[[:space:]]*:/ {print $4; exit}' "$template_root/package.json")"
+  [ -n "$template_version" ] && template_ref="code-foundry@$template_version"
+fi
+
+files=(
+  .editorconfig
+  .gitattributes
+  .gitignore
+  release-please-config.json
+  .githooks/pre-commit
+  AGENTS.md
+  LICENSE
+  NOTICE
+  ruff.toml
+  .prettierrc
+  .github/CODEOWNERS
+  .github/template.yml.example
+  .github/CODE_OF_CONDUCT.md
+  .github/CONTRIBUTING.md
+  .github/PULL_REQUEST_TEMPLATE.md
+  .github/SECURITY.md
+  .github/dependabot.yml
+  .github/ISSUE_TEMPLATE/bug_report.yml
+  .github/ISSUE_TEMPLATE/config.yml
+  .github/ISSUE_TEMPLATE/feature_request.yml
+  .github/actions/setup/action.yml
+  .github/actions/cache/action.yml
+  .github/actions/codeql/action.yml
+  .github/scripts/bootstrap.sh
+  .github/scripts/changed-files.sh
+  .github/scripts/ci.sh
+  .github/scripts/codeql-languages.sh
+  .github/scripts/doctor.sh
+  .github/scripts/security.sh
+  .github/scripts/sitecustomize.py
+  .github/scripts/sync-template.sh
+  .github/scripts/init-repo.sh
+  .github/scripts/sync-codeowners.sh
+  .github/scripts/sync-protection.sh
+  .github/workflows/ci.yml
+  .github/workflows/codeql.yml
+  .github/workflows/draft-pr.yml
+  .github/workflows/release-pr.yml
+  .github/workflows/release.yml
+  .github/workflows/security.yml
+  .github/workflows/test.yml
+)
+
+filtered_files=()
+for file in "${files[@]}"; do
+  case "$file" in
+    .github/dependabot.yml) workflow_enabled dependabot && filtered_files+=("$file") ;;
+    .github/workflows/ci.yml) workflow_enabled ci && filtered_files+=("$file") ;;
+    .github/workflows/codeql.yml) workflow_enabled codeql && filtered_files+=("$file") ;;
+    .github/workflows/security.yml) workflow_enabled security && filtered_files+=("$file") ;;
+    .github/workflows/test.yml) workflow_enabled test && filtered_files+=("$file") ;;
+    .github/workflows/draft-pr.yml) workflow_enabled draft-pr && filtered_files+=("$file") ;;
+    .github/workflows/release-pr.yml) workflow_enabled release-pr && filtered_files+=("$file") ;;
+    .github/workflows/release.yml) workflow_enabled release && filtered_files+=("$file") ;;
+    *) filtered_files+=("$file") ;;
+  esac
+done
+files=("${filtered_files[@]}")
+
+# Workflows outside the standard baseline are repository-owned extensions.
+# The sync operation never deletes or replaces them; surface them explicitly
+# so maintainers can verify custom deployment, indexing, or security flows.
+standard_workflow() {
+  case "$1" in
+    ci.yml|codeql.yml|draft-pr.yml|release-pr.yml|release.yml|security.yml|test.yml) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+custom_workflows=()
+if [ -d .github/workflows ]; then
+  while IFS= read -r workflow; do
+    workflow="${workflow#./}"
+    workflow="${workflow#.github/workflows/}"
+    standard_workflow "$workflow" || custom_workflows+=("$workflow")
+  done < <(find .github/workflows -maxdepth 1 -type f -print | sort)
+fi
+if [ "${#custom_workflows[@]}" -gt 0 ]; then
+  printf 'Preserving custom workflows: %s\n' "${custom_workflows[*]}"
+fi
+
+changed=0
+for file in "${files[@]}"; do
+  template_file="$template_root/$file"
+  # npm renames .gitignore to .npmignore when installing a package. Treat the
+  # renamed file as the same template asset so packaged initialization works.
+  if [ "$file" = .gitignore ] && [ ! -f "$template_file" ] && [ -f "$template_root/.npmignore" ]; then
+    template_file="$template_root/.npmignore"
+  fi
+  if [ ! -f "$template_file" ]; then
+    echo "Template file missing: $file" >&2
+    exit 1
+  fi
+  if [ "$file" = .github/CODEOWNERS ] && [ -f "$file" ]; then
+    continue
+  fi
+  if [ ! -f "$file" ] || ! cmp -s "$template_file" "$file"; then
+    changed=$((changed + 1))
+    if [ "$mode" = "check" ]; then
+      printf 'Would sync %s\n' "$file"
+    else
+      mkdir -p "$(dirname "$file")"
+      if [ "$file" = .gitignore ] && [ -f "$file" ]; then
+        # Keep repository-specific ignore rules while refreshing the shared
+        # baseline. This prevents a template sync from hiding generated files
+        # or local tooling that only one project uses.
+        gitignore_backup="$(mktemp)"
+        custom_ignores="$(mktemp)"
+        cp "$file" "$gitignore_backup"
+        cp "$template_file" "$file"
+        awk 'NR == FNR { seen[$0] = 1; next } /^# Repository-specific rules$/ { next } NF && !seen[$0] { print }' \
+          "$template_file" "$gitignore_backup" > "$custom_ignores"
+        if [ -s "$custom_ignores" ]; then
+          {
+            printf '\n# Repository-specific rules\n'
+            cat "$custom_ignores"
+          } >> "$file"
+        fi
+        rm -f "$gitignore_backup" "$custom_ignores"
+        gitignore_backup=""
+        custom_ignores=""
+      else
+        cp "$template_file" "$file"
+      fi
+      case "$file" in
+        .githooks/*|.github/scripts/*) chmod +x "$file" ;;
+      esac
+      printf 'Synced %s\n' "$file"
+    fi
+  fi
+done
+
+# Release Please owns changelog updates after initialization. Preserve an
+# existing project history, but give new repositories the expected file.
+if [ ! -f CHANGELOG.md ]; then
+  changed=$((changed + 1))
+  if [ "$mode" = "check" ]; then
+    printf '%s\n' 'Would initialize CHANGELOG.md'
+  else
+    cat > CHANGELOG.md <<'EOF'
+# Changelog
+
+All notable changes to this project are documented here.
+EOF
+    printf '%s\n' 'Initialized CHANGELOG.md'
+  fi
+fi
+
+detect_languages() {
+  local detected=()
+  if [ -f package.json ] || git ls-files -- '*.js' '*.jsx' '*.ts' '*.tsx' | grep -q .; then
+    detected+=(typescript)
+  fi
+  if [ -f Cargo.toml ] || git ls-files -- '*.rs' | grep -q .; then
+    detected+=(rust)
+  fi
+  if [ -f pyproject.toml ] || [ -f requirements.txt ] || [ -f requirements-dev.txt ] ||
+    git ls-files -- '*.py' ':!.github/**' | grep -q .; then
+    detected+=(python)
+  fi
+  if find . -path './.git' -prune -o -type f -name '*.sol' -print | grep -q .; then
+    detected+=(solidity)
+  fi
+  printf '%s\n' "${detected[*]}"
+}
+
+initialize_mise() {
+  local selected_languages="$1"
+  local language selected_package_manager
+  if [ -f .mise.toml ]; then
+    return
+  fi
+  if [ "$selected_languages" = auto ]; then
+    selected_languages="$(detect_languages)"
+  fi
+  selected_package_manager="$package_manager"
+  if [ "$selected_package_manager" = auto ]; then
+    if [ -f bun.lock ] || [ -f bun.lockb ]; then selected_package_manager=bun
+    elif [ -f pnpm-lock.yaml ]; then selected_package_manager=pnpm
+    elif [ -f yarn.lock ]; then selected_package_manager=yarn
+    elif [ -f package-lock.json ]; then selected_package_manager=npm
+    else selected_package_manager=bun
+    fi
+  fi
+  changed=$((changed + 1))
+  if [ "$mode" = check ]; then
+    printf '%s\n' 'Would initialize .mise.toml'
+    return
+  fi
+  {
+    printf '%s\n' '[tools]'
+    for language in $(normalize_csv "$selected_languages"); do
+      case "$language" in
+        typescript|solidity)
+          printf 'node = "%s"\n' "$node_version"
+          if [ "$selected_package_manager" = bun ]; then
+            printf 'bun = "%s"\n' "$bun_version"
+          fi
+          ;;
+        python)
+          printf 'python = "%s"\n' "$python_version"
+          printf 'uv = "%s"\n' "$uv_version"
+          printf 'ruff = "%s"\n' "$ruff_version"
+          ;;
+        rust)
+          printf 'rust = { version = "%s", components = ["rustfmt", "clippy"] }\n' "$rust_version"
+          ;;
+      esac
+    done | awk '!seen[$0]++'
+    printf '\n%s\n' '[settings]'
+    printf '%s\n' 'experimental = true'
+  } > .mise.toml
+  printf '%s\n' 'Initialized .mise.toml'
+}
+
+initialize_mise "$languages"
+
+initialize_mise_lock() {
+  if [ ! -f .mise.toml ] || [ -f mise.lock ]; then
+    return
+  fi
+  if ! command -v mise >/dev/null 2>&1; then
+    return
+  fi
+  changed=$((changed + 1))
+  if [ "$mode" = check ]; then
+    printf '%s\n' 'Would initialize mise.lock'
+    return
+  fi
+  if MISE_TRUSTED_CONFIG_PATHS="$PWD" mise lock >/dev/null 2>&1; then
+    printf '%s\n' 'Initialized mise.lock'
+  else
+    printf '%s\n' 'Warning: mise.lock could not be generated; CI will resolve pinned tools normally.' >&2
+  fi
+}
+
+initialize_mise_lock
+
+if [ -x .github/scripts/sync-codeowners.sh ]; then
+  if [ "$mode" = "check" ]; then
+    bash .github/scripts/sync-codeowners.sh --check
+  else
+    bash .github/scripts/sync-codeowners.sh --apply
+  fi
+fi
+
+# Release Please's simple strategy needs a version file. Initialize one only
+# for Solidity-only repositories, where no package manifest owns the version.
+if [ ! -f version.txt ] && find . -path './.git' -prune -o -type f -name '*.sol' -print | grep -q . &&
+  [ ! -f package.json ] && [ ! -f Cargo.toml ] && [ ! -f pyproject.toml ]; then
+  changed=$((changed + 1))
+  if [ "$mode" = "check" ]; then
+    printf '%s\n' 'Would initialize version.txt'
+  else
+    printf '%s\n' '0.1.0' > version.txt
+    printf '%s\n' 'Initialized version.txt'
+  fi
+fi
+
+if [ "$mode" = "apply" ]; then
+  git config core.hooksPath .githooks
+  mkdir -p .github
+  {
+    printf 'version: 1\n'
+    if [ -n "$template_ref" ]; then
+      printf 'template: %s\n' "$template_ref"
+    fi
+    printf 'languages: %s\n' "$languages"
+    printf 'features: %s\n' "$features"
+    if [ -n "$package_manager" ]; then
+      printf 'package_manager: %s\n' "$package_manager"
+    fi
+    printf 'release_type: %s\n' "$release_type"
+    printf 'npm_publish: %s\n' "$npm_publish"
+  } > .github/template.yml
+fi
+
+if [ "$prune" = true ]; then
+  for workflow in ci codeql security test draft-pr release-pr release; do
+    file=".github/workflows/$workflow.yml"
+    if [ -f "$file" ] && ! workflow_enabled "$workflow"; then
+      changed=$((changed + 1))
+      if [ "$mode" = "check" ]; then
+        printf 'Would remove disabled standard workflow %s\n' "$file"
+      else
+        rm "$file"
+        printf 'Removed disabled standard workflow %s\n' "$file"
+      fi
+    fi
+  done
+fi
+
+printf '%s\n' "$changed baseline file(s) differ."