code-foundry 0.12.0 → 0.14.0

package/.github/scripts/doctor.sh

@@ -91,10 +91,12 @@ for workflow in ci codeql security test draft-pr release-pr release; do
   fi
 done
 
-for script in ci.sh codeql-languages.sh profile.sh security.sh doctor.sh bootstrap.sh sync-template.sh init-repo.sh sync-protection.sh sync-codeowners.sh; do
+for script in ci.sh profile.sh doctor.sh bootstrap.sh sync-template.sh init-repo.sh sync-protection.sh sync-codeowners.sh; do
   [ -x ".github/scripts/$script" ] || error "missing executable script: .github/scripts/$script"
 done
 
+printf '%s\n' 'Remote CI, Test, Security, and CodeQL runtimes are loaded by reusable workflow wrappers.'
+
 if [ "$errors" -gt 0 ]; then
   printf '%s\n' "Repository doctor found $errors error(s)." >&2
   exit 1

package/.github/scripts/sync-template.sh

@@ -243,17 +243,11 @@ files=(
   .github/ISSUE_TEMPLATE/bug_report.yml
   .github/ISSUE_TEMPLATE/config.yml
   .github/ISSUE_TEMPLATE/feature_request.yml
-  .github/actions/setup/action.yml
-  .github/actions/cache/action.yml
-  .github/actions/codeql/action.yml
   .github/scripts/profile.sh
   .github/scripts/bootstrap.sh
   .github/scripts/changed-files.sh
   .github/scripts/ci.sh
-  .github/scripts/codeql-languages.sh
   .github/scripts/doctor.sh
-  .github/scripts/security.sh
-  .github/scripts/sitecustomize.py
   .github/scripts/pre-commit.sh
   .github/scripts/sync-template.sh
   .github/scripts/init-repo.sh

package/.github/workflows/codeql.yml

@@ -15,151 +15,8 @@ permissions:
   packages: read
   security-events: write
 
-env:
-  REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
-  REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
-  REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
-  cancel-in-progress: true
-
 jobs:
-  detect:
-    name: Detect
-    runs-on: ubuntu-slim
-    timeout-minutes: 10
-    outputs:
-      languages: ${{ steps.languages.outputs.languages }}
-      code_security: ${{ steps.security.outputs.status }}
-      actions_available: ${{ steps.languages.outputs.actions_available }}
-      actions_changed: ${{ steps.languages.outputs.actions_changed }}
-      actions_build_mode: ${{ steps.languages.outputs.actions_build_mode }}
-      javascript_available: ${{ steps.languages.outputs.javascript_available }}
-      javascript_changed: ${{ steps.languages.outputs.javascript_changed }}
-      javascript_build_mode: ${{ steps.languages.outputs.javascript_build_mode }}
-      python_available: ${{ steps.languages.outputs.python_available }}
-      python_changed: ${{ steps.languages.outputs.python_changed }}
-      python_build_mode: ${{ steps.languages.outputs.python_build_mode }}
-      rust_available: ${{ steps.languages.outputs.rust_available }}
-      rust_changed: ${{ steps.languages.outputs.rust_changed }}
-      rust_build_mode: ${{ steps.languages.outputs.rust_build_mode }}
-    steps:
-      - name: Detect Code Security
-        id: security
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          status="disabled"
-          if [ "${{ github.event.repository.private }}" != "true" ]; then
-            status="enabled"
-          else
-            status="$(gh api "repos/${GITHUB_REPOSITORY}" --jq '.security_and_analysis.code_security.status // "disabled"' 2>/dev/null || printf 'disabled')"
-          fi
-          printf 'status=%s\n' "$status" >> "$GITHUB_OUTPUT"
-      - name: Checkout
-        if: ${{ !github.event.repository.private || steps.security.outputs.status == 'enabled' }}
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 2
-          # Detection only reads Git trees, paths, and small profile files;
-          # defer source blob transfer until the analyzer jobs.
-          filter: blob:none
-          sparse-checkout: |
-            .github
-            .mise.toml
-            mise.lock
-            package.json
-            bun.lock
-            bun.lockb
-            pnpm-lock.yaml
-            yarn.lock
-            package-lock.json
-      - id: languages
-        name: Detect languages
-        env:
-          CODEQL_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
-          REPO_FOUNDRY_CODE_SECURITY: ${{ steps.security.outputs.status }}
-          REPO_FOUNDRY_PRIVATE: ${{ github.event.repository.private }}
-        run: |
-          if [ "$REPO_FOUNDRY_PRIVATE" = "true" ] && [ "$REPO_FOUNDRY_CODE_SECURITY" != "enabled" ]; then
-            echo 'languages=[]' >> "$GITHUB_OUTPUT"
-          else
-            bash .github/scripts/codeql-languages.sh
-          fi
-
-  analyze-actions:
-    name: Analyze (Actions)
-    needs: detect
-    if: >-
-      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
-      needs.detect.outputs.actions_available == 'true' &&
-      needs.detect.outputs.actions_changed == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-      - name: Analyze
-        uses: ./.github/actions/codeql
-        with:
-          language: actions
-          build-mode: ${{ needs.detect.outputs.actions_build_mode }}
-          category: /language:actions
-
-  analyze-typescript:
-    name: Analyze (TypeScript)
-    needs: detect
-    if: >-
-      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
-      needs.detect.outputs.javascript_available == 'true' &&
-      needs.detect.outputs.javascript_changed == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-      - name: Analyze
-        uses: ./.github/actions/codeql
-        with:
-          language: javascript-typescript
-          build-mode: ${{ needs.detect.outputs.javascript_build_mode }}
-          category: /language:javascript-typescript
-
-  analyze-python:
-    name: Analyze (Python)
-    needs: detect
-    if: >-
-      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
-      needs.detect.outputs.python_available == 'true' &&
-      needs.detect.outputs.python_changed == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-      - name: Analyze
-        uses: ./.github/actions/codeql
-        with:
-          language: python
-          build-mode: ${{ needs.detect.outputs.python_build_mode }}
-          category: /language:python
-
-  analyze-rust:
-    name: Analyze (Rust)
-    needs: detect
-    if: >-
-      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
-      needs.detect.outputs.rust_available == 'true' &&
-      needs.detect.outputs.rust_changed == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-      - name: Analyze
-        uses: ./.github/actions/codeql
-        with:
-          language: rust
-          build-mode: ${{ needs.detect.outputs.rust_build_mode }}
-          category: /language:rust
+  codeql:
+    name: CodeQL
+    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-codeql.yml@v0.12.0
+    secrets: inherit

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.14.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.13.0...v0.14.0) (2026-07-28)
+
+
+### Features
+
+* **init:** minimize consumer workflow footprint ([4427c1f](https://github.com/0xPlayerOne/code-foundry/commit/4427c1f964c3a0dc6ffe080ea3779ad2b8a1d170))
+
+## [0.13.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.12.0...v0.13.0) (2026-07-28)
+
+
+### Features
+
+* **codeql:** document centralized CodeQL runtime ([2aa20a9](https://github.com/0xPlayerOne/code-foundry/commit/2aa20a946d0979cb12af87cb2ea2d0b50f279965))
+
 ## [0.12.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.11.0...v0.12.0) (2026-07-28)
 
 

package/README.md

@@ -42,10 +42,19 @@ the selected repository is saved in `.github/template.yml` and rendered into
 the small `ci.yml` and `test.yml` wrappers automatically. The equivalent
 environment variable is `REPO_FOUNDRY_RUNTIME_REPOSITORY`.
 
+Normal synchronization imports only the local hook, agent-facing command,
+profile/release, initializer, doctor, ownership, and protection entrypoints.
+Workflow-only actions and Security/CodeQL analyzers stay in the versioned
+runtime package and are not duplicated in consumer repositories.
+
 The standard Security wrapper uses the same runtime contract, so dependency
 audits and the public-only Dependency Review policy can be upgraded centrally
 without copying security scripts into every consumer repository.
 
+CodeQL is also independently reusable through the same contract. It retains
+GitHub's native security-event permissions and language-specific analysis while
+keeping CodeQL separate from CI and dependency security checks.
+
 Initialization defaults to AGPL for new repositories. Synchronization defaults
 to `--license preserve`, so an existing repository's license is never replaced
 unless you explicitly select a license or provide `--license-file`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",