code-foundry 0.16.0 → 0.17.0

package/.github/workflows/release.yml

@@ -9,107 +9,10 @@ permissions:
   contents: write
   issues: write
   pull-requests: write
-
-env:
-  REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
-  REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
-  REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
-  REPO_FOUNDRY_PACKAGE_MANAGER: ${{ vars.REPO_FOUNDRY_PACKAGE_MANAGER }}
-  REPO_FOUNDRY_RELEASE_TYPE: ${{ vars.REPO_FOUNDRY_RELEASE_TYPE }}
-  REPO_FOUNDRY_NPM_PUBLISH: ${{ vars.REPO_FOUNDRY_NPM_PUBLISH }}
+  id-token: write
 
 jobs:
   release:
-    name: Release / Version
-    runs-on: ubuntu-slim
-    timeout-minutes: 20
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.ref }}
-      cancel-in-progress: false
-    outputs:
-      release_created: ${{ steps.release.outputs.release_created || 'false' }}
-      tag_name: ${{ steps.release.outputs.tag_name }}
-      npm_publish: ${{ steps.profile.outputs.npm_publish }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          # Release Please reads release metadata and manifests; defer source
-          # blob transfer until a package file is actually needed.
-          filter: blob:none
-      - name: Detect release profile
-        id: profile
-        shell: bash
-        run: |
-          if [ -x .github/scripts/profile.sh ]; then
-            release_type="$(bash .github/scripts/profile.sh get release_type)"
-            npm_publish="$(bash .github/scripts/profile.sh get npm_publish)"
-          else
-            release_type="$(awk -F': ' '/^release_type:/ {print $2; exit}' .github/template.yml 2>/dev/null || true)"
-            npm_publish="$(awk -F': ' '/^npm_publish:/ {print $2; exit}' .github/template.yml 2>/dev/null || true)"
-          fi
-          [ -n "$release_type" ] || release_type=auto
-          [ -n "$npm_publish" ] || npm_publish=false
-
-          if [ "$release_type" = auto ]; then
-            if [ -f package.json ]; then release_type=node
-            elif [ -f pyproject.toml ]; then release_type=python
-            elif [ -f Cargo.toml ]; then release_type=rust
-            elif [ -f version.txt ]; then release_type=simple
-            else release_type=none
-            fi
-          fi
-
-          case "$release_type" in
-            node|python|rust|simple) ;;
-            none) npm_publish=false ;;
-            *) echo "Unsupported release_type: $release_type" >&2; exit 2 ;;
-          esac
-          if [ ! -f package.json ]; then npm_publish=false; fi
-          printf 'release_type=%s\n' "$release_type" >> "$GITHUB_OUTPUT"
-          printf 'npm_publish=%s\n' "$npm_publish" >> "$GITHUB_OUTPUT"
-      - name: Release Please
-        id: release
-        if: steps.profile.outputs.release_type != 'none'
-        uses: googleapis/release-please-action@v5
-        with:
-          # Use a PAT or GitHub App token when GITHUB_TOKEN cannot create PRs.
-          token: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }}
-          config-file: release-please-config.json
-          release-type: ${{ steps.profile.outputs.release_type }}
-
-  npm:
-    name: Release / Publish npm
-    needs: release
-    if: needs.release.outputs.release_created == 'true' && needs.release.outputs.npm_publish == 'true'
-    runs-on: ubuntu-slim
-    timeout-minutes: 15
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-    steps:
-      - name: Checkout release
-        uses: actions/checkout@v7
-        with:
-          ref: ${{ needs.release.outputs.tag_name }}
-      - name: Setup Node (trusted)
-        if: env.NPM_TOKEN == ''
-        uses: actions/setup-node@v5
-        with:
-          node-version: 24
-      - name: Setup Node (token)
-        if: env.NPM_TOKEN != ''
-        uses: actions/setup-node@v5
-        with:
-          node-version: 24
-          registry-url: https://registry.npmjs.org
-      - name: Publish npm with token
-        if: env.NPM_TOKEN != ''
-        env:
-          NODE_AUTH_TOKEN: ${{ env.NPM_TOKEN }}
-        run: npm publish --provenance --access public
-      - name: Publish npm with trusted publishing
-        if: env.NPM_TOKEN == ''
-        run: npm publish --provenance --access public
+    name: Release
+    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-release.yml@v0.16.0
+    secrets: inherit

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [0.17.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.16.0...v0.17.0) (2026-07-28)
+
+
+### Features
+
+* **release:** document centralized release runtime ([3e2a3f9](https://github.com/0xPlayerOne/code-foundry/commit/3e2a3f9b5e71bf5003819aa177afd265d989bb34))
+
+
+### Bug Fixes
+
+* **release:** grant trusted publishing permission ([025f78e](https://github.com/0xPlayerOne/code-foundry/commit/025f78e851d44a60e2e4e17d3718b0b2fbe147ae))
+
 ## [0.16.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.15.0...v0.16.0) (2026-07-28)
 
 

package/README.md

@@ -55,6 +55,11 @@ CodeQL is also independently reusable through the same contract. It retains
 GitHub's native security-event permissions and language-specific analysis while
 keeping CodeQL separate from CI and dependency security checks.
 
+Release automation follows the same model: the consumer keeps a short
+main-branch wrapper while the shared runtime handles Release Please, GitHub
+release metadata, optional npm publication, provenance, and token/trusted
+publishing fallback.
+
 Initialization defaults to AGPL for new repositories. Synchronization defaults
 to `--license preserve`, so an existing repository's license is never replaced
 unless you explicitly select a license or provide `--license-file`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",