code-foundry 0.16.0 → 0.18.0

package/.github/scripts/init-repo.sh

@@ -11,7 +11,7 @@ force=false
 languages="${REPO_FOUNDRY_LANGUAGES:-auto}"
 features="${REPO_FOUNDRY_FEATURES:-all}"
 package_manager="${REPO_FOUNDRY_PACKAGE_MANAGER:-auto}"
-runtime_repository="${REPO_FOUNDRY_RUNTIME_REPOSITORY:-0xPlayerOne/code-foundry}"
+runtime_repository="${REPO_FOUNDRY_RUNTIME_REPOSITORY:-}"
 bootstrap=true
 release_type="${REPO_FOUNDRY_RELEASE_TYPE:-auto}"
 npm_publish="${REPO_FOUNDRY_NPM_PUBLISH:-false}"
@@ -38,7 +38,7 @@ Options:
   --features LIST            all or comma-separated optional features:
                              ci,codeql,security,test,draft-pr,release-pr,release,dependabot
   --package-manager NAME     auto, bun, pnpm, yarn, or npm
-  --runtime-repository OWNER/REPO  Reusable workflow runtime repository
+  --runtime-repository OWNER/REPO  Reusable workflow runtime repository (auto from source)
   --release-type NAME        auto, node, python, rust, or simple
   --license NAME             agpl-3.0-or-later, mit, preserve, or none
   --license-file PATH        Use an exact custom license file
@@ -111,9 +111,9 @@ sync_args=(
   --languages "$languages"
   --features "$features"
   --package-manager "$package_manager"
-  --runtime-repository "$runtime_repository"
   --license "$license"
 )
+if [ -n "$runtime_repository" ]; then sync_args+=(--runtime-repository "$runtime_repository"); fi
 if [ -n "$license_file" ]; then sync_args+=(--license-file "$license_file"); fi
 if [ "$dry_run" = true ]; then sync_args+=(--check); else sync_args+=(--apply); fi
 if [ "$prune" = true ]; then sync_args+=(--prune); fi

package/.github/scripts/sync-template.sh

@@ -370,16 +370,22 @@ for file in "${files[@]}"; do
 done
 
 # Reusable workflow callers must use a literal repository/ref. Render the
-# selected runtime repository while leaving custom workflows untouched.
+# selected runtime repository while leaving custom workflows untouched. Read
+# the source's configured runtime first so forks remain self-contained.
+source_runtime_repository=""
+if [ -f "$template_root/.github/template.yml" ]; then
+  source_runtime_repository="$(awk -F': ' '/^runtime_repository:/ {print $2; exit}' "$template_root/.github/template.yml")"
+fi
+[ -n "$source_runtime_repository" ] || source_runtime_repository="0xPlayerOne/code-foundry"
 for file in .github/workflows/ci.yml .github/workflows/test.yml .github/workflows/security.yml .github/workflows/codeql.yml; do
   [ -f "$file" ] || continue
-  if grep -q '0xPlayerOne/code-foundry' "$file"; then
+  if grep -qF "$source_runtime_repository" "$file" && [ "$source_runtime_repository" != "$runtime_repository" ]; then
     changed=$((changed + 1))
     if [ "$mode" = "check" ]; then
       printf 'Would render runtime repository in %s\n' "$file"
     else
       rendered_workflow="$(mktemp)"
-      sed "s#0xPlayerOne/code-foundry#$runtime_repository#g" "$file" > "$rendered_workflow"
+      sed "s#${source_runtime_repository}#${runtime_repository}#g" "$file" > "$rendered_workflow"
       mv "$rendered_workflow" "$file"
       printf 'Rendered runtime repository in %s\n' "$file"
     fi

package/.github/workflows/release.yml

@@ -9,107 +9,10 @@ permissions:
   contents: write
   issues: write
   pull-requests: write
-
-env:
-  REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
-  REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
-  REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
-  REPO_FOUNDRY_PACKAGE_MANAGER: ${{ vars.REPO_FOUNDRY_PACKAGE_MANAGER }}
-  REPO_FOUNDRY_RELEASE_TYPE: ${{ vars.REPO_FOUNDRY_RELEASE_TYPE }}
-  REPO_FOUNDRY_NPM_PUBLISH: ${{ vars.REPO_FOUNDRY_NPM_PUBLISH }}
+  id-token: write
 
 jobs:
   release:
-    name: Release / Version
-    runs-on: ubuntu-slim
-    timeout-minutes: 20
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.ref }}
-      cancel-in-progress: false
-    outputs:
-      release_created: ${{ steps.release.outputs.release_created || 'false' }}
-      tag_name: ${{ steps.release.outputs.tag_name }}
-      npm_publish: ${{ steps.profile.outputs.npm_publish }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          # Release Please reads release metadata and manifests; defer source
-          # blob transfer until a package file is actually needed.
-          filter: blob:none
-      - name: Detect release profile
-        id: profile
-        shell: bash
-        run: |
-          if [ -x .github/scripts/profile.sh ]; then
-            release_type="$(bash .github/scripts/profile.sh get release_type)"
-            npm_publish="$(bash .github/scripts/profile.sh get npm_publish)"
-          else
-            release_type="$(awk -F': ' '/^release_type:/ {print $2; exit}' .github/template.yml 2>/dev/null || true)"
-            npm_publish="$(awk -F': ' '/^npm_publish:/ {print $2; exit}' .github/template.yml 2>/dev/null || true)"
-          fi
-          [ -n "$release_type" ] || release_type=auto
-          [ -n "$npm_publish" ] || npm_publish=false
-
-          if [ "$release_type" = auto ]; then
-            if [ -f package.json ]; then release_type=node
-            elif [ -f pyproject.toml ]; then release_type=python
-            elif [ -f Cargo.toml ]; then release_type=rust
-            elif [ -f version.txt ]; then release_type=simple
-            else release_type=none
-            fi
-          fi
-
-          case "$release_type" in
-            node|python|rust|simple) ;;
-            none) npm_publish=false ;;
-            *) echo "Unsupported release_type: $release_type" >&2; exit 2 ;;
-          esac
-          if [ ! -f package.json ]; then npm_publish=false; fi
-          printf 'release_type=%s\n' "$release_type" >> "$GITHUB_OUTPUT"
-          printf 'npm_publish=%s\n' "$npm_publish" >> "$GITHUB_OUTPUT"
-      - name: Release Please
-        id: release
-        if: steps.profile.outputs.release_type != 'none'
-        uses: googleapis/release-please-action@v5
-        with:
-          # Use a PAT or GitHub App token when GITHUB_TOKEN cannot create PRs.
-          token: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }}
-          config-file: release-please-config.json
-          release-type: ${{ steps.profile.outputs.release_type }}
-
-  npm:
-    name: Release / Publish npm
-    needs: release
-    if: needs.release.outputs.release_created == 'true' && needs.release.outputs.npm_publish == 'true'
-    runs-on: ubuntu-slim
-    timeout-minutes: 15
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-    steps:
-      - name: Checkout release
-        uses: actions/checkout@v7
-        with:
-          ref: ${{ needs.release.outputs.tag_name }}
-      - name: Setup Node (trusted)
-        if: env.NPM_TOKEN == ''
-        uses: actions/setup-node@v5
-        with:
-          node-version: 24
-      - name: Setup Node (token)
-        if: env.NPM_TOKEN != ''
-        uses: actions/setup-node@v5
-        with:
-          node-version: 24
-          registry-url: https://registry.npmjs.org
-      - name: Publish npm with token
-        if: env.NPM_TOKEN != ''
-        env:
-          NODE_AUTH_TOKEN: ${{ env.NPM_TOKEN }}
-        run: npm publish --provenance --access public
-      - name: Publish npm with trusted publishing
-        if: env.NPM_TOKEN == ''
-        run: npm publish --provenance --access public
+    name: Release
+    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-release.yml@v0.16.0
+    secrets: inherit

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [0.18.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.17.0...v0.18.0) (2026-07-28)
+
+
+### Features
+
+* **init:** infer runtime from source template ([81a545b](https://github.com/0xPlayerOne/code-foundry/commit/81a545bc6a2d89c31be51a711e477c4e4ceca7dd))
+
+## [0.17.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.16.0...v0.17.0) (2026-07-28)
+
+
+### Features
+
+* **release:** document centralized release runtime ([3e2a3f9](https://github.com/0xPlayerOne/code-foundry/commit/3e2a3f9b5e71bf5003819aa177afd265d989bb34))
+
+
+### Bug Fixes
+
+* **release:** grant trusted publishing permission ([025f78e](https://github.com/0xPlayerOne/code-foundry/commit/025f78e851d44a60e2e4e17d3718b0b2fbe147ae))
+
 ## [0.16.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.15.0...v0.16.0) (2026-07-28)
 
 

package/README.md

@@ -36,11 +36,12 @@ npx code-foundry init --license agpl-3.0-or-later
 npx code-foundry init --license-file ./legal/LICENSE.txt
 ```
 
-Reusable workflow callers default to this package's public runtime. Use
-`--runtime-repository OWNER/REPO` when initializing from an organization fork;
-the selected repository is saved in `.github/template.yml` and rendered into
-the small `ci.yml` and `test.yml` wrappers automatically. The equivalent
-environment variable is `REPO_FOUNDRY_RUNTIME_REPOSITORY`.
+Reusable workflow callers use the source template's runtime automatically. For
+example, initializing from `NiftyLeague/template-repo` selects that fork's
+runtime without extra flags. Use `--runtime-repository OWNER/REPO` (or
+`REPO_FOUNDRY_RUNTIME_REPOSITORY`) only when you want to override it. The
+selected repository is saved in `.github/template.yml` and rendered into the
+small CI, Test, Security, and CodeQL wrappers automatically.
 
 Normal synchronization imports only the local hook, agent-facing command,
 profile/release, initializer, doctor, ownership, and protection entrypoints.
@@ -55,6 +56,11 @@ CodeQL is also independently reusable through the same contract. It retains
 GitHub's native security-event permissions and language-specific analysis while
 keeping CodeQL separate from CI and dependency security checks.
 
+Release automation follows the same model: the consumer keeps a short
+main-branch wrapper while the shared runtime handles Release Please, GitHub
+release metadata, optional npm publication, provenance, and token/trusted
+publishing fallback.
+
 Initialization defaults to AGPL for new repositories. Synchronization defaults
 to `--license preserve`, so an existing repository's license is never replaced
 unless you explicitly select a license or provide `--license-file`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "code-foundry",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "A fast, language-aware repository factory for agent-ready workflows, testing, security, and release automation.",
   "type": "module",
   "license": "AGPL-3.0-or-later",

package/src/cli.mjs

@@ -50,7 +50,10 @@ function parseArgs(argv) {
     languages: process.env.REPO_FOUNDRY_LANGUAGES || 'auto',
     features: process.env.REPO_FOUNDRY_FEATURES || 'all',
     packageManager: process.env.REPO_FOUNDRY_PACKAGE_MANAGER || 'auto',
-    runtimeRepository: process.env.REPO_FOUNDRY_RUNTIME_REPOSITORY || '0xPlayerOne/code-foundry',
+    // Leave this empty unless the caller explicitly selects a runtime. The
+    // initializer can then derive the runtime from --source, which keeps
+    // organization forks plug-and-play.
+    runtimeRepository: process.env.REPO_FOUNDRY_RUNTIME_REPOSITORY || '',
     releaseType: process.env.REPO_FOUNDRY_RELEASE_TYPE || 'auto',
     license: process.env.REPO_FOUNDRY_LICENSE || (command === 'init' ? 'agpl-3.0-or-later' : 'preserve'),
     licenseFile: process.env.REPO_FOUNDRY_LICENSE_FILE || '',
@@ -123,7 +126,7 @@ function main() {
   if (options.licenseFile) common.push('--license-file', options.licenseFile)
   if (options.languagesSet) common.push('--languages', options.languages)
   if (options.featuresSet) common.push('--features', options.features)
-  common.push('--runtime-repository', options.runtimeRepository)
+  if (options.runtimeRepository) common.push('--runtime-repository', options.runtimeRepository)
   if (options.prune) common.push('--prune')
   if (options.force) common.push('--force')
   if (options.dryRun) common.push('--check')
@@ -137,10 +140,10 @@ function main() {
       '--languages', options.languages,
       '--features', options.features,
       '--package-manager', options.packageManager,
-      '--runtime-repository', options.runtimeRepository,
       '--release-type', options.releaseType,
       '--license', options.license,
     ]
+    if (options.runtimeRepository) initArgs.push('--runtime-repository', options.runtimeRepository)
     if (options.licenseFile) initArgs.push('--license-file', options.licenseFile)
     if (options.protection) initArgs.push('--protection')
     if (options.dryRun) initArgs.push('--dry-run')