code-foundry 0.24.1 → 0.25.0

package/.github/scripts/sync-template.sh

@@ -390,7 +390,7 @@ done
 standard_workflow() {
   case "$1" in
     ci.yml|codeql.yml|draft-pr.yml|release-pr.yml|release.yml|security.yml|test.yml) return 0 ;;
-    reusable-draft-pr.yml|reusable-release-pr.yml) return 0 ;;
+    *_self-ci.yml) return 0 ;;
     *) return 1 ;;
   esac
 }
@@ -417,6 +417,13 @@ fi
 
 for file in "${files[@]}"; do
   template_file="$template_root/$file"
+  case "$file" in
+    .github/workflows/*.yml)
+      workflow_name="${file##*/}"
+      workflow_name="${workflow_name%.yml}"
+      template_file="$template_root/.github/workflows/${workflow_name}_self-ci.yml"
+      ;;
+  esac
   # npm renames .gitignore to .npmignore when installing a package. Treat the
   # renamed file as the same template asset so packaged initialization works.
   if [ "$file" = .gitignore ] && [ ! -f "$template_file" ] && [ -f "$template_root/.npmignore" ]; then
@@ -489,7 +496,7 @@ fi
 [ -n "$source_runtime_ref" ] || source_runtime_ref="$runtime_ref"
 for file in .github/workflows/ci.yml .github/workflows/test.yml .github/workflows/security.yml .github/workflows/codeql.yml .github/workflows/draft-pr.yml .github/workflows/release-pr.yml .github/workflows/release.yml; do
   [ -f "$file" ] || continue
-  if grep -qF "$source_runtime_repository@" "$file" || grep -q 'runtime-ref:' "$file"; then
+  if grep -qF "$source_runtime_repository@" "$file" || grep -q 'runtime-ref:' "$file" || grep -qF 'uses: ./.github/workflows/' "$file"; then
     changed=$((changed + 1))
     if [ "$mode" = "check" ]; then
       printf 'Would render runtime repository in %s\n' "$file"
@@ -506,6 +513,7 @@ for file in .github/workflows/ci.yml .github/workflows/test.yml .github/workflow
       rendered_workflow="$(mktemp)"
       sed -E \
         -e "s#${source_runtime_repository}@[^[:space:]]+#${runtime_repository}@${runtime_ref}#g" \
+        -e "s#uses: \.\/.github/workflows/([^[:space:]]+)#uses: ${runtime_repository}/.github/workflows/\\1@${runtime_ref}#g" \
         -e "s#runtime-ref: [^[:space:]]+#runtime-ref: ${runtime_ref}#g" \
         -e "s#^      runner: [^[:space:]]+#      runner: ${runner_value}#" \
         -e "s#^      unit-runner: [^[:space:]]+#      unit-runner: ${unit_runner}#" \

package/.github/workflows/ci.yml

@@ -1,21 +1,184 @@
-name: CI
+name: Code Foundry CI
 
 on:
-  push:
-    branches: [main, staging]
-  pull_request:
-    branches: [staging]
-  workflow_dispatch:
+  workflow_call:
+    inputs:
+      runtime-repository:
+        description: Repository containing the Code Foundry runtime.
+        required: false
+        type: string
+        default: 0xPlayerOne/code-foundry
+      runtime-ref:
+        description: Code Foundry runtime tag or ref.
+        required: false
+        type: string
+        default: v0.20.2
+      runner:
+        description: Runner used by CI jobs.
+        required: false
+        type: string
+        default: ubuntu-latest
 
 permissions:
   contents: read
 
+env:
+  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
+  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
+  REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
+  REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
+  REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
+  REPO_FOUNDRY_PACKAGE_MANAGER: ${{ vars.REPO_FOUNDRY_PACKAGE_MANAGER }}
+  REPO_FOUNDRY_RUNNER: ${{ vars.REPO_FOUNDRY_RUNNER }}
+  REPO_FOUNDRY_CACHE_PACKAGES: ${{ vars.REPO_FOUNDRY_CACHE_PACKAGES || 'auto' }}
+  REPO_FOUNDRY_CACHE_BUILD: ${{ vars.REPO_FOUNDRY_CACHE_BUILD || 'auto' }}
+  REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  cancel-in-progress: true
+
 jobs:
-  ci:
-    name: CI
-    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-ci.yml@v0.22.0
-    with:
-      runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: v0.22.0
-      runner: ubuntu-latest
-    secrets: inherit
+  format:
+    name: Format
+    runs-on: ${{ inputs.runner }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Runtime
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .code-foundry
+          sparse-checkout: |
+            .github/actions
+            .github/scripts
+      - name: Install runtime
+        run: |
+          mkdir -p .github/actions .github/scripts
+          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .code-foundry/.github/scripts/. .github/scripts/
+      - name: Detect
+        id: applicability
+        run: bash .github/scripts/ci.sh should_run format >> "$GITHUB_OUTPUT"
+      - name: Fast path
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/format-fast-path.sh
+      - name: Setup
+        if: steps.applicability.outputs.applicable == 'true'
+        uses: ./.github/actions/setup
+        with:
+          install: 'false'
+          cache-format: 'true'
+          cache-lint: 'false'
+          cache-build: 'false'
+          task: format
+          task-javascript: 'true'
+          task-python: 'false'
+          task-rust: 'false'
+      - name: Format
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/ci.sh format
+
+  lint:
+    name: Lint
+    runs-on: ${{ inputs.runner }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Runtime
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .code-foundry
+          sparse-checkout: |
+            .github/actions
+            .github/scripts
+      - name: Install runtime
+        run: |
+          mkdir -p .github/actions .github/scripts
+          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .code-foundry/.github/scripts/. .github/scripts/
+      - name: Detect
+        id: applicability
+        run: bash .github/scripts/ci.sh should_run lint >> "$GITHUB_OUTPUT"
+      - name: Setup
+        if: steps.applicability.outputs.applicable == 'true'
+        uses: ./.github/actions/setup
+        with:
+          install: 'true'
+          cache-lint: 'true'
+          task: lint
+      - name: Lint
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/ci.sh lint
+
+  type-check:
+    name: Type-Check
+    runs-on: ${{ inputs.runner }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Runtime
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .code-foundry
+          sparse-checkout: |
+            .github/actions
+            .github/scripts
+      - name: Install runtime
+        run: |
+          mkdir -p .github/actions .github/scripts
+          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .code-foundry/.github/scripts/. .github/scripts/
+      - name: Detect
+        id: applicability
+        run: bash .github/scripts/ci.sh should_run type_check >> "$GITHUB_OUTPUT"
+      - name: Setup
+        if: steps.applicability.outputs.applicable == 'true'
+        uses: ./.github/actions/setup
+        with:
+          install: 'true'
+          cache-build: 'true'
+          task: type_check
+      - name: Type-Check
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/ci.sh type_check
+
+  build:
+    name: Build
+    runs-on: ${{ inputs.runner }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Runtime
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .code-foundry
+          sparse-checkout: |
+            .github/actions
+            .github/scripts
+      - name: Install runtime
+        run: |
+          mkdir -p .github/actions .github/scripts
+          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .code-foundry/.github/scripts/. .github/scripts/
+      - name: Detect
+        id: applicability
+        run: bash .github/scripts/ci.sh should_run build >> "$GITHUB_OUTPUT"
+      - name: Setup
+        if: steps.applicability.outputs.applicable == 'true'
+        uses: ./.github/actions/setup
+        with:
+          install: 'true'
+          cache-build: 'true'
+          task: build
+      - name: Build
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/ci.sh build

package/.github/workflows/ci_self-ci.yml

@@ -0,0 +1,21 @@
+name: CI
+
+on:
+  push:
+    branches: [main, staging]
+  pull_request:
+    branches: [staging]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  ci:
+    name: CI
+    uses: ./.github/workflows/ci.yml
+    with:
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: v0.22.0
+      runner: ubuntu-latest
+    secrets: inherit

package/.github/workflows/codeql.yml

@@ -1,13 +1,23 @@
-name: CodeQL
+name: Code Foundry CodeQL
 
 on:
-  push:
-    branches: [main, staging]
-  pull_request:
-    branches: [staging]
-  schedule:
-    - cron: '31 6 * * 1'
-  workflow_dispatch:
+  workflow_call:
+    inputs:
+      runtime-repository:
+        description: Repository containing the Code Foundry runtime.
+        required: false
+        type: string
+        default: 0xPlayerOne/code-foundry
+      runtime-ref:
+        description: Code Foundry runtime tag or ref.
+        required: false
+        type: string
+        default: v0.20.2
+      runner:
+        description: Runner used by CodeQL jobs.
+        required: false
+        type: string
+        default: ubuntu-latest
 
 permissions:
   actions: read
@@ -15,12 +25,222 @@ permissions:
   packages: read
   security-events: write
 
+env:
+  REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
+  REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
+  REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  cancel-in-progress: true
+
 jobs:
-  codeql:
-    name: CodeQL
-    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-codeql.yml@v0.22.0
-    with:
-      runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: v0.22.0
-      runner: ubuntu-latest
-    secrets: inherit
+  detect:
+    name: Detect
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 10
+    outputs:
+      languages: ${{ steps.languages.outputs.languages }}
+      code_security: ${{ steps.security.outputs.status }}
+      actions_available: ${{ steps.languages.outputs.actions_available }}
+      actions_changed: ${{ steps.languages.outputs.actions_changed }}
+      actions_build_mode: ${{ steps.languages.outputs.actions_build_mode }}
+      javascript_available: ${{ steps.languages.outputs.javascript_available }}
+      javascript_changed: ${{ steps.languages.outputs.javascript_changed }}
+      javascript_build_mode: ${{ steps.languages.outputs.javascript_build_mode }}
+      python_available: ${{ steps.languages.outputs.python_available }}
+      python_changed: ${{ steps.languages.outputs.python_changed }}
+      python_build_mode: ${{ steps.languages.outputs.python_build_mode }}
+      rust_available: ${{ steps.languages.outputs.rust_available }}
+      rust_changed: ${{ steps.languages.outputs.rust_changed }}
+      rust_build_mode: ${{ steps.languages.outputs.rust_build_mode }}
+    steps:
+      - name: Detect Code Security
+        id: security
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          status="disabled"
+          if [ "${{ github.event.repository.private }}" != "true" ]; then
+            status="enabled"
+          else
+            status="$(gh api "repos/${GITHUB_REPOSITORY}" --jq '.security_and_analysis.code_security.status // "disabled"' 2>/dev/null || printf 'disabled')"
+          fi
+          printf 'status=%s\n' "$status" >> "$GITHUB_OUTPUT"
+      - name: Checkout
+        if: ${{ !github.event.repository.private || steps.security.outputs.status == 'enabled' }}
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 2
+          filter: blob:none
+          sparse-checkout: |
+            .github
+            .mise.toml
+            mise.lock
+            package.json
+            bun.lock
+            bun.lockb
+            pnpm-lock.yaml
+            yarn.lock
+            package-lock.json
+          sparse-checkout-cone-mode: false
+      - name: Runtime
+        if: ${{ !github.event.repository.private || steps.security.outputs.status == 'enabled' }}
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .code-foundry
+          sparse-checkout: |
+            .github/actions
+            .github/scripts
+      - name: Install runtime
+        if: ${{ !github.event.repository.private || steps.security.outputs.status == 'enabled' }}
+        run: |
+          mkdir -p .github/actions .github/scripts
+          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .code-foundry/.github/scripts/. .github/scripts/
+      - id: languages
+        name: Detect languages
+        env:
+          CODEQL_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
+          REPO_FOUNDRY_CODE_SECURITY: ${{ steps.security.outputs.status }}
+          REPO_FOUNDRY_PRIVATE: ${{ github.event.repository.private }}
+        run: |
+          if [ "$REPO_FOUNDRY_PRIVATE" = "true" ] && [ "$REPO_FOUNDRY_CODE_SECURITY" != "enabled" ]; then
+            echo 'languages=[]' >> "$GITHUB_OUTPUT"
+          else
+            bash .github/scripts/codeql-languages.sh
+          fi
+
+  analyze-actions:
+    name: Analyze (Actions)
+    needs: detect
+    if: >-
+      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
+      needs.detect.outputs.actions_available == 'true' &&
+      needs.detect.outputs.actions_changed == 'true'
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Runtime
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .code-foundry
+          sparse-checkout: |
+            .github/actions
+            .github/scripts
+      - name: Install runtime
+        run: |
+          mkdir -p .github/actions .github/scripts
+          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .code-foundry/.github/scripts/. .github/scripts/
+      - name: Analyze
+        uses: ./.github/actions/codeql
+        with:
+          language: actions
+          build-mode: ${{ needs.detect.outputs.actions_build_mode }}
+          category: /language:actions
+
+  analyze-typescript:
+    name: Analyze (TypeScript)
+    needs: detect
+    if: >-
+      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
+      needs.detect.outputs.javascript_available == 'true' &&
+      needs.detect.outputs.javascript_changed == 'true'
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Runtime
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .code-foundry
+          sparse-checkout: |
+            .github/actions
+            .github/scripts
+      - name: Install runtime
+        run: |
+          mkdir -p .github/actions .github/scripts
+          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .code-foundry/.github/scripts/. .github/scripts/
+      - name: Analyze
+        uses: ./.github/actions/codeql
+        with:
+          language: javascript-typescript
+          build-mode: ${{ needs.detect.outputs.javascript_build_mode }}
+          category: /language:javascript-typescript
+
+  analyze-python:
+    name: Analyze (Python)
+    needs: detect
+    if: >-
+      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
+      needs.detect.outputs.python_available == 'true' &&
+      needs.detect.outputs.python_changed == 'true'
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Runtime
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .code-foundry
+          sparse-checkout: |
+            .github/actions
+            .github/scripts
+      - name: Install runtime
+        run: |
+          mkdir -p .github/actions .github/scripts
+          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .code-foundry/.github/scripts/. .github/scripts/
+      - name: Analyze
+        uses: ./.github/actions/codeql
+        with:
+          language: python
+          build-mode: ${{ needs.detect.outputs.python_build_mode }}
+          category: /language:python
+
+  analyze-rust:
+    name: Analyze (Rust)
+    needs: detect
+    if: >-
+      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
+      needs.detect.outputs.rust_available == 'true' &&
+      needs.detect.outputs.rust_changed == 'true'
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+      - name: Runtime
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .code-foundry
+          sparse-checkout: |
+            .github/actions
+            .github/scripts
+      - name: Install runtime
+        run: |
+          mkdir -p .github/actions .github/scripts
+          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .code-foundry/.github/scripts/. .github/scripts/
+      - name: Analyze
+        uses: ./.github/actions/codeql
+        with:
+          language: rust
+          build-mode: ${{ needs.detect.outputs.rust_build_mode }}
+          category: /language:rust

package/.github/workflows/codeql_self-ci.yml

@@ -0,0 +1,26 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main, staging]
+  pull_request:
+    branches: [staging]
+  schedule:
+    - cron: '31 6 * * 1'
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  packages: read
+  security-events: write
+
+jobs:
+  codeql:
+    name: CodeQL
+    uses: ./.github/workflows/codeql.yml
+    with:
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: v0.22.0
+      runner: ubuntu-latest
+    secrets: inherit

package/.github/workflows/draft-pr.yml

@@ -1,24 +1,57 @@
-name: Draft PR
+name: Code Foundry Draft PR
 
 on:
-  push:
-    branches:
-      - 'feat/*'
-      - 'fix/*'
-      - 'chore/*'
-      - 'refactor/*'
-      - 'docs/*'
-      - 'style/*'
-      - 'test/*'
+  workflow_call:
+    inputs:
+      runner:
+        description: Runner used to create the draft PR.
+        required: false
+        type: string
+        default: ubuntu-slim
 
 permissions:
   contents: read
   pull-requests: write
 
+env:
+  GH_TOKEN: ${{ github.token }}
+
 jobs:
-  draft-pr:
-    name: Draft PR
-    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-draft-pr.yml@v0.22.0
-    with:
-      runner: ubuntu-slim
-    secrets: inherit
+  create-draft-pr:
+    name: Create
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 10
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: true
+    steps:
+      - name: Check
+        id: check-pr
+        run: |
+          BRANCH="${{ github.ref_name }}"
+          EXISTING=$(gh pr list --limit 1 --base staging --head "$BRANCH" --state open --json number,title 2>/dev/null | jq 'length')
+          echo "existing=$EXISTING" >> "$GITHUB_OUTPUT"
+
+      - name: Create
+        if: steps.check-pr.outputs.existing == '0'
+        run: |
+          BRANCH="${{ github.ref_name }}"
+          gh pr create \
+            --base staging \
+            --head "$BRANCH" \
+            --draft \
+            --title "[WIP] $BRANCH" \
+            --body "Draft PR created automatically by CI.
+
+            This PR is a draft and should not be merged until CI passes and a reviewer (or the Daily Review agent) marks it ready.
+
+            **CI Status:** Pending — this workflow triggered on push to \`$BRANCH\`."
+
+      - name: Mark ready
+        if: steps.check-pr.outputs.existing == '0'
+        run: |
+          BRANCH="${{ github.ref_name }}"
+          PR_NUMBER=$(gh pr list --limit 1 --base staging --head "$BRANCH" --state open --json number 2>/dev/null | jq '.[0].number')
+          if [ -n "$PR_NUMBER" ]; then
+            gh pr ready "$PR_NUMBER"
+          fi

package/.github/workflows/draft-pr_self-ci.yml

@@ -0,0 +1,24 @@
+name: Draft PR
+
+on:
+  push:
+    branches:
+      - 'feat/*'
+      - 'fix/*'
+      - 'chore/*'
+      - 'refactor/*'
+      - 'docs/*'
+      - 'style/*'
+      - 'test/*'
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  draft-pr:
+    name: Draft PR
+    uses: ./.github/workflows/draft-pr.yml
+    with:
+      runner: ubuntu-slim
+    secrets: inherit