code-foundry 0.24.1 → 0.25.0

package/.github/workflows/release-pr.yml

@@ -1,17 +1,99 @@
-name: Release PR
+name: Code Foundry Release PR
 
 on:
-  push:
-    branches: [staging]
+  workflow_call:
+    inputs:
+      runner:
+        description: Runner used to create the release PR.
+        required: false
+        type: string
+        default: ubuntu-slim
 
 permissions:
   contents: read
   pull-requests: write
 
+env:
+  GH_TOKEN: ${{ github.token }}
+
 jobs:
-  release-pr:
-    name: Release PR
-    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-release-pr.yml@v0.22.0
-    with:
-      runner: ubuntu-slim
-    secrets: inherit
+  create-release-pr:
+    name: Create
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 10
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: true
+    steps:
+      - name: Check
+        id: check-pr
+        run: |
+          set -euo pipefail
+          EXISTING=$(gh pr list \
+            --repo "$GITHUB_REPOSITORY" \
+            --limit 1 \
+            --base main \
+            --head staging \
+            --state open \
+            --json number | jq 'length')
+          COMPARE_URL="repos/${GITHUB_REPOSITORY}/compare/main...staging"
+          TOTAL_COMMITS=$(gh api "$COMPARE_URL?per_page=1" --jq '.total_commits // 0')
+          echo "existing=$EXISTING" >> "$GITHUB_OUTPUT"
+          echo "commits=$TOTAL_COMMITS" >> "$GITHUB_OUTPUT"
+
+      - name: No changes
+        if: steps.check-pr.outputs.existing == '0' && steps.check-pr.outputs.commits == '0'
+        run: echo 'staging is already aligned with main; no promotion PR is needed.'
+
+      - name: Create
+        if: steps.check-pr.outputs.existing == '0' && steps.check-pr.outputs.commits != '0'
+        run: |
+          DATE=$(date +%Y-%m-%d)
+          BODY_FILE="$RUNNER_TEMP/release-pr.md"
+          COMPARE_URL="repos/${GITHUB_REPOSITORY}/compare/main...staging"
+          COMPARE_FILE="$RUNNER_TEMP/release-compare.json"
+          gh api "$COMPARE_URL?per_page=100" > "$COMPARE_FILE"
+          TOTAL_COMMITS=$(jq -r '.total_commits // 0' "$COMPARE_FILE")
+          if [ "$TOTAL_COMMITS" -gt 100 ]; then
+            LAST_PAGE=$(( (TOTAL_COMMITS + 99) / 100 ))
+            gh api "$COMPARE_URL?per_page=100&page=$LAST_PAGE" > "$COMPARE_FILE"
+          fi
+          COMMITS=$(jq -r '.commits[] | "- \(.commit.message | split("\\n")[0]) (\(.sha[0:7]))"' "$COMPARE_FILE")
+          if [ -z "$COMMITS" ]; then
+            COMMITS='- No commits found since main.'
+          fi
+
+          if [ "$TOTAL_COMMITS" -eq 1 ]; then
+            CHANGE_LABEL=change
+          else
+            CHANGE_LABEL=changes
+          fi
+
+          cat > "$BODY_FILE" <<EOF
+          ## Environment promotion
+
+          Promote the validated \`staging\` environment into \`main\`.
+          This is a deployment-promotion PR, not the version-release PR.
+
+          - **Source:** \`staging\`
+          - **Target:** \`main\`
+          - **Changes:** $TOTAL_COMMITS $CHANGE_LABEL
+          - **Created:** $DATE
+
+          ### Commit summary
+
+          $COMMITS
+
+          ### Validation
+
+          - Required CI, test, security, and CodeQL checks must pass before merge.
+          - Merge with **rebase** to preserve the linear Conventional Commit history.
+          - After merge, Release Please opens a separate versioned release PR with the changelog.
+          EOF
+
+          gh pr create \
+            --repo "$GITHUB_REPOSITORY" \
+            --base main \
+            --head staging \
+            --title "Promote staging -> main ($DATE)" \
+            --body-file "$BODY_FILE"

package/.github/workflows/release-pr_self-ci.yml

@@ -0,0 +1,17 @@
+name: Release PR
+
+on:
+  push:
+    branches: [staging]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  release-pr:
+    name: Release PR
+    uses: ./.github/workflows/release-pr.yml
+    with:
+      runner: ubuntu-slim
+    secrets: inherit

package/.github/workflows/release.yml

@@ -1,20 +1,117 @@
-name: Release
+name: Code Foundry Release
 
 on:
-  push:
-    branches: [main]
-  workflow_dispatch:
+  workflow_call:
+    inputs:
+      runner:
+        description: Runner used by release jobs.
+        required: false
+        type: string
+        default: ubuntu-slim
 
 permissions:
   contents: write
   issues: write
   pull-requests: write
-  id-token: write
+
+env:
+  REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
+  REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
+  REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
+  REPO_FOUNDRY_PACKAGE_MANAGER: ${{ vars.REPO_FOUNDRY_PACKAGE_MANAGER }}
+  REPO_FOUNDRY_RELEASE_TYPE: ${{ vars.REPO_FOUNDRY_RELEASE_TYPE }}
+  REPO_FOUNDRY_NPM_PUBLISH: ${{ vars.REPO_FOUNDRY_NPM_PUBLISH }}
 
 jobs:
   release:
-    name: Release
-    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-release.yml@v0.22.0
-    with:
-      runner: ubuntu-slim
-    secrets: inherit
+    name: Release / Version
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 20
+    concurrency:
+      group: ${{ github.workflow }}-${{ github.ref }}
+      cancel-in-progress: false
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created || 'false' }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+      npm_publish: ${{ steps.profile.outputs.npm_publish }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          filter: blob:none
+      - name: Detect release profile
+        id: profile
+        shell: bash
+        run: |
+          if [ -x .github/scripts/profile.sh ]; then
+            release_type="$(bash .github/scripts/profile.sh get release_type)"
+            npm_publish="$(bash .github/scripts/profile.sh get npm_publish)"
+          else
+            config_file=.github/code-foundry.yml
+            release_type="$(awk -F': ' '/^release_type:/ {print $2; exit}' "$config_file" 2>/dev/null || true)"
+            npm_publish="$(awk -F': ' '/^npm_publish:/ {print $2; exit}' "$config_file" 2>/dev/null || true)"
+          fi
+          [ -n "$release_type" ] || release_type=auto
+          [ -n "$npm_publish" ] || npm_publish=false
+
+          if [ "$release_type" = auto ]; then
+            if [ -f package.json ]; then release_type=node
+            elif [ -f pyproject.toml ]; then release_type=python
+            elif [ -f Cargo.toml ]; then release_type=rust
+            elif [ -f version.txt ]; then release_type=simple
+            else release_type=none
+            fi
+          fi
+
+          case "$release_type" in
+            node|python|rust|simple) ;;
+            none) npm_publish=false ;;
+            *) echo "Unsupported release_type: $release_type" >&2; exit 2 ;;
+          esac
+          if [ ! -f package.json ]; then npm_publish=false; fi
+          printf 'release_type=%s\n' "$release_type" >> "$GITHUB_OUTPUT"
+          printf 'npm_publish=%s\n' "$npm_publish" >> "$GITHUB_OUTPUT"
+      - name: Release Please
+        id: release
+        if: steps.profile.outputs.release_type != 'none'
+        uses: googleapis/release-please-action@v5
+        with:
+          token: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }}
+          config-file: release-please-config.json
+          release-type: ${{ steps.profile.outputs.release_type }}
+
+  npm:
+    name: Release / Publish npm
+    needs: release
+    if: needs.release.outputs.release_created == 'true' && needs.release.outputs.npm_publish == 'true'
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+    steps:
+      - name: Checkout release
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ needs.release.outputs.tag_name }}
+      - name: Setup Node (trusted)
+        if: env.NPM_TOKEN == ''
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
+      - name: Setup Node (token)
+        if: env.NPM_TOKEN != ''
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+      - name: Publish npm with token
+        if: env.NPM_TOKEN != ''
+        env:
+          NODE_AUTH_TOKEN: ${{ env.NPM_TOKEN }}
+        run: npm publish --provenance --access public
+      - name: Publish npm with trusted publishing
+        if: env.NPM_TOKEN == ''
+        run: npm publish --provenance --access public

package/.github/workflows/release_self-ci.yml

@@ -0,0 +1,20 @@
+name: Release
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+  id-token: write
+
+jobs:
+  release:
+    name: Release
+    uses: ./.github/workflows/release.yml
+    with:
+      runner: ubuntu-slim
+    secrets: inherit

package/.github/workflows/security.yml

@@ -1,21 +1,296 @@
-name: Security
+name: Code Foundry Security
 
 on:
-  push:
-    branches: [main, staging]
-  pull_request:
-    branches: [staging]
-  workflow_dispatch:
+  workflow_call:
+    inputs:
+      runtime-repository:
+        description: Repository containing the Code Foundry runtime.
+        required: false
+        type: string
+        default: 0xPlayerOne/code-foundry
+      runtime-ref:
+        description: Code Foundry runtime tag or ref.
+        required: false
+        type: string
+        default: v0.20.2
+      runner:
+        description: Runner used by Security jobs.
+        required: false
+        type: string
+        default: ubuntu-slim
 
 permissions:
   contents: read
 
+env:
+  REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
+  REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
+  REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
+  REPO_FOUNDRY_PACKAGE_MANAGER: ${{ vars.REPO_FOUNDRY_PACKAGE_MANAGER }}
+  REPO_FOUNDRY_CACHE_PACKAGES: ${{ vars.REPO_FOUNDRY_CACHE_PACKAGES || 'auto' }}
+  REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
+  cancel-in-progress: true
+
 jobs:
-  security:
-    name: Security
-    uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-security.yml@v0.22.0
-    with:
-      runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: v0.22.0
-      runner: ubuntu-slim
-    secrets: inherit
+  profile:
+    name: Profile
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 10
+    outputs:
+      javascript: ${{ steps.profile.outputs.javascript }}
+      rust: ${{ steps.profile.outputs.rust }}
+      python: ${{ steps.profile.outputs.python }}
+      python_requirements: ${{ steps.profile.outputs.python_requirements }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 2
+          filter: blob:none
+          sparse-checkout: |
+            .github
+            .mise.toml
+            mise.lock
+            .npmrc
+            .pnpmfile.cjs
+            .yarnrc*
+            **/package.json
+            **/bun.lock
+            **/bun.lockb
+            **/pnpm-lock.yaml
+            **/yarn.lock
+            **/package-lock.json
+            **/Cargo.toml
+            **/Cargo.lock
+            **/.cargo/**
+            **/pyproject.toml
+            **/requirements*.txt
+            **/setup.py
+            **/setup.cfg
+            **/Pipfile
+            **/Pipfile.lock
+            **/poetry.lock
+            **/uv.lock
+          sparse-checkout-cone-mode: false
+      - name: Runtime
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .code-foundry
+          sparse-checkout: |
+            .github/actions
+            .github/scripts
+      - name: Install runtime
+        run: |
+          mkdir -p .github/actions .github/scripts
+          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .code-foundry/.github/scripts/. .github/scripts/
+      - name: Detect
+        id: profile
+        run: bash .github/scripts/security.sh profile >> "$GITHUB_OUTPUT"
+
+  dependency-audit-javascript:
+    name: Dependency Audit (JavaScript)
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          filter: blob:none
+          sparse-checkout: |
+            .github
+            .mise.toml
+            mise.lock
+            .npmrc
+            .pnpmfile.cjs
+            .yarnrc*
+            **/package.json
+            **/bun.lock
+            **/bun.lockb
+            **/pnpm-lock.yaml
+            **/yarn.lock
+            **/package-lock.json
+          sparse-checkout-cone-mode: false
+      - name: Runtime
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .code-foundry
+          sparse-checkout: |
+            .github/actions
+            .github/scripts
+      - name: Install runtime
+        run: |
+          mkdir -p .github/actions .github/scripts
+          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .code-foundry/.github/scripts/. .github/scripts/
+      - name: Detect
+        id: applicability
+        run: bash .github/scripts/security.sh should_run javascript >> "$GITHUB_OUTPUT"
+      - name: Setup
+        if: steps.applicability.outputs.applicable == 'true'
+        uses: ./.github/actions/setup
+        with:
+          mise-scope: javascript
+          cache-save: ${{ github.event_name != 'pull_request' }}
+      - name: Audit dependencies
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/security.sh audit javascript
+
+  dependency-audit-rust:
+    name: Dependency Audit (Rust)
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          filter: blob:none
+          sparse-checkout: |
+            .github
+            .mise.toml
+            mise.lock
+            **/Cargo.toml
+            **/Cargo.lock
+            **/.cargo/**
+          sparse-checkout-cone-mode: false
+      - name: Runtime
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .code-foundry
+          sparse-checkout: |
+            .github/actions
+            .github/scripts
+      - name: Install runtime
+        run: |
+          mkdir -p .github/actions .github/scripts
+          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .code-foundry/.github/scripts/. .github/scripts/
+      - name: Detect
+        id: applicability
+        run: bash .github/scripts/security.sh should_run rust >> "$GITHUB_OUTPUT"
+      - name: Check Rust
+        id: system-rust
+        if: steps.applicability.outputs.applicable == 'true'
+        shell: bash
+        run: |
+          if command -v cargo >/dev/null 2>&1 && command -v rustc >/dev/null 2>&1; then
+            cargo --version
+            rustc --version
+            echo 'available=true' >> "$GITHUB_OUTPUT"
+          else
+            echo 'available=false' >> "$GITHUB_OUTPUT"
+          fi
+      - name: Setup
+        if: >-
+          steps.applicability.outputs.applicable == 'true' &&
+          steps.system-rust.outputs.available != 'true'
+        uses: ./.github/actions/setup
+        with:
+          mise-scope: rust
+          cache-save: ${{ github.event_name != 'pull_request' }}
+      - name: Install cargo-audit
+        if: steps.applicability.outputs.applicable == 'true'
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-audit
+      - name: Audit dependencies
+        if: steps.applicability.outputs.applicable == 'true'
+        run: bash .github/scripts/security.sh audit rust
+
+  dependency-audit-python:
+    name: Dependency Audit (Python) / ${{ matrix.requirement }}
+    needs: profile
+    if: >-
+      ${{ needs.profile.result == 'success' &&
+      needs.profile.outputs.python == 'true' &&
+      needs.profile.outputs.python_requirements != '["none"]' }}
+    strategy:
+      fail-fast: false
+      max-parallel: 8
+      matrix:
+        requirement: ${{ fromJSON(needs.profile.outputs.python_requirements) }}
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 20
+    env:
+      REPO_FOUNDRY_PYTHON_REQUIREMENT: ${{ matrix.requirement }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          filter: blob:none
+          sparse-checkout: |
+            .github
+            .mise.toml
+            mise.lock
+            **/pyproject.toml
+            **/requirements*.txt
+            **/setup.py
+            **/setup.cfg
+            **/Pipfile
+            **/Pipfile.lock
+            **/poetry.lock
+            **/uv.lock
+          sparse-checkout-cone-mode: false
+      - name: Runtime
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ inputs.runtime-repository }}
+          ref: ${{ inputs.runtime-ref }}
+          path: .code-foundry
+          sparse-checkout: |
+            .github/actions
+            .github/scripts
+      - name: Install runtime
+        run: |
+          mkdir -p .github/actions .github/scripts
+          cp -R .code-foundry/.github/actions/. .github/actions/
+          cp -R .code-foundry/.github/scripts/. .github/scripts/
+      - name: Setup
+        uses: ./.github/actions/setup
+        with:
+          mise-scope: python
+          cache-save: ${{ github.event_name != 'pull_request' }}
+      - name: Audit dependencies
+        run: bash .github/scripts/security.sh audit python
+
+  dependency-audit-python-gate:
+    name: Dependency Audit (Python)
+    needs: [profile, dependency-audit-python]
+    if: always()
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 5
+    steps:
+      - name: Gate
+        env:
+          PROFILE_RESULT: ${{ needs.profile.result }}
+          AUDIT_RESULT: ${{ needs.dependency-audit-python.result }}
+        run: |
+          if [ "$PROFILE_RESULT" != success ]; then
+            echo "Python audit profile failed: $PROFILE_RESULT" >&2
+            exit 1
+          fi
+          case "$AUDIT_RESULT" in
+            success|skipped) exit 0 ;;
+            *) echo "Python dependency audit failed: $AUDIT_RESULT" >&2; exit 1 ;;
+          esac
+
+  dependency-review:
+    name: Dependency Review
+    if: ${{ github.event_name == 'pull_request' && !github.event.repository.private }}
+    runs-on: ${{ inputs.runner }}
+    timeout-minutes: 10
+    steps:
+      - name: Review
+        uses: actions/dependency-review-action@v5
+        with:
+          fail-on-severity: high
+          license-check: true

package/.github/workflows/security_self-ci.yml

@@ -0,0 +1,21 @@
+name: Security
+
+on:
+  push:
+    branches: [main, staging]
+  pull_request:
+    branches: [staging]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  security:
+    name: Security
+    uses: ./.github/workflows/security.yml
+    with:
+      runtime-repository: 0xPlayerOne/code-foundry
+      runtime-ref: v0.22.0
+      runner: ubuntu-slim
+    secrets: inherit