code-foundry 0.24.1 → 0.26.0

package/.github/workflows/reusable-codeql.yml

@@ -1,246 +0,0 @@
-name: Code Foundry CodeQL
-
-on:
-  workflow_call:
-    inputs:
-      runtime-repository:
-        description: Repository containing the Code Foundry runtime.
-        required: false
-        type: string
-        default: 0xPlayerOne/code-foundry
-      runtime-ref:
-        description: Code Foundry runtime tag or ref.
-        required: false
-        type: string
-        default: v0.20.2
-      runner:
-        description: Runner used by CodeQL jobs.
-        required: false
-        type: string
-        default: ubuntu-latest
-
-permissions:
-  actions: read
-  contents: read
-  packages: read
-  security-events: write
-
-env:
-  REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
-  REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
-  REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
-  cancel-in-progress: true
-
-jobs:
-  detect:
-    name: Detect
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 10
-    outputs:
-      languages: ${{ steps.languages.outputs.languages }}
-      code_security: ${{ steps.security.outputs.status }}
-      actions_available: ${{ steps.languages.outputs.actions_available }}
-      actions_changed: ${{ steps.languages.outputs.actions_changed }}
-      actions_build_mode: ${{ steps.languages.outputs.actions_build_mode }}
-      javascript_available: ${{ steps.languages.outputs.javascript_available }}
-      javascript_changed: ${{ steps.languages.outputs.javascript_changed }}
-      javascript_build_mode: ${{ steps.languages.outputs.javascript_build_mode }}
-      python_available: ${{ steps.languages.outputs.python_available }}
-      python_changed: ${{ steps.languages.outputs.python_changed }}
-      python_build_mode: ${{ steps.languages.outputs.python_build_mode }}
-      rust_available: ${{ steps.languages.outputs.rust_available }}
-      rust_changed: ${{ steps.languages.outputs.rust_changed }}
-      rust_build_mode: ${{ steps.languages.outputs.rust_build_mode }}
-    steps:
-      - name: Detect Code Security
-        id: security
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          status="disabled"
-          if [ "${{ github.event.repository.private }}" != "true" ]; then
-            status="enabled"
-          else
-            status="$(gh api "repos/${GITHUB_REPOSITORY}" --jq '.security_and_analysis.code_security.status // "disabled"' 2>/dev/null || printf 'disabled')"
-          fi
-          printf 'status=%s\n' "$status" >> "$GITHUB_OUTPUT"
-      - name: Checkout
-        if: ${{ !github.event.repository.private || steps.security.outputs.status == 'enabled' }}
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 2
-          filter: blob:none
-          sparse-checkout: |
-            .github
-            .mise.toml
-            mise.lock
-            package.json
-            bun.lock
-            bun.lockb
-            pnpm-lock.yaml
-            yarn.lock
-            package-lock.json
-          sparse-checkout-cone-mode: false
-      - name: Runtime
-        if: ${{ !github.event.repository.private || steps.security.outputs.status == 'enabled' }}
-        uses: actions/checkout@v7
-        with:
-          repository: ${{ inputs.runtime-repository }}
-          ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
-          sparse-checkout: |
-            .github/actions
-            .github/scripts
-      - name: Install runtime
-        if: ${{ !github.event.repository.private || steps.security.outputs.status == 'enabled' }}
-        run: |
-          mkdir -p .github/actions .github/scripts
-          cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
-      - id: languages
-        name: Detect languages
-        env:
-          CODEQL_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
-          REPO_FOUNDRY_CODE_SECURITY: ${{ steps.security.outputs.status }}
-          REPO_FOUNDRY_PRIVATE: ${{ github.event.repository.private }}
-        run: |
-          if [ "$REPO_FOUNDRY_PRIVATE" = "true" ] && [ "$REPO_FOUNDRY_CODE_SECURITY" != "enabled" ]; then
-            echo 'languages=[]' >> "$GITHUB_OUTPUT"
-          else
-            bash .github/scripts/codeql-languages.sh
-          fi
-
-  analyze-actions:
-    name: Analyze (Actions)
-    needs: detect
-    if: >-
-      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
-      needs.detect.outputs.actions_available == 'true' &&
-      needs.detect.outputs.actions_changed == 'true'
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 30
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-      - name: Runtime
-        uses: actions/checkout@v7
-        with:
-          repository: ${{ inputs.runtime-repository }}
-          ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
-          sparse-checkout: |
-            .github/actions
-            .github/scripts
-      - name: Install runtime
-        run: |
-          mkdir -p .github/actions .github/scripts
-          cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
-      - name: Analyze
-        uses: ./.github/actions/codeql
-        with:
-          language: actions
-          build-mode: ${{ needs.detect.outputs.actions_build_mode }}
-          category: /language:actions
-
-  analyze-typescript:
-    name: Analyze (TypeScript)
-    needs: detect
-    if: >-
-      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
-      needs.detect.outputs.javascript_available == 'true' &&
-      needs.detect.outputs.javascript_changed == 'true'
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 30
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-      - name: Runtime
-        uses: actions/checkout@v7
-        with:
-          repository: ${{ inputs.runtime-repository }}
-          ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
-          sparse-checkout: |
-            .github/actions
-            .github/scripts
-      - name: Install runtime
-        run: |
-          mkdir -p .github/actions .github/scripts
-          cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
-      - name: Analyze
-        uses: ./.github/actions/codeql
-        with:
-          language: javascript-typescript
-          build-mode: ${{ needs.detect.outputs.javascript_build_mode }}
-          category: /language:javascript-typescript
-
-  analyze-python:
-    name: Analyze (Python)
-    needs: detect
-    if: >-
-      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
-      needs.detect.outputs.python_available == 'true' &&
-      needs.detect.outputs.python_changed == 'true'
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 30
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-      - name: Runtime
-        uses: actions/checkout@v7
-        with:
-          repository: ${{ inputs.runtime-repository }}
-          ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
-          sparse-checkout: |
-            .github/actions
-            .github/scripts
-      - name: Install runtime
-        run: |
-          mkdir -p .github/actions .github/scripts
-          cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
-      - name: Analyze
-        uses: ./.github/actions/codeql
-        with:
-          language: python
-          build-mode: ${{ needs.detect.outputs.python_build_mode }}
-          category: /language:python
-
-  analyze-rust:
-    name: Analyze (Rust)
-    needs: detect
-    if: >-
-      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
-      needs.detect.outputs.rust_available == 'true' &&
-      needs.detect.outputs.rust_changed == 'true'
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 30
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-      - name: Runtime
-        uses: actions/checkout@v7
-        with:
-          repository: ${{ inputs.runtime-repository }}
-          ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
-          sparse-checkout: |
-            .github/actions
-            .github/scripts
-      - name: Install runtime
-        run: |
-          mkdir -p .github/actions .github/scripts
-          cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
-      - name: Analyze
-        uses: ./.github/actions/codeql
-        with:
-          language: rust
-          build-mode: ${{ needs.detect.outputs.rust_build_mode }}
-          category: /language:rust

package/.github/workflows/reusable-draft-pr.yml

@@ -1,57 +0,0 @@
-name: Code Foundry Draft PR
-
-on:
-  workflow_call:
-    inputs:
-      runner:
-        description: Runner used to create the draft PR.
-        required: false
-        type: string
-        default: ubuntu-slim
-
-permissions:
-  contents: read
-  pull-requests: write
-
-env:
-  GH_TOKEN: ${{ github.token }}
-
-jobs:
-  create-draft-pr:
-    name: Create
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 10
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.ref }}
-      cancel-in-progress: true
-    steps:
-      - name: Check
-        id: check-pr
-        run: |
-          BRANCH="${{ github.ref_name }}"
-          EXISTING=$(gh pr list --limit 1 --base staging --head "$BRANCH" --state open --json number,title 2>/dev/null | jq 'length')
-          echo "existing=$EXISTING" >> "$GITHUB_OUTPUT"
-
-      - name: Create
-        if: steps.check-pr.outputs.existing == '0'
-        run: |
-          BRANCH="${{ github.ref_name }}"
-          gh pr create \
-            --base staging \
-            --head "$BRANCH" \
-            --draft \
-            --title "[WIP] $BRANCH" \
-            --body "Draft PR created automatically by CI.
-
-            This PR is a draft and should not be merged until CI passes and a reviewer (or the Daily Review agent) marks it ready.
-
-            **CI Status:** Pending — this workflow triggered on push to \`$BRANCH\`."
-
-      - name: Mark ready
-        if: steps.check-pr.outputs.existing == '0'
-        run: |
-          BRANCH="${{ github.ref_name }}"
-          PR_NUMBER=$(gh pr list --limit 1 --base staging --head "$BRANCH" --state open --json number 2>/dev/null | jq '.[0].number')
-          if [ -n "$PR_NUMBER" ]; then
-            gh pr ready "$PR_NUMBER"
-          fi

package/.github/workflows/reusable-release-pr.yml

@@ -1,99 +0,0 @@
-name: Code Foundry Release PR
-
-on:
-  workflow_call:
-    inputs:
-      runner:
-        description: Runner used to create the release PR.
-        required: false
-        type: string
-        default: ubuntu-slim
-
-permissions:
-  contents: read
-  pull-requests: write
-
-env:
-  GH_TOKEN: ${{ github.token }}
-
-jobs:
-  create-release-pr:
-    name: Create
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 10
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.ref }}
-      cancel-in-progress: true
-    steps:
-      - name: Check
-        id: check-pr
-        run: |
-          set -euo pipefail
-          EXISTING=$(gh pr list \
-            --repo "$GITHUB_REPOSITORY" \
-            --limit 1 \
-            --base main \
-            --head staging \
-            --state open \
-            --json number | jq 'length')
-          COMPARE_URL="repos/${GITHUB_REPOSITORY}/compare/main...staging"
-          TOTAL_COMMITS=$(gh api "$COMPARE_URL?per_page=1" --jq '.total_commits // 0')
-          echo "existing=$EXISTING" >> "$GITHUB_OUTPUT"
-          echo "commits=$TOTAL_COMMITS" >> "$GITHUB_OUTPUT"
-
-      - name: No changes
-        if: steps.check-pr.outputs.existing == '0' && steps.check-pr.outputs.commits == '0'
-        run: echo 'staging is already aligned with main; no promotion PR is needed.'
-
-      - name: Create
-        if: steps.check-pr.outputs.existing == '0' && steps.check-pr.outputs.commits != '0'
-        run: |
-          DATE=$(date +%Y-%m-%d)
-          BODY_FILE="$RUNNER_TEMP/release-pr.md"
-          COMPARE_URL="repos/${GITHUB_REPOSITORY}/compare/main...staging"
-          COMPARE_FILE="$RUNNER_TEMP/release-compare.json"
-          gh api "$COMPARE_URL?per_page=100" > "$COMPARE_FILE"
-          TOTAL_COMMITS=$(jq -r '.total_commits // 0' "$COMPARE_FILE")
-          if [ "$TOTAL_COMMITS" -gt 100 ]; then
-            LAST_PAGE=$(( (TOTAL_COMMITS + 99) / 100 ))
-            gh api "$COMPARE_URL?per_page=100&page=$LAST_PAGE" > "$COMPARE_FILE"
-          fi
-          COMMITS=$(jq -r '.commits[] | "- \(.commit.message | split("\\n")[0]) (\(.sha[0:7]))"' "$COMPARE_FILE")
-          if [ -z "$COMMITS" ]; then
-            COMMITS='- No commits found since main.'
-          fi
-
-          if [ "$TOTAL_COMMITS" -eq 1 ]; then
-            CHANGE_LABEL=change
-          else
-            CHANGE_LABEL=changes
-          fi
-
-          cat > "$BODY_FILE" <<EOF
-          ## Environment promotion
-
-          Promote the validated \`staging\` environment into \`main\`.
-          This is a deployment-promotion PR, not the version-release PR.
-
-          - **Source:** \`staging\`
-          - **Target:** \`main\`
-          - **Changes:** $TOTAL_COMMITS $CHANGE_LABEL
-          - **Created:** $DATE
-
-          ### Commit summary
-
-          $COMMITS
-
-          ### Validation
-
-          - Required CI, test, security, and CodeQL checks must pass before merge.
-          - Merge with **rebase** to preserve the linear Conventional Commit history.
-          - After merge, Release Please opens a separate versioned release PR with the changelog.
-          EOF
-
-          gh pr create \
-            --repo "$GITHUB_REPOSITORY" \
-            --base main \
-            --head staging \
-            --title "Promote staging -> main ($DATE)" \
-            --body-file "$BODY_FILE"

package/.github/workflows/reusable-release.yml

@@ -1,117 +0,0 @@
-name: Code Foundry Release
-
-on:
-  workflow_call:
-    inputs:
-      runner:
-        description: Runner used by release jobs.
-        required: false
-        type: string
-        default: ubuntu-slim
-
-permissions:
-  contents: write
-  issues: write
-  pull-requests: write
-
-env:
-  REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
-  REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
-  REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
-  REPO_FOUNDRY_PACKAGE_MANAGER: ${{ vars.REPO_FOUNDRY_PACKAGE_MANAGER }}
-  REPO_FOUNDRY_RELEASE_TYPE: ${{ vars.REPO_FOUNDRY_RELEASE_TYPE }}
-  REPO_FOUNDRY_NPM_PUBLISH: ${{ vars.REPO_FOUNDRY_NPM_PUBLISH }}
-
-jobs:
-  release:
-    name: Release / Version
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 20
-    concurrency:
-      group: ${{ github.workflow }}-${{ github.ref }}
-      cancel-in-progress: false
-    outputs:
-      release_created: ${{ steps.release.outputs.release_created || 'false' }}
-      tag_name: ${{ steps.release.outputs.tag_name }}
-      npm_publish: ${{ steps.profile.outputs.npm_publish }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          filter: blob:none
-      - name: Detect release profile
-        id: profile
-        shell: bash
-        run: |
-          if [ -x .github/scripts/profile.sh ]; then
-            release_type="$(bash .github/scripts/profile.sh get release_type)"
-            npm_publish="$(bash .github/scripts/profile.sh get npm_publish)"
-          else
-            config_file=.github/code-foundry.yml
-            release_type="$(awk -F': ' '/^release_type:/ {print $2; exit}' "$config_file" 2>/dev/null || true)"
-            npm_publish="$(awk -F': ' '/^npm_publish:/ {print $2; exit}' "$config_file" 2>/dev/null || true)"
-          fi
-          [ -n "$release_type" ] || release_type=auto
-          [ -n "$npm_publish" ] || npm_publish=false
-
-          if [ "$release_type" = auto ]; then
-            if [ -f package.json ]; then release_type=node
-            elif [ -f pyproject.toml ]; then release_type=python
-            elif [ -f Cargo.toml ]; then release_type=rust
-            elif [ -f version.txt ]; then release_type=simple
-            else release_type=none
-            fi
-          fi
-
-          case "$release_type" in
-            node|python|rust|simple) ;;
-            none) npm_publish=false ;;
-            *) echo "Unsupported release_type: $release_type" >&2; exit 2 ;;
-          esac
-          if [ ! -f package.json ]; then npm_publish=false; fi
-          printf 'release_type=%s\n' "$release_type" >> "$GITHUB_OUTPUT"
-          printf 'npm_publish=%s\n' "$npm_publish" >> "$GITHUB_OUTPUT"
-      - name: Release Please
-        id: release
-        if: steps.profile.outputs.release_type != 'none'
-        uses: googleapis/release-please-action@v5
-        with:
-          token: ${{ secrets.RELEASE_PLEASE_TOKEN || github.token }}
-          config-file: release-please-config.json
-          release-type: ${{ steps.profile.outputs.release_type }}
-
-  npm:
-    name: Release / Publish npm
-    needs: release
-    if: needs.release.outputs.release_created == 'true' && needs.release.outputs.npm_publish == 'true'
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 15
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-    steps:
-      - name: Checkout release
-        uses: actions/checkout@v7
-        with:
-          ref: ${{ needs.release.outputs.tag_name }}
-      - name: Setup Node (trusted)
-        if: env.NPM_TOKEN == ''
-        uses: actions/setup-node@v5
-        with:
-          node-version: 24
-      - name: Setup Node (token)
-        if: env.NPM_TOKEN != ''
-        uses: actions/setup-node@v5
-        with:
-          node-version: 24
-          registry-url: https://registry.npmjs.org
-      - name: Publish npm with token
-        if: env.NPM_TOKEN != ''
-        env:
-          NODE_AUTH_TOKEN: ${{ env.NPM_TOKEN }}
-        run: npm publish --provenance --access public
-      - name: Publish npm with trusted publishing
-        if: env.NPM_TOKEN == ''
-        run: npm publish --provenance --access public