code-foundry 0.24.1 → 0.26.0

package/.github/workflows/reusable-security.yml

@@ -1,296 +0,0 @@
-name: Code Foundry Security
-
-on:
-  workflow_call:
-    inputs:
-      runtime-repository:
-        description: Repository containing the Code Foundry runtime.
-        required: false
-        type: string
-        default: 0xPlayerOne/code-foundry
-      runtime-ref:
-        description: Code Foundry runtime tag or ref.
-        required: false
-        type: string
-        default: v0.20.2
-      runner:
-        description: Runner used by Security jobs.
-        required: false
-        type: string
-        default: ubuntu-slim
-
-permissions:
-  contents: read
-
-env:
-  REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
-  REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
-  REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
-  REPO_FOUNDRY_PACKAGE_MANAGER: ${{ vars.REPO_FOUNDRY_PACKAGE_MANAGER }}
-  REPO_FOUNDRY_CACHE_PACKAGES: ${{ vars.REPO_FOUNDRY_CACHE_PACKAGES || 'auto' }}
-  REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
-  cancel-in-progress: true
-
-jobs:
-  profile:
-    name: Profile
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 10
-    outputs:
-      javascript: ${{ steps.profile.outputs.javascript }}
-      rust: ${{ steps.profile.outputs.rust }}
-      python: ${{ steps.profile.outputs.python }}
-      python_requirements: ${{ steps.profile.outputs.python_requirements }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 2
-          filter: blob:none
-          sparse-checkout: |
-            .github
-            .mise.toml
-            mise.lock
-            .npmrc
-            .pnpmfile.cjs
-            .yarnrc*
-            **/package.json
-            **/bun.lock
-            **/bun.lockb
-            **/pnpm-lock.yaml
-            **/yarn.lock
-            **/package-lock.json
-            **/Cargo.toml
-            **/Cargo.lock
-            **/.cargo/**
-            **/pyproject.toml
-            **/requirements*.txt
-            **/setup.py
-            **/setup.cfg
-            **/Pipfile
-            **/Pipfile.lock
-            **/poetry.lock
-            **/uv.lock
-          sparse-checkout-cone-mode: false
-      - name: Runtime
-        uses: actions/checkout@v7
-        with:
-          repository: ${{ inputs.runtime-repository }}
-          ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
-          sparse-checkout: |
-            .github/actions
-            .github/scripts
-      - name: Install runtime
-        run: |
-          mkdir -p .github/actions .github/scripts
-          cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
-      - name: Detect
-        id: profile
-        run: bash .github/scripts/security.sh profile >> "$GITHUB_OUTPUT"
-
-  dependency-audit-javascript:
-    name: Dependency Audit (JavaScript)
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 20
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          filter: blob:none
-          sparse-checkout: |
-            .github
-            .mise.toml
-            mise.lock
-            .npmrc
-            .pnpmfile.cjs
-            .yarnrc*
-            **/package.json
-            **/bun.lock
-            **/bun.lockb
-            **/pnpm-lock.yaml
-            **/yarn.lock
-            **/package-lock.json
-          sparse-checkout-cone-mode: false
-      - name: Runtime
-        uses: actions/checkout@v7
-        with:
-          repository: ${{ inputs.runtime-repository }}
-          ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
-          sparse-checkout: |
-            .github/actions
-            .github/scripts
-      - name: Install runtime
-        run: |
-          mkdir -p .github/actions .github/scripts
-          cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
-      - name: Detect
-        id: applicability
-        run: bash .github/scripts/security.sh should_run javascript >> "$GITHUB_OUTPUT"
-      - name: Setup
-        if: steps.applicability.outputs.applicable == 'true'
-        uses: ./.github/actions/setup
-        with:
-          mise-scope: javascript
-          cache-save: ${{ github.event_name != 'pull_request' }}
-      - name: Audit dependencies
-        if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/security.sh audit javascript
-
-  dependency-audit-rust:
-    name: Dependency Audit (Rust)
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 20
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          filter: blob:none
-          sparse-checkout: |
-            .github
-            .mise.toml
-            mise.lock
-            **/Cargo.toml
-            **/Cargo.lock
-            **/.cargo/**
-          sparse-checkout-cone-mode: false
-      - name: Runtime
-        uses: actions/checkout@v7
-        with:
-          repository: ${{ inputs.runtime-repository }}
-          ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
-          sparse-checkout: |
-            .github/actions
-            .github/scripts
-      - name: Install runtime
-        run: |
-          mkdir -p .github/actions .github/scripts
-          cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
-      - name: Detect
-        id: applicability
-        run: bash .github/scripts/security.sh should_run rust >> "$GITHUB_OUTPUT"
-      - name: Check Rust
-        id: system-rust
-        if: steps.applicability.outputs.applicable == 'true'
-        shell: bash
-        run: |
-          if command -v cargo >/dev/null 2>&1 && command -v rustc >/dev/null 2>&1; then
-            cargo --version
-            rustc --version
-            echo 'available=true' >> "$GITHUB_OUTPUT"
-          else
-            echo 'available=false' >> "$GITHUB_OUTPUT"
-          fi
-      - name: Setup
-        if: >-
-          steps.applicability.outputs.applicable == 'true' &&
-          steps.system-rust.outputs.available != 'true'
-        uses: ./.github/actions/setup
-        with:
-          mise-scope: rust
-          cache-save: ${{ github.event_name != 'pull_request' }}
-      - name: Install cargo-audit
-        if: steps.applicability.outputs.applicable == 'true'
-        uses: taiki-e/install-action@v2
-        with:
-          tool: cargo-audit
-      - name: Audit dependencies
-        if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/security.sh audit rust
-
-  dependency-audit-python:
-    name: Dependency Audit (Python) / ${{ matrix.requirement }}
-    needs: profile
-    if: >-
-      ${{ needs.profile.result == 'success' &&
-      needs.profile.outputs.python == 'true' &&
-      needs.profile.outputs.python_requirements != '["none"]' }}
-    strategy:
-      fail-fast: false
-      max-parallel: 8
-      matrix:
-        requirement: ${{ fromJSON(needs.profile.outputs.python_requirements) }}
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 20
-    env:
-      REPO_FOUNDRY_PYTHON_REQUIREMENT: ${{ matrix.requirement }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          filter: blob:none
-          sparse-checkout: |
-            .github
-            .mise.toml
-            mise.lock
-            **/pyproject.toml
-            **/requirements*.txt
-            **/setup.py
-            **/setup.cfg
-            **/Pipfile
-            **/Pipfile.lock
-            **/poetry.lock
-            **/uv.lock
-          sparse-checkout-cone-mode: false
-      - name: Runtime
-        uses: actions/checkout@v7
-        with:
-          repository: ${{ inputs.runtime-repository }}
-          ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
-          sparse-checkout: |
-            .github/actions
-            .github/scripts
-      - name: Install runtime
-        run: |
-          mkdir -p .github/actions .github/scripts
-          cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
-      - name: Setup
-        uses: ./.github/actions/setup
-        with:
-          mise-scope: python
-          cache-save: ${{ github.event_name != 'pull_request' }}
-      - name: Audit dependencies
-        run: bash .github/scripts/security.sh audit python
-
-  dependency-audit-python-gate:
-    name: Dependency Audit (Python)
-    needs: [profile, dependency-audit-python]
-    if: always()
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 5
-    steps:
-      - name: Gate
-        env:
-          PROFILE_RESULT: ${{ needs.profile.result }}
-          AUDIT_RESULT: ${{ needs.dependency-audit-python.result }}
-        run: |
-          if [ "$PROFILE_RESULT" != success ]; then
-            echo "Python audit profile failed: $PROFILE_RESULT" >&2
-            exit 1
-          fi
-          case "$AUDIT_RESULT" in
-            success|skipped) exit 0 ;;
-            *) echo "Python dependency audit failed: $AUDIT_RESULT" >&2; exit 1 ;;
-          esac
-
-  dependency-review:
-    name: Dependency Review
-    if: ${{ github.event_name == 'pull_request' && !github.event.repository.private }}
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 10
-    steps:
-      - name: Review
-        uses: actions/dependency-review-action@v5
-        with:
-          fail-on-severity: high
-          license-check: true

package/.github/workflows/reusable-test.yml

@@ -1,253 +0,0 @@
-name: Code Foundry Test
-
-on:
-  workflow_call:
-    inputs:
-      runtime-repository:
-        description: Repository containing the Code Foundry runtime.
-        required: false
-        type: string
-        default: 0xPlayerOne/code-foundry
-      runtime-ref:
-        description: Code Foundry runtime tag or ref.
-        required: false
-        type: string
-        default: v0.20.2
-      runner:
-        description: Runner used by non-unit test jobs.
-        required: false
-        type: string
-        default: ubuntu-latest
-      unit-runner:
-        description: Runner used by unit tests.
-        required: false
-        type: string
-        default: ubuntu-slim
-
-permissions:
-  contents: read
-
-env:
-  TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
-  TURBO_TEAM: ${{ vars.TURBO_TEAM }}
-  REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
-  REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
-  REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
-  REPO_FOUNDRY_PACKAGE_MANAGER: ${{ vars.REPO_FOUNDRY_PACKAGE_MANAGER }}
-  REPO_FOUNDRY_RUNNER: ${{ vars.REPO_FOUNDRY_RUNNER }}
-  REPO_FOUNDRY_CACHE_PACKAGES: ${{ vars.REPO_FOUNDRY_CACHE_PACKAGES || 'auto' }}
-  REPO_FOUNDRY_CACHE_BUILD: ${{ vars.REPO_FOUNDRY_CACHE_BUILD || 'auto' }}
-  REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
-  cancel-in-progress: true
-
-jobs:
-  unit:
-    name: Unit
-    runs-on: ${{ inputs.unit-runner }}
-    timeout-minutes: 30
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 2
-      - name: Runtime
-        uses: actions/checkout@v7
-        with:
-          repository: ${{ inputs.runtime-repository }}
-          ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
-          sparse-checkout: |
-            .github/actions
-            .github/scripts
-      - name: Install runtime
-        run: |
-          mkdir -p .github/actions .github/scripts
-          cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
-      - name: Detect
-        id: applicability
-        run: bash .github/scripts/ci.sh task_profile unit >> "$GITHUB_OUTPUT"
-      - name: Setup
-        if: steps.applicability.outputs.applicable == 'true'
-        uses: ./.github/actions/setup
-        with:
-          install: true
-          install-javascript: ${{ steps.applicability.outputs.javascript == 'true' }}
-          install-python: ${{ steps.applicability.outputs.python == 'true' }}
-          install-rust: ${{ steps.applicability.outputs.rust == 'true' }}
-          cache-build: false
-          cache-environment: false
-          cache-packages: ${{ vars.REPO_FOUNDRY_CACHE_PACKAGES || 'auto' }}
-          task: unit
-          task-javascript: ${{ steps.applicability.outputs.javascript }}
-          task-python: ${{ steps.applicability.outputs.python }}
-          task-rust: ${{ steps.applicability.outputs.rust }}
-      - name: Unit
-        if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/ci.sh unit
-      - name: Upload coverage
-        if: >-
-          always() &&
-          steps.applicability.outputs.applicable == 'true' &&
-          hashFiles('coverage/**', 'htmlcov/**', '.coverage*', 'target/llvm-cov/**') != ''
-        uses: actions/upload-artifact@v7
-        with:
-          name: coverage-unit-${{ github.run_id }}
-          path: |
-            coverage/**
-            htmlcov/**
-            .coverage*
-            target/llvm-cov/**
-          compression-level: 1
-          if-no-files-found: ignore
-          retention-days: 14
-
-  integration:
-    name: Integration
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 30
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 2
-      - name: Runtime
-        uses: actions/checkout@v7
-        with:
-          repository: ${{ inputs.runtime-repository }}
-          ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
-          sparse-checkout: |
-            .github/actions
-            .github/scripts
-      - name: Install runtime
-        run: |
-          mkdir -p .github/actions .github/scripts
-          cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
-      - name: Detect
-        id: applicability
-        run: bash .github/scripts/ci.sh task_profile integration >> "$GITHUB_OUTPUT"
-      - name: Setup
-        if: steps.applicability.outputs.applicable == 'true'
-        uses: ./.github/actions/setup
-        with:
-          install: true
-          install-javascript: ${{ steps.applicability.outputs.javascript == 'true' }}
-          install-python: ${{ steps.applicability.outputs.python == 'true' }}
-          install-rust: ${{ steps.applicability.outputs.rust == 'true' }}
-          cache-build: ${{ steps.applicability.outputs.rust == 'true' }}
-          cache-environment: false
-          cache-save: ${{ github.event_name == 'push' }}
-          task: integration
-          task-javascript: ${{ steps.applicability.outputs.javascript }}
-          task-python: ${{ steps.applicability.outputs.python }}
-          task-rust: ${{ steps.applicability.outputs.rust }}
-      - name: Integration
-        if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/ci.sh integration
-
-  e2e:
-    name: E2E
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 45
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 2
-      - name: Runtime
-        uses: actions/checkout@v7
-        with:
-          repository: ${{ inputs.runtime-repository }}
-          ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
-          sparse-checkout: |
-            .github/actions
-            .github/scripts
-      - name: Install runtime
-        run: |
-          mkdir -p .github/actions .github/scripts
-          cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
-      - name: Detect
-        id: applicability
-        run: bash .github/scripts/ci.sh task_profile e2e >> "$GITHUB_OUTPUT"
-      - name: Cache browser binaries
-        if: steps.applicability.outputs.applicable == 'true' && steps.applicability.outputs.browser == 'true'
-        uses: ./.github/actions/cache
-        with:
-          save: ${{ github.event_name == 'push' }}
-          path: |
-            ~/.cache/ms-playwright
-            ~/.cache/Cypress
-            ~/.cache/puppeteer
-          key: ${{ runner.os }}-e2e-browsers-${{ hashFiles('**/package.json', '**/bun.lock', '**/bun.lockb', '**/pnpm-lock.yaml', '**/yarn.lock', '**/package-lock.json', '**/playwright.config.*', '**/cypress.config.*') }}
-          restore-keys: |
-            ${{ runner.os }}-e2e-browsers-
-      - name: Setup
-        if: steps.applicability.outputs.applicable == 'true'
-        uses: ./.github/actions/setup
-        with:
-          install: true
-          install-javascript: ${{ steps.applicability.outputs.javascript == 'true' }}
-          install-python: ${{ steps.applicability.outputs.python == 'true' }}
-          install-rust: ${{ steps.applicability.outputs.rust == 'true' }}
-          cache-build: false
-          cache-environment: false
-          cache-save: ${{ github.event_name == 'push' }}
-          task: e2e
-          task-javascript: ${{ steps.applicability.outputs.javascript }}
-          task-python: ${{ steps.applicability.outputs.python }}
-          task-rust: ${{ steps.applicability.outputs.rust }}
-      - name: E2E
-        if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/ci.sh e2e
-
-  smoke:
-    name: Smoke
-    runs-on: ${{ inputs.runner }}
-    timeout-minutes: 15
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          fetch-depth: 2
-      - name: Runtime
-        uses: actions/checkout@v7
-        with:
-          repository: ${{ inputs.runtime-repository }}
-          ref: ${{ inputs.runtime-ref }}
-          path: .code-foundry
-          sparse-checkout: |
-            .github/actions
-            .github/scripts
-      - name: Install runtime
-        run: |
-          mkdir -p .github/actions .github/scripts
-          cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
-      - name: Detect
-        id: applicability
-        run: bash .github/scripts/ci.sh task_profile smoke >> "$GITHUB_OUTPUT"
-      - name: Setup
-        if: steps.applicability.outputs.applicable == 'true'
-        uses: ./.github/actions/setup
-        with:
-          install: true
-          install-javascript: ${{ steps.applicability.outputs.javascript == 'true' }}
-          install-python: ${{ steps.applicability.outputs.python == 'true' }}
-          install-rust: ${{ steps.applicability.outputs.rust == 'true' }}
-          cache-build: false
-          cache-environment: false
-          cache-save: ${{ github.event_name == 'push' }}
-          task: smoke
-          task-javascript: ${{ steps.applicability.outputs.javascript }}
-          task-python: ${{ steps.applicability.outputs.python }}
-          task-rust: ${{ steps.applicability.outputs.rust }}
-      - name: Smoke
-        if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/ci.sh smoke