code-foundry 0.25.0 → 0.27.0

package/.githooks/pre-commit

@@ -1,5 +1,4 @@
-#!/usr/bin/env bash
-set -euo pipefail
+#!/usr/bin/env sh
+set -eu
 
-repo_root="$(git rev-parse --show-toplevel)"
-exec bash "$repo_root/.github/scripts/pre-commit.sh" "$@"
+git diff --cached --check

package/.github/CONTRIBUTING.md

@@ -48,14 +48,14 @@ docs/*  test/*  refactor/*         │              │
 | `staging`                                                      | Integration branch       | Target normal pull requests here. Required checks must pass before merge. |
 | `feat/*`, `fix/*`, `chore/*`, `refactor/*`, `docs/*`, `test/*` | Focused work             | Branch from `staging`; keep changes small and reviewable.                 |
 
-Use squash merges unless the repository documents another strategy. Re-align `staging` with `main` after a release when needed.
+The default Git workflow is `staging-release`: topic branches merge into `staging`, then a promotion PR moves validated changes into `main`, followed by the versioned release PR. The default merge strategy is `rebase`, which preserves the linear Conventional Commit history. Configure `merge_strategy` as `squash` or `merge` in `.github/code-foundry.yml` when the repository intentionally uses another policy. Re-align `staging` with `main` after a release when needed.
 
 ## Before you start
 
 ### Toolchain
 
-1. Install [mise](https://mise.jdx.dev/).
-2. Run `npx code-foundry init` to install the pinned toolchain, enable hooks, and validate the checkout.
+1. Run `npx code-foundry init` to detect the repository and enable hooks.
+2. Follow `toolchain: auto` in `.github/code-foundry.yml`; install mise only if the repository already uses it or explicitly selects it.
 3. Use `npx code-foundry doctor` when setup, lockfiles, or hooks appear out of sync.
 4. Use the repository's existing package manager and lockfile. Do not introduce a second package manager.
 5. Copy `.env.example` to the appropriate local environment file when provided. Never commit the copy.
@@ -74,17 +74,14 @@ If the worktree is dirty, stop and understand the existing changes before switch
 
 ## Local validation
 
-The template scripts detect supported tools and skip checks that do not apply:
+The repository runtime detects supported tools and skips checks that do not apply:
 
 ```sh
-bash .github/scripts/ci.sh format
-bash .github/scripts/ci.sh lint
-bash .github/scripts/ci.sh type_check
-bash .github/scripts/ci.sh build
-bash .github/scripts/ci.sh unit
-bash .github/scripts/ci.sh integration
-bash .github/scripts/ci.sh e2e
-bash .github/scripts/ci.sh smoke
+npx code-foundry doctor
+npm run format:check   # or the package manager's equivalent
+npm run lint
+npm run type-check
+npm test
 Security and dependency audits run through the GitHub Security workflow.
 ```
 
@@ -110,7 +107,7 @@ For maintainers, trusted contributors, and automation agents:
 
 8. Push the branch and open a pull request into `staging`.
 9. Address review feedback and failed checks on the same branch.
-10. Squash-merge only after required checks pass and the change is ready.
+10. Merge using the repository's configured `merge_strategy` after required checks pass and the change is ready.
 
 ### Internal agent handoff
 

package/.github/actions/setup/action.yml

@@ -1,5 +1,5 @@
 name: Repository Setup
-description: Install the pinned mise toolchain and optionally project dependencies.
+description: Select mise or native language tooling and optionally install project dependencies.
 
 inputs:
   install:
@@ -85,6 +85,16 @@ runs:
       run: |
         tracked_files="$(git ls-files)"
 
+        toolchain="auto"
+        if [ -f .github/code-foundry.yml ]; then
+          configured_toolchain="$(awk -F': ' '/^toolchain:/ {print $2; exit}' .github/code-foundry.yml)"
+          [ -n "$configured_toolchain" ] && toolchain="$configured_toolchain"
+        fi
+        if [ "$toolchain" = auto ] && [ -f .mise.toml ]; then
+          toolchain=mise
+        fi
+        printf 'toolchain_mode=%s\n' "$toolchain" >> "$GITHUB_OUTPUT"
+
         has_tracked_regex() {
           printf '%s\n' "$tracked_files" | grep -Eq "$1"
         }
@@ -428,6 +438,43 @@ runs:
         REPO_FOUNDRY_TASK_RUST: ${{ inputs.task-rust }}
         REPO_FOUNDRY_CACHE_PACKAGES: ${{ inputs.cache-packages }}
 
+    - name: Setup Node
+      if: >-
+        steps.profile.outputs.toolchain_mode != 'mise' &&
+        steps.profile.outputs.javascript == 'true' &&
+        steps.profile.outputs.javascript_package_manager != 'bun'
+      uses: actions/setup-node@v5
+      with:
+        node-version: 24
+        cache: ${{ steps.profile.outputs.javascript_package_manager == 'npm' && 'npm' || steps.profile.outputs.javascript_package_manager == 'pnpm' && 'pnpm' || steps.profile.outputs.javascript_package_manager == 'yarn' && 'yarn' || '' }}
+
+    - name: Setup Bun
+      if: >-
+        steps.profile.outputs.toolchain_mode != 'mise' &&
+        steps.profile.outputs.javascript == 'true' &&
+        steps.profile.outputs.javascript_package_manager == 'bun'
+      uses: oven-sh/setup-bun@v2
+      with:
+        bun-version: 1.3.14
+
+    - name: Enable Corepack
+      if: >-
+        steps.profile.outputs.toolchain_mode != 'mise' &&
+        (steps.profile.outputs.javascript_package_manager == 'pnpm' ||
+        steps.profile.outputs.javascript_package_manager == 'yarn')
+      shell: bash
+      run: corepack enable
+
+    - name: Setup Python
+      if: steps.profile.outputs.toolchain_mode != 'mise' && steps.profile.outputs.python == 'true'
+      uses: actions/setup-python@v6
+      with:
+        python-version: '3.13'
+
+    - name: Setup Rust
+      if: steps.profile.outputs.toolchain_mode != 'mise' && steps.profile.outputs.rust == 'true'
+      uses: dtolnay/rust-toolchain@stable
+
     - name: Setup uv
       if: >-
         steps.profile.outputs.python == 'true' &&
@@ -658,7 +705,7 @@ runs:
         path: ~/.cargo/advisory-db
         # The advisory database is independent of project dependencies. Keep
         # it warm for Security without invalidating it on every lockfile edit.
-        key: ${{ runner.os }}-rust-advisory-${{ hashFiles('.github/scripts/security.sh') }}
+        key: ${{ runner.os }}-rust-advisory-${{ hashFiles('.code-foundry/src/runtime.mjs') }}
         restore-keys: |
           ${{ runner.os }}-rust-advisory-
     - name: Cache Rust builds
@@ -701,7 +748,7 @@ runs:
         REPO_FOUNDRY_INSTALL_PYTHON: ${{ inputs.install-python }}
         REPO_FOUNDRY_INSTALL_RUST: ${{ inputs.install-rust }}
         REPO_FOUNDRY_TASK: ${{ inputs.task }}
-      run: bash .github/scripts/ci.sh install
+      run: node .code-foundry/src/runtime.mjs ci install
     - name: Measure Bun dependencies
       id: javascript-bun-cache
       if: >-

package/.github/code-foundry.yml

@@ -3,12 +3,17 @@ version: 1
 profile: auto
 languages: typescript
 features: all
+codeql: auto
+dependency_review: auto
 package_manager: bun
+toolchain: auto
 runtime_repository: 0xPlayerOne/code-foundry
-runtime_ref: v0.22.2
+runtime_ref: v0.26.0
 release_type: node
 npm_publish: true
 license: agpl-3.0-or-later
+git_workflow: staging-release
+merge_strategy: rebase
 runner: ubuntu-latest
 unit_runner: ubuntu-slim
 cache_packages: auto