code-foundry 0.25.0 → 0.27.0

package/.github/licenses/MIT.txt

@@ -1,21 +1,9 @@
 MIT License
 
-Copyright (c) CURRENT_YEAR PROJECT_OWNER
+Copyright (c) <year> <copyright holders>
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/.github/workflows/ci.yml

@@ -53,18 +53,15 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Detect
         id: applicability
-        run: bash .github/scripts/ci.sh should_run format >> "$GITHUB_OUTPUT"
-      - name: Fast path
-        if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/format-fast-path.sh
+        run: node .code-foundry/src/runtime.mjs ci should_run format >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -79,7 +76,7 @@ jobs:
           task-rust: 'false'
       - name: Format
         if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/ci.sh format
+        run: node .code-foundry/src/runtime.mjs ci format
 
   lint:
     name: Lint
@@ -95,15 +92,15 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Detect
         id: applicability
-        run: bash .github/scripts/ci.sh should_run lint >> "$GITHUB_OUTPUT"
+        run: node .code-foundry/src/runtime.mjs ci should_run lint >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -113,7 +110,7 @@ jobs:
           task: lint
       - name: Lint
         if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/ci.sh lint
+        run: node .code-foundry/src/runtime.mjs ci lint
 
   type-check:
     name: Type-Check
@@ -129,15 +126,15 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Detect
         id: applicability
-        run: bash .github/scripts/ci.sh should_run type_check >> "$GITHUB_OUTPUT"
+        run: node .code-foundry/src/runtime.mjs ci should_run type_check >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -147,7 +144,7 @@ jobs:
           task: type_check
       - name: Type-Check
         if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/ci.sh type_check
+        run: node .code-foundry/src/runtime.mjs ci type_check
 
   build:
     name: Build
@@ -163,15 +160,15 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Detect
         id: applicability
-        run: bash .github/scripts/ci.sh should_run build >> "$GITHUB_OUTPUT"
+        run: node .code-foundry/src/runtime.mjs ci should_run build >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -181,4 +178,4 @@ jobs:
           task: build
       - name: Build
         if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/ci.sh build
+        run: node .code-foundry/src/runtime.mjs ci build

package/.github/workflows/ci_self-ci.yml

@@ -16,6 +16,6 @@ jobs:
     uses: ./.github/workflows/ci.yml
     with:
       runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: v0.22.0
+      runtime-ref: staging
       runner: ubuntu-latest
     secrets: inherit

package/.github/workflows/codeql.yml

@@ -41,6 +41,7 @@ jobs:
     timeout-minutes: 10
     outputs:
       languages: ${{ steps.languages.outputs.languages }}
+      enabled: ${{ steps.languages.outputs.enabled }}
       code_security: ${{ steps.security.outputs.status }}
       actions_available: ${{ steps.languages.outputs.actions_available }}
       actions_changed: ${{ steps.languages.outputs.actions_changed }}
@@ -61,14 +62,13 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           status="disabled"
-          if [ "${{ github.event.repository.private }}" != "true" ]; then
+          if [ "${{ github.event.repository.visibility }}" = "public" ]; then
             status="enabled"
           else
             status="$(gh api "repos/${GITHUB_REPOSITORY}" --jq '.security_and_analysis.code_security.status // "disabled"' 2>/dev/null || printf 'disabled')"
           fi
           printf 'status=%s\n' "$status" >> "$GITHUB_OUTPUT"
       - name: Checkout
-        if: ${{ !github.event.repository.private || steps.security.outputs.status == 'enabled' }}
         uses: actions/checkout@v7
         with:
           fetch-depth: 2
@@ -85,7 +85,6 @@ jobs:
             package-lock.json
           sparse-checkout-cone-mode: false
       - name: Runtime
-        if: ${{ !github.event.repository.private || steps.security.outputs.status == 'enabled' }}
         uses: actions/checkout@v7
         with:
           repository: ${{ inputs.runtime-repository }}
@@ -93,31 +92,26 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
-        if: ${{ !github.event.repository.private || steps.security.outputs.status == 'enabled' }}
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - id: languages
         name: Detect languages
         env:
           CODEQL_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
           REPO_FOUNDRY_CODE_SECURITY: ${{ steps.security.outputs.status }}
           REPO_FOUNDRY_PRIVATE: ${{ github.event.repository.private }}
-        run: |
-          if [ "$REPO_FOUNDRY_PRIVATE" = "true" ] && [ "$REPO_FOUNDRY_CODE_SECURITY" != "enabled" ]; then
-            echo 'languages=[]' >> "$GITHUB_OUTPUT"
-          else
-            bash .github/scripts/codeql-languages.sh
-          fi
+          REPO_FOUNDRY_VISIBILITY: ${{ github.event.repository.visibility }}
+        run: node .code-foundry/src/runtime.mjs codeql
 
   analyze-actions:
     name: Analyze (Actions)
     needs: detect
     if: >-
-      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
+      needs.detect.outputs.enabled == 'true' &&
       needs.detect.outputs.actions_available == 'true' &&
       needs.detect.outputs.actions_changed == 'true'
     runs-on: ${{ inputs.runner }}
@@ -133,12 +127,12 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Analyze
         uses: ./.github/actions/codeql
         with:
@@ -150,7 +144,7 @@ jobs:
     name: Analyze (TypeScript)
     needs: detect
     if: >-
-      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
+      needs.detect.outputs.enabled == 'true' &&
       needs.detect.outputs.javascript_available == 'true' &&
       needs.detect.outputs.javascript_changed == 'true'
     runs-on: ${{ inputs.runner }}
@@ -166,12 +160,12 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Analyze
         uses: ./.github/actions/codeql
         with:
@@ -183,7 +177,7 @@ jobs:
     name: Analyze (Python)
     needs: detect
     if: >-
-      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
+      needs.detect.outputs.enabled == 'true' &&
       needs.detect.outputs.python_available == 'true' &&
       needs.detect.outputs.python_changed == 'true'
     runs-on: ${{ inputs.runner }}
@@ -199,12 +193,12 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Analyze
         uses: ./.github/actions/codeql
         with:
@@ -216,7 +210,7 @@ jobs:
     name: Analyze (Rust)
     needs: detect
     if: >-
-      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
+      needs.detect.outputs.enabled == 'true' &&
       needs.detect.outputs.rust_available == 'true' &&
       needs.detect.outputs.rust_changed == 'true'
     runs-on: ${{ inputs.runner }}
@@ -232,12 +226,12 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Analyze
         uses: ./.github/actions/codeql
         with:

package/.github/workflows/codeql_self-ci.yml

@@ -21,6 +21,6 @@ jobs:
     uses: ./.github/workflows/codeql.yml
     with:
       runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: v0.22.0
+      runtime-ref: staging
       runner: ubuntu-latest
     secrets: inherit

package/.github/workflows/draft-pr.yml

@@ -29,7 +29,7 @@ jobs:
         id: check-pr
         run: |
           BRANCH="${{ github.ref_name }}"
-          EXISTING=$(gh pr list --limit 1 --base staging --head "$BRANCH" --state open --json number,title 2>/dev/null | jq 'length')
+          EXISTING=$(gh pr list --limit 1 --base staging --head "$BRANCH" --state open --json number,title 2>/dev/null | node -e 'let d=""; process.stdin.on("data", c => d += c).on("end", () => console.log(JSON.parse(d || "[]").length))')
           echo "existing=$EXISTING" >> "$GITHUB_OUTPUT"
 
       - name: Create
@@ -51,7 +51,7 @@ jobs:
         if: steps.check-pr.outputs.existing == '0'
         run: |
           BRANCH="${{ github.ref_name }}"
-          PR_NUMBER=$(gh pr list --limit 1 --base staging --head "$BRANCH" --state open --json number 2>/dev/null | jq '.[0].number')
+          PR_NUMBER=$(gh pr list --limit 1 --base staging --head "$BRANCH" --state open --json number 2>/dev/null | node -e 'let d=""; process.stdin.on("data", c => d += c).on("end", () => console.log(JSON.parse(d || "[]")[0]?.number || ""))')
           if [ -n "$PR_NUMBER" ]; then
             gh pr ready "$PR_NUMBER"
           fi

package/.github/workflows/release-pr.yml

@@ -35,7 +35,7 @@ jobs:
             --base main \
             --head staging \
             --state open \
-            --json number | jq 'length')
+            --json number | node -e 'let d=""; process.stdin.on("data", c => d += c).on("end", () => console.log(JSON.parse(d || "[]").length))')
           COMPARE_URL="repos/${GITHUB_REPOSITORY}/compare/main...staging"
           TOTAL_COMMITS=$(gh api "$COMPARE_URL?per_page=1" --jq '.total_commits // 0')
           echo "existing=$EXISTING" >> "$GITHUB_OUTPUT"
@@ -53,12 +53,12 @@ jobs:
           COMPARE_URL="repos/${GITHUB_REPOSITORY}/compare/main...staging"
           COMPARE_FILE="$RUNNER_TEMP/release-compare.json"
           gh api "$COMPARE_URL?per_page=100" > "$COMPARE_FILE"
-          TOTAL_COMMITS=$(jq -r '.total_commits // 0' "$COMPARE_FILE")
+          TOTAL_COMMITS=$(node -e 'const d=require(process.argv[1]); console.log(d.total_commits || 0)' "$COMPARE_FILE")
           if [ "$TOTAL_COMMITS" -gt 100 ]; then
             LAST_PAGE=$(( (TOTAL_COMMITS + 99) / 100 ))
             gh api "$COMPARE_URL?per_page=100&page=$LAST_PAGE" > "$COMPARE_FILE"
           fi
-          COMMITS=$(jq -r '.commits[] | "- \(.commit.message | split("\\n")[0]) (\(.sha[0:7]))"' "$COMPARE_FILE")
+          COMMITS=$(node -e 'const d=require(process.argv[1]); for (const c of d.commits || []) console.log(`- ${c.commit.message.split("\\n")[0]} (${c.sha.slice(0, 7)})`)' "$COMPARE_FILE")
           if [ -z "$COMMITS" ]; then
             COMMITS='- No commits found since main.'
           fi
@@ -87,7 +87,7 @@ jobs:
           ### Validation
 
           - Required CI, test, security, and CodeQL checks must pass before merge.
-          - Merge with **rebase** to preserve the linear Conventional Commit history.
+          - Merge using the repository's configured \`merge_strategy\` (default: **rebase**).
           - After merge, Release Please opens a separate versioned release PR with the changelog.
           EOF
 

package/.github/workflows/release.yml

@@ -41,36 +41,24 @@ jobs:
           filter: blob:none
       - name: Detect release profile
         id: profile
-        shell: bash
         run: |
-          if [ -x .github/scripts/profile.sh ]; then
-            release_type="$(bash .github/scripts/profile.sh get release_type)"
-            npm_publish="$(bash .github/scripts/profile.sh get npm_publish)"
-          else
-            config_file=.github/code-foundry.yml
-            release_type="$(awk -F': ' '/^release_type:/ {print $2; exit}' "$config_file" 2>/dev/null || true)"
-            npm_publish="$(awk -F': ' '/^npm_publish:/ {print $2; exit}' "$config_file" 2>/dev/null || true)"
-          fi
-          [ -n "$release_type" ] || release_type=auto
-          [ -n "$npm_publish" ] || npm_publish=false
-
-          if [ "$release_type" = auto ]; then
-            if [ -f package.json ]; then release_type=node
-            elif [ -f pyproject.toml ]; then release_type=python
-            elif [ -f Cargo.toml ]; then release_type=rust
-            elif [ -f version.txt ]; then release_type=simple
-            else release_type=none
-            fi
-          fi
-
-          case "$release_type" in
-            node|python|rust|simple) ;;
-            none) npm_publish=false ;;
-            *) echo "Unsupported release_type: $release_type" >&2; exit 2 ;;
-          esac
-          if [ ! -f package.json ]; then npm_publish=false; fi
-          printf 'release_type=%s\n' "$release_type" >> "$GITHUB_OUTPUT"
-          printf 'npm_publish=%s\n' "$npm_publish" >> "$GITHUB_OUTPUT"
+          node <<'NODE'
+          const fs = require('node:fs')
+          const config = fs.existsSync('.github/code-foundry.yml')
+            ? Object.fromEntries(fs.readFileSync('.github/code-foundry.yml', 'utf8').split(/\r?\n/).flatMap((line) => {
+                const match = line.match(/^([A-Za-z0-9_-]+):\s*(.*?)\s*$/)
+                return match ? [[match[1], match[2].replace(/\s+#.*$/, '').replace(/^['"]|['"]$/g, '')]] : []
+              }))
+            : {}
+          let releaseType = config.release_type || 'auto'
+          let npmPublish = config.npm_publish || 'false'
+          if (releaseType === 'auto') {
+            releaseType = fs.existsSync('package.json') ? 'node' : fs.existsSync('pyproject.toml') ? 'python' : fs.existsSync('Cargo.toml') ? 'rust' : fs.existsSync('version.txt') ? 'simple' : 'none'
+          }
+          if (!['node', 'python', 'rust', 'simple', 'none'].includes(releaseType)) throw new Error(`Unsupported release_type: ${releaseType}`)
+          if (releaseType === 'none' || !fs.existsSync('package.json')) npmPublish = 'false'
+          fs.appendFileSync(process.env.GITHUB_OUTPUT, `release_type=${releaseType}\nnpm_publish=${npmPublish}\n`)
+          NODE
       - name: Release Please
         id: release
         if: steps.profile.outputs.release_type != 'none'

package/.github/workflows/security.yml

@@ -44,6 +44,7 @@ jobs:
       rust: ${{ steps.profile.outputs.rust }}
       python: ${{ steps.profile.outputs.python }}
       python_requirements: ${{ steps.profile.outputs.python_requirements }}
+      dependency_review: ${{ steps.profile.outputs.dependency_review }}
     steps:
       - name: Checkout
         uses: actions/checkout@v7
@@ -83,15 +84,18 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Detect
         id: profile
-        run: bash .github/scripts/security.sh profile >> "$GITHUB_OUTPUT"
+        env:
+          REPO_FOUNDRY_PRIVATE: ${{ github.event.repository.private }}
+          REPO_FOUNDRY_VISIBILITY: ${{ github.event.repository.visibility }}
+        run: node .code-foundry/src/runtime.mjs security profile >> "$GITHUB_OUTPUT"
 
   dependency-audit-javascript:
     name: Dependency Audit (JavaScript)
@@ -124,15 +128,15 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Detect
         id: applicability
-        run: bash .github/scripts/security.sh should_run javascript >> "$GITHUB_OUTPUT"
+        run: node .code-foundry/src/runtime.mjs security should_run javascript >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -141,7 +145,7 @@ jobs:
           cache-save: ${{ github.event_name != 'pull_request' }}
       - name: Audit dependencies
         if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/security.sh audit javascript
+        run: node .code-foundry/src/runtime.mjs security audit javascript
 
   dependency-audit-rust:
     name: Dependency Audit (Rust)
@@ -168,15 +172,15 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Detect
         id: applicability
-        run: bash .github/scripts/security.sh should_run rust >> "$GITHUB_OUTPUT"
+        run: node .code-foundry/src/runtime.mjs security should_run rust >> "$GITHUB_OUTPUT"
       - name: Check Rust
         id: system-rust
         if: steps.applicability.outputs.applicable == 'true'
@@ -204,7 +208,7 @@ jobs:
           tool: cargo-audit
       - name: Audit dependencies
         if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/security.sh audit rust
+        run: node .code-foundry/src/runtime.mjs security audit rust
 
   dependency-audit-python:
     name: Dependency Audit (Python) / ${{ matrix.requirement }}
@@ -248,19 +252,19 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Setup
         uses: ./.github/actions/setup
         with:
           mise-scope: python
           cache-save: ${{ github.event_name != 'pull_request' }}
       - name: Audit dependencies
-        run: bash .github/scripts/security.sh audit python
+        run: node .code-foundry/src/runtime.mjs security audit python
 
   dependency-audit-python-gate:
     name: Dependency Audit (Python)
@@ -285,7 +289,8 @@ jobs:
 
   dependency-review:
     name: Dependency Review
-    if: ${{ github.event_name == 'pull_request' && !github.event.repository.private }}
+    needs: profile
+    if: ${{ github.event_name == 'pull_request' && needs.profile.outputs.dependency_review == 'true' }}
     runs-on: ${{ inputs.runner }}
     timeout-minutes: 10
     steps:

package/.github/workflows/security_self-ci.yml

@@ -16,6 +16,6 @@ jobs:
     uses: ./.github/workflows/security.yml
     with:
       runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: v0.22.0
+      runtime-ref: staging
       runner: ubuntu-slim
     secrets: inherit