code-foundry 0.25.0 → 0.27.0

package/src/runtime.mjs

@@ -0,0 +1,316 @@
+#!/usr/bin/env node
+// @ts-check
+
+import { appendFileSync, existsSync, readFileSync } from 'node:fs'
+import { resolve } from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { detectPackageManager, resolveProfile } from './lib/profile.mjs'
+import { configured, readConfig } from './lib/config.mjs'
+
+const root = process.cwd()
+const config = readConfig(resolve(root, '.github/code-foundry.yml'))
+const repoProfile = resolveProfile(root)
+/** @type {string[]} */
+const languages = configured(config.languages, repoProfile.languages).split(',').filter(Boolean)
+const packageManager = configured(config.package_manager, detectPackageManager(root))
+const output = process.env.GITHUB_OUTPUT
+
+/** @param {string} language */
+function hasLanguage(language) {
+  return languages.includes(language) || languages.includes('all')
+}
+
+/** @param {string} name */
+function hasScript(name) {
+  return readPackage()?.scripts?.[name] !== undefined
+}
+
+function readPackage() {
+  try { return JSON.parse(readFileSync(resolve(root, 'package.json'), 'utf8')) } catch { return null }
+}
+
+/** @param {string} key @param {unknown} value */
+function writeOutput(key, value) {
+  const line = `${key}=${typeof value === 'string' ? value : JSON.stringify(value)}\n`
+  if (output) requireWrite(output, line)
+  else console.log(line.trimEnd())
+}
+
+/** @param {string} file @param {string} content */
+function requireWrite(file, content) {
+  appendFileSync(file, content)
+}
+
+/** @param {string} command */
+function commandExists(command) {
+  return spawnSync(command, ['--version'], { stdio: 'ignore' }).status === 0
+}
+
+/** @param {string} command @param {string[]} [args] @param {Record<string, unknown>} [options] */
+function run(command, args = [], options = {}) {
+  const result = spawnSync(command, args, { cwd: root, stdio: 'inherit', env: process.env, ...options })
+  if (result.error) throw result.error
+  if (result.status !== 0) process.exit(result.status ?? 1)
+}
+
+/** @param {string} command @param {string[]} [args] */
+function capture(command, args = []) {
+  const result = spawnSync(command, args, { cwd: root, encoding: 'utf8', env: process.env })
+  return result.status === 0 ? result.stdout.trim() : ''
+}
+
+/** @param {string[]} args @returns {[string|null, string[]]} */
+function packageCommand(args) {
+  switch (packageManager) {
+    case 'bun': return ['bun', args]
+    case 'pnpm': return ['pnpm', args]
+    case 'yarn': return ['yarn', args]
+    case 'npm': return ['npm', args]
+    default: return [null, args]
+  }
+}
+
+/** @param {string[]} names */
+function runScript(names) {
+  const name = names.find((candidate) => hasScript(candidate))
+  if (!name) return false
+  const [manager, args] = packageCommand(['run', name])
+  if (!manager) return false
+  run(manager, args)
+  return true
+}
+
+/** @param {string} tool @param {string[]} [args] */
+function runTool(tool, args = []) {
+  const [manager] = packageCommand([])
+  if (manager === 'bun') return run('bunx', ['--no-install', tool, ...args])
+  if (manager === 'pnpm') return run('pnpm', ['exec', tool, ...args])
+  if (manager === 'yarn') return run('yarn', ['exec', tool, ...args])
+  if (manager === 'npm') return run('npx', ['--no-install', tool, ...args])
+  return run(tool, args)
+}
+
+function install() {
+  if (existsSync(resolve(root, 'package.json'))) {
+    const lock = ['bun.lock', 'bun.lockb', 'pnpm-lock.yaml', 'yarn.lock', 'package-lock.json'].find((file) => existsSync(resolve(root, file)))
+    if (lock) {
+      /** @type {Record<string, [string, string[]]>} */
+      const commands = {
+        bun: ['bun', ['install', '--frozen-lockfile']],
+        pnpm: ['pnpm', ['install', '--frozen-lockfile', '--prefer-offline']],
+        yarn: ['yarn', ['install', '--immutable']],
+        npm: ['npm', ['ci', '--prefer-offline', '--no-audit', '--fund=false']],
+      }
+      const command = commands[packageManager]
+      if (command) run(command[0], command[1])
+    }
+  }
+  if (hasLanguage('python') && (existsSync(resolve(root, 'pyproject.toml')) || existsSync(resolve(root, 'requirements.txt')))) {
+    if (commandExists('uv') && existsSync(resolve(root, 'uv.lock'))) run('uv', ['sync', '--frozen'])
+    else if (!existsSync(resolve(root, '.venv'))) run('python', ['-m', 'venv', '.venv'])
+  }
+  if (hasLanguage('rust') && existsSync(resolve(root, 'Cargo.toml'))) run('cargo', ['fetch'])
+}
+
+/** @param {string} task */
+function relevant(task) {
+  const js = hasLanguage('typescript') || hasLanguage('javascript')
+  const python = hasLanguage('python')
+  const rust = hasLanguage('rust')
+  if (task === 'format' || task === 'lint' || task === 'type_check' || task === 'build') return js || python || rust
+  if (['unit', 'integration', 'e2e', 'smoke'].includes(task)) return js || python || rust || hasLanguage('solidity')
+  return true
+}
+
+/** @param {string} ecosystem */
+function hasDependencyManifest(ecosystem) {
+  if (ecosystem === 'javascript') {
+    const packageJson = readPackage()
+    return ['bun.lock', 'bun.lockb', 'pnpm-lock.yaml', 'yarn.lock', 'package-lock.json'].some((file) => existsSync(resolve(root, file))) ||
+      Boolean(packageJson && ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'].some((group) => Object.keys(packageJson[group] ?? {}).length))
+  }
+  if (ecosystem === 'rust') return existsSync(resolve(root, 'Cargo.toml'))
+  if (ecosystem === 'python') return existsSync(resolve(root, 'pyproject.toml')) || existsSync(resolve(root, 'uv.lock')) || capture('git', ['ls-files', '*requirements*.txt']) !== ''
+  return false
+}
+
+/** @param {string} task */
+function ci(task) {
+  if (task === 'install') return install()
+  if (task === 'should_run' || task === 'task_profile') {
+    const selected = process.argv[3]
+    writeOutput('applicable', relevant(selected) ? 'true' : 'false')
+    writeOutput('javascript', (hasLanguage('typescript') || hasLanguage('javascript')) ? 'true' : 'false')
+    writeOutput('python', hasLanguage('python') ? 'true' : 'false')
+    writeOutput('rust', hasLanguage('rust') ? 'true' : 'false')
+    return
+  }
+  if (task === 'format') {
+    const scripted = runScript(['format:check', 'format', 'fmt'])
+    if (!scripted && (hasLanguage('typescript') || hasLanguage('javascript'))) runTool('prettier', ['--check', '.'])
+    if (hasLanguage('python')) runTool('ruff', ['format', '--check', '.'])
+    if (hasLanguage('rust')) run('cargo', ['fmt', '--check'])
+    return
+  }
+  if (task === 'lint') {
+    const scripted = runScript(['lint'])
+    if (!scripted && (hasLanguage('typescript') || hasLanguage('javascript'))) runTool('eslint', ['.'])
+    if (hasLanguage('python')) runTool('ruff', ['check', '.'])
+    if (hasLanguage('rust')) run('cargo', ['clippy', '--all-targets', '--', '-D', 'warnings'])
+    return
+  }
+  if (task === 'type_check') {
+    const scripted = runScript(['type-check', 'typecheck', 'type:check'])
+    if (!scripted && existsSync(resolve(root, 'tsconfig.json'))) runTool('tsc', ['--noEmit'])
+    if (hasLanguage('rust')) run('cargo', ['check', '--all-targets'])
+    return
+  }
+  if (task === 'build') {
+    const scripted = runScript(['build'])
+    if (!scripted && hasLanguage('rust')) run('cargo', ['build', '--all-targets'])
+    return
+  }
+  /** @type {Record<string, string[]>} */
+  const scriptsByTask = {
+    unit: ['test:unit', 'test:coverage', 'test'],
+    integration: ['test:integration'],
+    e2e: ['test:e2e', 'e2e'],
+    smoke: ['test:smoke', 'smoke'],
+  }
+  const scripts = scriptsByTask[task]
+  if (scripts) runScript(scripts)
+  if (hasLanguage('rust')) run('cargo', ['test'])
+  if (hasLanguage('python')) {
+    const python = existsSync(resolve(root, '.venv/bin/python')) ? resolve(root, '.venv/bin/python') : 'python'
+    run(python, ['-m', 'pytest', ...(task === 'integration' ? ['tests/integration'] : [])])
+  }
+}
+
+/** @param {string} task @param {string} ecosystem */
+function security(task, ecosystem) {
+  if (task === 'profile') {
+    writeOutput('javascript', hasDependencyManifest('javascript') ? 'true' : 'false')
+    writeOutput('rust', hasDependencyManifest('rust') ? 'true' : 'false')
+    writeOutput('python', hasDependencyManifest('python') ? 'true' : 'false')
+    const requirements = capture('git', ['ls-files', '*requirements*.txt']).split('\n').filter(Boolean)
+    writeOutput('python_requirements', hasDependencyManifest('python') ? (requirements.length ? requirements : ['project']) : ['none'])
+    writeOutput('dependency_review', featureEnabled('dependency_review') ? 'true' : 'false')
+    return
+  }
+  if (task === 'should_run') {
+    writeOutput('applicable', hasDependencyManifest(ecosystem) ? 'true' : 'false')
+    return
+  }
+  if (ecosystem === 'javascript' && existsSync(resolve(root, 'package.json'))) {
+    const ignores = existsSync(resolve(root, '.github/security-audit-allowlist.txt'))
+      ? readFileSync(resolve(root, '.github/security-audit-allowlist.txt'), 'utf8').split(/\r?\n/).filter((line) => line && !line.startsWith('#'))
+      : []
+    /** @type {Record<string, [string, string[]]>} */
+    const commands = {
+      bun: ['bun', ['audit', ...ignores.flatMap((advisory) => ['--ignore', advisory])]],
+      pnpm: ['pnpm', ['audit', '--audit-level', 'high']],
+      yarn: ['yarn', ['npm', 'audit', '--all', '--recursive']],
+      npm: ['npm', ['audit', '--audit-level=high']],
+    }
+    const command = commands[packageManager]
+    if (command) run(command[0], command[1])
+  } else if (ecosystem === 'rust' && existsSync(resolve(root, 'Cargo.toml'))) {
+    if (!commandExists('cargo-audit')) run('cargo', ['install', 'cargo-audit', '--locked', '--quiet'])
+    run('cargo', ['audit'])
+  } else if (ecosystem === 'python' && hasDependencyManifest('python')) {
+    const requirement = process.env.REPO_FOUNDRY_PYTHON_REQUIREMENT
+    const auditArgs = requirement && !['project', 'none'].includes(requirement) ? ['-r', requirement] : []
+    if (commandExists('uv')) run('uv', ['tool', 'run', '--from', 'pip-audit==2.10.1', 'pip-audit', ...auditArgs])
+    else {
+      run('python', ['-m', 'pip', 'install', '--quiet', 'pip-audit==2.10.1'])
+      run('python', ['-m', 'pip_audit', ...auditArgs])
+    }
+  }
+}
+
+/** @param {string} key */
+function featureEnabled(key) {
+  const policy = config[key] ?? 'auto'
+  if (policy === 'false') return false
+  if (policy === 'true') return true
+  return isPublicRepository()
+}
+
+function isPublicRepository() {
+  const visibility = process.env.REPO_FOUNDRY_VISIBILITY
+  return visibility ? visibility === 'public' : process.env.REPO_FOUNDRY_PRIVATE !== 'true'
+}
+
+function codeql() {
+  const enabled = featureEnabled('codeql') &&
+    (isPublicRepository() || process.env.REPO_FOUNDRY_CODE_SECURITY === 'enabled')
+  writeOutput('enabled', enabled ? 'true' : 'false')
+  if (!enabled) {
+    writeOutput('languages', [])
+    for (const language of ['actions', 'javascript', 'python', 'rust']) {
+      writeOutput(`${language}_available`, 'false')
+      writeOutput(`${language}_changed`, 'false')
+      writeOutput(`${language}_build_mode`, 'none')
+    }
+    return
+  }
+  const available = []
+  if (existsSync(resolve(root, '.github/workflows'))) available.push('actions')
+  if (hasLanguage('typescript') || hasLanguage('javascript')) available.push('javascript-typescript')
+  if (hasLanguage('python')) available.push('python')
+  if (hasLanguage('rust')) available.push('rust')
+  const changed = capture('git', ['diff', '--name-only', process.env.CODEQL_BASE_SHA || 'HEAD^', process.env.GITHUB_SHA || 'HEAD']).split('\n').filter(Boolean)
+  const languagesJson = available.map((language) => ({ language, name: language === 'javascript-typescript' ? 'TypeScript' : language[0].toUpperCase() + language.slice(1), 'build-mode': 'none', changed: changed.length === 0 || changed.some((file) => fileMatches(language, file)) }))
+  writeOutput('languages', languagesJson)
+  for (const language of ['actions', 'javascript-typescript', 'python', 'rust']) {
+    const entry = languagesJson.find((item) => item.language === language)
+    const prefix = language === 'javascript-typescript' ? 'javascript' : language
+    writeOutput(`${prefix}_available`, entry ? 'true' : 'false')
+    writeOutput(`${prefix}_changed`, entry?.changed ? 'true' : 'false')
+    writeOutput(`${prefix}_build_mode`, entry?.['build-mode'] ?? 'none')
+  }
+}
+
+/** @param {string} language @param {string} file */
+function fileMatches(language, file) {
+  if (language === 'actions') return file.startsWith('.github/workflows/') || file.endsWith('action.yml')
+  if (language === 'javascript-typescript') return /\.(js|jsx|mjs|cjs|ts|tsx|mts|cts)$/.test(file) || /(^|\/)(package\.json|tsconfig[^/]*\.json|(?:bun|pnpm|yarn|package-lock)\.lock)$/.test(file)
+  if (language === 'python') return /\.py$|(^|\/)(pyproject\.toml|requirements[^/]*\.txt|setup\.py|Pipfile\.lock|poetry\.lock)$/.test(file)
+  return /\.rs$|(^|\/)Cargo\.(toml|lock)$/.test(file)
+}
+
+/** @param {string} command */
+function printProfile(command) {
+  if (command === 'get') {
+    const key = process.argv[3]
+    console.log(config[key] ?? (key === 'languages' ? languages.join(',') : key === 'package_manager' ? packageManager : ''))
+    return
+  }
+  writeOutput('languages', languages.join(','))
+  writeOutput('package_manager', packageManager)
+  writeOutput('release_type', config.release_type ?? 'auto')
+  writeOutput('npm_publish', config.npm_publish ?? 'false')
+}
+
+function preCommit() {
+  const changed = capture('git', ['diff', '--cached', '--name-only'])
+  if (!changed) return
+  const check = spawnSync('git', ['diff', '--cached', '--check'], { cwd: root, stdio: 'inherit' })
+  if (check.status !== 0) process.exit(check.status ?? 1)
+  if (/\.(js|jsx|ts|tsx|json|md|mdx|yml|yaml)$/.test(changed)) { ci('format'); ci('lint') }
+  if (/\.rs$|(^|\/)Cargo\.toml$/.test(changed)) { run('cargo', ['fmt', '--check']); run('cargo', ['clippy', '--all-targets', '--', '-D', 'warnings']) }
+  if (/\.py$|(^|\/)(pyproject\.toml|requirements[^/]*\.txt)$/.test(changed)) { runTool('ruff', ['format', '--check', '.']); runTool('ruff', ['check', '.']) }
+}
+
+const [area, task, ecosystem] = process.argv.slice(2)
+try {
+  if (area === 'ci') ci(task)
+  else if (area === 'security') security(task, ecosystem)
+  else if (area === 'codeql') codeql()
+  else if (area === 'profile') printProfile(task)
+  else if (area === 'pre-commit') preCommit()
+  else throw new Error(`Unknown runtime command: ${area || '(missing)'}`)
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error))
+  process.exitCode = 1
+}

package/.github/scripts/bootstrap.sh

@@ -1,21 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-git config core.hooksPath .githooks
-
-if command -v mise >/dev/null 2>&1; then
-  mise trust --yes .mise.toml >/dev/null 2>&1 || true
-  if [ -f .mise.toml ] && [ ! -f mise.lock ]; then
-    if MISE_TRUSTED_CONFIG_PATHS="$PWD" mise lock >/dev/null 2>&1; then
-      printf '%s\n' 'Initialized mise.lock for deterministic CI tool installs.'
-    else
-      printf '%s\n' 'Warning: mise.lock could not be generated; continuing with pinned tool resolution.' >&2
-    fi
-  fi
-  mise install
-else
-  printf '%s\n' "mise is not installed; install it from https://mise.jdx.dev/ and rerun this script." >&2
-  exit 1
-fi
-
-bash .github/scripts/doctor.sh

package/.github/scripts/changed-files.sh

@@ -1,96 +0,0 @@
-#!/usr/bin/env bash
-
-# Shared pull-request change detection. A failed or incomplete diff must be
-# treated as relevant so checks never become silently optional.
-repo_foundry_changed_files() {
-  if [ "${REPO_FOUNDRY_CHANGED_FILES_READY:-false}" = true ]; then
-    return 0
-  fi
-
-  local base_sha="${REPO_FOUNDRY_BASE_SHA:-}"
-  local head_sha="${GITHUB_SHA:-HEAD}"
-  local changed_files=""
-
-  if [ -n "$base_sha" ] && [ "$base_sha" != "0000000000000000000000000000000000000000" ]; then
-    if ! git cat-file -e "$base_sha^{commit}" 2>/dev/null; then
-      git fetch --no-tags --filter=blob:none --depth=1 origin "$base_sha" >/dev/null 2>&1 || return 1
-    fi
-    changed_files="$(git diff --name-only "$base_sha" "$head_sha" 2>/dev/null || true)"
-  else
-    changed_files="$(git diff --name-only HEAD^ HEAD 2>/dev/null || true)"
-  fi
-
-  [ -n "$changed_files" ] || return 1
-  REPO_FOUNDRY_CHANGED_FILES="$changed_files"
-  REPO_FOUNDRY_CHANGED_FILES_READY=true
-}
-
-repo_foundry_governance_only() {
-  case "${GITHUB_EVENT_NAME:-}" in
-    pull_request|push) ;;
-    *) return 1 ;;
-  esac
-
-  local changed_files=""
-
-  repo_foundry_changed_files || return 1
-  changed_files="$REPO_FOUNDRY_CHANGED_FILES"
-
-  # An unavailable or empty diff is not evidence that a PR is documentation
-  # only. Continue with the full check in that case.
-  while IFS= read -r file; do
-    case "$file" in
-      README|README.*|LICENSE|NOTICE|.github/CODEOWNERS|.github/CODE_OF_CONDUCT.md|\
-      .github/CONTRIBUTING.md|.github/PULL_REQUEST_TEMPLATE.md|.github/SECURITY.md|\
-      .github/ISSUE_TEMPLATE/*)
-        ;;
-      *) return 1 ;;
-    esac
-  done <<< "$changed_files"
-
-  return 0
-}
-
-repo_foundry_pr_docs_only() {
-  repo_foundry_governance_only
-}
-
-# Return success when an ordinary push or pull request changed no dependency or
-# audit inputs for the requested ecosystem. Scheduled and manual runs, plus
-# unknown or unavailable diffs, fail open to a full security check.
-repo_foundry_pr_dependencies_unchanged() {
-  local ecosystem="${1:-all}"
-  case "${GITHUB_EVENT_NAME:-}" in
-    pull_request|push) ;;
-    *) return 1 ;;
-  esac
-
-  local changed_files=""
-  repo_foundry_changed_files || return 1
-  changed_files="$REPO_FOUNDRY_CHANGED_FILES"
-
-  while IFS= read -r file; do
-    case "$file" in
-      .github/workflows/security.yml|.github/scripts/security.sh|.github/scripts/changed-files.sh|\
-      .github/actions/setup/action.yml|.github/code-foundry.yml|.mise.toml|mise.lock|\
-      .github/security-audit-allowlist.txt)
-        return 1
-        ;;
-      package.json|*/package.json|bun.lock|bun.lockb|*/bun.lock|*/bun.lockb|\
-      pnpm-lock.yaml|*/pnpm-lock.yaml|yarn.lock|*/yarn.lock|package-lock.json|*/package-lock.json|\
-      .npmrc|*/.npmrc|.yarnrc*|*/.yarnrc*|.pnpmfile.cjs|*/.pnpmfile.cjs)
-        case "$ecosystem" in javascript|all) return 1 ;; esac
-        ;;
-      Cargo.toml|*/Cargo.toml|Cargo.lock|*/Cargo.lock|.cargo/*|*/.cargo/*)
-        case "$ecosystem" in rust|all) return 1 ;; esac
-        ;;
-      pyproject.toml|*/pyproject.toml|requirements*.txt|*/requirements*.txt|\
-      setup.py|*/setup.py|setup.cfg|*/setup.cfg|Pipfile|*/Pipfile|Pipfile.lock|*/Pipfile.lock|\
-      poetry.lock|*/poetry.lock|uv.lock|*/uv.lock)
-        case "$ecosystem" in python|all) return 1 ;; esac
-        ;;
-    esac
-  done <<< "$changed_files"
-
-  return 0
-}