code-foundry 0.26.0 → 0.27.0

package/.github/scripts/profile.sh

@@ -1,186 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Resolve repository settings with this precedence:
-# explicit REPO_FOUNDRY_* values (CLI callers can export them), then
-# .github/code-foundry.yml, then detected defaults.
-
-root="${REPO_FOUNDRY_ROOT:-$PWD}"
-command="detect"
-requested_key=""
-
-usage() {
-  cat <<'EOF'
-Usage: profile.sh [detect|env|get KEY] [--root PATH]
-
-Commands:
-  detect       Print the resolved profile as key=value lines (default)
-  env          Print REPO_FOUNDRY_* assignments
-  get KEY      Print one resolved profile value
-EOF
-}
-
-while [ "$#" -gt 0 ]; do
-  case "$1" in
-    detect|env) command="$1"; shift ;;
-    get) command=get; requested_key="${2:?missing profile key}"; shift 2 ;;
-    --root) root="${2:?missing root path}"; shift 2 ;;
-    -h|--help) usage; exit 0 ;;
-    *) printf 'Unknown option: %s\n' "$1" >&2; exit 2 ;;
-  esac
-done
-
-cd "$root"
-template_file=.github/code-foundry.yml
-
-config_value() {
-  local key="$1"
-  [ -f "$template_file" ] || return 0
-  awk -F': *' -v key="$key" '$1 == key { value=substr($0, index($0, ":") + 1); sub(/[[:space:]]+#.*/, "", value); print value; exit }' "$template_file" |
-    sed -e 's/^ *//' -e 's/ *$//' -e 's/^['"'"'"]//' -e 's/['"'"'"]$//'
-}
-
-env_value() {
-  local key="$1" env_key
-  env_key="REPO_FOUNDRY_$(printf '%s' "$key" | tr '[:lower:]-' '[:upper:]_')"
-  if [ -n "${!env_key+x}" ] && [ -n "${!env_key}" ]; then
-    printf '%s\n' "${!env_key}"
-  fi
-}
-
-raw_value() {
-  local key="$1" default="${2:-}" value
-  value="$(env_value "$key" || true)"
-  [ -n "$value" ] || value="$(config_value "$key" || true)"
-  [ -n "$value" ] && printf '%s\n' "$value" || printf '%s\n' "$default"
-}
-
-has_source() {
-  find . -path './.git' -prune -o -type f -print |
-    awk -v pattern="(^|/)[^/]+\\.($1)$" '$0 ~ pattern { found=1; exit } END { exit !found }'
-}
-
-detect_languages() {
-  local detected=()
-  if [ -f package.json ] || has_source 'js|jsx|mjs|cjs|ts|tsx|mts|cts' ||
-    [ -f bun.lock ] || [ -f bun.lockb ] || [ -f pnpm-lock.yaml ] ||
-    [ -f yarn.lock ] || [ -f package-lock.json ]; then
-    detected+=(typescript)
-  fi
-  if [ -f Cargo.toml ] || has_source 'rs'; then detected+=(rust); fi
-  if [ -f pyproject.toml ] || [ -f requirements.txt ] || [ -f requirements-dev.txt ] || has_source 'py'; then
-    detected+=(python)
-  fi
-  if find . -path './.git' -prune -o -type f -name '*.sol' -print -quit | grep -q .; then
-    detected+=(solidity)
-  fi
-  (IFS=,; printf '%s\n' "${detected[*]:-none}")
-}
-
-detect_package_manager() {
-  if [ -f bun.lock ] || [ -f bun.lockb ]; then echo bun
-  elif [ -f pnpm-lock.yaml ]; then echo pnpm
-  elif [ -f yarn.lock ]; then echo yarn
-  elif [ -f package-lock.json ]; then echo npm
-  elif [ -f package.json ]; then echo bun
-  else echo none
-  fi
-}
-
-detect_profile() {
-  if [ -f turbo.json ] || [ -f pnpm-workspace.yaml ] ||
-    ( [ -f package.json ] && node -e 'const p=require("./package.json"); process.exit(Array.isArray(p.workspaces) || (p.workspaces && typeof p.workspaces === "object") ? 0 : 1)' 2>/dev/null ); then
-    echo monorepo
-  elif [ -f package.json ] || [ -f pyproject.toml ] || [ -f Cargo.toml ]; then
-    echo application
-  else
-    echo minimal
-  fi
-}
-
-resolve_languages() {
-  local value
-  value="$(raw_value languages auto)"
-  [ "$value" = auto ] && value="$(detect_languages)"
-  printf '%s\n' "$value"
-}
-
-resolve_profile() {
-  local value
-  value="$(raw_value profile auto)"
-  [ "$value" = auto ] && value="$(detect_profile)"
-  printf '%s\n' "$value"
-}
-
-resolve_package_manager() {
-  local value
-  value="$(raw_value package_manager auto)"
-  [ "$value" = auto ] && value="$(detect_package_manager)"
-  printf '%s\n' "$value"
-}
-
-resolve_release_type() {
-  local value
-  value="$(raw_value release_type auto)"
-  if [ "$value" = auto ]; then
-    if [ -f package.json ]; then value=node
-    elif [ -f pyproject.toml ]; then value=python
-    elif [ -f Cargo.toml ]; then value=rust
-    elif [ -f version.txt ]; then value=simple
-    else value=none
-    fi
-  fi
-  printf '%s\n' "$value"
-}
-
-resolve_npm_publish() {
-  local value release_type
-  value="$(raw_value npm_publish false)"
-  release_type="$(resolve_release_type)"
-  [ "$release_type" = node ] || value=false
-  printf '%s\n' "$value"
-}
-
-detect() {
-  local profile languages package_manager release_type npm_publish features runner unit_runner
-  profile="$(resolve_profile)"
-  languages="$(resolve_languages)"
-  package_manager="$(resolve_package_manager)"
-  release_type="$(resolve_release_type)"
-  npm_publish="$(resolve_npm_publish)"
-  features="$(raw_value features all)"
-  runner="$(raw_value runner ubuntu-latest)"
-  unit_runner="$(raw_value unit_runner ubuntu-slim)"
-  printf 'profile=%s\n' "$profile"
-  printf 'languages=%s\n' "$languages"
-  printf 'features=%s\n' "$features"
-  printf 'package_manager=%s\n' "$package_manager"
-  printf 'release_type=%s\n' "$release_type"
-  printf 'npm_publish=%s\n' "$npm_publish"
-  printf 'runner=%s\n' "$runner"
-  printf 'unit_runner=%s\n' "$unit_runner"
-  printf 'ci_runner=%s\n' "$(raw_value ci_runner "$runner")"
-  printf 'test_runner=%s\n' "$(raw_value test_runner "$runner")"
-  printf 'security_runner=%s\n' "$(raw_value security_runner ubuntu-slim)"
-  printf 'codeql_runner=%s\n' "$(raw_value codeql_runner "$runner")"
-  printf 'pr_runner=%s\n' "$(raw_value pr_runner ubuntu-slim)"
-  printf 'release_runner=%s\n' "$(raw_value release_runner ubuntu-slim)"
-  printf 'cache_packages=%s\n' "$(raw_value cache_packages auto)"
-  printf 'cache_build=%s\n' "$(raw_value cache_build auto)"
-  printf 'coverage_minimum=%s\n' "$(raw_value coverage_minimum 80)"
-  printf 'turbo_remote=%s\n' "$(raw_value turbo_remote auto)"
-  printf 'prune_standard=%s\n' "$(raw_value prune_standard false)"
-}
-
-case "$command" in
-  detect) detect ;;
-  get)
-    detect | awk -F= -v key="$requested_key" '$1 == key { print substr($0, index($0, "=") + 1); found=1 } END { exit !found }'
-    ;;
-  env)
-    detect | while IFS='=' read -r key value; do
-      env_key="REPO_FOUNDRY_$(printf '%s' "$key" | tr '[:lower:]-' '[:upper:]_')"
-      printf '%s=%q\n' "$env_key" "$value"
-    done
-    ;;
-esac

package/.github/scripts/security.sh

@@ -1,214 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-source .github/scripts/changed-files.sh
-
-has_javascript_dependencies() {
-  [ -f bun.lock ] || [ -f bun.lockb ] || [ -f pnpm-lock.yaml ] ||
-    [ -f yarn.lock ] || [ -f package-lock.json ] ||
-    { [ -f package.json ] && node -e 'const p=require("./package.json"); const groups=[p.dependencies,p.devDependencies,p.optionalDependencies,p.peerDependencies]; process.exit(groups.some((g)=>g && Object.keys(g).length) ? 0 : 1)' 2>/dev/null; }
-}
-
-has_python_manifest() {
-  [ -f pyproject.toml ] || [ -f uv.lock ] ||
-    git ls-files | grep -Eq '(^|/)requirements[^/]*\.txt$'
-}
-
-has_dependency_manifest() {
-  has_javascript_dependencies || [ -f Cargo.toml ] || has_python_manifest
-}
-
-should_run() {
-  if repo_foundry_governance_only; then
-    printf '%s\n' 'applicable=false'
-    return 0
-  fi
-  if repo_foundry_pr_dependencies_unchanged "${1:-all}"; then
-    return 1
-  fi
-  case "${1:-all}" in
-    javascript) has_javascript_dependencies || return 1 ;;
-    rust) [ -f Cargo.toml ] || return 1 ;;
-    python) has_python_manifest || return 1 ;;
-    all) has_dependency_manifest || return 1 ;;
-    *) echo "unknown ecosystem: ${1:-}" >&2; return 2 ;;
-  esac
-  printf '%s\n' 'applicable=true'
-}
-
-if [ "${1:-audit}" = should_run ]; then
-  if should_run "${2:-all}"; then
-    exit 0
-  else
-    status=$?
-    [ "$status" -eq 1 ] && printf '%s\n' 'applicable=false' && exit 0
-    exit "$status"
-  fi
-fi
-
-if [ "${1:-}" = profile ]; then
-  python_requirements='["none"]'
-  if has_python_manifest && ! repo_foundry_governance_only && ! repo_foundry_pr_dependencies_unchanged python; then
-    python_requirements="$(
-      git ls-files -z '*requirements*.txt' |
-        node -e 'let data=""; process.stdin.on("data", (chunk) => { data += chunk; }).on("end", () => process.stdout.write(JSON.stringify(data.split("\0").filter(Boolean))));'
-    )"
-    [ "$python_requirements" = "[]" ] && python_requirements='["project"]'
-  fi
-  for ecosystem in javascript rust python; do
-    if should_run "$ecosystem"; then
-      printf '%s=true\n' "$ecosystem"
-    else
-      status=$?
-      [ "$status" -eq 1 ] && printf '%s=false\n' "$ecosystem" && continue
-      exit "$status"
-    fi
-  done
-  printf 'python_requirements=%s\n' "$python_requirements"
-  exit 0
-fi
-
-mode="${1:-audit}"
-if [ "$mode" = audit ] && [ -n "${2:-}" ]; then mode="$2"; fi
-case "$mode" in
-  audit|all|javascript|rust|python) ;;
-  *)
-    echo "usage: $0 [audit|should_run] [javascript|rust|python|all]" >&2
-    exit 2
-    ;;
-esac
-
-audits=0
-
-wait_for_parallel() {
-  local status=0 pid
-  for pid in "$@"; do
-    if ! wait "$pid"; then status=1; fi
-  done
-  return "$status"
-}
-
-run_parallel() {
-  local status=0 pid task
-  local -a pids=()
-  for task in "$@"; do
-    "$task" &
-    pids+=("$!")
-  done
-  for pid in "${pids[@]}"; do
-    if ! wait "$pid"; then status=1; fi
-  done
-  return "$status"
-}
-
-package_manager() {
-  local configured=""
-  if [ -x .github/scripts/profile.sh ]; then
-    configured="$(bash .github/scripts/profile.sh get package_manager 2>/dev/null || true)"
-  else
-    config_file=.github/code-foundry.yml
-    if [ -f "$config_file" ]; then
-      configured="$(awk -F': ' '/^package_manager:/ {print $2; exit}' "$config_file")"
-    fi
-  fi
-  case "$configured" in
-    bun|pnpm|yarn|npm) echo "$configured"; return ;;
-  esac
-  if [ -f bun.lock ] || [ -f bun.lockb ]; then echo bun
-  elif [ -f pnpm-lock.yaml ]; then echo pnpm
-  elif [ -f yarn.lock ]; then echo yarn
-  elif [ -f package-lock.json ]; then echo npm
-  else echo none
-  fi
-}
-
-audit_javascript() {
-  if ! has_javascript_dependencies; then
-    echo "Skipping JavaScript/TypeScript audit (dependency inputs not found)"
-    return
-  fi
-  audit_args=(--audit-level=high)
-  if [ -f .github/security-audit-allowlist.txt ]; then
-    while IFS= read -r advisory; do
-      [[ -z "$advisory" || "$advisory" == \#* ]] && continue
-      audit_args+=(--ignore "$advisory")
-    done < .github/security-audit-allowlist.txt
-  fi
-  case "$(package_manager)" in
-    bun) audits=$((audits + 1)); bun audit "${audit_args[@]}" ;;
-    pnpm) audits=$((audits + 1)); corepack pnpm audit --audit-level high ;;
-    yarn) audits=$((audits + 1)); corepack yarn npm audit --all --recursive ;;
-    npm) audits=$((audits + 1)); npm audit --audit-level=high ;;
-  esac
-}
-
-audit_rust() {
-  if [ -f Cargo.toml ]; then
-    audits=$((audits + 1))
-    if ! command -v cargo-audit >/dev/null 2>&1; then cargo install cargo-audit --locked --quiet; fi
-    cargo audit
-  else
-    echo "Skipping Rust audit (Cargo.toml not found)"
-  fi
-}
-
-audit_python() {
-  local pip_audit_version='2.10.1'
-  requirement_files=()
-  if [ -n "${REPO_FOUNDRY_PYTHON_REQUIREMENT:-}" ] && [ "$REPO_FOUNDRY_PYTHON_REQUIREMENT" != project ] && [ "$REPO_FOUNDRY_PYTHON_REQUIREMENT" != none ]; then
-    if ! git ls-files --error-unmatch -- "${REPO_FOUNDRY_PYTHON_REQUIREMENT}" >/dev/null 2>&1; then
-      echo "Python requirement file is not tracked: ${REPO_FOUNDRY_PYTHON_REQUIREMENT}" >&2
-      return 1
-    fi
-    requirement_files+=( "$REPO_FOUNDRY_PYTHON_REQUIREMENT" )
-  else
-    while IFS= read -r requirement_file; do
-      [ -n "$requirement_file" ] && requirement_files+=( "$requirement_file" )
-    done < <(git ls-files '*requirements*.txt')
-  fi
-  if [ "${#requirement_files[@]}" -gt 0 ] || [ -f pyproject.toml ]; then
-    audits=$((audits + 1))
-    if command -v uv >/dev/null 2>&1; then
-      local uv_audit_cache="${REPO_FOUNDRY_UV_AUDIT_CACHE:-$HOME/.cache/uv-audit}"
-      pip_audit() {
-        if [ "${REPO_FOUNDRY_UV_AUDIT_OFFLINE:-false}" = true ]; then
-          if UV_CACHE_DIR="$uv_audit_cache" uv tool run --offline --from "pip-audit==${pip_audit_version}" pip-audit "$@"; then
-            return 0
-          fi
-          echo 'Offline pip-audit cache was incomplete; retrying online.' >&2
-        fi
-        REPO_FOUNDRY_UV_AUDIT_OFFLINE=false UV_CACHE_DIR="$uv_audit_cache" uv tool run --from "pip-audit==${pip_audit_version}" pip-audit "$@"
-      }
-    else
-      python -m pip install --disable-pip-version-check --quiet "pip-audit==${pip_audit_version}"
-      pip_audit() { python -m pip_audit "$@"; }
-    fi
-    if [ "${#requirement_files[@]}" -gt 0 ]; then
-      pids=()
-      for requirement_file in "${requirement_files[@]}"; do
-        pip_audit -r "$requirement_file" &
-        pids+=( "$!" )
-      done
-      wait_for_parallel "${pids[@]}"
-    else
-      pip_audit
-    fi
-  else
-    echo "Skipping Python audit (Python dependency manifest not found)"
-  fi
-}
-
-case "$mode" in
-  audit|all)
-    run_parallel audit_javascript audit_rust audit_python
-    ;;
-  javascript) audit_javascript ;;
-  rust) audit_rust ;;
-  python) audit_python ;;
-esac
-
-if [ "$audits" -eq 0 ] && ! has_dependency_manifest; then
-  echo "No supported dependency manifests found; nothing to audit"
-fi
-
-exit 0

package/.github/scripts/sitecustomize.py

@@ -1,17 +0,0 @@
-"""Keep coverage.py usable with runners that ship malformed sysconfig schemes."""
-
-import sysconfig
-
-_get_paths = sysconfig.get_paths
-
-
-def get_paths(scheme=None, vars=None, expand=True):
-    try:
-        return _get_paths(scheme, vars, expand)
-    except ValueError as error:
-        if "Single '}' encountered in format string" not in str(error):
-            raise
-        return {}
-
-
-sysconfig.get_paths = get_paths

package/.github/scripts/sync-codeowners.sh

@@ -1,76 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-mode=check
-while [ "$#" -gt 0 ]; do
-  case "$1" in
-    --check) mode=check; shift ;;
-    --apply) mode=apply; shift ;;
-    -h|--help)
-      printf '%s\n' 'Usage: sync-codeowners.sh [--check|--apply]'
-      exit 0
-      ;;
-    *) printf 'Unknown option: %s\n' "$1" >&2; exit 2 ;;
-  esac
-done
-
-codeowners_file=.github/CODEOWNERS
-mkdir -p .github
-remote="$(git remote get-url origin 2>/dev/null || true)"
-repo="$(printf '%s\n' "$remote" | sed -E 's#.*github.com[:/]([^/]+/[^/.]+)(\.git)?$#\1#')"
-owners=()
-
-if [ -n "$repo" ] && command -v gh >/dev/null 2>&1; then
-  owner_json="$(gh repo view "$repo" --json owner 2>/dev/null || true)"
-  owner_login="$(jq -r '.owner.login // empty' <<< "$owner_json" 2>/dev/null || true)"
-  owner_type="$(jq -r '.owner.type // empty' <<< "$owner_json" 2>/dev/null || true)"
-  if [ "$owner_type" = User ] && [ -n "$owner_login" ]; then
-    owners+=("@$owner_login")
-  fi
-  admins="$(gh api --paginate "repos/$repo/collaborators?per_page=100" \
-    --jq '.[] | select(.permissions.admin == true) | .login' 2>/dev/null || true)"
-  while IFS= read -r admin; do
-    [ -n "$admin" ] && owners+=("@$admin")
-  done <<< "$admins"
-fi
-
-if [ "${#owners[@]}" -gt 0 ]; then
-  owner_line="$(printf '%s\n' "${owners[@]}" | awk '!seen[$0]++' | paste -sd ' ' -)"
-else
-  owner_line='@OWNER'
-  printf '%s\n' 'GitHub owner/admin discovery unavailable; retaining @OWNER placeholder.' >&2
-fi
-
-existing_file=""
-if [ -f "$codeowners_file" ]; then
-  existing_file="$(mktemp)"
-  cp "$codeowners_file" "$existing_file"
-fi
-
-if [ "$mode" = check ]; then
-  if [ -f "$codeowners_file" ] && grep -q "^\* $owner_line$" "$codeowners_file"; then
-    printf '%s\n' 'CODEOWNERS is current.'
-  else
-    printf 'Would update %s with %s\n' "$codeowners_file" "$owner_line"
-  fi
-  [ -n "$existing_file" ] && unlink "$existing_file"
-  exit 0
-fi
-
-tmp_file="$(mktemp)"
-{
-  printf '%s\n' '# Managed by code-foundry. Repository owners/admins are discovered during initialization.'
-  printf '* %s\n' "$owner_line"
-  if [ -n "$existing_file" ]; then
-    awk '
-      /^# Managed by code-foundry\./ { managed=1; next }
-      managed && /^\* / { managed=0; next }
-      managed { next }
-      /^\* @(OWNER|[^[:space:]]+)/ { next }
-      { print }
-    ' "$existing_file"
-  fi
-} > "$tmp_file"
-mv "$tmp_file" "$codeowners_file"
-[ -n "$existing_file" ] && unlink "$existing_file"
-printf 'Updated %s with %s\n' "$codeowners_file" "$owner_line"

package/.github/scripts/sync-protection.sh

@@ -1,138 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-branch="main"
-repo=""
-mode="check"
-configured_features="all"
-configured_languages="auto"
-
-config_file=.github/code-foundry.yml
-if [ -f "$config_file" ]; then
-  configured_features="$(awk -F': ' '/^features:/ {print $2; exit}' "$config_file")"
-  configured_languages="$(awk -F': ' '/^languages:/ {print $2; exit}' "$config_file")"
-  [ -n "$configured_features" ] || configured_features="all"
-  [ -n "$configured_languages" ] || configured_languages="auto"
-fi
-
-feature_enabled() {
-  [ "$configured_features" = all ] && return 0
-  case " $(printf '%s' "$configured_features" | tr ',' ' ') " in
-    *" $1 "*) return 0 ;;
-    *) return 1 ;;
-  esac
-}
-
-language_enabled() {
-  [ "$configured_languages" = auto ] || [ "$configured_languages" = all ] && return 0
-  case " $(printf '%s' "$configured_languages" | tr ',' ' ') " in
-    *" $1 "*) return 0 ;;
-    *) return 1 ;;
-  esac
-}
-
-usage() {
-  printf '%s\n' 'Usage: sync-protection.sh --repo OWNER/REPO [--branch main] [--check] [--apply]'
-}
-
-while [ "$#" -gt 0 ]; do
-  case "$1" in
-    --repo) repo="${2:?missing OWNER/REPO}"; shift 2 ;;
-    --branch) branch="${2:?missing branch}"; shift 2 ;;
-    --check) mode="check"; shift ;;
-    --apply) mode="apply"; shift ;;
-    -h|--help) usage; exit 0 ;;
-    *) usage >&2; exit 2 ;;
-  esac
-done
-
-[ -n "$repo" ] || { usage >&2; exit 2; }
-command -v gh >/dev/null 2>&1 || { echo "gh is required" >&2; exit 1; }
-
-is_private="$(gh repo view "$repo" --json isPrivate --jq '.isPrivate')"
-code_security_status="disabled"
-if [ "$is_private" = true ]; then
-  code_security_status="$(gh api "repos/$repo" --jq '.security_and_analysis.code_security.status // "disabled"' 2>/dev/null || printf 'disabled')"
-fi
-contexts=()
-if feature_enabled ci; then contexts+=(Format Lint Type-Check Build); fi
-if feature_enabled test; then contexts+=(Unit Integration E2E Smoke); fi
-if feature_enabled security; then
-  contexts+=(Profile 'Dependency Audit (JavaScript)' 'Dependency Audit (Rust)' 'Dependency Audit (Python)')
-fi
-if feature_enabled codeql; then contexts+=(Detect); fi
-
-if { [ "$is_private" != true ] || [ "$code_security_status" = enabled ]; } && feature_enabled codeql; then
-  contexts+=("Analyze (Actions)")
-  if language_enabled typescript && git ls-files -- '*.ts' '*.tsx' '*.js' '*.jsx' package.json tsconfig\*.json | grep -q .; then contexts+=("Analyze (TypeScript)"); fi
-  if language_enabled python && git ls-files -- '*.py' pyproject.toml requirements\*.txt setup.py ':!.github/**' | grep -q .; then contexts+=("Analyze (Python)"); fi
-  if language_enabled rust && git ls-files -- '*.rs' Cargo.toml Cargo.lock | grep -q .; then contexts+=("Analyze (Rust)"); fi
-fi
-
-protection="$(gh api "repos/$repo/branches/$branch/protection" 2>/dev/null || true)"
-if ! jq -e 'type == "object" and (.required_status_checks | type == "object")' >/dev/null 2>&1 <<< "$protection"; then
-  if [ "$mode" = apply ]; then
-    echo "Cannot read branch protection for $repo:$branch (repository plan or permissions may not allow it)." >&2
-    exit 1
-  fi
-  existing=""
-else
-  existing="$(jq -r '.required_status_checks.contexts[]?' <<< "$protection")"
-fi
-preserved=()
-while IFS= read -r context; do
-  [ -n "$context" ] || continue
-  case "$context" in
-    'Slither / Analyze') continue ;; # removed from the standard workflow set
-    # Remove both the current concise job names and older workflow-prefixed
-    # names before rebuilding the standard set. This prevents stale required
-    # checks from remaining required after a repository changes visibility or
-    # template version.
-    'Dependency Audit'|'Dependency Audit ('*|'Profile'|'Test Profile'|\
-    'Format'|'Lint'|'Type-Check'|'Build'|'Unit'|'Integration'|'E2E'|'Smoke'|\
-    'Detect'|'Analyze'|'Analyze ('*|\
-    'CI / '*|'Test / '*|'Security / '*|'CodeQL / '*) ;;
-    *) preserved+=("$context") ;;
-  esac
-done <<< "$existing"
-
-payload="$(printf '%s\n' "${preserved[@]-}" "${contexts[@]}" | jq -Rsc 'split("\n") | map(select(length > 0)) | unique | {strict: true, contexts: .}')"
-
-if [ "$mode" = check ]; then
-  printf '%s\n' "$payload" | jq .
-  exit 0
-fi
-
-current="$protection"
-full_payload="$(jq --argjson checks "$payload" '
-  {
-    required_status_checks: $checks,
-    enforce_admins: .enforce_admins.enabled,
-    required_pull_request_reviews: (
-      if .required_pull_request_reviews == null then null else {
-        dismiss_stale_reviews: .required_pull_request_reviews.dismiss_stale_reviews,
-        require_code_owner_reviews: .required_pull_request_reviews.require_code_owner_reviews,
-        required_approving_review_count: .required_pull_request_reviews.required_approving_review_count,
-        require_last_push_approval: .required_pull_request_reviews.require_last_push_approval
-      } end
-    ),
-    restrictions: (
-      if .restrictions == null then null else {
-        users: [.restrictions.users[].login],
-        teams: [.restrictions.teams[].slug],
-        apps: [.restrictions.apps[].slug]
-      } end
-    ),
-    required_linear_history: .required_linear_history.enabled,
-    allow_force_pushes: .allow_force_pushes.enabled,
-    allow_deletions: .allow_deletions.enabled,
-    block_creations: .block_creations.enabled,
-    required_conversation_resolution: .required_conversation_resolution.enabled,
-    lock_branch: .lock_branch.enabled,
-    allow_fork_syncing: .allow_fork_syncing.enabled
-  }
-' <<< "$current")"
-
-gh api --method PUT "repos/$repo/branches/$branch/protection" \
-  --input - <<< "$full_payload" >/dev/null
-printf 'Updated required checks for %s:%s\n' "$repo" "$branch"