code-foundry 0.26.0 → 0.27.1

package/.githooks/pre-commit

@@ -1,5 +1,4 @@
-#!/usr/bin/env bash
-set -euo pipefail
+#!/usr/bin/env sh
+set -eu
 
-repo_root="$(git rev-parse --show-toplevel)"
-exec bash "$repo_root/.github/scripts/pre-commit.sh" "$@"
+git diff --cached --check

package/.github/CONTRIBUTING.md

@@ -48,14 +48,14 @@ docs/*  test/*  refactor/*         │              │
 | `staging`                                                      | Integration branch       | Target normal pull requests here. Required checks must pass before merge. |
 | `feat/*`, `fix/*`, `chore/*`, `refactor/*`, `docs/*`, `test/*` | Focused work             | Branch from `staging`; keep changes small and reviewable.                 |
 
-Use squash merges unless the repository documents another strategy. Re-align `staging` with `main` after a release when needed.
+The default Git workflow is `staging-release`: topic branches merge into `staging`, then a promotion PR moves validated changes into `main`, followed by the versioned release PR. The default merge strategy is `rebase`, which preserves the linear Conventional Commit history. Configure `merge_strategy` as `squash` or `merge` in `.github/code-foundry.yml` when the repository intentionally uses another policy. Re-align `staging` with `main` after a release when needed.
 
 ## Before you start
 
 ### Toolchain
 
-1. Install [mise](https://mise.jdx.dev/).
-2. Run `npx code-foundry init` to install the pinned toolchain, enable hooks, and validate the checkout.
+1. Run `npx code-foundry init` to detect the repository and enable hooks.
+2. Follow `toolchain: auto` in `.github/code-foundry.yml`; install mise only if the repository already uses it or explicitly selects it.
 3. Use `npx code-foundry doctor` when setup, lockfiles, or hooks appear out of sync.
 4. Use the repository's existing package manager and lockfile. Do not introduce a second package manager.
 5. Copy `.env.example` to the appropriate local environment file when provided. Never commit the copy.
@@ -74,17 +74,14 @@ If the worktree is dirty, stop and understand the existing changes before switch
 
 ## Local validation
 
-The template scripts detect supported tools and skip checks that do not apply:
+The repository runtime detects supported tools and skips checks that do not apply:
 
 ```sh
-bash .github/scripts/ci.sh format
-bash .github/scripts/ci.sh lint
-bash .github/scripts/ci.sh type_check
-bash .github/scripts/ci.sh build
-bash .github/scripts/ci.sh unit
-bash .github/scripts/ci.sh integration
-bash .github/scripts/ci.sh e2e
-bash .github/scripts/ci.sh smoke
+npx code-foundry doctor
+npm run format:check   # or the package manager's equivalent
+npm run lint
+npm run type-check
+npm test
 Security and dependency audits run through the GitHub Security workflow.
 ```
 
@@ -110,7 +107,7 @@ For maintainers, trusted contributors, and automation agents:
 
 8. Push the branch and open a pull request into `staging`.
 9. Address review feedback and failed checks on the same branch.
-10. Squash-merge only after required checks pass and the change is ready.
+10. Merge using the repository's configured `merge_strategy` after required checks pass and the change is ready.
 
 ### Internal agent handoff
 

package/.github/actions/setup/action.yml

@@ -1,5 +1,5 @@
 name: Repository Setup
-description: Install the pinned mise toolchain and optionally project dependencies.
+description: Select mise or native language tooling and optionally install project dependencies.
 
 inputs:
   install:
@@ -85,6 +85,16 @@ runs:
       run: |
         tracked_files="$(git ls-files)"
 
+        toolchain="auto"
+        if [ -f .github/code-foundry.yml ]; then
+          configured_toolchain="$(awk -F': ' '/^toolchain:/ {print $2; exit}' .github/code-foundry.yml)"
+          [ -n "$configured_toolchain" ] && toolchain="$configured_toolchain"
+        fi
+        if [ "$toolchain" = auto ] && [ -f .mise.toml ]; then
+          toolchain=mise
+        fi
+        printf 'toolchain_mode=%s\n' "$toolchain" >> "$GITHUB_OUTPUT"
+
         has_tracked_regex() {
           printf '%s\n' "$tracked_files" | grep -Eq "$1"
         }
@@ -428,6 +438,61 @@ runs:
         REPO_FOUNDRY_TASK_RUST: ${{ inputs.task-rust }}
         REPO_FOUNDRY_CACHE_PACKAGES: ${{ inputs.cache-packages }}
 
+    - name: Install native test libraries
+      if: >-
+        inputs.install == 'true' &&
+        inputs.task == 'unit' &&
+        hashFiles('**/package.json') != '' &&
+        steps.profile.outputs.javascript == 'true'
+      shell: bash
+      run: |
+        if node -e '
+          const fs = require("node:fs");
+          const p = JSON.parse(fs.readFileSync("package.json", "utf8"));
+          const all = { ...p.dependencies, ...p.devDependencies, ...p.optionalDependencies };
+          process.exit(all["matchstick-as"] ? 0 : 1);
+        ' 2>/dev/null; then
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq libpq5
+        fi
+
+    - name: Setup Node
+      if: >-
+        steps.profile.outputs.toolchain_mode != 'mise' &&
+        steps.profile.outputs.javascript == 'true' &&
+        steps.profile.outputs.javascript_package_manager != 'bun'
+      uses: actions/setup-node@v5
+      with:
+        node-version: 24
+        cache: ${{ steps.profile.outputs.javascript_package_manager == 'npm' && 'npm' || steps.profile.outputs.javascript_package_manager == 'pnpm' && 'pnpm' || steps.profile.outputs.javascript_package_manager == 'yarn' && 'yarn' || '' }}
+
+    - name: Setup Bun
+      if: >-
+        steps.profile.outputs.toolchain_mode != 'mise' &&
+        steps.profile.outputs.javascript == 'true' &&
+        steps.profile.outputs.javascript_package_manager == 'bun'
+      uses: oven-sh/setup-bun@v2
+      with:
+        bun-version: 1.3.14
+
+    - name: Enable Corepack
+      if: >-
+        steps.profile.outputs.toolchain_mode != 'mise' &&
+        (steps.profile.outputs.javascript_package_manager == 'pnpm' ||
+        steps.profile.outputs.javascript_package_manager == 'yarn')
+      shell: bash
+      run: corepack enable
+
+    - name: Setup Python
+      if: steps.profile.outputs.toolchain_mode != 'mise' && steps.profile.outputs.python == 'true'
+      uses: actions/setup-python@v6
+      with:
+        python-version: '3.13'
+
+    - name: Setup Rust
+      if: steps.profile.outputs.toolchain_mode != 'mise' && steps.profile.outputs.rust == 'true'
+      uses: dtolnay/rust-toolchain@stable
+
     - name: Setup uv
       if: >-
         steps.profile.outputs.python == 'true' &&
@@ -658,7 +723,7 @@ runs:
         path: ~/.cargo/advisory-db
         # The advisory database is independent of project dependencies. Keep
         # it warm for Security without invalidating it on every lockfile edit.
-        key: ${{ runner.os }}-rust-advisory-${{ hashFiles('.github/scripts/security.sh') }}
+        key: ${{ runner.os }}-rust-advisory-${{ hashFiles('.code-foundry/src/runtime.mjs') }}
         restore-keys: |
           ${{ runner.os }}-rust-advisory-
     - name: Cache Rust builds
@@ -701,7 +766,7 @@ runs:
         REPO_FOUNDRY_INSTALL_PYTHON: ${{ inputs.install-python }}
         REPO_FOUNDRY_INSTALL_RUST: ${{ inputs.install-rust }}
         REPO_FOUNDRY_TASK: ${{ inputs.task }}
-      run: bash .github/scripts/ci.sh install
+      run: node .code-foundry/src/runtime.mjs ci install
     - name: Measure Bun dependencies
       id: javascript-bun-cache
       if: >-

package/.github/code-foundry.yml

@@ -3,12 +3,17 @@ version: 1
 profile: auto
 languages: typescript
 features: all
+codeql: auto
+dependency_review: auto
 package_manager: bun
+toolchain: auto
 runtime_repository: 0xPlayerOne/code-foundry
-runtime_ref: v0.22.2
+runtime_ref: v0.26.0
 release_type: node
 npm_publish: true
 license: agpl-3.0-or-later
+git_workflow: staging-release
+merge_strategy: rebase
 runner: ubuntu-latest
 unit_runner: ubuntu-slim
 cache_packages: auto

package/.github/workflows/ci.yml

@@ -53,23 +53,23 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Detect
         id: applicability
-        run: bash .github/scripts/ci.sh should_run format >> "$GITHUB_OUTPUT"
-      - name: Fast path
-        if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/format-fast-path.sh
+        run: node .code-foundry/src/runtime.mjs ci should_run format >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
         with:
-          install: 'false'
+          # Repository format scripts normally call a project-local formatter
+          # (for example, Prettier). Install dependencies before running them;
+          # otherwise a clean runner cannot resolve the declared tool.
+          install: 'true'
           cache-format: 'true'
           cache-lint: 'false'
           cache-build: 'false'
@@ -79,7 +79,7 @@ jobs:
           task-rust: 'false'
       - name: Format
         if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/ci.sh format
+        run: node .code-foundry/src/runtime.mjs ci format
 
   lint:
     name: Lint
@@ -95,15 +95,15 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Detect
         id: applicability
-        run: bash .github/scripts/ci.sh should_run lint >> "$GITHUB_OUTPUT"
+        run: node .code-foundry/src/runtime.mjs ci should_run lint >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -113,7 +113,7 @@ jobs:
           task: lint
       - name: Lint
         if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/ci.sh lint
+        run: node .code-foundry/src/runtime.mjs ci lint
 
   type-check:
     name: Type-Check
@@ -129,15 +129,15 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Detect
         id: applicability
-        run: bash .github/scripts/ci.sh should_run type_check >> "$GITHUB_OUTPUT"
+        run: node .code-foundry/src/runtime.mjs ci should_run type_check >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -147,11 +147,16 @@ jobs:
           task: type_check
       - name: Type-Check
         if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/ci.sh type_check
+        run: node .code-foundry/src/runtime.mjs ci type_check
 
   build:
     name: Build
     runs-on: ${{ inputs.runner }}
+    env:
+      # Framework builds may validate server-side configuration at build time.
+      # Consumers can provide the real value; the fallback is intentionally
+      # CI-only and must never be used at runtime.
+      NEXTAUTH_SECRET: ${{ secrets.NEXTAUTH_SECRET || 'code-foundry-ci-placeholder-0123456789' }}
     steps:
       - name: Checkout
         uses: actions/checkout@v7
@@ -163,15 +168,15 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Detect
         id: applicability
-        run: bash .github/scripts/ci.sh should_run build >> "$GITHUB_OUTPUT"
+        run: node .code-foundry/src/runtime.mjs ci should_run build >> "$GITHUB_OUTPUT"
       - name: Setup
         if: steps.applicability.outputs.applicable == 'true'
         uses: ./.github/actions/setup
@@ -181,4 +186,4 @@ jobs:
           task: build
       - name: Build
         if: steps.applicability.outputs.applicable == 'true'
-        run: bash .github/scripts/ci.sh build
+        run: node .code-foundry/src/runtime.mjs ci build

package/.github/workflows/ci_self-ci.yml

@@ -16,6 +16,6 @@ jobs:
     uses: ./.github/workflows/ci.yml
     with:
       runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: v0.22.0
+      runtime-ref: staging
       runner: ubuntu-latest
     secrets: inherit

package/.github/workflows/codeql.yml

@@ -41,6 +41,7 @@ jobs:
     timeout-minutes: 10
     outputs:
       languages: ${{ steps.languages.outputs.languages }}
+      enabled: ${{ steps.languages.outputs.enabled }}
       code_security: ${{ steps.security.outputs.status }}
       actions_available: ${{ steps.languages.outputs.actions_available }}
       actions_changed: ${{ steps.languages.outputs.actions_changed }}
@@ -61,14 +62,13 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           status="disabled"
-          if [ "${{ github.event.repository.private }}" != "true" ]; then
+          if [ "${{ github.event.repository.visibility }}" = "public" ]; then
             status="enabled"
           else
             status="$(gh api "repos/${GITHUB_REPOSITORY}" --jq '.security_and_analysis.code_security.status // "disabled"' 2>/dev/null || printf 'disabled')"
           fi
           printf 'status=%s\n' "$status" >> "$GITHUB_OUTPUT"
       - name: Checkout
-        if: ${{ !github.event.repository.private || steps.security.outputs.status == 'enabled' }}
         uses: actions/checkout@v7
         with:
           fetch-depth: 2
@@ -85,7 +85,6 @@ jobs:
             package-lock.json
           sparse-checkout-cone-mode: false
       - name: Runtime
-        if: ${{ !github.event.repository.private || steps.security.outputs.status == 'enabled' }}
         uses: actions/checkout@v7
         with:
           repository: ${{ inputs.runtime-repository }}
@@ -93,31 +92,26 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
-        if: ${{ !github.event.repository.private || steps.security.outputs.status == 'enabled' }}
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - id: languages
         name: Detect languages
         env:
           CODEQL_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
           REPO_FOUNDRY_CODE_SECURITY: ${{ steps.security.outputs.status }}
           REPO_FOUNDRY_PRIVATE: ${{ github.event.repository.private }}
-        run: |
-          if [ "$REPO_FOUNDRY_PRIVATE" = "true" ] && [ "$REPO_FOUNDRY_CODE_SECURITY" != "enabled" ]; then
-            echo 'languages=[]' >> "$GITHUB_OUTPUT"
-          else
-            bash .github/scripts/codeql-languages.sh
-          fi
+          REPO_FOUNDRY_VISIBILITY: ${{ github.event.repository.visibility }}
+        run: node .code-foundry/src/runtime.mjs codeql
 
   analyze-actions:
     name: Analyze (Actions)
     needs: detect
     if: >-
-      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
+      needs.detect.outputs.enabled == 'true' &&
       needs.detect.outputs.actions_available == 'true' &&
       needs.detect.outputs.actions_changed == 'true'
     runs-on: ${{ inputs.runner }}
@@ -133,12 +127,12 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Analyze
         uses: ./.github/actions/codeql
         with:
@@ -150,7 +144,7 @@ jobs:
     name: Analyze (TypeScript)
     needs: detect
     if: >-
-      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
+      needs.detect.outputs.enabled == 'true' &&
       needs.detect.outputs.javascript_available == 'true' &&
       needs.detect.outputs.javascript_changed == 'true'
     runs-on: ${{ inputs.runner }}
@@ -166,12 +160,12 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Analyze
         uses: ./.github/actions/codeql
         with:
@@ -183,7 +177,7 @@ jobs:
     name: Analyze (Python)
     needs: detect
     if: >-
-      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
+      needs.detect.outputs.enabled == 'true' &&
       needs.detect.outputs.python_available == 'true' &&
       needs.detect.outputs.python_changed == 'true'
     runs-on: ${{ inputs.runner }}
@@ -199,12 +193,12 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Analyze
         uses: ./.github/actions/codeql
         with:
@@ -216,7 +210,7 @@ jobs:
     name: Analyze (Rust)
     needs: detect
     if: >-
-      ( !github.event.repository.private || needs.detect.outputs.code_security == 'enabled' ) &&
+      needs.detect.outputs.enabled == 'true' &&
       needs.detect.outputs.rust_available == 'true' &&
       needs.detect.outputs.rust_changed == 'true'
     runs-on: ${{ inputs.runner }}
@@ -232,12 +226,12 @@ jobs:
           path: .code-foundry
           sparse-checkout: |
             .github/actions
-            .github/scripts
+            src/lib
+            src/runtime.mjs
       - name: Install runtime
         run: |
-          mkdir -p .github/actions .github/scripts
+          mkdir -p .github/actions
           cp -R .code-foundry/.github/actions/. .github/actions/
-          cp -R .code-foundry/.github/scripts/. .github/scripts/
       - name: Analyze
         uses: ./.github/actions/codeql
         with:

package/.github/workflows/codeql_self-ci.yml

@@ -21,6 +21,6 @@ jobs:
     uses: ./.github/workflows/codeql.yml
     with:
       runtime-repository: 0xPlayerOne/code-foundry
-      runtime-ref: v0.22.0
+      runtime-ref: staging
       runner: ubuntu-latest
     secrets: inherit

package/.github/workflows/draft-pr.yml

@@ -29,7 +29,7 @@ jobs:
         id: check-pr
         run: |
           BRANCH="${{ github.ref_name }}"
-          EXISTING=$(gh pr list --limit 1 --base staging --head "$BRANCH" --state open --json number,title 2>/dev/null | jq 'length')
+          EXISTING=$(gh pr list --limit 1 --base staging --head "$BRANCH" --state open --json number,title 2>/dev/null | node -e 'let d=""; process.stdin.on("data", c => d += c).on("end", () => console.log(JSON.parse(d || "[]").length))')
           echo "existing=$EXISTING" >> "$GITHUB_OUTPUT"
 
       - name: Create
@@ -51,7 +51,7 @@ jobs:
         if: steps.check-pr.outputs.existing == '0'
         run: |
           BRANCH="${{ github.ref_name }}"
-          PR_NUMBER=$(gh pr list --limit 1 --base staging --head "$BRANCH" --state open --json number 2>/dev/null | jq '.[0].number')
+          PR_NUMBER=$(gh pr list --limit 1 --base staging --head "$BRANCH" --state open --json number 2>/dev/null | node -e 'let d=""; process.stdin.on("data", c => d += c).on("end", () => console.log(JSON.parse(d || "[]")[0]?.number || ""))')
           if [ -n "$PR_NUMBER" ]; then
             gh pr ready "$PR_NUMBER"
           fi

package/.github/workflows/release-pr.yml

@@ -35,7 +35,7 @@ jobs:
             --base main \
             --head staging \
             --state open \
-            --json number | jq 'length')
+            --json number | node -e 'let d=""; process.stdin.on("data", c => d += c).on("end", () => console.log(JSON.parse(d || "[]").length))')
           COMPARE_URL="repos/${GITHUB_REPOSITORY}/compare/main...staging"
           TOTAL_COMMITS=$(gh api "$COMPARE_URL?per_page=1" --jq '.total_commits // 0')
           echo "existing=$EXISTING" >> "$GITHUB_OUTPUT"
@@ -53,12 +53,12 @@ jobs:
           COMPARE_URL="repos/${GITHUB_REPOSITORY}/compare/main...staging"
           COMPARE_FILE="$RUNNER_TEMP/release-compare.json"
           gh api "$COMPARE_URL?per_page=100" > "$COMPARE_FILE"
-          TOTAL_COMMITS=$(jq -r '.total_commits // 0' "$COMPARE_FILE")
+          TOTAL_COMMITS=$(node -e 'const d=require(process.argv[1]); console.log(d.total_commits || 0)' "$COMPARE_FILE")
           if [ "$TOTAL_COMMITS" -gt 100 ]; then
             LAST_PAGE=$(( (TOTAL_COMMITS + 99) / 100 ))
             gh api "$COMPARE_URL?per_page=100&page=$LAST_PAGE" > "$COMPARE_FILE"
           fi
-          COMMITS=$(jq -r '.commits[] | "- \(.commit.message | split("\\n")[0]) (\(.sha[0:7]))"' "$COMPARE_FILE")
+          COMMITS=$(node -e 'const d=require(process.argv[1]); for (const c of d.commits || []) console.log(`- ${c.commit.message.split("\\n")[0]} (${c.sha.slice(0, 7)})`)' "$COMPARE_FILE")
           if [ -z "$COMMITS" ]; then
             COMMITS='- No commits found since main.'
           fi
@@ -87,7 +87,7 @@ jobs:
           ### Validation
 
           - Required CI, test, security, and CodeQL checks must pass before merge.
-          - Merge with **rebase** to preserve the linear Conventional Commit history.
+          - Merge using the repository's configured \`merge_strategy\` (default: **rebase**).
           - After merge, Release Please opens a separate versioned release PR with the changelog.
           EOF
 

package/.github/workflows/release.yml

@@ -41,36 +41,24 @@ jobs:
           filter: blob:none
       - name: Detect release profile
         id: profile
-        shell: bash
         run: |
-          if [ -x .github/scripts/profile.sh ]; then
-            release_type="$(bash .github/scripts/profile.sh get release_type)"
-            npm_publish="$(bash .github/scripts/profile.sh get npm_publish)"
-          else
-            config_file=.github/code-foundry.yml
-            release_type="$(awk -F': ' '/^release_type:/ {print $2; exit}' "$config_file" 2>/dev/null || true)"
-            npm_publish="$(awk -F': ' '/^npm_publish:/ {print $2; exit}' "$config_file" 2>/dev/null || true)"
-          fi
-          [ -n "$release_type" ] || release_type=auto
-          [ -n "$npm_publish" ] || npm_publish=false
-
-          if [ "$release_type" = auto ]; then
-            if [ -f package.json ]; then release_type=node
-            elif [ -f pyproject.toml ]; then release_type=python
-            elif [ -f Cargo.toml ]; then release_type=rust
-            elif [ -f version.txt ]; then release_type=simple
-            else release_type=none
-            fi
-          fi
-
-          case "$release_type" in
-            node|python|rust|simple) ;;
-            none) npm_publish=false ;;
-            *) echo "Unsupported release_type: $release_type" >&2; exit 2 ;;
-          esac
-          if [ ! -f package.json ]; then npm_publish=false; fi
-          printf 'release_type=%s\n' "$release_type" >> "$GITHUB_OUTPUT"
-          printf 'npm_publish=%s\n' "$npm_publish" >> "$GITHUB_OUTPUT"
+          node <<'NODE'
+          const fs = require('node:fs')
+          const config = fs.existsSync('.github/code-foundry.yml')
+            ? Object.fromEntries(fs.readFileSync('.github/code-foundry.yml', 'utf8').split(/\r?\n/).flatMap((line) => {
+                const match = line.match(/^([A-Za-z0-9_-]+):\s*(.*?)\s*$/)
+                return match ? [[match[1], match[2].replace(/\s+#.*$/, '').replace(/^['"]|['"]$/g, '')]] : []
+              }))
+            : {}
+          let releaseType = config.release_type || 'auto'
+          let npmPublish = config.npm_publish || 'false'
+          if (releaseType === 'auto') {
+            releaseType = fs.existsSync('package.json') ? 'node' : fs.existsSync('pyproject.toml') ? 'python' : fs.existsSync('Cargo.toml') ? 'rust' : fs.existsSync('version.txt') ? 'simple' : 'none'
+          }
+          if (!['node', 'python', 'rust', 'simple', 'none'].includes(releaseType)) throw new Error(`Unsupported release_type: ${releaseType}`)
+          if (releaseType === 'none' || !fs.existsSync('package.json')) npmPublish = 'false'
+          fs.appendFileSync(process.env.GITHUB_OUTPUT, `release_type=${releaseType}\nnpm_publish=${npmPublish}\n`)
+          NODE
       - name: Release Please
         id: release
         if: steps.profile.outputs.release_type != 'none'